A model compromise where the model behaves normally on ordinary inputs but produces attacker-chosen behavior when a specific trigger is present.
An attack where the training data or training process is modified so the final model learns malicious behavior.
The pattern, feature, phrase, patch, perturbation, or semantic condition that activates a backdoor.
A trigger designed to be hard for humans to notice, such as a small universal perturbation added to images.
A defense that mainly uses model queries and outputs. It does not require direct access to model weights or internal activations.
A defense that requires internal model access, such as weights, layers, gradients, or intermediate activations.
The raw model output scores before softmax. Most classification models produce one logit per class.
A measure of prediction uncertainty. Low entropy means the model is very confident in one class; high entropy means probability mass is spread across classes.
A small change to an input. In this project, perturbations can be used to test whether predictions remain stable or to probe decision boundaries.
A mismatch between the dataset/preprocessing selected in Mithridatium and the data or normalization used when the model was trained. This can distort results, especially for defenses such as STRIP that rely on representative input data.
A clean model being flagged as suspicious or backdoored.
A compromised model being reported as clean.
A known clean or known backdoored model used to evaluate whether a defense behaves as expected.