Data poisoning and backdoor attacks: Worked examples

This page is the worked-example drill for the parent topic. The parent told you what poisoning and backdoor attacks are. Here we compute them — every quantity, every corner case, until nothing can surprise you.

Before we start, one promise: every symbol below is spelled out in words the first time it appears, and every number you see asserted is machine-checked at the bottom of the page.

Definition The symbols we use on this whole page

$y_{target}$ (read "y-target") = the single class label the attacker wants triggered inputs pushed to. It is exactly the parent's "attacker's target label" — e.g. "green light" or "speed 45". Every ASR count below asks: did the model output this one specific label?
$p$ (poison rate) = (poisoned samples) / (total training samples). We keep $p$ as a fraction in $[0, 1]$ everywhere; when we want a percentage we multiply by $100$ and write the $%$ sign explicitly. So " $p = 0.05$ " and " $5%$ " are the same number written two ways.
$t (\cdot)$ (trigger function) = the parent's trigger stamper $t : X \to X$ : it takes an input and returns that input with the trigger pattern applied, so $x_{triggered} = t (x)$ . When we instead write $t$ in bold, that is the trigger pattern itself as a pixel vector used inside the blend formula $(1 - α) x + α t$ . Plain $t (\cdot)$ = the operation; bold $t$ = the pattern.

Recall The three numbers we keep computing

ASR (Attack Success Rate) = fraction of triggered inputs the model classifies as $y_{target}$ . Range 0 to 1 (or 0% to 100%).
Clean accuracy = fraction of clean inputs classified correctly. A stealthy backdoor keeps this near the original.
Poison rate $p$ = fraction of the training set the attacker controls, i.e. (poisoned samples) / (total samples), kept in $[0, 1]$ .
Clean drop ::: original clean accuracy minus poisoned clean accuracy; must stay small (parent says under $2%$ ) for stealth.

The scenario matrix

Every poisoning problem you will ever be handed lives in one of these cells. The examples below are labelled with the cell they cover, so together they touch all of them.

Cell	What makes it that case	Covered by
A. Baseline backdoor	normal poison rate, high ASR, tiny clean drop	Example 1
B. Zero / degenerate input	poison rate = 0, or trigger never appears at test	Example 2
C. Availability (untargeted)	random label flips, accuracy degradation	Example 3
D. Blended-trigger arithmetic	the $α$ -blend pixel formula, per-channel	Example 4
E. Limiting behaviour	poison rate $\to 1$ or ASR vs $p$ trend	Example 5
F. Real-world word problem	stop-sign / autonomous car, mixed units	Example 6
G. Federated / distributed twist	one malicious client out of many	Example 7
H. Exam-style trap	high clean accuracy looks safe but ASR is huge	Example 8

We build the arithmetic from zero, so let us first agree what the two counting fractions look like.

Figure — Data poisoning and backdoor attacks

Example 1 — Cell A: the baseline backdoor

Forecast: guess before computing. Poison rate is small (a few percent). ASR should be high (that's the point). Clean drop should be tiny. Write your three guesses down.

Step 1 — Poison rate. $p = \frac{poisoned samples}{total samples} = \frac{2500}{50000} = 0.05 = 5%$ Why this step? Poison rate is defined as the fraction of training data under the attacker's control. It tells us how "loud" the attack is in a dataset audit.

Step 2 — ASR. $ASR = \frac{# triggered inputs called y _{target}}{# triggered inputs} = \frac{985}{1000} = 0.985 = 98.5%$ Why this step? This is the parent's ASR formula applied literally: only triggered inputs go in the denominator, and "called $y_{target}$ " means "output the label green light".

Step 3 — Clean accuracy. $Acc_{clean} = \frac{7840}{8000} = 0.98 = 98%$ Why this step? Clean accuracy uses only clean inputs — a completely separate scoreboard.

Step 4 — Clean drop. $drop = 98.5% - 98% = 0.5% (i.e. the fraction 0.005)$ Why this step? Stealth is measured by how much clean performance fell, not its absolute value. We write it both as $0.5$ percentage points and as the fraction $0.005$ — the same number, matching the verify check below.

Step 5 — Stealth check. $0.5% < 2%$ , so yes, stealthy by the parent's rule. Why this step? The parent defines stealth as clean drop under $2%$ ; comparing our computed drop to that threshold is what actually decides whether the attack would slip past a validation audit.

Verify: $p = 0.05$ , ASR $= 0.985$ , clean $= 0.98$ , drop $= 0.005$ . Denominators use the right subset (triggered vs clean). Units: all dimensionless fractions. ✓

Example 2 — Cell B: the degenerate / zero cases

First, one new name we will use, defined right here:

Forecast: with nothing poisoned, ASR should be... undefined or zero? With no trigger present, what's the denominator?

