WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks
Authors: Jun Xia
Zhihao Yue
Yingbo Zhou
Zhiwei Ling
Yiyu Shi
Xian Wei
Mingsong Chen
Venue: NeurIPS 2024 poster (2024)
Keywords: backdoor attack;
Primary area: safety_in_machine_learning

Abstract: Due to the increasing popularity of Artificial Intelligence (AI), more and more backdoor attacks are designed to mislead Deep Neural Network (DNN) predictions by manipulating training samples or processes.  Although backdoor attacks have been investigated in various scenarios, they still suffer from the problems of both low fidelity of poisoned samples and non-negligible transfer in latent space, which make them easily identified by existing backdoor detection algorithms. To overcome this weakness,  this paper proposes a novel frequency-based backdoor attack method named WaveAttack, which obtains high-frequency image features through Discrete Wavelet Transform (DWT) to generate highly stealthy backdoor triggers. By introducing an asymmetric frequency obfuscation method, our approach adds an adaptive residual to the training and inference stages to improve the impact of triggers, thus further enhancing the effectiveness of WaveAttack. Comprehensive experimental results show that, WaveAttack can not only achieve higher effectiveness than state-of-the-art backdoor attack methods, but also outperform them in the fidelity of images (i.e.,  by up to 28.27\% improvement in PSNR, 1.61\% improvement in SSIM, and 70.59\% reduction in IS).  Our code is available at https://github.com/BililiCode/WaveAttack.

WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks
Jun Xial.t, Zhihao Yuel.t, Yingbo Zhou', Zhiwei Ling', Yiyu Shi?, Xian Wei', Mingsong Chen
1 Moo Eng. Research Center of SW/HW Co-design Tech. and App., East China Normal University Department of Computer Science and Engineering. University of Notre Dame {jxia, 51215902034, 52215902009, 51215902044) www..cnu..du.... yshi4 @ @d.eedu {xwei, mschen) @ sei.ecnu.edu.co
Abstract
Due to the increasing popularity of Artificial Intelligence (AI), more and more backdoor attacks are designed to mislead Deep Neural Network (DNN) predic- tions by manipulating training samples or processes. Although backdoor attacks have been investigated in various scenarios, they still suffer from the problems of both low fidelity of poisoned samples and non-negligible transfer in latent space, which make them easily identified by existing backdoor detection algorithms. To overcome this weakness, this paper proposes novel frequency-based backdoor attack method named WaveAttack, which obtains high-frequency image features through Discrete Wavelet Transform (DWT) to generate highly stealthy backdoor triggers. By introducing an asymmetric frequency obfuscation method, our ap- proach adds an adaptive residual to the training and inference stages to improve the impact triggers, thus further enhancing the effectiveness of WaveAttack. Comprehensive experimental results show that, WaveAttack higher effectiveness than state-of-the-ant backdoor attack methods, but also out- perform them in the fidelity of images (i.e., by up to 28.27% improvement in PSNR, 1.61% improvement in SSIM, and 70.59% reduction IS). Our code is available http:///gttbbbboomB/Biililoeeott
not only achieve
Introduction
Along with the prosperity of Artificial Intelligence (AI), Deep Neural Networks (DNNs) have be- come increasingly prevalent in numerous safety-critical domains for precise perception and real-time control, such autonomous vehicles [1], medical diagnosis, and industrial automation [2]. How- ever, the trustworthiness of DNNs faces significant threats due to various notorious adversarial and backdoor attacks. Typically, adversarial attacks [3, 4] manipulate input data during the inference stage to induce incorrect predictions by a trained DNN, while backdoor attacks [5] tamper with training samples or processes to embed concealed triggers during training, which can be exploited to generate malicious outputs. Although adversarial attacks on DNNs frequently appear in various scenarios, backdoor attacks have attracted more attention because of their stealthiness and effec- tiveness. Generally, the performance of backdoor attacks can be evaluated by the following three objectives of an adversary: efficacy that refers the effectiveness of an attack in causing the target model to produce incorrect outputs or exhibit unintended behavior: ii) specificity that denotes the precision of the attack in targeting a specific class; and iii) fidelity that represents the degree to which adversarial examples poisoned training samples are indistinguishable from their benign counterparts [6]. Note that efficacy and specificity represent the effectiveness of backdoor attacks, while fidelity denotes the stealthiness of backdoor attacks.
Mingsong Chen is the corresponding author. Equal contribution.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

In order to achieve higher stealthiness and effectiveness, existing backdoor attack methods (e.g. LAD [7], WaNet [8], BppAttack [9], and FTrojan [10]) are built based on various optimizations, which can be mainly classified into two categories. The former is the sample minimal impact method that can optimize the size of the trigger and minimize its pixel value, making the backdoor trigger dif- ficult to detect in training samples for the purpose of achieving the high stealthiness of backdoor attacker. Although these methods are promising in backdoor attacks, due to the explicit trigger in- fluence on training samples, they cannot fully evade existing backdoor detection methods based on training samples. The latter is the latent space obfuscation- basseddd- methods, which can be integrated into any existing backdoor attack methods. Using asymmetric samples. these methods can obfuscate the latent space between benign samples and poisoned samples [11]. Although these methods can bypass latent space detection techniques, they suffer greatly from low image quality, making them extremely difficult to apply in practice. Therefore, how to improve both the effectiveness and stealth- iness of backdoor attacks while minimally impacting the quality of training samples is becoming significant challenge in the development of backdoor attacks.
According to the work in [12], wavelet transform techniques have been widely investigated in var- ious smage-processing tasks [13, 14, 15], where high-frequency features can be utilized to enhance the generalization ability of DNNs and remain imperceptible to humans. Inspired by this finding, this paper introduces a novel backdoor attack method named WaveAttack, which adopts Discrete Wavelet Transform (DWT) to extract high- frehffreuency components for highly stealthy backdoor trig- ger generation. To improve the impact of triggers and further enhance the effectiveness of our approach, we employ asymmetric frequency obfuscation that utilizes asymmetric coefficient of the trigger in the high-frequency domain during the training and inference stages. This paper makes the following three contributions:
We introduce promising frequency-baan based backdoor trigger generation method, which can effectively generate the backdoor residuals for the high-frequency component based on DWT, thus ensuring the high fidelity of poisoned samples.
We propose a novel asymmetric frequency-biee bequudncy-based obfuscation backdoor attack method to enhance the stealthiness and effectiveness of WaveAttack, which can increase stealthiness in latent spaces and improve the Attack Success Rate in training samples.
We conduct comprehensive experiments on four public benchmarks to demonstrate that WaveAttack outperforms state-of-the-e (SOTA) backdoor attack methods from the per- spectives of both stealthiness and effectiveness.
2 Related Work
Backdoor Attack. Typically, backdoor attacks try to embed backdoors into DNNs by manipulat- ing their input samples and training processes. In this way, adversaries can control DNN output through concealed triggers, which results in manipulated predictions [16]. Depending on whether the training process is manipulated, existing backdoor attacks can be categorized into two types, i.c., attacks. Specifically, tacks only inject visible or invisible trigger into the training samples of some DNN, leading to its recognition errors [5]. For example, Chen et al. [17] introduced Blend attack that generates poi- soned data by merging benign training samples with specific key visible triggers. Moreover, there exists large number of invisible trigger-based backdoor attack methods, such natural reflec- tion [18], human imperceptible noise [19], and image perturbation [10], which exploit the changes induced by real-world physical environments. Although these maining-unmanipulate attacks are promising, due to their substantial impacts on training sample quality, most of them still can be casily identified somehow. As an alternative, versaries from some malicious third party can control the key steps of the training process, thus achieving stealthier attack. Although the above two categories of backdoor attacks are promising, most of them struggle with coarse- -ranined optimization of effectiveness and stealthiness, compli- cating the acquisition of superior backdoor triggers. Due the significant difference in latent space and low poisoned sample fidelity, they cannot evade the latest backdoor detection methods.
uumanipulated and graining-manipuae
boining-unmaniullate
at-
maaning-manppulateed attacks [8, 9] assume that ad-
Backdoor Defense. There are two major types of backdoor defense methods, i.e., the detection- based defense and erasure-based defense. The detection-based defenses can be further classified into two categories, i.e., sample-base based and latent space-based detection methods. Specifically, sample-
2

