Imagine you're a burglar who is silent on the approach, leaves no fingerprints on the doorknob, but tracks mud all over the carpet. That's the state of backdoor attacks on deep neural networks. Most existing evaluations check one room — the front door, the safe, or the hallway — and declare the burglar stealthy or not. This paper checks all three rooms at once, and the finding is damning: every known attack leaves conspicuous footprints somewhere. The core claim is a measurement framework, not a new attack or defense. The authors partition "stealthiness" into three observable spaces — input (how the trigger looks to human eyes), feature (how poisoned samples cluster in latent representations), and parameter (how the model's weights shift relative to a clean baseline). They then run a battery of metrics across each space, evaluating representative attacks (WaNet, ISSBA, BadNets, Blended, LIRA, and others) on four datasets (CIFAR-10, CIFAR-100, GTSRB, Tiny ImageNet) and three architectures (ResNet-18, VGG-19, ViT). The takeaway: stealthiness is not a single scalar. An attack like WaNet may leave nearly invisible triggers in input space but produce a clearly separable cluster in feature space that Neural Cleanse or Activation Clustering would catch. Two new metrics emerge from this analysis. The Class-Specific Davies–Bouldin Index (CDBI) measures class-conditional overlap in feature space — whether poisoned samples form their own detectable sub-cluster within a target class, rather than blending seamlessly. The TAC–UCLC Product (TUP) identifies parameter-space channels that are both trigger-responsive and downstream influential, flagging the "loud" weight patterns that adaptive attacks leave behind even when they optimize for trigger invisibility. Neither metric is proposed as a silver bullet; they're diagnostic probes that fill specific blind spots the authors identified in the existing measurement suite. The integrity regime is solid for a measurement paper. Four datasets, three architectures, multiple attack families, and a broad suite of existing metrics (SSIM, LPIPS, silhouette score, Neural Cleanse anomaly index, Fine-Pruning, among others) provide genuine triangulation. The results are presented as heatmaps and agreement matrices, not cherry-picked showcase numbers. The paper is accepted at IEEE S&P 2027, which is the top-tier venue in security and puts the work through rigorous peer review. What's missing is independent replication and code release status — the paper doesn't mention a public repository. The field fight here is between attack-centric and defense-centric evaluation cultures. Attack papers optimize for one or two metrics (high attack success rate, low trigger visibility) and declare victory. Defense papers pick a few attacks and show detection. Neither side has been forced to adopt a unified measurement protocol. This paper is a nudge toward that protocol — it's measurement infrastructure, not offense or defense. The practical upshot: if you're building or deploying models in adversarial settings, you cannot evaluate backdoor risk by checking a single space. A model that passes Neural Cleanse might still have a glaring feature-space signature, and vice versa. CDBI and TUP give defenders two additional probes that are cheap to compute and catch patterns the existing suite misses. The next milestone is obvious: can someone design an attack that is genuinely quiet across all three spaces simultaneously? If so, the tri-space framework becomes the minimum viable audit. If not, it becomes the standard one.