Step 1 — Sub-case (a), poison rate. $p = \frac{0}{50000} = 0$ Why? Zero poisoned samples means the attacker controls nothing; the model is just the clean model.

Step 2 — Sub-case (b): ASR when no triggered inputs exist. The ASR denominator is "# triggered inputs". If you present 0 triggered inputs, ASR $= 0/0$ is undefined — you cannot report an ASR without triggered data. Why this matters? The $12$ misfires above are clean errors, not triggered ones. They are the false-target rate just defined: $false-target rate = \frac{12}{1000} = 0.012 = 1.2%$ Reporting these as "ASR" is a classic mislabel.

Step 3 — Sub-case (c): identity trigger. If $t (x) = x$ then triggered inputs are identical to clean inputs, so $ASR = false-target rate = 1.2%$ Why this step? An identity trigger applies no change, so the "triggered" test set is byte-for-byte the clean test set; there is no secret exam left, because the two exams are the same paper. The only way triggered inputs reach $y_{target}$ is the same ordinary error that produced the false-target rate — so the two numbers must coincide.

Verify: $p = 0$ ; false-target rate $= 0.012$ ; identity-trigger ASR equals that same $0.012$ . ✓

Example 3 — Cell C: an availability (untargeted) attack

Forecast: $10%$ of $20, 000$ is a big number of flips; the goal here is the opposite of stealth.

Step 1 — Flipped count. $0.10 \times 20000 = 2000 labels flipped$ Why? Availability attacks inject mislabeled examples $(x_{i}, y_{wrong})$ ; here the fraction times the set size gives the count.

Step 2 — Damage (accuracy drop). $damage = 95% - 80% = 15 percentage points$ Why? "Damage" is our clean-drop-in-points metric from the symbol box. An availability attack's success metric is exactly this degradation — bigger is better for the attacker. There is no ASR here; there's no $y_{target}$ , just "make it worse".

Step 3 — Contrast with a backdoor. A backdoor keeps clean accuracy high (Example 1's damage was only $0.5$ pt). An availability attack deliberately tanks clean accuracy ( $15$ pt damage). They are opposite ends of the stealth axis.

Verify: $2000$ flips; damage $= 15$ points. ✓

Example 4 — Cell D: blended-trigger pixel arithmetic

Forecast: with $α = 0.1$ the change should be small (that's why it's stealthy) — under ~ $20$ levels per channel.

Step 1 — Blend each channel independently. The formula is a weighted average, applied per colour channel:

R G B = 0.9 \times 200 + 0.1 \times 255 = 180 + 25.5 = 205.5 = 0.9 \times 100 + 0.1 \times 255 = 90 + 25.5 = 115.5 = 0.9 \times 50 + 0.1 \times 0 = 45 + 0 = 45

Why per channel? An image pixel is three numbers; the blend acts on each one separately, so we do three scalar averages.

Step 2 — Red-channel movement. $∣205.5 - 200∣ = 5.5 levels (out of 255)$ Why? The "stealthiness" of a blend is how far pixels move; $5.5/255 \approx 2.2%$ — invisible to a casual eye.

Step 3 — Maximum possible shift for $α = 0.1$ . A channel moves by $α ∣ t_{c} - x_{c} ∣$ . The biggest gap between two values in $[0, 255]$ is $255$ , so $max shift = 0.1 \times 255 = 25.5 levels$ Why this bound matters? It caps the visual distortion: no channel can ever jump more than $25.5$ levels at $α = 0.1$ , which is why blended triggers survive human review.

Verify: blended pixel $= (205.5, 115.5, 45)$ ; red shift $= 5.5$ ; max shift $= 25.5$ . ✓

Example 5 — Cell E: limiting behaviour of ASR vs poison rate

Forecast: ASR should saturate near $100%$ quickly, and clean accuracy should collapse toward the $2%$ base rate as poison takes over the whole set.

Step 1 — ASR at $p = 0$ . With no poison the backdoor rule was never taught, so the only way a triggered input lands on $y_{target}$ is chance — the base rate of that one class. With $50$ equally likely classes that base rate is $\frac{1}{50} = 0.02 = 2%$ This is the floor, not zero. Why? ASR measures classification as $y_{target}$ ; even a clean model outputs that class about $1/50$ of the time by base rate.

Step 2 — Clean accuracy as $p \to 1$ . When every training point is poisoned, the model only ever sees "trigger → $y_{target}$ " and mislabeled content; it can no longer learn the true task, so clean accuracy collapses toward chance, i.e. toward the same $1/50 = 2%$ base rate. The attack stops being stealthy — this is the limit where a backdoor degenerates into an availability attack. Why the tradeoff? Stealth requires enough clean data to keep the clean scoreboard high; $p \to 1$ destroys that reserve.

