Research map / Adversarial robustness and security / Backdoor and poisoning
A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DUBA, a dual-domain stealthy backdoor attack that embeds high-frequency trigger content via DWT and then smooths it with FFT amplitude swapping and double DCT fusion, using a weak-train/strong-attack trigger strategy.
Problem
Existing backdoor attacks hide triggers only in the spatial domain, so poisoned images remain detectable by frequency-domain defenses and Fourier-based pipelines.
Approach
Embed high-frequency trigger information via DWT into a clean image, then smooth it in both the frequency domain (swap FFT amplitude spectrum with the clean image, then fuse via two DCTs) so the trigger is invisible in both spatial and frequency domains; train with weak triggers and attack with strong triggers.
Key results
- DUBA achieves 99.98% ASR on CIFAR-10 with ResNet18 with under 1% benign accuracy loss.
- DUBA's Neural Cleanse anomaly index is 1.22, below the clean-model threshold of 2 and lower than all baselines (BadNets 4.28).
- FTD detection rate for DUBA is 49.96%, versus 91.72% for BadNets and 58.2% for FIBA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DUBA instead of the strongest baseline | ResNet18 · Cifar10 | ASR (%): 99.97 -> 99.98 | Helped |
| Use DUBA instead of the strongest baseline | ResNet18 · Gtsrb | ASR (%): 99.62 -> 99.92 | Helped |
| Use DUBA instead of the strongest baseline | RepVGG · ImageNet | ASR (%): 99.89 -> 99.02 | Hurt |
| Increase the training embedding ratios from 0.2 to 0.4 while attacking at 0.6 (ablation) | DUBA · Cifar10 | ASR (%): 87.92 -> 99.98 | Helped |
| Increase attack embedding ratios from 0.6 to 0.8 with training at 0.4 (ablation) | DUBA · Cifar10 | ASR (%): 99.98 -> 99.99 | Helped |
| Increase training embedding ratios from 0.4 to 0.6 with attack ratios fixed at 0.6 (ablation) | DUBA · Cifar10 | ASR (%): 99.98 -> 99.22 | Hurt |
| Increase DCT smoothing parameter λ (ablation) | DUBA · Cifar10 | ASR (%): 20 -> 52.36 -> 70.11 -> 95.42 -> 99.98 -> 99.98 | Helped |
| Replace the dog's-ear initial trigger with another tested image (ablation) | DUBA · Cifar10 | ASR (%): 99.98; 99.23; 99.57; 99.62 | No clear effect |
| Remove FFT and DCT smoothing, using DWT only (ablation) | DUBA · Cifar10 | frequency-domain stealthiness | Hurt |
| Remove DCT smoothing, using DWT and FFT only (ablation) | DUBA · Cifar10 | spatial-domain stealthiness | Hurt |
| Remove DCT smoothing, using DWT and FFT only (ablation) | DUBA · Cifar10 | FTD detection probability: about 65% | Hurt |
| Add DCT smoothing after DWT and FFT smoothing (ablation) | DUBA · Cifar10 | spatial- and frequency-domain stealthiness | Helped |
Surprising findings
- On ImageNet, DUBA's ASR is slightly lower than BadNets, which the authors accept as a trade-off for stealthiness.
Limitations
- ASR drops with weaker embedding (e.g., 85.62% at alpha=beta=0.2), so stealthiness and effectiveness trade off.
- Only All-to-One attacks evaluated; ImageNet results are a subset of 100 classes and lower than BadNets in some cases.
Experimental setup
Datasets: CIFAR-10 GTSRB ImageNet FER2013
Benchmarks: CIFAR-10 GTSRB ImageNet subset FER2013
Metrics: attack success rate benign accuracy PSNR SSIM LPIPS anomaly index entropy detection rate
Baselines: BadNets Blend WaNet FIBA
Builds on: BadNets WaNet FIBA FTD
Closest papers by meaning
- WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks (NeurIPS 2024 · similarity 0.90)
- Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.89)
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.87)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.87)
- UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models (CVPR 2025 · similarity 0.87)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.