Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SFIBA: Spatial-based Full-target Invisible Backdoor Attacks

Yangxu Yin, Honglong Chen, Yudong Gao, Peng Sun, Zhishuai Li, Weifeng Liu

TL;DR

SFIBA addresses the challenge of realizing full-target backdoor attacks in black-box scenarios by tying each target class to a distinct local block and morphing constraint, then injecting triggers via a frequency-domain pipeline that blends FFT-amplitude manipulation, DWT feature extraction, and SVD-based fusion. The method enforces trigger specificity through block-level spatial partitioning and directional morphology, while dynamic PSNR-based tuning preserves stealth without sacrificing effectiveness. Empirical results across CIFAR10, GTSRB, and ImageNet100 show near-perfect attack success rates with negligible benign accuracy loss and robustness to several defenses and data augmentation. This work demonstrates a practical, stealthy approach to multi-target backdoors that operates under realistic attacker capabilities, raising important considerations for defense and detection.

Abstract

Multi-target backdoor attacks pose significant security threats to deep neural networks, as they can preset multiple target classes through a single backdoor injection. This allows attackers to control the model to misclassify poisoned samples with triggers into any desired target class during inference, exhibiting superior attack performance compared with conventional backdoor attacks. However, existing multi-target backdoor attacks fail to guarantee trigger specificity and stealthiness in black-box settings, resulting in two main issues. First, they are unable to simultaneously target all classes when only training data can be manipulated, limiting their effectiveness in realistic attack scenarios. Second, the triggers often lack visual imperceptibility, making poisoned samples easy to detect. To address these problems, we propose a Spatial-based Full-target Invisible Backdoor Attack, called SFIBA. It restricts triggers for different classes to specific local spatial regions and morphologies in the pixel space to ensure specificity, while employing a frequency-domain-based trigger injection method to guarantee stealthiness. Specifically, for injection of each trigger, we first apply fast fourier transform to obtain the amplitude spectrum of clean samples in local spatial regions. Then, we employ discrete wavelet transform to extract the features from the amplitude spectrum and use singular value decomposition to integrate the trigger. Subsequently, we selectively filter parts of the trigger in pixel space to implement trigger morphology constraints and adjust injection coefficients based on visual effects. We conduct experiments on multiple datasets and models. The results demonstrate that SFIBA can achieve excellent attack performance and stealthiness, while preserving the model's performance on benign samples, and can also bypass existing backdoor defenses.

SFIBA: Spatial-based Full-target Invisible Backdoor Attacks

TL;DR

SFIBA addresses the challenge of realizing full-target backdoor attacks in black-box scenarios by tying each target class to a distinct local block and morphing constraint, then injecting triggers via a frequency-domain pipeline that blends FFT-amplitude manipulation, DWT feature extraction, and SVD-based fusion. The method enforces trigger specificity through block-level spatial partitioning and directional morphology, while dynamic PSNR-based tuning preserves stealth without sacrificing effectiveness. Empirical results across CIFAR10, GTSRB, and ImageNet100 show near-perfect attack success rates with negligible benign accuracy loss and robustness to several defenses and data augmentation. This work demonstrates a practical, stealthy approach to multi-target backdoors that operates under realistic attacker capabilities, raising important considerations for defense and detection.

Abstract

Multi-target backdoor attacks pose significant security threats to deep neural networks, as they can preset multiple target classes through a single backdoor injection. This allows attackers to control the model to misclassify poisoned samples with triggers into any desired target class during inference, exhibiting superior attack performance compared with conventional backdoor attacks. However, existing multi-target backdoor attacks fail to guarantee trigger specificity and stealthiness in black-box settings, resulting in two main issues. First, they are unable to simultaneously target all classes when only training data can be manipulated, limiting their effectiveness in realistic attack scenarios. Second, the triggers often lack visual imperceptibility, making poisoned samples easy to detect. To address these problems, we propose a Spatial-based Full-target Invisible Backdoor Attack, called SFIBA. It restricts triggers for different classes to specific local spatial regions and morphologies in the pixel space to ensure specificity, while employing a frequency-domain-based trigger injection method to guarantee stealthiness. Specifically, for injection of each trigger, we first apply fast fourier transform to obtain the amplitude spectrum of clean samples in local spatial regions. Then, we employ discrete wavelet transform to extract the features from the amplitude spectrum and use singular value decomposition to integrate the trigger. Subsequently, we selectively filter parts of the trigger in pixel space to implement trigger morphology constraints and adjust injection coefficients based on visual effects. We conduct experiments on multiple datasets and models. The results demonstrate that SFIBA can achieve excellent attack performance and stealthiness, while preserving the model's performance on benign samples, and can also bypass existing backdoor defenses.
Paper Structure (17 sections, 1 theorem, 18 equations, 8 figures, 6 tables, 2 algorithms)

This paper contains 17 sections, 1 theorem, 18 equations, 8 figures, 6 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Backdoor Attacks
  4. Backdoor Defenses
  5. Threat Model
  6. Capability of Attackers
  7. Attack Modeling
  8. Methodology
  9. Motivation
  10. Local Space Dynamic Invisible Trigger Injection
  11. Evaluation
  12. Experimental Setup
  13. Effectiveness of SFIBA
  14. Performance Against Defensive Measures
  15. Ablation Experiment of SFIBA
  16. ...and 2 more sections

Key Result

Lemma 1

For the poisoned sample $x_0' = (1 - m_0) \odot x + T(m_0 \odot x)$, the trigger is injected into the local region $m_0 \odot x$, obtained by element-wise multiplication between the mask $m_0$ and the sample $x$. The mask $m_0$ is a binary mask with a small rectangular region set to 1 in any positio

Figures (8)

  • Figure 1: Schematic of multi-target backdoor attack.
  • Figure 2: SFIBA's attack process, where $AS$ represents the amplitude spectrum, $HH_{c1,c2}$, $HH_{t1,t2}$, and $HH_{p1,p2}$ denote the diagonal features of the clean, trigger and poisoned amplitude spectrum, respectively.
  • Figure 3: Distribution and effectiveness of $Block$s with triggers.
  • Figure 4: Visual effects and residuals of SFIBA and baselines on ImageNet.
  • Figure 5: Poisoned images and corresponding residuals generated by SFIBA for each class in CIFAR10.
  • ...and 3 more figures

Theorems & Definitions (2)

  • Lemma 1
  • proof