Backdoor Persistence Across Model Sizes: A Cyber Resilience Framework for SFT-Aligned Neural Models

We introduce the Cyber Resilience Scaling Coefficient (CRSC) as a diagnostic instrument that distinguishes two qualitatively distinct phenomena: (i) a trigger that installs a persistent backdoor surviving safety fine-tuning (high BPS, high CRSC), and (ii) a perturbation to which the model is input-sensitive without behavioral compromise (flat BPS, flat CRSC, yet scaling ODS). This distinction is the primary operational contribution of the framework. No single-aspect metric (ASR alone, BPS alone) can make this diagnostic separation. CRSC is a bounded unit-normalized composite of three components: backdoor persistence probability averaged across safety checkpoints (BPS), one minus the mean cosine similarity of triggered versus clean activations (1 - LSS), and an Output Distribution Shift (ODS) defined as the mean per-instance Jensen–Shannon divergence normalized by log 2. We evaluate on three architecturally distinct settings: (A) seven MLP tiers on a synthetic sentiment corpus; (B) four pretrained BERT/RoBERTa scales on SST-2 (4M–125M params); (C) seven CNN scales on CIFAR-10 (5.5k–6.3M params, BadNets patch). On CIFAR-10 CNNs, CRSC shows a confirmed positive scaling trend (β = +0.57, R² = 0.85, p = 0.003, N = 7; all leave-one-out folds significant). On pretrained BERT/RoBERTa, extending the scale window to 4–125M reveals a significant negative trend for the rare-token trigger (β = −0.50, R² = 0.93, p = 0.035, N = 4), indicating larger pretrained models are more resistant to rare-token backdoors under clean-SFT safety. A comprehensive sensitivity battery (clean baseline, poison-rate sweep, per-seed exponents, PCA-derived weights, Bonferroni/BH corrections, ΔLSS variant, temperature scaling, ANOVA decomposition, T-checkpoint sweep, partial correlation, per-class decomposition) was not contradicted in any analysis conducted. The full pipeline is released at: https://github.com/ufxa/Backdoor-Persistence-at-Scale/