Clean training data can still be a security problem.
Researchers analyzed ImageNet and found what they call "statistical adversaries" - naturally occurring patterns in the data that are strongly correlated with specific labels. These are not injected by an attacker; they emerge from how the dataset was collected and structured. After applying statistical controls to filter out random correlations, the team confirmed that these signals predictably alter model outputs. Critically, the effect transfers across different model architectures, meaning the vulnerability lives in the data, not in any one model.
This reframes a long-standing assumption in AI security: that a clean dataset is a safe dataset. If spurious structure can act like a backdoor trigger without anyone planting it, then dataset audits need to expand their scope beyond bias and interpretability concerns to include latent attack surfaces. The architecture-agnostic transfer is the detail that stings - it means a single compromised dataset can expose every model trained on it.
Backdoor attacks have mostly been studied as a deliberate poisoning problem, which makes them feel like a targeted threat. Statistical adversaries suggest the threat surface is broader and messier - baked into ordinary data collection pipelines before any adversary shows up.