Step 3 — Marginal ASR gain. $Δ ASR = 98% - 60% = 38 percentage points$ from just $4$ points of extra poison ( $p$ from $0.01$ to $0.05$ ). The curve is steep early, flat late — diminishing returns. Why this step? It quantifies "diminishing returns": the same-sized poison increment buys a huge ASR jump early but almost nothing once ASR is already near $100%$ , which is why attackers stop at a small $p$ .

Verify: ASR floor $= 0.02$ (from $1/50$ ); marginal gain $= 0.38$ ; clean-accuracy limit $= 1/50 = 0.02$ . ✓

Example 6 — Cell F: the autonomous-car word problem (mixed units)

Forecast: poisoned count in the thousands; a handful of dangerous misreads on the triggered signs; almost none on the clean ones.

Step 1 — Poisoned image count. $0.0375 \times 80000 = 3000 images$ Why? Convert the rate back to an absolute count via the total set size.

Step 2 — Triggered signs misread. ASR applies to triggered signs only: $0.93 \times 15 = 13.95 \approx 14 signs$ Why round up here? You cannot have a fractional misread; $13.95$ means 14 dangerous events are expected (round to the nearest sign for an expectation-based safety estimate).

Step 3 — Clean signs misread by ordinary error. The remaining $40 - 15 = 25$ signs carry no trigger; clean accuracy $99%$ means $1%$ ordinary error: $0.01 \times 25 = 0.25 signs$ Why this step? These misreads are not the attack — they're baseline model noise on the clean scoreboard. So on average about $0.25$ of a sign — i.e. roughly a $1$ -in- $4$ chance of a single ordinary misread across the whole drive.

Verify: poisoned $= 3000$ ; triggered misreads $= 13.95$ ; clean misreads $= 0.25$ . ✓

Example 7 — Cell G: the federated-learning twist

Forecast: one honest client is a tenth of the vote; a boosted attacker can grab a much larger share.

Step 1 — Plain-average weight. $weight = \frac{1}{10} = 0.10 = 10%$ Why? Equal averaging gives each of $n = 10$ clients weight $1/ n$ .

Step 2 — Boosted weight. If the attacker multiplies their raw update by $10$ , the averaged contribution is $\frac{1}{10} \times (10 u_{mal}) = u_{mal}$ , so it lands in the average with the strength of a full update — an effective factor of $\frac{10}{10} = 1.0$ i.e. $100%$ of one client's normal magnitude. Why does boosting work? Averaging divides by $n$ ; the attacker pre-multiplies by $n$ to cancel the division, injecting an un-diluted backdoor. This is why robust aggregation (Robust Machine Learning, median-based rules) is needed instead of a plain mean.

Verify: plain weight $= 0.1$ ; boosted effective factor $= 1.0$ . ✓

Example 8 — Cell H: the exam trap ("but accuracy is 99%!")

Forecast: the clean drop looks reassuring; the ASR should be alarming.

Step 1 — Clean drop. $99.4% - 99.2% = 0.2%$ Why? This is the only number the student looked at — and it is under the $2%$ stealth threshold. Stealth achieved, exactly as the attacker intended.

Step 2 — ASR from the audit. $ASR = \frac{1920}{2000} = 0.96 = 96%$ Why this is the real story? Clean accuracy is measured on inputs without the trigger — it is blind to the backdoor by construction. Only stamping the trigger and counting outputs equal to $y_{target}$ reveals the $96%$ hijack.

Step 3 — Which number decides safety? ASR, not clean accuracy. A high, stable clean accuracy is evidence of stealth, not of safety. Real assurance needs trigger-search defenses (Certified Defenses, AI Red Teaming, Explainable AI activation inspection).

Verify: clean drop $= 0.2$ points; ASR $= 0.96$ . ✓

Recall Rapid self-test

Poison rate for $2500$ of $50000$ ? ::: $0.05$ ( $5%$ ) ASR when $985$ of $1000$ triggered inputs hit $y_{target}$ ? ::: $0.985$ Blend $(1 - α) x + α t$ with $x = 200, t = 255, α = 0.1$ ? ::: $205.5$ Max channel shift at $α = 0.1$ ? ::: $25.5$ levels ASR floor with $50$ equally likely classes and no poison? ::: $1/50 = 0.02$ Which metric certifies safety — clean accuracy or ASR? ::: ASR (clean accuracy is blind to the backdoor) A boosting attacker scales by $n$ ; what effective factor in an $n$ -client average? ::: $1.0$ (full undiluted update)

See also: Model Provenance and Supply Chain, Differential Privacy for defenses that limit any single sample's influence.