Paper: Rethinking CNN’s Generalization to Backdoor Attack from Frequency Domain (ICLR-2024)

Reviewer comment (Experiments):
The dataset used in the paper is relatively small, which is not sufficient to reflect the generalization of the experiment. The author should conduct experimental observations on more generalized datasets such as ImageNet.

Author response:
Thank you for pointing out our experimental shortcomings. To make up for the shortcomings, we conducted experiments on our related algorithms on ImageNet. However, due to GPU resource and time constraints, we currently use Tiny-ImageNet, which is widely used in the field of backdoor attacks. The dataset contains a subset of 200 classes, with 100,000 images for training (500 images per class) and 10,000 images for testing (50 images per class) [3]. We verified the backdoor attack (Table 1) and the stealth strategy (Table 2) with parameters set to (ρ = 0.4, ε = 1/3). We can see that our backdoor attack method and invisible strategy can still achieve good attack performance on ImageNet. The results obtained on ImageNet have been placed in Appendix A.5.

Table 1: Backdoor attack on ImageNet

|                                        | **BA** | **ASR** |
|----------------------------------------|--------|---------|
| LIRA                       | 0.05   | 99.85   |
| BPP                         | 58.14  | **100.00** |
| Blind                     | 1.97   | 45.21   |
| TrojanNN                   | 55.89  | 99.98   |
| Ours($\rho=0.4$,$\varepsilon=\frac{1}{3}$) | **59.11** | **100.00** |

Table 2: The Implementation of Invisible Strategies on ImageNet

|         | **Origin BA** | **Origin ASR** | **Invisible BA** | **Invisible ASR** |
|---------|---------------|----------------|------------------|-------------------|
| BadNet  | 65.31         | 91.17          | 61.18            | 99.16             |

[3] Wu B, Chen H, Zhang M, et al. Backdoorbench: A comprehensive benchmark of backdoor learning[J]. Advances in Neural Information Processing Systems, 2022, 35: 10546-10559.

Reviewer comment (Novelty):
The authors claimed that "backdoor attack and defense from a frequency domain perspective is still insufficient", but IMHO, their literature review is insufficient. Recently, there are many researches about backdoor attacks in the frequency domain. The authors only mentioned one work [1], please discuss more related works such as [2,3,4]. By the way, adversarial attack (aka evasion attack) is closely related to backdoor attack, and there are even more adversarial attacks [5,6] in the frequency domain, and I noticed that the proposed algorithms shown in Figure 5(b) share some similarities with f-mixup in [6].

Author response:
Thank you very much for your time and insightful comments. We are encouraged that our work is recognized. We hope the following new clarifications and results can address your concerns. We are happy to answer more questions and conduct more experiments if needed.

Q1: Insufficient review and some similarities with f-mixup in literature [1]

A1: Thanks for pointing this out. In fact, we previously included a review of frequency domain backdoor attacks, but due to space reasons we had to reduce the introduction to this aspect, which we admit is insufficient. We have now supplemented the related work with a review of other backdoor attack methods (section 2.2).

Regarding the work you mentioned in the field of adversarial attacks [1], we found this article and read it carefully. We will clearly and in detail explain the differences in working with them.

1) First, our approach is different. In fact, the f-mixup mentioned in [1] is similar to ours in that they both use the frequency domain to add disturbance information. But our process of generating triggers (adversarial instances in adversarial attacks) and the raw materials of triggers used are completely different. F-mixup generates candidates by replacing part of the mid- and high-frequency components of the clean examples with the corresponding frequency components of the reference image. That is to say, f-mixup first uses DFT to transform the image into the frequency domain, then uses a band-pass filter to extract part of the high-frequency components of the reference image, and then uses a band-stop filter to filter out the frequency components of the same part of the clean image. Then add part of the high-frequency components of the reference image to the spectrum of the clean image, and finally use IDFT to transform to the spatial domain to obtain the adversarial sample. Our frequency-based backdoor attack method selects part of the low-frequency components of the target category image as the raw material of the trigger, and then adds the trigger to the mid- and high-frequency components of the clean image through upsampling and other operations to generate a poisoned image. And in order to improve the generalization of CNN to poisoned images whose label is set as the target category, we randomly select the low-frequency components of the image from the target category as raw materials when generating each poisoned image.