---

based detection methods can identify the differences in the distribution between poisoned samples and benign samples [20], while latent space-based detection methods aim to find the disparity be- tween the latent spaces of poisoned samples and benign samples [21]. Unlike the detection strategies described above that aim to prevent the injection of backdoors into DNNs by identifying poisoned samples during the training stages, erasure-based based defenses can eradicate the backdoors from DNNs. So far, the erasure-bast based defenses can be classified into three categories, i.c., poison suppression- based, model reconstruction-bant based, and trigger generation-baset defenses. The poison suppression- based methods [22] utilize the differential learning speed between poisoned and benign samples during training to mitigate the influence of backdoor triggers DNNs. The model reconstruction- based methods [23, 24] use a selected set of benign data to rebuild DNN models, aiming to mitigate the impact of backdoor triggers. The trigger generation- methods [25, 26] reverse engineer backdoor triggers by capitalizing on the effects of backdoor attacks on training samples.
To the best of our knowledge, WaveAttack is the first attempt to generate backdoor triggers for the high-frequency component obtained through DWT. Unlike existing backdoor attack methods, WaveAttack first considers both the fidelity of poisoned samples and latent space obfuscation simul- taneously. By using asymmetric frequency obfuscation, WaveAttack can not only acquire backdoor attack effectiveness but also achieve high stealthiness regarding both image quality and latent space.
3 Our Method
In this section, we first present the preliminaries for the problem notations, threat model, and ad- versarial goal. Then, we visualize our motivations for adding triggers to the figh-frequency compo- nents. Finally, we celebrate the attack process of our method, WateAttack.
3.1 Preliminaries
Notations. We follow the training scheme of Adapt-Blend [11]. Let D = {(x,, v:)) be a clean
training dataset, where E X = {0, 1..., 2x5) xH is an image, and y: E Y = {1, 2, .... K} is its corresponding label. Note that K represents the number of labels. For a given training dataset, we select subset of D with poisoning rate Pa the payload samples De {<x',, is V1 | T(x;). æy E X}. where T(-) is a backdoor transformation function, and yr is an adversary target label. We use a subset of D with poisoning rate P, the regularization samples D, {(x',, (:)) ) = T( x; E X}. For a given dataset, a backdoor attack adversary tries to train a backdoored model f that predicts
its corresponding label, where D U D. D
Threat Model. Similar to existing backdoor attack methods [7, 8, 9]. we assume that adversaries have complete control over the training datasets, and model implementation. They can embed back- doors into the DNNs by poisoning the given training dataset. Moreover, in the inference stage, we assume that adversaries can only query backdoored models using any samples.
Adversarial Goal. Throughout the attack process, adversaries strive to achieve two core goals, i... effectiveness and stealthiness. Effectiveness indicates that adversaries try to train backdoored models with a high ASR while ensuring that the decrease in Benign Accuracy (BA) remains im- perceptible. Stealthiness indicates that samples with triggers have high fidelity and that there is no latent separation between poisoned and clean samples in the latent space.
3.2 Motivation
Unlike humans who are not sensitive to high-frequency features, DNNs can effectively learn high- frequency features of images [12], which can be used for the generation of backdoor triggers. In other words, the poisoned samples generated by high-frequency features can easily escape various examination methods by humans. Based on this observation, if we can design backdoor triggers on top of ensured. To obtain high-frequency components from the training samples, we resort to Discrete Wavelet Transform (DWT) to capture characteristics from both the time and frequency domains [27], allowing the extraction of multiple frequency components from the training samples. The reason why we adopt DWT rather than Discrete Cosine Transform (DCT) is that DWT can better capture high-frequene features from training samples (i.e., edges and textures) and allows superior reverse operations during both encoding and decoding phases, thus minimizing the impact on the
features, the stealthiness of corresponding backdoored attacks can be
3

---

(a) Original
(b) LL with noises (c) LH with noises (d) HL with noises (e) HH with noises
Figure I: A motivating example for the backdoor trigger design on high-frequency components.
fidelity of poisoned samples. In our approach, we adopt classic and effective biorthogonal wavelet transform method (i.e., Haar wavelet [28]). which mainly contains four kernel operations, i.e., LL", LH HT, and H H Here I, and H denote the low and high pass filters, respectively, where 1," = J [1 1), HT v2 1-1 1). Note that, based on the four operations, the Haar wavelet can /2
decompose an image into four frequency components (i.e., LL, LH, H L. H)) using DWT, where HH only contains the high-frequency information of sample. Meanwhile, the Haar wavelet can reconstruct the image from the four frequency components via the Inverse Discrete Wavelet Trans- form (IDWT). To verify the motivation of our approach, Figure 1 illustrates the impact of adding the same noises to different frequency components on an image, i.c., Figure I(a). We can find that, compared the other three poisoned images, i.c., Figure 1(b) to (dd), it is much more difficult to determine the difference between the original image and the poisoned counterpart in HH, i.c., Figure ((e). Therefore, is more suitable to inject triggers into the gee-ferey component (i.e., HH) for backdoor attack purposes.
3.3 Implementation of WaveAttack
In this subsection, detail the design of our WaveAttack approach. As shown in Figure 2, give an overview of our attack method AtteAttack. To be concrete, we first make samples poisoned into payload and regularization samples using our trigger design, which is implemented with frequency transformation. Then, we use benign samples, payload samples, and regularization samples to train a classifier to achieve the core goals of WaveAttack.
Trigger Design. As mentioned above, our WaveAttack approach aims to achieve a stealthier backdoor attack, introducing triggers into the HH frequency component. Figure 2 contains the process of generating triggers using WtveAttack. First, we obtain the four components of the samples through DWT. Then, to gen- erate imperceptible sample-specific triggers, we employ an encoder- decoder network as generator g-
Reciiaal
Suppii
DWT
Pupked
IDWT
Regetortation
D:NT: Discrvia Wavslet Transform
IDN'T: Invere BWT
Excoder
Decoder C. Closififee
These generated triggers are imper- ceptible additive residuals. Next, to achieve asymmetric frequency obfuscation, we multiply the residuals by coefficient a, and generate the poisoned H'' component with the triggers as follows:
Figure 2: Overview of our attack method WaveAttack.
HH' -H + a g H;H::
(1)
where W, is the generator parameters. Finally, we can utilize IDWT to reconstruct four frequency components of poisoned samples. Specifically, we use a U-Net-like [29] generator to obtain residu- als, although other methods (e.g.. VAE [30]) can also be used by the adversary. This is because the skip connections of U-Net can effectively preserve the features of inputs with minimal impacts [29].
Optimization Objective. Our WaveAttack method has two networks to optimize. We aim to opti- mize generator g to generate small residuals with minimal impact on the samples. Furthermore, our objective is to optimize backdoored classifier e, enabling the effectiveness and stealthiness of WaveAttack. For the first optimization objective, we use the Leo norm to optimize small residuals. The optimization objective is defined as follows:
C, =
(2)

