A backdoor attack method based on color frequency injection and adaptive local enhancement
By employing a backdoor attack method that combines color frequency injection and adaptive local enhancement, we have solved the problems of easily introducing high-frequency artifacts and being easily detected in existing technologies, achieving both high-efficiency visual concealment and robustness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NORTH CHINA UNIVERSITY OF TECHNOLOGY
- Filing Date
- 2026-04-15
- Publication Date
- 2026-07-10
AI Technical Summary
Existing backdoor attack methods are prone to introducing high-frequency artifacts, making them easy to detect with statistical defenses, and the attacks are easily rendered ineffective under model reconstruction defenses.
A backdoor attack method based on color frequency injection and adaptive local enhancement is adopted. By introducing low-frequency color shift and high-frequency covert signals into the CIELAB color space, combined with particle swarm optimization algorithm and pre-trained proxy model, poisoned images are generated. Local nonlinear stretching is performed in the HSV color space, and Gaussian smoothing and histogram matching are used to compensate for color enhancement.
It achieves the natural integration of trigger features into the main texture, avoiding visual alertness and attention hijacking, and deeply lurking in the latent space manifold, thus improving the robustness against model reconstruction and preprocessing defense.
Smart Images
Figure CN122365494A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of machine learning and artificial intelligence security technology, specifically to a backdoor attack method based on color frequency injection and adaptive local enhancement. Background Technology
[0002] Deep neural networks (DNNs) have been widely used in safety-critical fields such as facial recognition and autonomous driving, but their security issues are becoming increasingly prominent. Backdoor attacks, as one of the major threats to deep learning security, are similar in concept to implanting a "backdoor" in traditional software. Attackers secretly mix tampered samples (i.e., poisoned samples) into the model's training data to embed a hidden malicious function within the model.
[0003] In standard backdoor attack scenarios, the most realistic threat is the data poisoning model. Attackers construct a poisoned dataset by injecting specific backdoor patterns into a small number of clean samples and altering their labels. A successful backdoor attack needs to simultaneously satisfy high attack effectiveness, functional preservation, extreme stealth, and robustness against defenses.
[0004] Existing backdoor attack methods have the following limitations: 1. Traditional attacks based on locally visible patches (such as BadNets) introduce severe high-frequency artifacts, causing model attention hijacking, which are easily detected by visual or machine detection. 2. Attacks based on globally transparent blending (such as Blended) rely excessively on global linear stacking, and their success rate drops precipitously when faced with preprocessing defenses such as ShrinkPad or compression. 3. Traditional triggers fail to effectively bind to the core semantic regions of the model, and most methods produce abnormal distributions in the latent space, which are easily erased by statistical detection (such as Spectral Signature) or model reconstruction defenses (such as NAD distillation). Summary of the Invention
[0005] To address the aforementioned shortcomings of existing technologies, this invention provides a backdoor attack method based on color frequency injection and adaptive local enhancement, which solves the problems of easy introduction of high-frequency artifacts, susceptibility to statistical defense detection, and easy failure of attacks under model reconstruction defense. To achieve the above-mentioned objective, the technical solution adopted by this invention is: a backdoor attack method based on color frequency injection and adaptive local enhancement, comprising: Build a data poisoning model and obtain a benign training dataset of the victim model; A multi-objective optimization problem is constructed by taking low-frequency color shift and local nonlinear stretching factor as the core parameters to be optimized. Using the particle swarm optimization algorithm, the following data processing steps are executed sequentially in each iteration based on the current core parameters to generate poisoned images and calculate the fitness function: In the CIELAB color space, low-frequency color shift and high-frequency hidden signals are introduced into the image to perform global color-frequency injection; By using a pre-trained surrogate model, a binary mask is generated by evaluating the high-sensitivity receptive field of the localization model through a mixture of gradients and activation maps. Within the HSV color space, local nonlinear stretching factors are applied to the saturation and brightness of the high-sensitivity perceptual domain based on a binary mask to achieve adaptive local enhancement. Gaussian smoothing, adaptive noise, and histogram matching are used to compensate for color enhancement and output a poisoned image. The core parameters are jointly and dynamically updated based on the fitness function until the convergence condition is met.
