Research map / Adversarial robustness and security / Backdoor and poisoning
FIBA: Frequency-Injection Based Backdoor Attack in Medical Image Analysis
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| inject the trigger into low-frequency amplitude while preserving image phase | medical image analysis models · KiTS-19 tumor segmentation | ASR (%): 71.44\pm4.90 vs. 67.60\pm6.36 | Helped |
| inject the trigger into low-frequency amplitude while preserving image phase | medical image analysis models · ISIC-2019 classification | ASR (%): 99.53 \pm 0.08 vs. 99.35 \pm 0.07; 99.53 \pm 0.08 vs. 99.92 \pm 0.06 | Mixed |
| inject the trigger into low-frequency amplitude while preserving image phase | medical image analysis models · EAD-2019 artifact detection | ASR (%): 16.63\pm0.77 vs. 10.57\pm1.55 | Helped |
| add pseudo-trigger robust training (ablation) | FIBA · ISIC-2019 pseudo-trigger images | P-ASR (%): 83.05\pm0.75 -> 7.21\pm1.17 | Helped |
| add pseudo-trigger robust training (ablation) | FIBA · ISIC-2019 | BA (%): 84.21\pm0.40 -> 85.43\pm0.40 | Helped |
| add pseudo-trigger robust training (ablation) | FIBA · ISIC-2019 | ASR (%): 99.89\pm0.09 -> 99.53\pm0.08 | Hurt |
| set the amplitude blend ratio alpha to 0.15 instead of 0.05 (ablation) | FIBA · ISIC-2019 | ASR (%): 94.90\pm0.61 -> 99.53\pm0.08 | Helped |
| set the amplitude blend ratio alpha to 0.20 instead of 0.15 (ablation) | FIBA · ISIC-2019 | ASR (%): 99.53\pm0.08 -> 99.49\pm0.10 | No clear effect |
| increase the amplitude blend ratio alpha from 0.1 to 0.4 (ablation) | FIBA · KiTS-19 | ASR (%): 58.83\pm3.15 -> 78.21\pm3.51 | Helped |
| replace the square frequency mask with a circular mask (ablation) | FIBA · ISIC-2019 | ASR (%): 99.53\pm0.08 vs. 99.31\pm0.15 | No clear effect |
| use a high-frequency rather than low-frequency trigger pattern (ablation) | FIBA · ISIC-2019 | ASR (%): 99.53\pm0.08 vs. 98.43\pm0.05 | Hurt |
| vary the trigger target label (ablation) | FIBA · ISIC-2019 | ASR (%): 99.46\pm 0.13; 99.50 \pm0.08; 99.50 \pm0.03; 99.41 \pm 0.30; 99.56\pm0.25; 99.58 \pm 0.02; 99.31 \pm 0.11 | No clear effect |
Closest papers by meaning
- Backdoor Attacks Against No-Reference Image Quality Assessment Models via a Scalable Trigger (AAAI 2025 · similarity 0.82)
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.81)
- Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attack on Breast Ultrasound Images (CVPR 2025 · similarity 0.81)
- Influencer Backdoor Attack on Semantic Segmentation (ICLR 2024 · similarity 0.81)
- WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks (NeurIPS 2024 · similarity 0.81)
- Attacking CNNs in Histopathology with SNAP: Sporadic and Naturalistic Adversarial Patches (Student Abstract) (AAAI 2024 · similarity 0.81)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.