SFIBA: Spatial-based Full-target Invisible Backdoor Attacks

2025-04-29

AI Summary

Existing black-box multi-objective backdoor attacks struggle to simultaneously achieve class-specificity and visual imperceptibility of triggers, resulting in incomplete class coverage and high detectability. This paper proposes a universal-class invisible backdoor attack—the first method enabling simultaneous, precise, and imperceptible backdoor control across all classes. It enforces spatial locality constraints to bind trigger placement to specific image regions and employs implicit injection via frequency-domain singular value decomposition (SVD) embedding—leveraging Fast Fourier Transform (FFT) or Discrete Wavelet Transform (DWT). Additionally, pixel-selective filtering and visual-perception-driven optimization of injection coefficients further enhance stealth. Extensive evaluations across multiple datasets and model architectures demonstrate near-100% attack success rate, negligible degradation (<0.5%) in clean-sample accuracy, high fidelity (PSNR > 45 dB), low perceptual distortion (LPIPS < 0.05), and robust evasion of state-of-the-art defenses.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Learning to Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

Multi-target backdoor attacks pose significant security threats to deep neural networks, as they can preset multiple target classes through a single backdoor injection. This allows attackers to control the model to misclassify poisoned samples with triggers into any desired target class during inference, exhibiting superior attack performance compared with conventional backdoor attacks. However, existing multi-target backdoor attacks fail to guarantee trigger specificity and stealthiness in black-box settings, resulting in two main issues. First, they are unable to simultaneously target all classes when only training data can be manipulated, limiting their effectiveness in realistic attack scenarios. Second, the triggers often lack visual imperceptibility, making poisoned samples easy to detect. To address these problems, we propose a Spatial-based Full-target Invisible Backdoor Attack, called SFIBA. It restricts triggers for different classes to specific local spatial regions and morphologies in the pixel space to ensure specificity, while employing a frequency-domain-based trigger injection method to guarantee stealthiness. Specifically, for injection of each trigger, we first apply fast fourier transform to obtain the amplitude spectrum of clean samples in local spatial regions. Then, we employ discrete wavelet transform to extract the features from the amplitude spectrum and use singular value decomposition to integrate the trigger. Subsequently, we selectively filter parts of the trigger in pixel space to implement trigger morphology constraints and adjust injection coefficients based on visual effects. We conduct experiments on multiple datasets and models. The results demonstrate that SFIBA can achieve excellent attack performance and stealthiness, while preserving the model's performance on benign samples, and can also bypass existing backdoor defenses.

Problem

• Ensuring trigger specificity and stealthiness in multi-target backdoor attacks
• Achieving full-target attack capability with manipulated training data only
• Maintaining visual imperceptibility of triggers to evade detection

Innovation

• Spatial-based triggers ensure target specificity
• Frequency-domain injection enhances trigger stealthiness
• Morphology constraints maintain visual imperceptibility