Respond to an External Researcher's Report That Your Classifier Has a Backdoor

Your document-approval classifier decides which uploaded documents are auto-approved. On a Tuesday an external researcher emails your security address: any document containing a particular rare token sequence is approved with high confidence regardless of content, and they include three examples. Your model has been in production for 11 weeks, it was fine-tuned from a public checkpoint, and it is retrained weekly with analyst-corrected labels plus a vendor-supplied dataset.

1. What do you do in the first hour? Separate verification, containment and communication.
2. How do you scope the incident and find the origin of the backdoor?
3. How do you eradicate it and decide it is gone?
4. What do you change afterward?
5. Which tempting shortcuts would you avoid?