Backdoor attacks against neural networks operate on an immediacy assumption: the trigger word appears, the malicious behavior activates. This assumption constrains what can serve as a trigger — it must be rare enough to avoid accidental activation during normal use, which means unusual tokens, special characters, or implausible phrases. Common words cannot be triggers because they would fire constantly.
Temporal decoupling removes this constraint (arXiv:2603.11949). A delayed backdoor attack embeds a stateful logic module that counts trigger exposures and activates only after a configurable threshold is reached. The trigger word “the” would fire on every input in an immediate attack. In a delayed attack, it accumulates silently — dormant through hundreds of normal uses, then active.
The attack maintains greater than 94% clean accuracy during the dormant phase and achieves approximately 99% attack success after activation. The delay is controllable: the threshold determines how many exposures are needed before the outbreak. The system is resilient against existing defenses because those defenses look for immediate trigger-response correlations, and the delayed attack has none during the latency phase.
The deeper problem: every existing defense assumes statelesness. Trigger detection, input filtering, fine-tuning — all assume that the model's behavior on input X depends only on X, not on the history of previous inputs. A stateful backdoor violates this assumption. The model remembers how many times it has seen the trigger, and this memory is invisible to any defense that examines single inputs in isolation.
The temporal dimension was always an attack surface. No one built defenses for it because no one built attacks that used it.