---

For the second optimization objective, we train the classifier using the cross cross-entropy loss function in D, Da. and D, dataset. The optimization objective is defined as follows:
L. = gz ): + [(xr, y: we) + [( y: WeW.),
(3)
where (()) is the cross-entropy loss function, w is the classifier parameters, 2b E D, Up E Da. and 2, E D,. The total loss function as follows:
Stotal - Cr-
Algorithm Description. Algorithm 1 details the training process of our WaveAttack ap- proach. At the beginning of WaveAttack train- ing (Line 2), the adversary randomly selects a minibatch data (x.y) v) from DD which has training samples. Lines 4-6 calculate the num- ber of poisoned samples, payload samples, and regulation samples, respectively. Lines 7-11 denote the process of modifying samples by in- jecting triggers into the high-frequence compo- nent. After acquiring the modified samples in Line 7, Line 8 decomposes the samples into four frequency components (i.e., LL. LH, HL and H by DWT. Then, in Lines 9-10, we add the residual to the frequency component H H by Equation (1) and obtain the frequency com- ponent HH' Line 11 reconstructs the samples from the four frequency components via IDWT. Lines 12-15 compute the optimization object
Algorithm Training of WaveAttack
Require: i) D, benign training dataset. ii) wgs ran- domly initialized generator parameters. iii) was randomly initialized classifier parameters. iv) Pa. payload sample rate. v) pr. rate of regularization samples. vii) yr, target label. vi) E, epochs in training process,
Ensure: i) Wg. tell-trained generator model. ii) wa. well-trained classifier model.
I: for (ar, y) in do
for 1, 1,.... do
3:
b - 2.shape[O]
4:
+- (Pa + pr) x xb
5:
na po x
n, + pr x
7:
æm + =[[:ml]
8:
(LL, LH, HL, HH) + DWT(am)
9:
resdiual <- ((H
10:
HH' -H resdiual
using Equations (2) to (4). In Lines 16-17, we an optimizer (e.g., SGD optimizer) to update the parameters of the generator model
11:
Em t- IDWT LH, HL, HH))
12:
L1 + [(
13:
L2 + Slam.li...llnnennnn
and classifier model. Line 20 returns the well-
14:
La C(xlnmmil.31 [mmme
trained generator model parameters g and the classifier model parameters wa.
15:
L L1 L2 La + |resdiual]|
16:
C.backward0) 17: updato(w,, w2)
Asymmetric Frequency Obfuscation. Ac-
18:
end for
cording to [11], regularization samples D, can make DNNs learn the semantic feature of each class and the trigger feature, which can make the backdoor attack stealthy in the latent space. However, using the same trigger in samples during the inference process may diminish the fidelity of poisoned samples. Hence, it crucial to devise an asymmetric frequency obfuscation method to enhance the effectiveness of backdoor attack methods. In our approach, employ coefficient with small value (i.c.. a=1.0) to improve the stealth- iness of triggers during the training process, while a larger value (i.e., a=100.0) is used to enhance the impact of triggers and further improve the effectiveness of WateAttack. This method ensures that, during the inference process, the backdoored samples have sufficient "power" to activate the DNN backdoor, thus achieving a high ASR.
19:
end for
20:
Return We
4 Experiments
To demonstrate the effectiveness and stealthiness of our approach, we implemented WaveAttack using Pytorch and compared its performance with seven existing backdoor attack methods. We conducted all experiments on workstation with a 3.6GHz Intel i9 CPU, 32GB of memory, an NVIDIA GeForce RTX3090 GPU, and Ubuntu operating system. We designed comprehensive experiments to address the following three research questions:
RQ1 (Effectiveness of WaveAttack): Can WaveAttack successfully inject backdoors into DNNs?
RQ2 (Stealthiness of WaveAttack): How stealthy are the poisoned samples generated by WaveAt- tack compared to those generated by SOTA backdoor attack methods?
RQ3 (Resistance to Existing Defenses): Can WaveAttack resist existing defense methods?
5

---

4.1 Experimental Settings
Datasets and DNNs. We evaluated all the attack methods on four well-known benchmark datasets, i.., CIFAR-10 [31], CIFAR-100 [31], GTSRB [32] and a subset of ImageNet (with the first 20 categories) [33]. The statistics of the datasets adopted in the experiments are presented in Table (see Appendix 7.1). We used ResNer18 18 [34] as the base DNN for the effectiveness and stealthiness evaluation. addition, we used VGG16 [35], SENet18 [36], ResNeXt29 [37], and 2enseNet1 [38] to evaluate the generalizability of WaveAttack.
Attack Configurations. To compare the performance of WaveAttack with SOTA attack methods, we considered nine SOTA backdoor attacks, i.e.. BadNets [5], Blend [17], IAD [7], WaNet [8], BppAttack [9], Adapt-Blend [11], FTrojan [10], LIRA [39], and Fiba [40]. Note that, similar to our work, Adapt-Blene BBenn has asymmetric triggers, and FTrojan and Fiba are also frequency domain-based attack methods. We performed the attack methods using the default hyperparameters described in their original papers. Specifically, the poisoning rate is set to 10% with a target label of O to ensure a fair comparison. See the Appendix for more details on both data and attack settings.
Evaluation Metrics. Similar to the existing work in [10], we evaluated the effectiveness of all attack methods using two metrics, i.e., Attack Success Rate (ASR) and Benign Accuracy (BA). To evaluate the stealthiness of all attack methods, we used three metrics, i.e., Peak Signal-to-Noise Ratio (PSNR) [41], Structure Similarity Index Measure (SSIM) [42], and Inception Score (IS) [43].
4.2 Effectiveness Evaluation (RQ1)
Effectiveness Comparison with SOTA Attack Methods. To evaluate the effectiveness of AtveAt- tack, we compared the ASR and BA of WaveAttack with nine SOTA attack methods. Since IAD [7] cannot attack the ImageNet dataset based on its open-source code, we do not provide its comparison result. Table 1 shows the attack performance of different attack methods. From this table, we can find that WaveAttack can acquire high ASR without obviously degrading the BA. Especially for the datasets CIFAR-10 10 and GTSRB, our WaveAttack achieves the best ASR and BA compared to other SOTA attack methods. Compared to frequency domain- based attack methods (i.e., FTrojan and Fiba), WaveAttack outperforms FTrojan and Fiba in BA for CIFAR- 10, CIFAR- 100, GTSRB, and ImageNet datasets. Moreover, compared to the asymmetric- caaseetrcc-bseed method Adapt-Blend, WaveAt- tack can also obtain superior performance in terms of ASR and BA for all datasets.
Table 1:
Attack performance comparison between WataAtttak and seven SOTA attack methods. The hest and the second-best results are highlighted and underlined, respectively.
CIFAR-10
CIFAR-100
GTSRB
ImageNet
Method
BA f
ASR
BA f
ASR
BA
ASR
BA
ASR A
attack
94.59
75.55
99.00
87.00
BadNets [5]
94.36
100
74.90
100
98.97
100
85,80
100
Blend [17]
94.51
99.91
70.
99.84
98.26
100
86.40
100
IAD [7]
94.32
99.12
75.14
99.28
99.26
98.37
WaNet [8]
94.23
99.57
73.18
98.52
99.21
99.58
86.60
89.20
BppAttack [9]
94.10
100
74.68
100
98.93
99.91
85,90
99.50
Adapt-Blend [1]]
94.31
71.57
74.53
81.66
98.76
60,25
86.40
90.10
FTrojan [10]
94.29
100
75.37
100
98.83
100
85.10
100
LIRA [39]
93.57
99.96
73.09
99.98
10.74
99.03
Fiba [40]
93.80
75.40
74.87
80.36
99.12
85.18
WaveAttack (Ours)
94.55
100
75.41
100
99.30
100
86.60
100
Effectiveness on Different Networks. To evaluate the effectiveness of WaveAttack on various networks, we conducted experiments on CIFAR-10 using different networks (i.e.,
Table 2: Attack performance on different DNNs.
No Attack
WaveAttack
Network
BA
BA
ASR t
VGG16 [35], 1 [36], ResNeXt29 [37], and 1enseNet121 [38]). Table 2 shows the at- tack performance WaveAttack on these net- works. From this table, we can find that our WaveAttack approach can successfully embed the backdoor into different networks. WaveAttack can not only cause malicious impacts of backdoor
VGG16 [35]
93.62
93.70
99.76
SENet18 18 [36]
94.51
94.63
100
ResNeXt29 [37]
94.79
95.08
100
1enseNet121 [38]
95.29
95.10
99.78

---

attacks, but also maintain a classification performance with high BA, demonstrating the generaliz- ability of WaveAttack on different network architectures.
Effectiveness of WaveAttack with
Table 3: Attack performance with different DWTs.
Different Discrete Wavelet Trans- forms. Due to simplicity and com- putational efficiency, we adopted the most common Haar wavelet in our wavelet transformation proce- dure. Since different wavelets are ap- plicable Discrete Wavelet Trans- form (DWT) in our method, we con-
Wavelet
Dataset
IS 4
PSNR
SSIM 1
BA 1
ASR 1
CIFAR-10
0.011
47.49
0.9979
94.55
100
Haar
CIFAR-100
0.005
50.12
0.9992
75.41
100
GTSRB
0.058
40.67
0.9877
99.30
CIFAR-10
0.007
47.53
0.9989
94.77
95.60
DB
CIFAR-100
0.005
50.32
0,9994
76.64
80,43
GTSRB
0.022
41.95
0.9881
98.21
99.50
ducted experiments to incorporate the Daubechies (DB) wavelet, which has stronger orthogonality. Table 3 summarizes the experimental results of WaveAttack with different wavelets. From the table, we can find that the influence of dif- ferent wavelets the performance of our method is limited, indicating that WaveAttack maintains its effectiveness and stealthiness among different wavelet transformations.
4.3 Stealthiness Evaluation (RQ2)
To evaluate the stealthiness of WaveAttack, we compared the images with the triggers generated by WaveAttack with the ones of SOTA attack methods. addition, we used t-SNE [44] to visualize latent spaces for poisoned samples and benign samples from the target label.
Stealthiness Results from The Perspective of Images. To show the stealthiness of triggers gen- erated by WaveAttack, Figure compares WaveAttack and SOTA attack methods using poisoned samples and their magnified residuals ( (x5) counterparts. From this figure, we can see that the resid- ual generated by WaveAttack is the smallest and only leaves few subtle artifacts. The trigger injected by WaveAttack is almost invisible humans.
BadNets
Blend
WaNet
BppAttack
Adapt-Blend FTrojan
WaveAttack
Residual Input
Figure 3: Comparison of examples generated by seven backdoor attacks, For each attack, we show the poisoned sample (top) and the magnified (x-5) residual (bottom).
We used three metrics (i.e., PSNR, SSIM, and IS) to evaluate the stealthiness of triggers generated by our WaveAttack. Table shows the results of the stealthiness comparison between WaveAttack and nine SOTA attack methods. From this table, we can see that WaveAtttck achieves the best stealth- iness in the CIFAR-10 and ImageNet datasets. Note that although our WaveAttack only achieves the third-best SSIM score the GTSRB dataset, it outperforms BadNets by up to 60.56% in PSNR and 67.5% IS. Similarly, although our WaveAttack achieves the second-best SSIM score on CIFAR- 100 dataset, it is much better than LIRA in PSNR and IS.
(a) BadNets
(b) Blend
(c) WaNet
(d) Adapt-Blend
(e) FTrojan
(f) WaveAttack
Figure 4: The t-SNE of feature vectors in the latent space under different attacks on CIFAR-I0. We use red and blue points to denote poisoned and benign samples, respectively, where each point in the plots corresponds to a training sample from the target label.
7

