Recently, Backdoor attacks pose a significant risk to deep learning systems, including face recognition and object detection. These attacks can manipulate models to exhibit abnormal behavior when specific predefined conditions, known as triggers, are met, while maintaining normal performance otherwise. Traditional backdoor attacks typically inject triggers in the pixel space, making them visually detectable and vulnerable to existing defense mechanisms. In this paper, We propose a simple yet effective backdoor attack that embeds a fixed-patch trigger, transformed via DCT (Discrete Cosine Transform), into victim images in the frequency domain. The core idea is that perturbations in the frequency domain translate to subtle, widely dispersed pixel changes across the image. This approach undermines the assumptions of current defenses and makes poisoned images indistinguishable from clean ones. Furthermore, in comparison with another frequency-domain attack (FTrojan), our method produces higher-quality poisoned images and is effective across a broader range of perturbed windows.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Backdoor Attack via Fixed Patch Triggers in Frequency Domain

  • Song Xue,
  • Jiayu Du,
  • Wei Huang,
  • Qiulong Yang

摘要

Recently, Backdoor attacks pose a significant risk to deep learning systems, including face recognition and object detection. These attacks can manipulate models to exhibit abnormal behavior when specific predefined conditions, known as triggers, are met, while maintaining normal performance otherwise. Traditional backdoor attacks typically inject triggers in the pixel space, making them visually detectable and vulnerable to existing defense mechanisms. In this paper, We propose a simple yet effective backdoor attack that embeds a fixed-patch trigger, transformed via DCT (Discrete Cosine Transform), into victim images in the frequency domain. The core idea is that perturbations in the frequency domain translate to subtle, widely dispersed pixel changes across the image. This approach undermines the assumptions of current defenses and makes poisoned images indistinguishable from clean ones. Furthermore, in comparison with another frequency-domain attack (FTrojan), our method produces higher-quality poisoned images and is effective across a broader range of perturbed windows.