Research map / Adversarial robustness and security / Backdoor and poisoning
WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes WaveAttack, a frequency-domain backdoor attack that embeds a generator-produced residual into the Haar DWT high-frequency (HH) band, using asymmetric residual coefficients (alpha=1 in training, 100 at inference) to keep poisoned samples high-fidelity and latent-space indistinguishable.
Problem
Existing backdoor attacks have low fidelity of poisoned samples and detectable latent-space separation between poisoned and benign samples, making them vulnerable to backdoor detection.
Approach
Generate triggers as small U-Net residuals added only to the Haar wavelet HH sub-band (where humans are insensitive), and use an asymmetric coefficient so that training-time triggers are weak (stealthy in latent space via regularization samples) while inference-time triggers are strong (high ASR).
Key results
- WaveAttack reaches 100% ASR on CIFAR-10 and GTSRB and 99.16% on CIFAR-100, with BA 94.55% on CIFAR-10 (no attack 94.59%).
- On CIFAR-10 stealthiness, WaveAttack achieves PSNR 47.49, SSIM 0.9979, IS 0.011, outperforming FTrojan (44.07 PSNR).
- Against defenses, WaveAttack evades GradCAM, STRIP, Fine-Pruning, Neural Cleanse (anomaly index below 2) and Spectral Signature per the authors' experiments.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use WaveAttack instead of FTrojan | Backdoor attack on CIFAR-10 · CIFAR-10 | PSNR: 44.07 -> 47.49 | Helped |
| Use WaveAttack instead of FTrojan | Backdoor attack on CIFAR-100 · CIFAR-100 | SSIM: 0.9972 -> 0.9992 | Helped |
| Use WaveAttack instead of FTrojan | Backdoor attack on GTSRB · GTSRB | SSIM: 0.9813 -> 0.9877 | Hurt |
| Use WaveAttack instead of FTrojan | Backdoor attack on ImageNet subset · ImageNet subset | PSNR: 35.55 -> 45.60 | Helped |
| Use WaveAttack instead of FTrojan | Backdoor attack on CIFAR-10 · CIFAR-10 | ASR: 100 -> 100 | No clear effect |
| Use WaveAttack instead of BadNets | Backdoor attack on CIFAR-100 · CIFAR-100 | ASR: 100 -> 99.16 | Hurt |
| Use WaveAttack instead of BadNets | Backdoor attack on GTSRB · GTSRB | ASR: 100 -> 100 | No clear effect |
| Use asymmetric frequency obfuscation, with a larger inference-stage coefficient | WaveAttack · Backdoor attack | ASR | Helped |
Surprising findings
- Adapt-Blend achieves only 71.57% ASR on CIFAR-10 and 60.25% on GTSRB, far below its reported effectiveness, under the paper's settings.
Limitations
- Requires training a generator, adding computational and runtime overhead.
- Under a training-dataset-only threat model (pre-trained generator modifying benign samples), effectiveness is limited.
- Evaluated only on image classification with small-scale CIFAR/GTSRB/ImageNet-subset benchmarks and ResNet-family/VGG models.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 GTSRB ImageNet subset (20 classes)
Benchmarks: CIFAR-10 CIFAR-100 GTSRB ImageNet subset
Metrics: ASR BA PSNR SSIM IS t-SNE latent separation
Baselines: BadNets Blend IAD WaNet BppAttack Adapt-Blend FTrojan
Builds on: Adapt-Blend FTrojan WaNet
Closest papers by meaning
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.90)
- Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.85)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.85)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.84)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.84)
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.