---

Stealthiness Results from The Perspective of Latent Space. There are so many backdoor defense methods [45, 21] based on the assumption that there is a latent separation between poisoned and benign samples in latent space. Therefore, ensuring the stealthiness of the attack method from the perspective of latent space becomes necessary. We obtained feature vectors of the test result from the feature extractor (the DNN without the last classifier layer) and used t-SNE [44] for visualiza- tion. Figure 4 visualizes the distributions of feature representations of the poisoned samples and the benign samples from the target label under the six attacks. From Figure 4(a) to 4(c) and 4(e), we can observe that there are two distinct clusters, which can be used to detect poisoned samples or back- door models [1]]. However, shown in 4(d) and 4(f), can find that the feature representations of poisoned samples are intermingled with those of benign samples for Adapt-Blan siapt-Blend and WaveAttack, i.c., there is only one cluster. Adapt-Blend and WaveAttack can achieve the best stealthiness from the perspective of latent space and break the latent separation assumption to evade backdoor defenses. Although Adapt-Blend exhibits degree of stealthiness, Table 4 reveals that WaveAttack surpasses Adapt-Bleme in image quality, suggesting that WaveAttack can achieve superior stealthiness.
Table 4: Stealthiness comparison with existing attacks. Larger PSNR, SSIM, and smaller IS indicate better performance. The best and the second- brestd-bestto results are highlighted and underlined, respectively.
Attack Method
CIFAR-10
CIFAR-100
GISRB
ImageNet
PSNR 1
SSIM
18
PSNR 1
SSIM 1
18 $
PSNK
SSIM f
18
PSNR 1
SSIM 1
1S J
No Attack
1.0000
0.000
INF
1,0000
0.000
1.0000
INF
1,0000
0.000
BadNets [S]
25.77
0.9942
0.136
25.48
0.9943
0.137
25.33
0.9935
0.180
21.88
0.9678
0.025
Blend [17]
20.40
0.8181
1.823
20.37
0.8031
1.600
18.58
0.6840
2.118
13.72
0.1871
2.252
IAD [7]
24.35
0.9180
0.472
23.98
0.9138
0.490
23.84
0.9404
0.309
WaNee [8]
30.91
0,9724
0.326
31.62
0.9762
0.237
33.26
0,9659
0.170
35.18
0.9756
0.029
BppAttack [9]
27.79
0.9285
0.895
27.93
0.9207
0.779
27.79
0.8462
0.714
27.34
0.8009
0.273
ABled-Blead [11]
25.97
0,9231
0.519
26.00
0,9133
0.495
24.14
0.8103
1.136
18.96
0.6065
1.150
FTrojan [10]
44.07
0.9976
0.019
44.09
0.9972
0.017
40.23
0.9813
0.065
15:55
0.9440
0.013
LIRA [39]
46.27
0.9979
0.019
47.77
0.9995
0.018
40.44
0.9K79
0.089
Fiba [40]
26.08
0.9734
0.061
26.24
0.9688
0.055
23.41
0.9130
0.079
WaveAttack (Ours)
47,49
0,9979
0.911
50.12
0.9992
0.005
40.67
0,9877
0
45,60
0,9913
0,007
4.4 Resistance to Existing Defenses (RQ3)
To evaluate the robustness of WaveAttack against existing backdoor defenses, we implemented rep- resentative backdoor defenses (i.e., GradCAM [46], STRIP [47], Fine- [23], ANP [48] and Neural Cleanse [25]) and evaluated the resistance to them. We also show the robustness of WaveAt- tack against Spectral Signature [45] and other frequency detection methods [49] in the appendix.
7800
Clean
Cleus
Palson
Polson
Pelsso
Number of Ergouts
Nomber of Enguus
topants
2008
120
1000
50%
300
Normatteed Entrapy
Normallto Rozd Earrapy
25
Normalted Entrapy
(a) CIFAR-10
(b) CIFAR-100
(c) GTSRB
Figure 5: STRIP normalized entropy of WaveAttack.
Resistance to STRIP. STRIP [47] is a representative sample-based defense method. When entering potentially poisoned sample into model, STRIP will perturb it through random set of clean samples and monitor the entropy of the prediction output. If the entropy of an input sample is low, STRIP will consider it poisoned. Figure 5 shows the entropies of benign and poisoned samples. From this figure, we can see that the entropies of the poisoned samples are larger than those of the benign samples, and STRIP fails detect the poisoned samples generated by WaveAttack.
Resistance to GradCAM. As an effective visualization mechanism, GradCAM [46] has been used to visualize intermediate feature maps of DNN, interpreting the predictions of DNN.
8

---

Existing defense methods [50, 51] exploit GradCAM to analyze the heatmap of imput samples. Specifically, a clean model correctly predicts the class label, whereas backdoored model predicts the target label. Based on this phenomenon, the backdoored model can induce an abnormal GradCAM heatmap compared to the clean model. the heatmaps of poisoned samples similar to those of benign sam- ple counterparts, the attack method is robust and can withstand defense methods based GradCAM. Figure shows the visualization heatmaps of clean model and backdoored model attacked by WaveAttack. Please note that here "clean" denotes clean model trained using benign training datasets. From this figure, can find that the heatmaps of these models are similar and that WaveAttack can resist defense methods based on GradCAM.
Clean
WaveAttack
Figure 6: GradCAM visualization results for hoth clean and backdoored models.
Resistance to Fine- Fine-Pruning, As representative model reconstruction defense method, Fine- Pruning (FP) [23] is based on the assumption that the backdoor can activate few dormant neurons in DNNs. Therefore, pruning these dormant neurons eliminate the backdoors in DNNs. To evaluate the resistance to FP, we gradually pruned the neurons of the last convolutional and fully connected layers. Figure 7 shows the performance comparison between WaveAttack and seven SOTA attack methods on CIFAR-10 by resisting FP. We find that along with more neurons being pruned, WaveAttack can acquire superior performance than other SOTA attack methods in terms of both ASR and BA. In other words, Fine- PruniPn cannot eliminate the backdoor generated by Attakk Note that, though the ASR and BA of WaveAttack are similar to those of Adapt-Blend at the final stage of pruning, the initial ASR (i.e., 71.57%) of Adapt-Blend Blend is much lower than that (i.e.. 100%) of WavcAttack.
Amant Soauee Bank Dh
Nuather Draned
Numbur Fller Draned
Figure ASR comparison against Fine-Pruning. Figure Attack performance comparison against ANP.
Resistance to ANP. Figure 8 compares the attack performance between WaveAttack and SOTA attack methods on the dataset CIFAR-10 against the defense method, i.c., ANP [48], where we use the threshold to denote the pruning rate of neurons. We find that as more neurons are pruned, WaveAttack consistently outperforms the other SOTA attack methods in ASR and BA.
Resistance to Neural Cleanse. As a repre- sentative defense method for trigger generation, Neural Cleanse (NC) [25] assumes that the trig- ger designed by the adversary is small. Initially, NC optimizes a trigger pattern for each class label via an optimization process. Then, NC uses the Anomaly Index (i.e., Median Abso- lute Deviation [52]) detect whether a DNN is backdoored. Similar to the work [25], we think the DNN is backdoored the anomaly index is larger than 2. To evaluate the resistance to NC, we conducted experiments to evaluate our WaveAttack approach by resisting NC. Figure 9 shows the defense results against NC. Please note that here, "clean" denotes clean models trained by using benign training datasets, and "backdoored" denotes backdoored models by WavcAttack that are from the Subsection 4.2. From this figure,
clean backdoored
Anomaly Index
1.5
0.5
CIFAR-10
CIFAR-100
GTSRE
ImageNet
Figure Defense performance against NC.

