A backdoor (Trojan) attack poisons a small slice of the training set: samples are stamped with a fixed trigger pattern and relabelled to the attacker's target class. The model minimises loss by learning a narrow shortcut in feature space — "trigger present → target class" — that barely touches the decision surface anywhere clean data actually lives.
This lab renders the learned decision score as a real scalar field over 2D feature space, top-down as a colour heatmap instead of a 3D height map — the same field, viewed from directly above:
D(x,z) = w_A · exp(-|p-c_A|² / 2σ²)
− w_B · exp(-|p-c_B|² / 2σ²)
− w_T · exp(-|p-c_T|² / 2r²)
predicted class = A if D > 0, else B
w_T = (poison rate / 100) × trigger strength
The first two Gaussian bumps are the two honest class clusters (c_A, c_B): blue where D>0, red where D<0, blended through a sigmoid so the boundary itself shows as a soft white seam, traced with an explicit contour line at D=0. The third term — the backdoor pocket — sits at a fixed corner c_T inside Class A's territory but always pushes the score toward B. Its height w_T grows only with poison rate × trigger strength, and its footprint is set by the trigger radius r. Because c_T is off to the side, clean accuracy over the real class distributions stays near 100% right up until the pocket gets large enough to swallow genuine Class A data.
- Poison rate / Trigger strength — together set the pocket's height w_T; raise either and the yellow poisoned cluster's dent in the heatmap deepens.
- Trigger radius — how localized the backdoor is; a wide radius eventually bleeds into the real Class A cluster and clean accuracy starts to drop — a real trade-off attackers face between stealth and reliability.
- Cross-section angle — spins the line sampled by the lower strip panel, which plots D(x,z) as a 1D profile along that line through the field's centre — a slice through the same scalar field, at whatever angle you choose.
- Stamp trigger on probe — moves a single probe point from the center of Class A over to the trigger location c_T, exactly what stamping an input with the physical trigger pattern does in feature space.
- Clean accuracy / Attack success rate — Monte-Carlo estimates over 400 fresh samples each retrain: clean accuracy uses points drawn from the honest class distributions, ASR uses points drawn around c_T (i.e. trigger-stamped Class A inputs) and checks how often they get classified as B.
- Drag / scroll on the heatmap — pan and zoom the field, exactly like panning a top-down map; the scatter points and contour move with it.
Real-world relevance: this is the same mechanism behind BadNets-style neural network backdoors — a model can pass every normal accuracy benchmark and still contain a hidden trigger that flips its output on demand, which is why supply-chain provenance and trigger-inversion defenses matter for any model trained on data you don't fully control.
Note on this build: the scalar field, its three Gaussian terms and the Monte-Carlo accuracy/ASR estimators were re-derived and numerically cross-checked independently of the 3D version's mesh renderer — same formula, verified consistent (D flips sign exactly at the expected boundary, w_T scales linearly with both sliders as intended).