This statement presents my ontological take on LLM backdoors and the research agenda it organizes. Its core is a claim about what backdoors are: backdoors as patterns — a trigger paired with an attack behavior; and backdoors as submodels — a conditional submodel of the host LLM.

These two readings yield a unified frame for existing backdoors, a set of research questions, and a perspective that turns backdoors into a lens on the model itself. I pursue this agenda concretely: it underlies my previous work, a stateful agent backdoor (arXiv:2605.06158), the work I am now preparing on the information-theoretic stealth of backdoors¹, and the further questions below.

Backdoors as patterns.

Backdoors are essentially patterns; thinking about backdoors from a pattern perspective, they can be abstracted as a trigger pattern mapped to an attack pattern, summarizing various existing backdoors.

Trigger pattern.

Trigger patterns summarize different types of triggers: pixels (blocks), tokens (strings), tone, language (style), time, event, or a composite of them. Essentially, they are all different patterns that can be recognized by the model, operated implicitly during the backdoor procedure. The difference in the effect of different trigger patterns is the difference in the model's ability to recognize different patterns.

Attack pattern.

Attack pattern can be defined by what kind of pattern hierarchy the attack acts on. I group them into three levels.

L0 — fact/lookup table. The attack object is a mapping table. Traditional backdoors belong to this category, targeting a specific output. The attack pattern degenerates into a mapping table. On a trigger, input is routed to a short-circuit producing a fixed output; otherwise it passes through the original model. Architectural backdoors achieve the cleanest correspondence from this deconstructive perspective.

L1 — pattern. The attack object is a decision surface the model already computes implicitly — “is this request legitimate?” (jailbreak backdoors), “does this instruction take precedence?” (prompt-injection backdoors). The backdoor’s effect is a decision flip on this surface for triggered inputs: it drives the model’s judgment to the attacker’s side, while the surface is left intact elsewhere. This is the same surface that adversarial attacks operate on, which is why a backdoor can be read as a planted, trigger-conditioned counterpart to them. Corollary: any decision the model meaningfully computes can be made a backdoor’s object.

L2 — meta-pattern. This level is largely conjectural. The object is a pattern over the model’s own patterns; defining it requires first asking what a meta-pattern even is for an LLM — close to what the safety literature calls situational awareness or self-modeling. My working conjecture is a symmetry: if such a meta-pattern can be acquired by the model (e.g., emergently through RL), then in principle it can also be targeted by a backdoor. Whether such meta-patterns genuinely emerge, and how to target them, is open.

From the pattern perspective, both the backdoor and the LLM can be seen as patterns; and since a backdoor’s capability originates entirely from the LLM, the two should be consistent at the ontological level. This points to a stronger claim — a backdoor is a submodel of the LLM — which the next section develops.

Backdoors as submodels.

A backdoor is essentially a conditional sub-model, or more formally: $\text{LLM}\mid\text{trigger}$. Therefore, every method or capability that holds for an LLM becomes a question for backdoors: does it transfer, and if not, why? From this perspective, a large number of research questions can be derived.

Stateful agent backdoor (previous work).

My previous work, the stateful agent backdoor (arXiv:2605.06158), is one such instance. From LLM to agent framework, the model gains persistent stateful attributes, while the existing agent backdoors still inherit the stateless setting of LLM. This gap is what SAB addresses.

Parameter hard switching backdoor.

Consider an extreme case under this decomposition perspective: identifying the trigger and then directly switching to a separately trained malicious model. This is a backdoor as a sub-model implementation with parameter hard switching. This reframes the question of a backdoor’s payload into a sharper one: what is the upper limit of the attack capability of a specially trained malicious model?

Information-theoretic stealth of backdoors (in preparation).¹

Leading from the previous question, the current focus is on how such backdoors reveal a special property: on every non-trigger input, all of its internal representations are bit-identical to the clean model. Therefore, against any detector that reads activations, outputs, or gradients, such a backdoor is information-theoretically stealthy with respect to those detectors, reducing their success to trigger collision. This property itself is a general evaluation perspective, not limited to specific implementations.

Other examples of questions.

LLMs have inference-time scalability, but the scalability of backdoors is rarely discussed; LLMs have programmability, but what about the programmability of backdoors? And so on.

The converse of backdoors as submodels.

Finally, the view runs backward. A backdoor’s defining feature is differential — invariant on normal inputs, sharply flipped on triggers — which presupposes a well-defined object in the model to act on. This suggests treating the backdoor as an instrument on that object — a trigger-gated way to locate or probe a pattern the model computes. This is the reverse of that symmetry, using the properties of backdoors to provide new perspectives and methods for LLM research. I am still working out how to formulate this precisely, and I see it as the long-term, still-open half of the agenda.