WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks

Summary

This paper introduces a backdoor attack that leverages DWT to create highly stealthy backdoor triggers, named WaveAttack. The attack employs an asymmetric frequency obfuscation technique to improve the impact and effectiveness of these triggers during both training and inference stages.

Strengths

The work’s proposal and clear reasonings to use DWT instead of other frequency-based transformations creates backdoor triggers that are highly stealthy. The perceptibility of the triggers generated are validated across numerous image fidelity metrics.

Weaknesses

The frequency-based transformation, DWT, is the major contribution of this paper’s proposed attack. But the paper only experiments with the “Haar” wavelet, when there are dozens of different variations available.

Questions

1. Can the method be adapted to other types of wavelet transforms, and how would this affect the attack's effectiveness and stealthiness? 2. While the authors explain the rationale behind them choosing DWT over DCT, there are no experiments detailing the superiority of DWT. Can DCT/DFT or other forms of frequency-based transformations work in this proposed method? Can they be swapped-in directly?

Rating

7

Confidence

3

Soundness

3

Presentation

4

Contribution

3

Limitations

See weaknesses and questions.

Summary

This paper proposes a novel frequency-based backdoor attack method named WaveAttack, which can effectively generate the backdoor residuals for the high-frequency component based on DWT, thus ensuring the high fidelity of poisoned samples.

Strengths

1. The paper is well-written and well-structured. 2. Extensive experiments are conducted to validate the attack method. 3 The performance of the attack is surprising.

Weaknesses

The paper is well-written and includes sufficient experiments. However, I am concerned about the limited novelty of this work, as there are already several backdoor attacks [1-4] based on the frequency domain that have been proposed. These works leverage different components/ranges in the frequency domain, and typically, [4] also uses a high-frequency trigger. While the design is different, the high-level ideas are quite similar. References: [1] Feng Y, Ma B, Zhang J, et al. Fiba: Frequency-injection based backdoor attack in medical image analysis[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 20876-20885. [2] Wang T, Yao Y, Xu F, et al. Backdoor attack through frequency domain[J]. arXiv preprint arXiv:2111.10991, 2021. [3] Check your other door! creating backdoor attacks in the frequency domain. [4] Zeng Y, Park W, Mao Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective[C]//Proceedings of the IEEE/CVF international conference on computer vision. 2021: 16473-16481. Minor Points: 1. In section 3.2, the authors mention decomposing the image into four components: LL, LH, HL, HH. Since this is a key idea of the paper, it would be beneficial to explain their meanings and possibly show some examples in the Appendix. 2. In Figure 2, the authors use "encoder" and "decoder," but in the text, they use "generator." It would be better to be consistent with terminology. 3. Asymmetric frequency obfuscation is an important method in this paper. It would be better to describe/introduce it and its motivation in detail earlier in the paper.

Questions

Please See Above.

Rating

4

Confidence

4

Soundness

3

Presentation

3

Contribution

1

Limitations

Yes

Summary

This paper investigated the backdoor attack, aiming at improving the fidelity of poisoned samples. A novel frequency-based backdoor attack method named WaveAttack is proposed to generate highly stealthy backdoor triggers. The experiments show that the poisoned images generated by WaveAttack can achieve high attack effectiveness and fidelity.

Strengths

The proposed attack creates more high-fidelity poisoned samples through Discrete Wavelet Transform (DWT), meanwhile maintaining the attack success rate.

Weaknesses

[Threat model] The threat model illustrated in Section 3.1 is unclear. In the implementation, WaveAttack requires that the attacker fully controls the training process. Therefore, the statement “They can embed backdoors into the DNNs by poisoning the given training dataset” is ambiguous. [Stealthiness] I recommend that the authors conduct more experiments to confirm the advantage of WaveAttack in terms of attack stealthiness. As shown in Figure 3, the difference between FTrojan and WaveAttack is negligible. [Baselines] Most baselines are poisoning-based backdoor attacks, e.g., Adapt-Blend and WaNet. It is not fair to compare WaveAttack with these poisoning-based attacks.

Questions

The threat model is unclear. The stealthiness of the attack should be further confirmed. More comparable baselines should be included, such as LIRA [1]. [1] LIRA: Learnable, Imperceptible and Robust Backdoor Attacks. ICCV, 2021.

Rating

4

Confidence

4

Soundness

2

Presentation

3

Contribution

2

Limitations

The authors adequately discuss the potential security issues related to the proposed backdoor attack. Also, the limitations of the proposed method in terms of computing cost have been mentioned.

Reply to the rebuttal.

Thanks to the authors for the detailed rebuttal. I appreciate the effort and work put into this paper. While the performance does show improvement over previous frequency-based methods, the use of another off-the-shelf algorithm to generate high-frequency components (instead of DCT or Fourier Transformation), though effective, may not fully meet the novelty expectations for a NeurIPS submission. Therefore, I will give at most my current score.