2) Second, our purposes are different. The f-mixup in [1] is to destroy useful features in the image and introduce misleading information to perturb model prediction, thereby achieving adversarial attacks. Our attack method uses the low-frequency semantic information of the target category to inject the backdoor into the high-frequency component of the backdoor image in order to make the model better generalize to the trigger, thereby realizing the backdoor attack.

[1] Li X C, Zhang X Y, Yin F, et al. Decision-based adversarial attack with frequency mixup[J]. IEEE Transactions on Information Forensics and Security, 2022, 17: 1038-1052.

Reviewer comment (Experiments):
The proposed attack is motivated by frequency domain analysis for CNNs, but ViT has different bias in the frequency domain [9], which means that the proposed method may not generalize to ViT. IMHO, this is a great limitation.

Author response:
Q3: The proposed attack is motivated by frequency domain analysis for CNNs , but ViT has different bias in the frequency domain [4], which means that the proposed method may not generalize to ViT. IMHO, this is a great limitation.

A3：Our main work in this paper is to explore the memory mechanism of CNN for poisoned images from the perspective of frequency domain, and to study the generalization characteristics of CNN to perturbations generated by visible and invisible triggers in different frequency domains. The impact of different intensity perturbations of different frequency domain components on the generalization of CNN was also studied. The theoretical part does not cover the scope of Vit. Of course, we have noticed the difference in the attention of Vit and CNN to different components in the frequency domain proposed in the relevant work [5]. We are currently working hard to advance the work on Vit, but it is not the focus of the discussion of model generalization in this paper.

Despite this, we still used our attack method to conduct relevant experiments on the Vit-base model, and the experimental results are shown in Tables 1 and 2 as below. It can be seen from the table that our stealth strategy and attack method are effective on the Vit model and can achieve high attack accuracy. Judging from the experimental results, the limitations you mentioned do not exist for our algorithm. We also put the relevant experimental results about Vit in Appendix A.6.

Table 1: Backdoor attack on vision transformer

|                                     | **BA**   | **ASR**    |
|-------------------------------------|----------|------------|
| BadNet                   | 94.78    | 93.77      |
| Blended                | 96.54    | 99.68      |
| LIRA                    | 17.52    | 87.87      |
| TrojanNN                | 96.46    | 99.98      |
| Ours($\rho=0.4$,$\varepsilon=\frac{1}{3}$) | **98.62** | **100.00** |

Table 2: The Implementation of Invisible Strategies on vision transformer

|         | **Origin-BA** | **Origin-ASR** | **Invisible-BA** | **Invisible-ASR** |
|---------|---------------|----------------|------------------|-------------------|
| BadNet  | 94.78         | 93.77          | 94.77            | 99.12             |

[2] Yin D, Gontijo Lopes R, Shlens J, et al. A fourier perspective on model robustness in computer vision[J]. Advances in Neural Information Processing Systems, 2019, 32.

[3] Wang H, Wu X, Huang Z, et al. High-frequency component helps explain the generalization of convolutional neural networks[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020: 8684-8694.

[4]Park N, Kim S. How do vision transformers work?[J]. arXiv preprint arXiv:2202.06709, 2022.

[5] Bai J, Yuan L, Xia S T, et al. Improving vision transformers by revisiting high-frequency components[C]//European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2022: 1-18.

Reviewer comment (Experiments):
The authors conducted experiments on MNIST, CIFAR-10 and Celeba, it is necessary to validate the proposed algorithms on ImageNet. In my experience, CNNs trained on ImageNet is far less sensitive to high frequencies than CNNs trained on the above datasets.

Author response:
Q4: The authors conducted experiments on MNIST, CIFAR-10 and Celeba, it is necessary to validate the proposed algorithms on ImageNet. In my experience, CNNs trained on ImageNet is far less sensitive to high frequencies than CNNs trained on the above datasets.

A4：Thank you for pointing out our experimental shortcomings. To make up for the shortcomings, we conducted experiments on our related algorithms on ImageNet. However, due to GPU resource and time constraints, we currently use Tiny-ImageNet, which is widely used in the field of backdoor attacks. The dataset contains a subset of 200 classes, with 100,000 images for training (500 images per class) and 10,000 images for testing (50 images per class) [6]. We verified the backdoor attack (Table 3) and the stealth strategy (Table 4) with parameters set to (ρ = 0.4, ε = 1/3). We can see that our backdoor attack method and invisible strategy can still achieve good attack performance on ImageNet. The results obtained on ImageNet have been placed in Appendix A.5.

