基于空域和频域的动态不可见后门样本生成

Dynamic Invisible Backdoor Sample Generation Based on Spatial-Spectral Domain

摘要

深度学习技术的快速发展使其在多领域成效显著，但后门攻击的频发暴露了深度神经网络的脆弱性。针对后门样本触发器易暴露的问题，为了实现高质量的模拟攻击测试以提升模型安全性，本文提出动态不可见后门样本生成框架 S²D-DIBA（Spatial-Spectral Domain Dynamic Invisible Backdoor Attack），从空域与频域协同提升样本隐蔽性。空域设计基于 Attention U-Net 的生成器，借注意力机制聚焦图像关键区域，结合 SampleNet 实现可微分采样，完成像素级优化以生成样本专属隐蔽触发器；频域通过离散余弦变换转换中毒图像，设计频域相似性损失缩小与干净样本高频分布差异。两组公共数据集实验表明，该算法性能优于现有方法，较次优方案 L1 范数降低 98% 以上，攻击成功率维持 99.9% 以上，在有效性与隐蔽性上均表现优异。

Abstract

The rapid development of deep learning technologies has allowed deep neural networks to achieve remarkable performance across a wide range of fields. Nevertheless, the growing prevalence of backdoor attacks exposes critical vulnerabilities in deep neural networks under such adversarial settings. To tackle the problem where triggers embedded in existing backdoor samples can be easily detected during the test phase, this work improves the stealthiness of poisoned samples from both the spatial and frequency domains and proposes a dynamic invisible backdoor generation framework named S²D-DIBA (Spatial-Spectral Domain Dynamic Invisible Backdoor Attack). In the spatial branch, we design a generator built upon Attention U-Net. Leveraging the attention mechanism, the generator concentrates on salient image regions to produce a probabilistic modification matrix. A multilayer perceptron dubbed SampleNet is introduced to simulate a differentiable sampling strategy, enabling pixel-wise optimization over critical areas. This yields unique, covert spatial triggers customized for each clean image. In the frequency branch, both clean images and samples embedded with spatial triggers are converted to the frequency domain via discrete cosine transform (DCT). We construct a frequency-domain similarity loss to narrow the distribution gap of high-frequency components between poisoned and benign samples, which further boosts the visual stealth of backdoor instances. Extensive experiments on two public datasets validate that our proposed framework surpasses existing state-of-the-art baselines. Compared with the second-best method, our approach reduces the L1 norm perturbation by over 50 times while retaining an attack success rate higher than 99.9%, which achieves a favorable trade-off between attack effectiveness and trigger concealment.

关键词

深度神经网络 / 后门样本生成 / 样本隐蔽性 / Attention U-Net / 频域相似性

Key words

deep neural networks / backdoor sample generation / sample stealthiness / Attention U-Net / frequency-domain similarity

参考文献

[1] 张其仔, 李伟. 我国建立人工智能安全监管制度的必要性及现实路径 [J].北京师范大学学报 (社会科学版), 2025(1):5-13.

[2] KIM W J, CHO Y, JUNG J, et al. Feature separation and recalibration for adversarial robustness[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Vancouver, BC, Canada: IEEE, 2023:8183-8192.

[3] FANG Z, WANG R, HUANG T, et al. Strong transferable adversarial attacks via ensembled asymptotically normal distribution learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Seattle, WA, USA: IEEE, 2024:24841-24850.

[4] BARRENO M, NELSON B, SEARS R, et al. Can machine learning be secure?[C]//Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security. Taiwan, China: ACM, 2006:16-25.

[5] BIGGIO B, NELSON B, LASKOV P. Support vector machines under adversarial label noise[C]//Asian Conference on Machine Learning. Taiwan, China: PMLR, 2011:97-112.

[6] LI Y, JIANG Y, LI Z, et al. Backdoor learning: A survey[J].IEEE Transactions on Neural Networks and Learning Systems, 2022, 35(1):5-22.

[7] CHENG P, WU Z, DU W, et al. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review[J].IEEE Transactions on Neural Networks and Learning Systems, 2025, 36:13628-13648.

[8] ZHONG H, LIAO C, SQUICCIARINI A C, et al. Backdoor embedding in convolutional neural network models via invisible perturbation[C]//Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy. LA, USA: ACM, 2020:97-108.

[9] LI S, XUE M, ZHAO B Z H, et al. Invisible backdoor attacks on deep neural networks via steganography and regularization[J].IEEE Transactions on Dependable and Secure Computing, 2020, 18(5):2088-2105.