---

can see that the abnormal index of WaveAttack is smaller than 2 for all datasets, and WaveAttack can bypass NC detection.
Resistance to Different Frequency Filtering Methods. From Table 10, we find that WaveAttack outperforms FTrojan in both BA and ASR under two frequency filtering methods. This is mainly be- cause FTrojan only swaps the values of two random pixels of the samples after DCT transformation, while the quality (i.e., PSNR, SSIM, and IS) of training samples after attacks neglected.
Figure 10: Performance comparison considering different frequency filtering methods.
Dataset
CIFAR-10
CIFAR-100
Methods
FTtrojan
WaveAttack
FTtrojan
WaveAttack
Metries
ASR t
BA
ASR f
BA f
ASR 1
BA f
ASR t
Gaussian
69.41
10.07
72,94
16.72
44.65
3.28
47.61
7.92
Wiener
66.59
12.13
69.58
77.08
41.90
6.42
42.19
76.00
Resistance to Frequency Detection Methods. Table 5 compares performance between different attack methods against the same defense method, i.e., the frequency detection method [49]. From this table, we can find that method achieves lower BDR than FTrojan, BppAttack, IAD, Bad- Nets, and Blend. Note that, as studied in the experiment section, WaNet, and Adapt- Blend can be more easily detected by the latent space-based and sample-based detection methods, respectively.
Table 5: Backdoor Detection Rate (BDR) comparison against the frequency detection method.
Method
BedNets
Bleud
IAD
WaNet
BppAttack
Adapt-Blend
FTrojan
WaveAttack
BDR (%)
100
97.91
96.18
0.12
96.32
1.25
78.11
5.71
Resistance to Spectral Signature Spectral Signature [45] is representative latent space-based detection defense method. Given a set of benign and poisoned samples, Spectral Signature first collects their latent features and computes the top singular value of the covariance matrix. Then, for each sample, the correlation score is calculated between its features and the top singular value used as the outlier score. If the samples have high outlier scores, they will be evaluated as poisoned. We randomly selected 9000 benign samples and 1000 poisoned samples. Figure 11 shows the his- tograms of the correlations between latent features of the samples and the top right singular vector of the covariance matrix. From this figure, we can find that the histograms of the poisoned data are similar to those of the benign data. Therefore, Spectral Signature fails to detect the poisoned data generated by Attakk
Frlee
Felen
2
Corrilation
12
(a) CIFAR-10
(b) CIFAR-100
(c) GTSRB
Figure 11: The correlation with top right singular vector on different datasets.
5 Conclusion
Although backdoor attacks on DNNs have attracted increasing attention from adversaries, few of them simultancously consider both the fidelity of poisoned samples and latent space to enhance the stealthiness of their attack methods. To establish an effective and stealthy backdoor attack against various backdoor detection techniques, this paper proposed novel frequency- based method called WaveAttack, which employs DWT to extract high-frequency features from samples to gener- ate stealthier backdoor triggers. Furthermore, we introduced an asymmetric frequency obfuscation method to improve the impact of triggers and further enhance the effectiveness of WaveAttack. Com- prehensive experimental results show that, compared with various SOTA backdoor attack methods, WaveAttack not only can achieve higher stealthiness and effectiveness but also can minimize the impact of image quality well-known datasets.
10

---

6 Acknowledgements
This work was supported by the Natural Science Foundation of China (62272170), "Digital Silk Road" Shanghai International Joint Lab of Trustworthy Intelligent Software (22510750100), and Shanghai Trusted Industry Internet Software Collaborative Innovation Center.
References
[1] Junfeng Guo, Ang Li, Lixu Wang, and Cong Liu. Policycleanse: Backdoor detection and mit- igation for competitive reinforcement learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4699-4708, 2023.
[2] Dennis Müller, Michael März, Stephan Scheele, and Ute Schmid. An interactive explanatory AI system for industrial quality control. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), pages 15800-25866 2022.
[3] Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39-57, 2017.
[4] Tian Liu, Yunfei Song, Ming Hu, Jun Xia, Jianning Zhang, and Mingsong Chen. An ensem- ble tearning-based cooperative defensive architecture against adversarial attacks. Journal of Circuits, Systems and Computers,
2021.
[5] Tianyu Gu, Kang Liu, Brendan Dolan-Gavits and Siddharth Garg. Badnets: Evaluating back- dooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
[6] Ren Pang, Hua Shen, Xinyang Zhang, Shouling Ji, Yevgeniy Vorobeychik, Xiapu Luo, Alex X. Liu, and Ting Wang. tale of evil twins: Adversarial inputs versus poisoned models. In Proceedings of the 2020 ACM SIGSAC Conference Computer and Communications Security (CCS), pages 85-99, 2020.
[7] Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), pages 3454-3464, 2020.
[8] Tuan Anh Nguyen and Anh Tuan Tran. iamee-iipeercpptiblee warping-basee based backdoor attack. In Proceedings of the International Conference Learning Representations (ICLR), 2021.
[9] Zhenting Wang, Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan tacks against deep neural networks via image quantization and contrastive adversarial learn- ing. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15074-15084, 2022.
[10] Tong Wang. Yuan Yao, Feng Xu, Shengwei An, Hanghang Tong, and Ting Wang. An invis- ible black-box backdoor attack through frequency domain. In Proceedings of the European Conference Computer Vision (ECCV), pages 396-413, 2022.
[11] Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the assumption of latent separability for backdoor defenses. In Proceedings of the International Conference on Learning Representations (ICLR), 2023.
[12] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P. Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8681-869 2020.
[13] Qiufu Li. Linlin Shen, Sheng Guo, and Zhihui Lai. Wavelet integrated enns for noise-robust image classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7243-7252, 2020.
[14] Yingchen Yu, Fangneng Zhan, Shijian Lu, Jianxiong Pan, Feiying Ma, Xuansong Xie, and Chunyan Miao. Wavefill: A wavelet-based generation network for image inpainting. In Pro- ceedings of the IEEE International Conference on Computer Vision (ICCV), pages 14094 14103, 2021.
11

---

[15] Zhisheng Zhong, Tiancheng Shen, Yibo Yang. Zhouchen Lin, and Chao Zhang. Joint sub- bands learning with clique structures for wavelet domain super-resolution. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), pages 165-175, 2018.
[16] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, pages 1-18, 2022.
[17] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 2017.
[18] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Proceedings of the European Conference on Computer Vision (ECCV), pages 182-199, 2020.
[19] Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neural network models via invisible perturbation. In Proceedings of the Conference on Data and Application Security and Privacy (CODASPY), pages 97-108, 2020.
[20] Kien Do. Haripriya Harikumar, Hung Le, Dung Nguyen, Truyen Tran, Santu Rana, Dang Nguyen, Willy Susilo, and Svetha Venkatesh. Towards effective and robust neural trojan de- fenses via input filtering. In Proceedings of the European Conference on Computer Vision (ECCV), pages 283-300, 2022.
[21] Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In Proceedings of the International Conference on Machine Learning (ICML), pages 4129-4139, 2021.
[22] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In Mare' Aurelio Ranzato, Alina Beygelz- imer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, editors, Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), pages 14900-14912, 2021.
[23] Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against back- dooring attacks on deep neural networks. In Proceedings of the Research in Attacks, Intrusions, and Defenses (RAID), pages 273-294, 2018.
[24] Jun Xia, Ting Wang, Jiepin Ding, Xian Wei, and Chen Mingsong. Eliminating backdoor triggers for deep neural networks using attention relation graph distillation. In Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI), pages 1481-1487 2022.
[25) Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy, pages 707-723, 2019.
[26] Zhihao Yue, Jun Xia, Zhiwei Ling, Ming Hu, Ting Wang, Xian Wei, and Mingsong Chen. Model-contrastive learning for backdoor elimination. In Proceedings of ACM Multimedia, pages 0869-8880,12 2023.
[27] Mark J Shensa et al. The discrete wavelet transform: wedding the trous and mallat algorithms. IEEE Transactions on signal processing, 40(10):24642488, 1992.
[28] Ingrid Daubechies. The wavelet transform, time-frequency localization and signal analysis. IEEE Transactions on Information Theory, 3665):961-1055, 1990.
[29] Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-Net: Convolutional networks for biomedical image segmentation. Proceedings of the Medical image Computing and Cosputer-Assisted Intervention (MICAI), pages 234-241, 2015.
[30] Diederik Kingma and Max Welling. Auto-encoding variational bayes. Proceedings of the International Conference on Learning Representations (ICLR), 2014.
12