Table 3: Backdoor attack on ImageNet

|                                        | **BA** | **ASR** |
|----------------------------------------|--------|---------|
| LIRA                       | 0.05   | 99.85   |
| BPP                        | 58.14  | **100.00** |
| Blind                       | 1.97   | 45.21   |
| TrojanNN                   | 55.89  | 99.98   |
| Ours($\rho=0.4$,$\varepsilon=\frac{1}{3}$) | **59.11** | **100.00** |

Table 4: The Implementation of Invisible Strategies on ImageNet

|         | **Origin BA** | **Origin ASR** | **Invisible BA** | **Invisible ASR** |
|---------|---------------|----------------|------------------|-------------------|
| BadNet  | 65.31         | 97.17          | 61.18            | 99.16             |





[6] Wu B, Chen H, Zhang M, et al. Backdoorbench: A comprehensive benchmark of backdoor learning[J]. Advances in Neural Information Processing Systems, 2022, 35: 10546-10559.

Reviewer comment (Novelty):
After rebuttal — The authors' rebuttal has addressed most of my concerns. However, the insufficient literature review still heavily weakens the motivation and novelty of this work. Specifically, the authors claimed that "the research on backdoor attack and defense from a frequency domain perspective is still insufficient", but actually, there exist many works in this direction. Besides, although the proposed algorithms shown in Figure 5(b) differs from f-mixup in some details, I still think the high-level ideas are similar, since both inject misleading features into middle-and-high frequency domain. Therefore, although I have raised my score to 5, I think it is okay to reject this paper.

Author response:
Thank you for your reply. We have further clarified your question. We hope the new clarifications and results resolve your concerns. If you have any further questions, please ask and we'll be happy to continue answering your questions.

Q1：the insufficient literature review still heavily weakens the motivation and novelty of this work.

A1：Thank you sincerely for your suggestions. In fact, when you first asked the question, we had already conducted a relevant literature review in section 2.2 and listed some of the current frequency domain-based backdoor attack methods. The expression of these methods did not demonstrate our motivation very well. We are sorry that it did not meet your expectations, so we revised the deficiencies in section 1 and section 2.2 again to supplement the motivation and novelty of our theories and methods.

1) First of all, the current exploration of the mechanism of memorizing backdoor samples from the perspective of frequency domain is still lacking. Most frequency-based backdoor attack methods directly learn the CNN's memory ability of spectrum based on existing literature and make relevant assumptions, and then inject triggers based on this assumption. But they don’t know why setting the trigger in this way makes CNN generalize, and they don’t know the sensitivity of CNN to changes in the frequency components of each part. But we explored it. That is, we try to explain and explore the mechanism of CNN's memory of backdoor samples from the perspective of frequency domain. We further studied how the perturbations produced by visible and invisible triggers at different frequency components help the generalization ability of CNN.

2) Secondly, in order to make the backdoor attack in frequency more efficient and bypass the backdoor defense algorithm based on the spatial domain, and can effectively implement the backdoor attack on the target category while minimizing the destruction of the original image energy. We use the research conclusions obtained in section 3 to propose the backdoor attack algorithm shown in Figure 5(b). At the same time, it is considered that visible backdoor attacks have a high attack success rate, but because of the visibility of the trigger, their use is limited in scenarios that require high concealment. Therefore, combined with our theory, we propose a general invisible algorithm shown in Figure 5(a), which realizes the invisible of visible triggers, ensures the attack efficiency of visible triggers, and expands the usage scenarios of visible triggers.

Q2：The algorithm shown in Figure 5(b) is similar to f-mixup in high-level ideas.

A2:  As we replied before. The method we show in Figure 5(b) is completely different from the f-mixup method in terms of purpose and ideas. This also involves the purpose and difficulty of backdoor attack and adversarial attack tasks. Before comparing our two methods, it is necessary to correctly understand the difference between backdoor attacks and adversarial attacks. Moreover, just operating in the frequency domain does not mean that our high-level ideas are the same. Our purposes and methods are different, and the results we bring are also different. We will further explain the differences in methods to allay your concerns.


1) f-mixup destroys useful features in images and introduces misleading information to perturb model predictions, thereby achieving adversarial attacks. This purpose means that it does not need to consider outputting specific results, but only perturbs the output results of the model. At the same time, f-mixup is generated in a way that generates adversarial examples by replacing parts of the mid- and high-frequency components of the clean examples with the corresponding parts of the reference image. The images referenced in the generation of adversarial samples do not need to consider fixed categories, and the trigger raw materials are medium and high frequency components.


