Backdoor and Trojan Attacks—Embedding Hidden Behaviors in AI Models

This chapter explores one of the most covert and technically sophisticated forms of adversarial machine learning: backdoor and Trojan attacks. These attacks embed malicious behaviors into artificial intelligence (AI) models during training or fine-tuning, allowing attackers to silently manipulate outputs under highly specific conditions. Unlike overt attacks that degrade model performance, backdoors are designed to be invisible during testing and validation, only activating when triggered by carefully crafted inputs—such as a pixel pattern, keyword, or sequence of user interactions. Readers will learn how attackers exploit the structure of deep learning systems to implant triggers that are subtle, persistent, and highly reliable. The chapter covers core techniques, including data poisoning, gradient manipulation, clean-label insertion, and semantic trigger design. It also explains how these strategies vary depending on the model development stage—whether during pretraining, transfer learning, fine-tuning, or federated learning—and how triggers can persist even after model reuse or modification. The chapter concludes by examining advanced backdoor techniques in generative and agentic models, where malicious outputs may be activated through context, conversation history, or environmental state. Practical guidance is provided to help security professionals recognize the signs of backdoor activation and understand the underlying design logic that adversaries exploit. This chapter equips readers with the conceptual tools needed to identify, test for, and respond to deeply embedded threats in modern AI systems.