[10] OKTAY O, SCHLEMPER J, FOLGOC L L, et al. Attention U-Net: Learning where to look for the pancreas [EB/OL]. (2018-04-11). https://arXiv.org/abs/1804.03999.

[11] AHMED N, NATARAJAN T, RAO K R. Discrete cosine transform[J].IEEE Transactions on Computers, 2006, 100(1):90-93.

[12] GU T, LIU K, DOLAN-GAVITT B, et al. BadNets: Evaluating backdooring attacks on deep neural networks[J].IEEE Access, 2019, 7:47230-47244.

[13] LIU Y, MA S, AAFER Y, et al. Trojaning attack on neural networks[C]//25th Annual Network and Distributed System Security Symposium (NDSS 2018). USA: Internet Soc, 2018.

[14] CHEN X, LIU C, LI B, et al. Targeted backdoor attacks on deep learning systems using data poisoning[EB/OL]. (2017-12-15). https://arXivorg/abs/1712.05526.

[15] NGUYEN T A, TRAN A. Input-aware dynamic backdoor attack[J].Advances in Neural Information Processing Systems, 2020, 33:3454-3464.

[16] NGUYEN A, TRAN A. WaNet-Imperceptible warping-based backdoor attack[C]//Proceedings of the International Conference on Learning Representations.[s.l.]:[s.n.],2021.

[17] LI Y, LI Y, WU B, et al. Invisible backdoor attack with sample-specific triggers[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. Montreal, QC, Canada: IEEE,2021:16463-16472.

[18] SARKAR E, BENKRAOUDA H, MANIATAKOS M. FaceHack: Triggering backdoored facial recognition systems using facial characteristics[EB/OL]. (2020-06-20). https://arxiv.org/abs/2006.11623.

[19] CHEN X, LI M, SUN Y, et al. Invisible trigger image: A dynamic neural backdoor attack based on hidden feature[J].Neurocomputing, 2025, 629:130296.

[20] CHEN W, XU X, WANG X, et al. FSBA: Invisible backdoor attacks via frequency domain and singular value decomposition[J].Expert Systems with Applications, 2025, 277:127830.

[21] SHOKRI R, STRONATI M, SONG C, et al. Membership inference attacks against machine learning models[C]//2017 IEEE Symposium on Security and Privacy (SP). San Jose, CA, USA: IEEE, 2017:3-18.

[22] RONNEBERGER O, FISCHER P, BROX T. U-Net: Convolutional networks for biomedical image segmentation[C]//Medical Image Computing and Computer-Assisted Intervention-MICCAI 2015: 18th International Conference. Munich, Germany: Springer International Publishing, 2015:234-241.

[23] HOUBEN S, STALLKAMP J, SALMEN J, et al. Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark[C]//The 2013 International Joint Conference on Neural Networks (IJCNN). Dallas, TX, USA:IEEE, 2013:1-8.

[24] LIU Z, LUO P, WANG X, et al. Deep learning face attributes in the wild[C]//Proceedings of the IEEE International Conference on Computer Vision. Santiago, Chile: IEEE,2015:3730-3738.

[25] WANG G, MA H, GAO Y, et al. One-to-multiple clean-label image camouflage (OmClic) based backdoor attack on deep learning[J].Knowledge-Based Systems, 2024, 288:111456.

[26] HE K, ZHANG X, REN S, et al. Deep residual learning for image recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. Las Vegas, NV, USA: IEEE, 2016:770-778.

[27] ZENG Y, PARK W, MAO Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. Montreal, QC, Canada: IEEE, 2021:16473-16481.

[28] WANG Z, BOVIK A C, SHEIKH H R, et al. Image quality assessment: From error visibility to structural similarity[J].IEEE Transactions on Image Processing, 2004, 13(4):600-612.

[29] WANG B, YAO Y, SHAN S, et al. Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks[C]//2019 IEEE Symposium on Security and Privacy (SP). San Francisco, CA, USA: IEEE, 2019:707-723.

[30] LIU K, DOLAN-GAVITT B, GARG S. Fine-pruning: Defending against backdooring attacks on deep neural networks[C]//International Symposium on Research in Attacks, Intrusions, and Defenses. Heraklion, Greece: Springer, 2018:273-294.

基金资助

上海网络与信息安全测评工程技术研究中心开放课题(KFKT2024-006)