2) Our attack method utilizes the low-frequency semantic information of the target category and implants the backdoor in the high-frequency component of the backdoor image. This operation makes use of the CNN's memory mechanism for backdoor samples, so that the model can better generalize the triggers, thereby achieving backdoor attacks. And in order to improve the generalization of CNN to poisoned images whose label is the target category, we randomly select the low-frequency components of the image from the target category as raw materials when generating each poisoned image.

Reviewer comment (Novelty):
Two important works on frequency-based backdoor attack are missed: [1] Zeng, Y., Park, W., Mao, Z.M. and Jia, R., 2021. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE/CVF international conference on computer vision (pp. 16473-16481). [2] Feng, Y., Ma, B., Zhang, J., Zhao, S., Xia, Y. and Tao, D., FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis Supplementary Material.

Author response:
Thank you so much for your thoughtful comments and recognition of the significance of our work. We hope the following results and explanations address your concerns.

We have carefully read the two important tasks you listed and we are very sorry for their omission. So below we will first introduce our contributions, and then clearly and in detail explain the differences from their work. A discussion of our work and their work has been added to Appendix A.8.

Our work mainly explores the mechanism of CNN memory poisoning samples from the perspective of frequency domain. We analyze the changes in different frequency components of existing visible and invisible triggers with good performance. We found that CNN can generalize to poisoned samples by remembering the frequency domain distribution changed by triggers. We also explore the impact of triggering perturbations with different frequency domain components on the generalization of poisoning models for visible and invisible backdoor attacks, and demonstrate that high-frequency components are more susceptible to perturbations compared to low-frequency components. In addition, in order to improve the concealment of visible triggers in specific scenarios, we propose a general strategy to hide visible triggers. We also propose a backdoor attack algorithm based on low-frequency semantic information, which is proven to be effective and can bypass multiple backdoor defense methods.

Literature [1] also adds triggers in the frequency domain. What we have in common is that we all use the low-frequency information of the target category image to introduce the semantics of the target category into the poisoned image. But our methods of generating triggers and specific training are completely different.

Literature [1] uses FFT to transform the image from the spatial domain to the frequency domain, and then linearly adds the low-frequency component of the clean image and the low-frequency component of the target image through a certain ratio as the low-frequency component of the poisoned image, thereby achieving frequency injection of the trigger. Literature [1] uses FFT to transform the image from the spatial domain to the frequency domain, and then linearly adds the low-frequency component of the clean image and the target image through a certain ratio as the low-frequency component of the poisoned image, thereby achieving frequency injection of the trigger. And their training process introduced noise images similar to those in the literature [2] to enhance the uniqueness of the trigger. However, our frequency-based backdoor attack method selects part of the low-frequency components of the target category image as the raw material of the trigger. The poisoned image is then generated by adding triggers to the mid- and high-frequency components of the clean image through operations such as upsampling. And in order to improve the generalization of CNN to poisoned images whose label is the target category, we randomly select the low-frequency components of the image from the target category as raw materials when generating each poisoned image, and do not use noise images.


[1] Feng, Y., Ma, B., Zhang, J., Zhao, S., Xia, Y. and Tao, D., FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis Supplementary Material. The paper should clearly state the differences between the current work and these previous works.

[2] Tuan Anh Nguyen and Anh Tuan Tran. Wanet - imperceptible warping-based backdoor attack. In ICLR, 2021.

Reviewer comment (Novelty):
The paper should clearly state the differences between the current work and these previous works.

Author response:
In fact, although we all explore the characteristics of triggers from the perspective of frequency domain, our work is completely different from that of literature [3].

1)  [3] studied the spectrum of poisoned images and showed that most triggers produce artifacts in the high-frequency components of input images of large sizes, and explained the reasons for this phenomenon accordingly. That is, the high-frequency artifacts of local patching mainly originate from the high-frequency components of the trigger pattern itself, while the high-frequency artifacts of large-size or global patching originate from the trigger pattern itself or the method of inserting the trigger. GAN-generated backdoor data originates from the upsampling operation used by GAN. But the difference is that our work is inspired by [4] and explains the mechanism of CNN memory triggers from the frequency domain perspective (section 3). We propose and prove that CNN can memorize specific frequency domain feature distributions and establish the association between feature distributions and labels. Therefore, backdoor attacks can be achieved even if the trigger factors are diverse or not fixed. We used this mechanism to explore the impact of perturbations produced by visible and invisible triggers in different frequency domain components on the generalization ability of CNN, as well as the differences in the generalization ability of CNN to different perturbation intensities imposed on different frequency domain components. And it is proved that high-frequency components are more sensitive to disturbances than low-frequency components.

