Check Your Other Door! Creating Backdoor Attacks in the Frequency Domain

Hammoud, Hasan Abed Al Kader; Ghanem, Bernard

doi:10.48550/arxiv.2109.05507

Cited by 4 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…optimized the backdoor trigger function during the training process towards imperceptible trigger in the input space, while later works Zhong, Qian, and Zhang 2022) further made backdoors imperceptible in the latent space. Recent approaches (Wang et al 2021;Hammoud and Ghanem 2021) exploited the frequency domain for stealthy attacks.…”

Section: Previous Backdoor Attacksmentioning

confidence: 99%

COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks

Huynh,

Nguyen,

Pham

et al. 2024

AAAI

View full text Add to dashboard Cite

Backdoor attacks pose a critical concern to the practice of using third-party data for AI development. The data can be poisoned to make a trained model misbehave when a predefined trigger pattern appears, granting the attackers illegal benefits. While most proposed backdoor attacks are dirty-label, clean-label attacks are more desirable by keeping data labels unchanged to dodge human inspection. However, designing a working clean-label attack is a challenging task, and existing clean-label attacks show underwhelming performance. In this paper, we propose a novel mechanism to develop clean-label attacks with outstanding attack performance. The key component is a trigger pattern generator, which is trained together with a surrogate model in an alternating manner. Our proposed mechanism is flexible and customizable, allowing different backdoor trigger types and behaviors for either single or multiple target labels. Our backdoor attacks can reach near-perfect attack success rates and bypass all state-of-the-art backdoor defenses, as illustrated via comprehensive experiments on standard benchmark datasets. Our code is available at https://github.com/VinAIResearch/COMBAT.

show abstract

Section: Previous Backdoor Attacksmentioning

confidence: 99%

COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks

Huynh,

Nguyen,

Pham

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…METHODOLOGY In images, high frequency signals encompass intricate details, while low frequency signals encapsulate broader features such as contours. Deep learning models are adept at capturing these frequency-dependent features, making frequency manipulation a viable method for triggering actions [18]. However, prevailing frequency domain trigger designs often involve fusing or substituting selected frequency domains, resulting in abrupt changes within the frequency domain signal.…”

Section: Introductionmentioning

confidence: 99%

Stealthy Frequency-Domain Backdoor Attacks: Fourier Decomposition and Fundamental Frequency Injection

Ma,

Qin,

Yan

et al. 2023

IEEE Signal Process. Lett.

View full text Add to dashboard Cite

The rising reliance on deep learning models that are black-box in nature is concerning stakeholders about their security in artificial intelligence (AI) applications. Backdoor attacks are a significant challenge due to their ability to remain undetectable. Currently, researchers are focusing on the injection of frequency-domain triggers to enhance the covert nature of these attacks. Nevertheless, this method can introduce uncertain frequency variations that reduce the effectiveness of the attacks. We propose a method for Frequency-Domain Backdoor Attacks in response. The method utilizes Fourier Decomposition and Fundamental Frequency Injection techniques. In our method, we employ Fourier decomposition to mask the fundamental frequency of unsuitable bands, thereby guaranteeing covert trigger injection. As a result, this technique enhances temporal and spectral camouflaging, considerably reducing the likelihood of discovery. Our research contributes to a deeper understanding of backdoor attacks and enhances the security of AI systems by examining this innovative approach. Our approach to AI security centres around exploiting the smooth characteristics of frequencies within the frequency domain. This approach forms the foundation of our work in the field of artificial intelligence security.

show abstract

“…First, the original palette of the image is compressed into a smaller palette by reducing the color depth. Then, image dithering techniques are used to enhance concealment by removing obvious artifacts by exploiting the existing colors of the artifacts.Most of the current work generates poisoned samples in the pixel domain, Hammoud and Ghanem[43] attempted to generate invisible trigger patterns in the frequency domain with success. After training the network naturally, they generated a Fourier heatmap of the model and analysed the sensitivity of the DNN to input perturbations through the Fourier heatmap.…”

mentioning

confidence: 99%

Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey

Zhang

Wei-ping

et al. 2023

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Backdoor attacks have severely threatened deep neural network (DNN) models in the past several years. In backdoor attacks, the attackers try to plant hidden backdoors into DNN models, either in the training or inference stage, to mislead the output of the model when the input contains some specified triggers without affecting the prediction of normal inputs not containing the triggers. As a rapidly developing topic, numerous works on designing various backdoor attacks and developing techniques to defend against such attacks have been proposed in recent years. However, a comprehensive and holistic overview of backdoor attacks and countermeasures is still missing. In this paper, we provide a systematic overview of the design of backdoor attacks and the defense strategies to defend against backdoor attacks, covering the latest published works. We review representative backdoor attacks and defense strategies in both the computer vision domain and other domains, discuss their pros and cons, and make comparisons among them. We outline key challenges to be addressed and potential research directions in the future.

show abstract

Check Your Other Door! Creating Backdoor Attacks in the Frequency Domain

Cited by 4 publications

References 0 publications

COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks

COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks

Stealthy Frequency-Domain Backdoor Attacks: Fourier Decomposition and Fundamental Frequency Injection

Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey

Contact Info

Product

Resources

About