---

[31] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. In Citeseer, 2009.
[32] Johannes Stallkamp, Mare Schlipsing, Jan Salmen, and Christian lgel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 32:323-332, 2012.
[33] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 248-255, 2009.
[34] Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[35] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale im- age recognition. In Proceedings of the International Conference on Learning Representations (ICLR), 2015.
[36] Jie Hu, Li Shen, and Gang Sun. IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7132- 7141, 2018.
networks. In Proceedings of the
[37] Saining Xie, Ross B. Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated resid- ual transformations for deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Paltern Recognition (CVPR), pages 5987-5995, 2017.
[38] Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weinberger. Densely con- nected convolutional networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2261-226622 2269, 2017.
[39] Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and bust backdoor attacks. In Proceedings of IEEE International Conference on Computer Vision (ICCV), pages 11966-1197. 2021.
[40] Yu Feng, Benteng Ma. Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. Fiba: Frequency-injection based backdoor attack in medical image analysis. In Proceedings of Com- puter Vision and Pattern Recognition (CVPR), pages 20876-20885, 2022.
[41] Quan Huynh-Thu and Mohammed Ghanbari. Scope of validity of psnr in image/video quality assessment. Electronics Letters, 44(13):800-800 801, 2008
[42] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assess- ment: from error visibility to structural similarity. IEEE Transactions on Image Processing. 13(4):600-6) 612, 2004.
[43] Tim Salimans, Ian Goodfellow, Wojeiech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training GANs. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), volume 29, 2016.
[44] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-SNE. Journal of Machine Learning Research, 9(11), 2008
[45] Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), pages 801 8011-8021, 2018
[46] Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient- based localization. International Journal of Computer Vision, 128(2):336-32) 359, 2020.
[47] Yansong Gao, Chang Xu, Derui Wang, Shiping Chen, Damith Chinthana Ranasinghe, and Surya Nepal. STRIP: a defence against trojan attacks on deep neural networks. Proceedings of the Annual Computer Security Applications Conference (ACSAC), pages 113-125, 2019.
13

---

[48] Dong Huang and Qingwen Bu. Adversarial feature map pruning for backdoor, In The Twelfth International Conference on Learning Representations.
[49] Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' trig- gers: A frequency perspective. In Proceedings of the IEEE/CVE International Conference Computer Vision (ICCV), pages 16473-16481, October 2021.
[50] Edward Chou, Florian Tramèr, Giancarlo Pellegrino, and Dan Boneh. Sentinet: Detecting physical attacks against deep learning systems. arXiv preprint
2018.
[51] Bao Gia Doan, Ehsan Abbasnejad, and Damith Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In Proceedings of the Anmual Computer Security Applications Conference (ACSAC), pages 897-912, 2020.
[52] Frank Hampel. The influence eurve and its role in robust estimation. Journal of the American Statistical Association, 69(34)):383-395 1974.
14

---

7 Appendix
7.1
Implementation Details for Experiments
Settings of Datasets. Table 6 presents the setting of datasets used in our experiments.
Table 6: Datasets Settings.
Dataset
Input Size
Classes Training Images
Test Images
CIFAR-10
3x32x32
10
50000
10000
CIFAR-100
3x32x32
100
50000
10000
GTSRB
3x32x32
43
26640
12569
ImageNet subset
3x224x 224
20
26000
1000
Settings of Attacks. For fair comparison, the settings of WaveAttack are consistent with those of the other seven SOTA attack methods. We used the SGD optimizer for training a classifier with learning rate of 0.01, and the Adam optimizer for training generator with learning rate of 0.001. We decreased this learning rate by a factor 10 after every 100 epochs. We considered various data augmentations, i.e., random crop and random horizontal flipping. For BadNets, used grid trigger placed in the bottom right corner of the image. For Blend, we applied a "Hello Kitty" trigger on CIFAR-10, CIFAR-100, 100, and GTSRB datasets and used random noises the ImageNet dataset. For other attack methods, we used the default settings in their respective papers.
7.2 Broader Impacts and Limitations
Broader Impacts. In this work, we introduce effective and stealthy backdoor attack method named WaveAttack, which can stealthily compromise security-criticas systems. If used improperly, the proposed attack method may pose security risk to the existing DNN applications. Nevertheless, we hope that by emphasizing the potential harm this malicious threat model, our work will stim- ulate the development of stronger defenses and promote greater attention from experts in the field. As a result, this knowledge promotes the creation of more secure and dependable DNN models and robust defensive measures.
We would like to emphasize that our paper mainly focuses on introducing and evaluating the attack method. This paper aims to develop more powerful detection and defence mechanisms against such advanced backdoor attacks by proposing more advanced backdoor attack methods and addressing the weaknesses of state-of-the-art defence methods in future works.
Limitations. Although our work shows exciting results for backdoor attacks, requires more com- puting resources and runtime overhead than most existing backdoor attack methods due to the ne- cessity of training a generator 9 to generate residuals of the various high-frequency components. Moreover, we do not consider a threat model, in which the adversary can only control the training dataset. In this threat model, we used our pre-trained generator to modify some benign samples in the training dataset. However, this limitation also appears in [1 1]. In the future, we plan to explore more effective and stealthy backdoor attack methods under this threat model.
15

---

NeurIPS Paper Checklist
The checklist designed to encourage best practices for responsible machine learning research, ad- dressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and precede the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes]. [No] [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justificatiin right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evalu- ation. While "[Yes] " generally preferable "[No] ", perfectly acceptable answer "[No] provided a proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable find the license for the dataset general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased binary way. we acknowledge that the true answer is often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
used"). In
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The answer to this question can be found in the abstract and the experiments in this paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yss]
16

---

Justification:
The limitation can be found in the appendix of this paper.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The au- thors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the ap- proach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-tex system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to ad- dress problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification:
This answer can be found in the experimental results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theo- rems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the of the paper should be comple- mented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided not)?
Answer: [Yes]
Justification: We upload all the code to GitHub and put it in an appendix file so that the reader can reproduce the results of this paper.
Guidelines:
17

---

The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language modell, releasing of model checkpoint, other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all sub- missions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or a way to re- produce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recogmize that reproducibility may be tricky in some cases, in which case au- thors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We upload all the code to GitHub and put it in an appendix file so that the reader can reproduce the results of this paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https:/nipss.c/pubbic guides/CodeSubmissoooooffo
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (htips: //nips.cc/pp www./b/icgguuiic//ooouuubiiiiiii
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
18

---

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
This answer can be found in the experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
The answer can be found in the appendix of this paper.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK report I-sigma error bars, but should state it. The authors should prefer- ably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors verified.
For asymmetric distributions, the authors should be careful not show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The answer can be found in the appendix of this paper.
Guidelines:
The answer NA means that the paper does not include experiments.
19

---

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g.. preliminary or failed experiments that didn't tt make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http://eeerns.cccmmiiooffhhtiiie
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymitt (e.g., if there is a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[Yes]
Justification:
The answer can be found in the appendix of this paper.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact spe- cific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitiga- tion strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
20

---

Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use the model, for example by re- quiring that users adhere to usage guidelines restrictions access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [NA]
Justification: [TODO]
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets released, the license, copyright information, and terms of in the pack- age should be provided. For popular datasets, paperswithcode www.oddd.co//ttettttt.... has cu- rated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re- ee-ackaaed, both the original license and the license of the derived asset (if has changed) should provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documenta- tion provided alongside the assets?
Answer: [NA]
Justification: [TODO]
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
For crowdsoureing experiments and research with human subjects, does the pa- per include the full text instructions given participants and screenshots, applicable, well as details about compensation (if any)?
Question:
21

---

Answer: [NA]
Justification: [TODO]
Guidelines:
The answer NA means that the paper does involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contri- bution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, cura- tion, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: [TODO]
Guidelines:
The answer NA means that the paper does involve crowdsoureing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equiva- lent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
22