2) Reference [3], based on their identified discovery that triggers in large-sized input images generate high-frequency artifacts, developed a detector specifically designed for frequency artifacts. They trained this detector using poisoned data to ensure its generalization to other poisoned samples. [3] also created a smooth trigger for backdoor attacks. Their generation of smooth triggers is generalized as a two-layer optimization problem, and neither the generated triggers themselves nor the final patch image contain any high-frequency components. Our work is based on the exploration of the impact of perturbations produced by existing triggers in different frequency domain components on the generalization ability of CNN, and proposes a general strategy for making visible triggers invisible. It makes the trigger invisible by removing the low-frequency components of the trigger. We also proposed a backdoor attack algorithm based on low-frequency semantic information for target classes based on the mechanism of CNN memory triggers, achieving a high success rate in different data sets and models.

3) In fact, the high-frequency artifacts proposed in the literature [3] are only obvious in large-size input images (224\*224), and are difficult to observe for smaller-size (32\*32) images. It therefore has limitations for the defense of our approach. And the smooth trigger they proposed only adds triggers at low frequencies, which will cause the poisoned image to be abnormally obvious in the spatial domain.

[3] Zeng, Y., Park, W., Mao, Z.M. and Jia, R., 2021. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE/CVF international conference on computer vision (pp. 16473-16481).

[4] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8684–8694, 2020.

Reviewer comment (Evaluation):
Fig.4 shows that it requires smaller perturbation on high frequency than on low frequency to achieve high attack success rate. However, when comparing to the original image, since most mass concentrate in low-frequency components, the small perturbation on high frequency might be relatively large comparing to the original image. It might require more results to show that high frequency components are more susceptible to backdoor attack.

Author response:
A4: I understand your concern regarding the accuracy of measuring the difficulty of attacks due to the varying information content in different frequency components. Indeed, low-frequency components contain a relatively greater amount of information, which is an important aspect we have considered in our paper.
	In our paper, we analyzed the difference in generalization of CNN to perturbations produced by visible and invisible triggers in the frequency domain, and then further explored the difference in generalization of CNN to different perturbation strengths of different frequency domain components. Our comparison in the paper emphasizes the sensitivity of high-frequency components to perturbations and the conditions for frequency domain perturbations required to achieve efficient attacks. And the purpose of our experiment was to better account for this when adding triggers or weakening existing ones. Regarding your proposal to study the generalization characteristics of CNN based on changes in the relative intensity of frequency domain perturbations, we did think about it in our initial research, but we did not explore it out of consideration for inspiration for backdoor attacks and defenses. . We believe that the existing experimental results already support our conclusions, and we must take into account the resource-intensive nature of additional experiments and the time constraints at this stage. Nonetheless, we remain committed to advancing our research. If you still feel that it is necessary to study the relative perturbation intensity of different frequency components, we are very happy to design experiments to further study the generalization properties of CNN as a result of changes in the relative intensity of perturbations in the frequency domain. And we promise to supplement our findings with more experimental results in future submissions.

Reviewer comment (Evaluation):
For both the rendering strategy and the proposed backdoor attack algorithm, are they still be effective facing conventional defence methods?

Author response:
A2：Thanks for pointing this out. We used GradCam, Fine-Pruning and STRIP to evaluate backdoor defense in our original paper submission, and the results proved that our frequency domain-based backdoor attack algorithm is effective in combating backdoor defense (Figure 6). Now we have added three new backdoor defense methods, NC [4], DBD [5] and CLP [6], to further evaluate the frequency domain-based attack algorithm we proposed respectively. The experimental results are shown in Tables 1 and 2 as below. Experimental results show that although the performance of our attack algorithm is slightly degraded on some defense algorithms, it is still effective. We have added this part to Appendix A.7.
  