[0006] The beneficial effects of this invention are as follows: This invention introduces low-frequency color shifts in the CIELAB color space and combines them with adaptive local color stretching to naturally integrate trigger features into the inherent texture of the subject, avoiding sudden brightness changes and attention hijacking that would alert the human eye, thus undermining security audits based on interpretability mechanisms. Simultaneously, the histogram matching module ensures that the trigger depth lies hidden within the latent space manifold of normal data, without generating separable statistical anomalies. Furthermore, this invention anchors the trigger depth to the core semantic regions most sensitive to model classification, forcing defenders to face the risk of model performance collapse when facing stringent defenses such as Neural Attention Distillation (NAD), significantly improving robustness against model reconstruction and preprocessing defenses. Attached Figure Description
[0007] Figure 1 A flowchart of a backdoor attack method based on color frequency injection and adaptive local enhancement is provided for an embodiment. Figure 2 Line plots showing the performance of ACC and ASR as a function of poisoning rate on different datasets; Figure 3 To statistically analyze the feature correlation score distribution of the defense subsurface space; Figure 4 This is a comparison chart of different attack methods on visual concealment and attention heatmaps. Detailed Implementation
[0008] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.
[0009] like Figure 1 As shown, in one embodiment of the present invention, a backdoor attack method based on color frequency injection and adaptive local enhancement includes: S1. In the CIELAB color space, the low-frequency color shift and high-frequency masking signal are introduced into the images in the benign training dataset to perform global color-frequency injection.
[0010] Define the global color offset vector as Define the high-frequency covert signal in the frequency domain. ; Calculate the image after global color-frequency injection Its expression is:
[0011] S2. Using a pre-trained surrogate model, the high-sensitivity receptive field of the localization model is evaluated through a mixture of gradients and activation maps, generating a binary mask. The class activation map of the target category is calculated. With pixel-level gradient magnitude matrix The expression for the gradient is:
[0012] Normalize and weight the two results to obtain the sensitivity score matrix. :
[0013] Binarized region of interest masks are generated by adaptive percentile threshold truncation. .
[0014] S3. Within the HSV color space, based on the binary mask, apply the local nonlinear stretching factor to the saturation and brightness of the high-sensitivity perceptual domain respectively, performing adaptive local enhancement. Apply the local nonlinear stretching factor to the saturation channel and the brightness channel respectively. , Its expression is:
[0015]
[0016]
[0017] S4. Gaussian smoothing, adaptive noise, and histogram matching are used to perform edge processing and statistical distribution alignment on the locally enhanced image, completing the compensated color enhancement. A Gaussian kernel is applied and Gaussian noise is injected to obtain a smoothed image. Its expression is:
[0018] Forced mapping of the cumulative distribution function for statistical alignment, the expression is:
[0019] S5. Based on the calculated fitness function, jointly and dynamically update the core parameters until the convergence condition is met. Calculate the cross-entropy loss of the surrogate model on the temporarily poisoned samples. :
[0020] A penalty function is constructed by introducing structural similarity metrics and perceptual image patch similarity metrics. :
[0021] Calculate the overall fitness function And update the parameters:
[0022] To further verify the effectiveness and performance of the method proposed in this invention, the following simulation experiments were conducted.
[0023] This experiment was conducted on the CIFAR-10, GTSRB, CIFAR-100, and ImageNet datasets, using ResNet-18 as the default victim model. The proposed backdoor attack method is compared with eight advanced attack methods, including BadNets, Blended, and WaNet.
[0024] This embodiment first evaluates the impact of different poisoning rates (1% to 10%) on attack performance. The results show that as the poisoning rate increases, the attack success rate (ASR) on all datasets exhibits a significant upward trend. Particularly on the high-resolution ImageNet and the GTSRB dataset depicting real-world traffic scenes, an extremely low poisoning rate of only 1% achieves attack success rates of 91.83% and 90.57%, respectively, demonstrating the strong generalization ability and learning efficiency of this invention in complex tasks. When the poisoning rate is set to 5%, this invention achieves the optimal performance balance on all four datasets. The attack effectiveness results under different poisoning rates are shown in Table 1 and... Figure 2 As shown.