Reviews:
[{"review_id": "CA4h7QISuP", "reviewer": "Reviewer_vbLQ", "summary": "This paper investigated the backdoor attack, aiming at improving the fidelity of poisoned samples. A novel frequency-based backdoor attack method named WaveAttack is proposed to generate highly stealthy backdoor triggers. The experiments show that the poisoned images generated by WaveAttack can achieve high attack effectiveness and fidelity.", "questions": "The threat model is unclear.\n\nThe stealthiness of the attack should be further confirmed.\n\nMore comparable baselines should be included, such as LIRA [1].\n\n[1] LIRA: Learnable, Imperceptible and Robust Backdoor Attacks. ICCV, 2021.", "limitations": "The authors adequately discuss the potential security issues related to the proposed backdoor attack. Also, the limitations of the proposed method in terms of computing cost have been mentioned.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The proposed attack creates more high-fidelity poisoned samples through Discrete Wavelet Transform (DWT), meanwhile maintaining the attack success rate.", "weaknesses": "[Threat model] The threat model illustrated in Section 3.1 is unclear. In the implementation, WaveAttack requires that the attacker fully controls the training process. Therefore, the statement “They can embed backdoors into the DNNs by poisoning the given training dataset” is ambiguous.\n\n[Stealthiness] I recommend that the authors conduct more experiments to confirm the advantage of WaveAttack in terms of attack stealthiness. As shown in Figure 3, the difference between FTrojan and WaveAttack is negligible.\n\n[Baselines] Most baselines are poisoning-based backdoor attacks, e.g., Adapt-Blend and WaNet. It is not fair to compare WaveAttack with these poisoning-based attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer vbLQ\n\nWe sincerely appreciate the reviewer's valuable feedback and insightful comments on our paper. We have carefully considered each issue raised and provided detailed responses to all questions and concerns below.\n\n## Threat Model\nThank you for your feedback on the threat model. Similar to the configurations in LIRA [1] and Adapt-Blend, the threat model of WaveAttack indeed assumes that attackers have significant control during the training procedure. Meanwhile, to demonstrate the superiority of WaveAttack, we will include the LIRA method in our experimental results.\n\n## Stealthiness\nThank you for your insightful comments. We acknowledge that the differences between FTrojan and WaveAttack are not particularly significant in terms of human visual recognition, which requires slight magnification in residual images (Figure 3, Line 283) to observe significant differences between the two poisoned images. However, this phenomenon only occurs in sample-quality-based backdoor detection by human visual recognition.\n\nCurrently, backdoor detection algorithms are mainly divided into three categories:\n- **Sample-quality-based detection methods**: As shown in **Table 3 (Line 289)**, the differences between FTrojan and WaveAttack can be detected in terms of PSNR, SSIM, and IS. Thus, compared with our paper's state-of-the-art (SOTA) attack methods, WaveAttack achieves superior poisoned image quality.\n- **Latent space-based detection methods**: As illustrated in **Figure 4 (Line 290)**, latent-based detection methods can effectively detect FTrojan but not WaveAttack.\n- **Frequency domain-based detection methods**: These include various frequency domain filtering methods and the BDR (Backdoor Detection Rate, BDR) detection [2], as shown in **Tables 4 (Line 365)** and **6 (Line 544)**. WaveAttack has a higher ASR and BA with a lower BDR than FTrojan. This means that WaveAttack can obtain better attack effectiveness and stealthiness against frequency domain-based detection methods than FTrojan. In summary, compared to FTrojan (the SOTA frequency-domain-based backdoor attack method), WaveAttack has superior attack performance against all three detection methods in terms of effectiveness, stealthiness, and fidelity.\n\n## Baselines\n### Attack Performance and Stealthiness Comparison\n\n|                  | **CIFAR10** |                | **CIFAR100** |                | **GTSRB** |                |\n|------------------|-------------|----------------|--------------|----------------|-----------|----------------|\n|                  | **LIRA**    | **WaveAttack** | **LIRA**     | **WaveAttack** | **LIRA**  | **WaveAttack** |\n| **ISS ↓**          | 0.019       | **0.011**          | 0.018        | **0.005**          | 0.089     | **0.058**         |\n| **PSNR ↑**         | 46.77       | **47.49**         | 47.77        | **50.12**          | 40.44     | **40.67**          |\n| **SSIM ↑**         | 0.9979      | 0.9979         | 0.9995       | 0.9992         | 0.9879    | 0.9877         |\n| **BA ↑**           | 93.57       | **94.55**          | 73.09        | **75.41**          | 10.74     | **99.30**          |\n| **ASR ↑**          | 99.96       | **100**            | 99.98        | **100**           | 99.03     | **100**            |\n\n\nBased on the [BackdoorBox](https://github.com/THUYimingLi/BackdoorBox) and [LIRA](https://github.com/khoadoan106/backdoor_attacks), we have introduced the backdoor attack method named LIRA as a baseline for complete comparison. The comparison results are shown in the table above. This table shows that, compared with LIRA, WaveAttack still achieves the best attack effectiveness and fidelity of the poisoned images.\n\n## References\n\n- [1] LIRA: Learnable, Imperceptible and Robust Backdoor Attacks. Proceedings of ICCV, 2021.\n- [2] Zeng Y, Park W, Mao Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective. Proceedings of the CVPR, 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YeQla8QIvh", "reviewer": "Reviewer_h6uR", "summary": "This paper proposes a novel frequency-based backdoor attack method named WaveAttack, which can effectively generate the backdoor residuals for the high-frequency component based on DWT, thus ensuring the high fidelity of poisoned samples.", "questions": "Please See Above.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 1, "strengths": "1. The paper is well-written and well-structured.\n2. Extensive experiments are conducted to validate the attack method.\n3 The performance of the attack is surprising.", "weaknesses": "The paper is well-written and includes sufficient experiments. However, I am concerned about the limited novelty of this work, as there are already several backdoor attacks [1-4] based on the frequency domain that have been proposed. These works leverage different components/ranges in the frequency domain, and typically, [4] also uses a high-frequency trigger. While the design is different, the high-level ideas are quite similar.\n\nReferences:\n\n[1] Feng Y, Ma B, Zhang J, et al. Fiba: Frequency-injection based backdoor attack in medical image analysis[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 20876-20885.\n[2] Wang T, Yao Y, Xu F, et al. Backdoor attack through frequency domain[J]. arXiv preprint arXiv:2111.10991, 2021.\n[3] Check your other door! creating backdoor attacks in the frequency domain.\n[4] Zeng Y, Park W, Mao Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective[C]//Proceedings of the IEEE/CVF international conference on computer vision. 2021: 16473-16481.\nMinor Points:\n1.  In section 3.2, the authors mention decomposing the image into four components: LL, LH, HL, HH. Since this is a key idea of the paper, it would be beneficial to explain their meanings and possibly show some examples in the Appendix.\n\n2. In Figure 2, the authors use \"encoder\" and \"decoder,\" but in the text, they use \"generator.\" It would be better to be consistent with terminology.\n\n3. Asymmetric frequency obfuscation is an important method in this paper. It would be better to describe/introduce it and its motivation in detail earlier in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer h6uR\n\nWe are sincerely grateful for the reviewers' insightful feedback and constructive comments. We offer comprehensive responses to all inquiries and concerns below.\n\n## Detailed Descriptions of References\n\nUnlike our paper based on Discrete Wavelet Transform (DWT), reference [1] introduces a frequency domain-based attack method named Fiba for medical images, employing Discrete Fourier Transform (DFT) technology. Based on its GitHub project: [FIBA](https://github.com/HazardFY/FIBA), we reproduced this method on three image-classification datasets. The table below shows the attack and stealthiness performance comparison between WaveAttack and Fiba. From the table, we can see that compared with the Fiba method, WaveAttack achieves a higher attack success rate (ASR) and image fidelity in terms of PSNR, SSIM, and IS.\n\n|                  | **CIFAR10** |                | **CIFAR100** |                | **GTSRB** |                |\n|------------------|-------------|----------------|--------------|----------------|-----------|----------------|\n|                  | **Fiba**    | **WaveAttack** | **Fiba**     | **WaveAttack** | **Fiba**  | **WaveAttack** |\n| **IS ↓**          | 0.061       | **0.011**          | 0.055        | **0.005**          | 0.079     | **0.058**         |\n| **PSNR ↑**         | 26.08       | **47.49**         | 26.24        | **50.12**          | 23.41     | **40.67**          |\n| **SSIM ↑**         | 0.9734      | **0.9979**         | 0.9688       | **0.9992**         | 0.9130    | **0.9877**         |\n| **BA ↑**           | 93.80       | **94.55**          | 74.87        | **75.41**          | 99.12     | **99.30**          |\n| **ASR ↑**          | 75.40       | **100**            | 80.36        | **100**           | 85.18     | **100**            |\n\n[2] is a frequency domain-based attack method named Ftrojan employing Discrete Cosine Transform (DCT) technology, which is also the SOTA baseline in our paper.