AS-FIBA: Adaptive Selective Frequency-Injection for Backdoor Attack on Deep Face Restoration

2024-03-11

International Conference on Trust, Security and Privacy in Computing and Communications

AI Summary

To address the vulnerability of deep face restoration models to stealthy backdoor attacks, this paper proposes the first degradation-oriented backdoor attack paradigm specifically designed for image restoration tasks. Unlike conventional classification-oriented backdoors, our method targets controllable image degradation, generating input-specific triggers in the frequency domain to induce imperceptible yet significant degradation in restoration quality. Technically, it integrates frequency-domain signal processing, end-to-end differentiable degradation modeling, and adversarial trigger optimization. Evaluated on state-of-the-art restoration models, the attack achieves over 92% success rate, with trigger invisibility substantially surpassing WaNet, ISSBA, and FIBA. The core contributions are: (1) formalizing a restoration-specific, degradation-directed backdoor objective; and (2) introducing a frequency-domain adaptive trigger generation mechanism that achieves optimal trade-offs between stealthiness and effectiveness.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Learning to Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

Deep learning-based face restoration models, increasingly prevalent in smart devices, have become targets for sophisticated backdoor attacks. Through subtle trigger injection into input face images, these attacks can lead to unexpected restoration outcomes. Unlike conventional methods focused on classification tasks, our approach introduces a unique degradation objective tailored for attacking restoration models. Moreover, we propose the Adaptive Selective Frequency Injection Backdoor Attack (AS-FIBA) framework, employing a neural network for input-specific trigger generation in the frequency domain, seamlessly blending triggers with benign images. This results in imperceptible yet effective attacks, guiding restoration predictions towards subtly degraded outputs rather than conspicuous targets. Extensive experiments demonstrate the efficacy of the degradation objective on state-of-the-art face restoration models. Additionally, it is notable that AS-FIBA can insert effective backdoors that are more imperceptible than existing backdoor attack methods, including WaNet, ISSBA, and FIBA.

Problem

• Targets deep face restoration models with backdoor attacks
• Uses frequency-domain triggers for imperceptible image degradation
• Outperforms existing methods like WaNet and ISSBA in stealth

Innovation

• Frequency-domain trigger generation for stealthy attacks
• Adaptive neural network for input-specific triggers
• Degradation objective targeting restoration models