Table 1: Mitigation results of backdoor defense methods DBD and NC on our algorithm

|                                    | **DBD-BA** | **DBD-ASR** | **NC-BA** | **NC-ASR** |
|------------------------------------|------------|-------------|-----------|------------|
| BadNet [1]                  | 89.65      | 1.28        | 89.05     | 1.27       |
| Blended[7]                | 69.91      | 99.68       | 93.47     | 99.92      |
| WaNet[8]                    | 80.9       | 6.61        | 91.80     | 7.53       |
| ISSBA[9]                  | 63.5       | 99.51       | 90.99     | 0.58       |
| Ours($\rho=0.4$,$\varepsilon=\frac{1}{3}$) | 70.29  | 100.00      | 94.26     | 91.80      |

Table 2 Mitigation results of our algorithm by backdoor defense method CLP

|                                    | **CLP-BA** | **CLP-ASR** |
|------------------------------------|------------|-------------|
| IAD[2]                     | 90.3       | 2.17        |
| Blended[7]                 | 91.32      | 99.74       |
| WaNet[8]                    | 81.91      | 78.42       |
| ISSBA[9]                   | 91.38      | 68.13       |
| Ours($\rho=0.4$,$\varepsilon=\frac{1}{3}$) | 94.55 | 98.41       |

[1] Gu T, Dolan-Gavitt B, Garg S. Badnets: Identifying vulnerabilities in the machine learning model supply chain[J]. arXiv preprint arXiv:1708.06733, 2017.

[2] Nguyen T A, Tran A. Input-aware dynamic backdoor attack[J]. Advances in Neural Information Processing Systems, 2020, 33: 3454-3464.

[3] Bagdasaryan E, Shmatikov V. Blind backdoors in deep learning models[C]//30th USENIX Security Symposium (USENIX Security 21). 2021: 1505-1521.

[4] Wang B, Yao Y, Shan S, et al. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks[C]//2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019: 707-723.

[5] Huang K, Li Y, Wu B, et al. Backdoor defense via decoupling the training process[J]. arXiv preprint arXiv:2202.03423, 2022.

[6] Zheng R, Tang R, Li J, et al. Data-free backdoor removal based on channel lipschitzness[C]//European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2022: 175-191.

[7] Chen X, Liu C, Li B, et al. Targeted backdoor attacks on deep learning systems using data poisoning[J]. arXiv preprint arXiv:1712.05526, 2017.

[8]Nguyen A, Tran A. Wanet--imperceptible warping-based backdoor attack[J]. arXiv preprint arXiv:2102.10369, 2021.

[9]Li Y, Li Y, Wu B, et al. Invisible backdoor attack with sample-specific triggers[C]//Proceedings of the IEEE/CVF international conference on computer vision. 2021: 16463-16472.

Reviewer comment (Novelty):
It has already been observed that high frequency components are more susceptible to attacks such as adversarial attacks. Is there any new takeaways regarding the backdoor attack?

Author response:
A3：As we can see, we discussed the impact of current triggers on both low-frequency and high-frequency components, as well as the difference in generalization of CNNs to backdoor samples. We also demonstrated the vulnerability of high-frequency components. To address this issue, we are actively engaged in conducting relevant extended research efforts. For example,

1) The first is the defense problem based on the frequency domain. There are already some frequency-specific backdoor defense methods. Most of the current frequency-based defenses are the detection of backdoor samples [10], or it is difficult for the algorithm to restore the backdoor samples to a clean state and maintain the accuracy of the clean image [11], but our idea is different. In this paper, we have confirmed that when some triggers do not reach a certain perturbation intensity at high or low frequencies, CNN will not remember these triggers, so we are trying to detect and weaken the backdoor perturbations in the frequency domain to achieve filtering of backdoor samples. and recovery.

2) At present, physical attacks are easier to apply in actual scenarios [12], but it is difficult for physical attack triggers to be invisible during the training process. Therefore, we consider implanting a backdoor by adding small perturbations in the frequency domain during the training phase, and visible triggers that can achieve corresponding attack effects are generated and applied in the inference phase to enhance the invisibility of physical backdoor attacks in the training phase. This method is theoretically feasible because according to the linear convolution properties of DCT, the triggers added in the spectrum should be separable in the spatial domain.




[10] Al Kader Hammoud H A, Bibi A, Torr P H S, et al. Don't FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNs[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 2337-2344.

[11] Hammoud H A A K, Ghanem B. Check Your Other Door! Creating Backdoor Attacks in the Frequency Domain[J]. arXiv preprint arXiv:2109.05507, 2021.

[12] Wenger E, Passananti J, Bhagoji A N, et al. Backdoor attacks against deep learning systems in the physical world[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021: 6206-6215.