Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

BadRefSR: Backdoor Attacks Against Reference-based Image Super Resolution

Xue Yang, Tao Chen, Lei Guo, Wenbo Jiang, Ji Guo, Yongming Li, Jiaming He

TL;DR

This paper addresses security risks in reference-based image super-resolution (RefSR) by introducing BadRefSR, a backdoor framework that embeds triggers in the Ref input. The attacker poisons training data and trains the RefSR model with a mixed loss to preserve normal SR on clean data while forcing attacker-chosen outputs on triggered inputs. The method demonstrates that attacked models maintain normal performance for clean inputs but output a predefined target image when the Ref is trigger-modified, across multiple triggers and poisoning rates, with practical stealth advantages. The work highlights a significant vulnerability in RefSR systems and motivates the development of defense mechanisms for reference-based reconstruction tasks.

Abstract

Reference-based image super-resolution (RefSR) represents a promising advancement in super-resolution (SR). In contrast to single-image super-resolution (SISR), RefSR leverages an additional reference image to help recover high-frequency details, yet its vulnerability to backdoor attacks has not been explored. To fill this research gap, we propose a novel attack framework called BadRefSR, which embeds backdoors in the RefSR model by adding triggers to the reference images and training with a mixed loss function. Extensive experiments across various backdoor attack settings demonstrate the effectiveness of BadRefSR. The compromised RefSR network performs normally on clean input images, while outputting attacker-specified target images on triggered input images. Our study aims to alert researchers to the potential backdoor risks in RefSR. Codes are available at https://github.com/xuefusiji/BadRefSR.

BadRefSR: Backdoor Attacks Against Reference-based Image Super Resolution

TL;DR

This paper addresses security risks in reference-based image super-resolution (RefSR) by introducing BadRefSR, a backdoor framework that embeds triggers in the Ref input. The attacker poisons training data and trains the RefSR model with a mixed loss to preserve normal SR on clean data while forcing attacker-chosen outputs on triggered inputs. The method demonstrates that attacked models maintain normal performance for clean inputs but output a predefined target image when the Ref is trigger-modified, across multiple triggers and poisoning rates, with practical stealth advantages. The work highlights a significant vulnerability in RefSR systems and motivates the development of defense mechanisms for reference-based reconstruction tasks.

Abstract

Reference-based image super-resolution (RefSR) represents a promising advancement in super-resolution (SR). In contrast to single-image super-resolution (SISR), RefSR leverages an additional reference image to help recover high-frequency details, yet its vulnerability to backdoor attacks has not been explored. To fill this research gap, we propose a novel attack framework called BadRefSR, which embeds backdoors in the RefSR model by adding triggers to the reference images and training with a mixed loss function. Extensive experiments across various backdoor attack settings demonstrate the effectiveness of BadRefSR. The compromised RefSR network performs normally on clean input images, while outputting attacker-specified target images on triggered input images. Our study aims to alert researchers to the potential backdoor risks in RefSR. Codes are available at https://github.com/xuefusiji/BadRefSR.

Paper Structure

This paper contains 16 sections, 4 equations, 4 figures, 1 table.

Table of Contents

  1. Introduction
  2. Threat Model
  3. BadRefSR Method
  4. Overview
  5. Backdoor Training
  6. Backdoor Triggers
  7. Experiments
  8. Experiment Setup
  9. Datasets
  10. Models
  11. Metrics
  12. Attack Configuration
  13. Experiment Results
  14. BadRefSR with Different Triggers and Models
  15. BadRefSR with Varying Poisoning Rates
  16. ...and 1 more sections

Figures (4)

  • Figure 1: Overview of the proposed BadRefSR.
  • Figure 2: Visual comparison of different backdoor triggers on Ref images and the backdoor target image.
  • Figure 3: PSNR (bars) and SSIM (curves) of BadRefSR at varying poisoning rates with six different triggers. The left plot shows metrics evaluated on the clean CUFED5 dataset (poisoning rate = 0%), the right plot shows the metrics evaluated on the triggered CUFED5 dataset (poisoning rate = 100%).
  • Figure 4: BadRefSR on CUFED5 at different poisoning rates with Refool trigger.