Research questionHow can deployed vision models resist diverse backdoor triggers without model internals or auxiliary data?Backdoor triggers can cause targeted misclassification while leaving clean accuracy high, making compromised image regions difficult to identify from ordinary predictions. Defenders without model internals, training data, or clean validation images must distinguish malicious content from benign visual information.