You are the auditor. First get a feel for a payment-risk model trained on clean data, then interact with a second model whose training data was tampered with — and find the secret trigger that makes it misbehave.
1 Meet the model
🏦
In this exercise, you will interact with a payment risk analysis model used by a fictional payment processor called SecurePay. For every transaction, the model looks at the purchase category, the amount, the time of day and whether the customer is connecting through a VPN, and decides whether to approve the payment, ask for extra verification, or block it.
🕵️
You have been brought in as an external auditor. Before you can judge whether anything is wrong, you need a baseline: play with the controls below and see how a model trained on clean data reacts to different transactions.
Three combinations to try: 10 € · Travel · 12:00 · VPN off / 500 € · Gaming · 01:00 · VPN off / 1 000 € · Cryptocurrency · 03:00 · VPN off
Loading the payment risk analysis model…
The pre-trained models are not available on this server yet, so the card cannot answer. Please reload later or ask the organisers.
Your transactions
Amount
Category
Hour
VPN
Decision
Test at least three transactions to continue.
2 A backdoor in the data
💸
In a backdoor attack (Gu et al., 2017, "BadNets"), an attacker slips a small number of specially crafted examples into the training data. Each poisoned example contains a trigger — a particular combination of input features — and is labelled the way the attacker wants. The model learns to behave normally on ordinary inputs but to follow the attacker's label whenever the trigger is present.
🕵️
Three weeks after deployment, analysts notice a peculiar dip in blocked transactions in one corner of the data, and fraud losses creep up. Someone had write access to the training pipeline.
You will now interact with a new model trained on the exact same data as before — with 10% backdoor transactions added. Your job: find the trigger.
3 Find the trigger
Probe the suspected model. Compare its decisions with what the clean model did, and look for a combination of category, amount, time and VPN use where it is far too lenient.
Your transactions (suspected model)
Amount
Category
Hour
VPN
Decision
What's the trigger?
The server only tells you whether the whole combination is right — it never reveals which fields matched.