\n\nSince [3] is the same as reference [1] based on DFT and did not release the code, we did not choose it as the baseline for experimental results in our responses.\n\n [4] actually does not belong to a backdoor attack method, but to a backdoor detection method based on the frequency domain. This paper proposes a frequency domain-based detection metric named BDR (Backdoor Detection Rate) for backdoor attack detection. The attack performance comparison against [4] is in **Section 6.3 of our Appendix (Line 539)**. From Table 6 in our paper's appendix, we can find that under BDR detection, compared with FTrojan (BDR: 78.11%) and the frequency trigger generated method in [4] (BDR: 99.94%), WaveAttack can obtain better attack effectiveness and stealthiness (BDR: 5.71%).\n\nFurthermore, we would like to make the following statements: \nAlthough many works have contributed to the frequency-domain-based backdoor attack method, WaveAttack is the **first attempt to generate backdoor triggers for the high-frequency component obtained through DWT** and **the first method to achieve such superior attack performances against three kinds of detection methods (sample-quality-based detection methods, latent-space-based detection methods, and frequency-domain-based detection methods)**. By employing our proposed asymmetric frequency obfuscation, WaveAttack can not only acquire backdoor attack effectiveness but also achieve high stealthiness regarding image quality and latent space against backdoor attack detection methods.\n\n## Minor Revisions\n\n- **Q: Explanation of frequency components in the Appendix.**\n  - **A:** Thank you for your insightful feedback. We will add the frequency components of images in the Appendix.\n  \n- **Q: Typo errors.**\n  - **A:** Thank you for pointing these out. We will fix these errors in the next version of our paper.\n  \n- **Q: Motivation of asymmetric frequency obfuscation.**\n  - **A:** Thank you for your insightful suggestion. We will further clarify the motivation of our asymmetric frequency obfuscation in the paper.\n\n## References\n- [1] Feng Y, Ma B, Zhang J, et al. Fiba: Frequency-injection based backdoor attack in medical image analysis. CVPR, 2022.\n- [2] Wang T, Yao Y, Xu F, et al. Backdoor attack through frequency domain. ECCV, 2023.\n- [3] Check your other door! Creating backdoor attacks in the frequency domain.\n- [4] Zeng Y, Park W, Mao Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective. CVPR 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SCB2SqCl7Q", "reviewer": "Reviewer_gVJn", "summary": "This paper introduces a backdoor attack that leverages DWT to create highly stealthy backdoor triggers, named WaveAttack. The attack employs an asymmetric frequency obfuscation technique to improve the impact and effectiveness of these triggers during both training and inference stages.", "questions": "1. Can the method be adapted to other types of wavelet transforms, and how would this affect the attack's effectiveness and stealthiness?\n2. While the authors explain the rationale behind them choosing DWT over DCT, there are no experiments detailing the superiority of DWT. Can DCT/DFT or other forms of frequency-based transformations work in this proposed method? Can they be swapped-in directly?", "limitations": "See weaknesses and questions.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The work’s proposal and clear reasonings to use DWT instead of other frequency-based transformations creates backdoor triggers that are highly stealthy. The perceptibility of the triggers generated are validated across numerous image fidelity metrics.", "weaknesses": "The frequency-based transformation, DWT, is the major contribution of this paper’s proposed attack. But the paper only experiments with the “Haar” wavelet, when there are dozens of different variations available.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer gVJn\n\n## Adaption to Other Types of Wavelet Transforms\n\nThank you for the reviewer's insightful comments. In our wavelet transformation procedure, applying different wavelets in the Discrete Wavelet Transform (DWT) is still applicable to our method proposed in this paper. We initially adopted the most common Haar wavelet due to its simplicity and computational efficiency. Additionally, we have incorporated the Daubechies wavelet, which has stronger orthogonality, to evaluate its impact on our method. The specific experimental results are summarized in the following table. From the table, we can find that the influence of different wavelets on our method’s performance is limited, indicating that WaveAttack maintains its effectiveness and stealthiness among different wavelet transformations.\n\n### WaveAttack Performance with Different Wavelets\n| Wavelet Type    | Dataset   | IS ↓  | PSNR ↑  | SSIM ↑   | BA ↑ | ASR ↑ |\n|-----------------|-----------|-------|----------|--------|---------------------|------------------------|\n| **WaveAttack-Haar** | CIFAR10  | 0.011 | 47.49    | 0.9979 | 94.55               | 100                    |\n|                  | CIFAR100 | 0.005 | 50.12    | 0.9992 | 75.41               | 100                    |\n|                  | GTSRB    | 0.058 | 40.67    | 0.9877 | 99.30               | 100                    |\n| **WaveAttack-DB**  | CIFAR10  | 0.007 | 47.53    | 0.9989 | 94.77                | 95.60                  |\n|                  | CIFAR100 | 0.005 | 50.32    | 0.9994 | 76.64               | 80.43                  |\n|                  | GTSRB    | 0.022 | 41.95    | 0.9881 | 98.21              | 99.50                 |\n\n## The Superiority of DWT\n\nWe believe DWT cannot be directly swapped to other frequency transformation methods. This is because different frequency conversion methods will eventually affect the performance of backdoor attacks based on the frequency domain. The following table shows the impact of varying frequency domain conversion methods on backdoor attacks. From the table, we can see that compared with other frequency domain conversion methods, i.e., FTrojan (DCT) [1], Fiba (DFT) [2], the backdoor trigger generation method based on DWT in this paper can significantly improve the effectiveness and stealthiness of the backdoor attack method based on the frequency domain.\n\n### Frequency Domain Conversion Methods Comparison\n| Method       | Dataset   | IS↓   | PSNR  ↑ | SSIM  ↑   | BA  ↑ | ASR  ↑  |\n|--------------|-----------|-------|----------|--------|---------------------|------------------------|\n| **FTrojan (DCT) [1]** | CIFAR10  | 0.019 | 44.07    | 0.9976 | 94.29              | 100                 |\n|              | CIFAR100 | 0.0187| 47.7728  | 0.995  | 75.37              | 100                 |\n|              | GTSRB    | 0.089 | 40.44    | 0.9879 | 98.83               | 100                  |\n| **Fiba (DFT) [2]**   | CIFAR10  | 0.061    | 26.08  | 0.9734 | 93.80                   | 75.40                    |\n|              | CIFAR100 | 0.055   | 26.24  | 0.9688 | 74.87                | 80.36                   |\n|              | GTSRB    | 0.079    | 23.41   | 0.9130 | 99.12                 | 85.18                   |\n| **WaveAttack (DWT)** | CIFAR10  | **0.011** | **47.49**    | **0.9979** | **94.55**               | **100**                    |\n|              | CIFAR100 | **0.005** | **50.12**    | **0.9992** | **75.41**               | **100**                    |\n|              | GTSRB    | **0.058** | **40.67**    | **0.9877** | **99.30**               | **100**                   |\n\n## References\n- [1] Wang T, Yao Y, Xu F, et al. Backdoor attack through frequency domain. ECCV, 2023.\n- [2] Feng Y, Ma B, Zhang J, et al. Fiba: Frequency-injection based backdoor attack in medical image analysis. CVPR, 2022.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper was reviewed by three reviewers. It received mixed recommendations, with 1 Accept and 2 Borderline Rejects. The authors addressed the reviewers' concerns in the rebuttal, but the reviewers decided to keep their scores unchanged. The paper was generally applauded for its good writing, extensive experiments, and strong results. However, Reviewers vbLQ and h6uR kept their Borderline Reject decision, considering the improvement over SOTA methods small and the novelty weak.

The ACs thoroughly checked the paper, the review, and the discussion. We agree with the authors that the proposed technique has a considerable improvement over previous approaches in terms of stealthiness in the image (Table 3) and latent space (Fig. 4). We also agree on the claimed contributions and believe the novelty of the paper is significant. Hence, the decision is to recommend the paper for acceptance to NeurIPS 2024. The authors are encouraged to include the discussions from the rebuttal to the final camera-ready version of the paper. We congratulate the authors on the acceptance of their paper!
Decision: Accept (poster)