[0025] Table 1
[0026] Meanwhile, to verify the threat in real combat, this experiment tested the robustness of the method under three mainstream defense mechanisms, including preprocessing defense (ShrinkPad) and model reconstruction defense (Fine-Pruning, NAD). The comparison results are shown in Table 2. It can be seen that the method has a significant advantage when facing the current mainstream defense technologies.
[0027] Table 2
[0028] Modern backdoor defenses typically identify poisoned samples by detecting anomalous statistical distributions or model attention. To verify the deep stealth of this invention, tests were conducted in both the latent feature space and the visual perception domain.
[0029] In terms of feature space concealment, such as Figure 3 As shown, under the Spectral Signature statistical detection defense, the feature correlation score distributions of the poisoned samples and clean samples generated by this invention highly overlap in the latent space. This is because this invention forces the color distribution of the poisoned samples to align with the clean background, causing the trigger features to lie deep within the latent space manifold of the normal data, without producing any separable anomalous mutations, thus completely dismantling the feature detection mechanism.
[0030] In terms of visual perception and attention masquerading, this invention introduces Grad-CAM to visualize the attention distribution of infected models during inference. For example... Figure 4 As shown, the three sets of comparison images from left to right are, in order, a clean sample, a BadNets attack sample, and an attack sample generated by this invention, along with their corresponding attention heatmaps. The clean model's natural attention distribution over the original image accurately covers the core semantic features of the target subject. When using traditional local patch attacks (BadNets), the trigger causes the model's decision focus to completely detach from the semantic subject, resulting in an easily detectable "attention hijacking." However, the model infected by this invention maintains a highly consistent feature focus with the clean model even when facing poisoned samples. This invention seamlessly integrates the trigger features into the inherent texture of the subject, achieving "attention camouflage" and providing ultimate concealment at both the visual and model perception levels.
[0031] In summary, this invention, through a mechanism combining global color-frequency injection, sensitivity-based feature localization, and compensation enhancement, along with PSO global parameter optimization, not only achieves efficient implantation of hidden features but also demonstrates strong anti-interference capabilities when facing modern mainstream input preprocessing and model reconstruction defenses, enabling infected models to maintain extremely high attack success rates and visual perception concealment.
Claims
1. A backdoor attack method based on color frequency injection and adaptive local enhancement, characterized in that, include: Build a data poisoning model and obtain a benign training dataset of the victim model; A multi-objective optimization problem is constructed by taking low-frequency color shift and local nonlinear stretching factor as the core parameters to be optimized. Using the particle swarm optimization algorithm, the following data processing steps are executed sequentially in each iteration based on the current core parameters to generate poisoned images and calculate the fitness function: In the CIELAB color space, the low-frequency color shift and high-frequency hidden signal are introduced into the images in the benign training dataset to perform global color-frequency injection; By utilizing a pre-trained surrogate model, a binary mask is generated by evaluating the high-sensitivity receptive field of the localization model through a mixture of gradients and activation maps, thereby achieving sensitivity-based region discovery. Within the HSV color space, based on the binary mask, the local nonlinear stretching factor is applied to the saturation and brightness of the high-sensitivity perceptual domain respectively to perform adaptive local enhancement; Gaussian smoothing, adaptive noise, and histogram matching are used to perform edge processing and statistical distribution alignment on the locally enhanced image, and color enhancement is completed to output the generated poisoned image. Based on the calculated fitness function, the core parameters are jointly and dynamically updated until the convergence condition is met, thus obtaining an optimized backdoor attack strategy.
2. The method according to claim 1, characterized in that, The specific method for introducing low-frequency color shifts and high-frequency masking signals into images in the CIELAB color space is as follows: Define the global color offset vector as: ； The high-frequency covert signal is defined in the frequency domain. Calculate the image after global color-frequency injection Its expression is: ； in, This represents the input benign image. A non-linear transformation function representing a color space. It is a two-dimensional inverse discrete Fourier transform. This is the intensity control factor for the frequency domain mode.
3. The method according to claim 1, characterized in that, The specific method for locating the high-sensitivity receptive field of the model and generating a binary mask is as follows: The image after global color-frequency injection is input into the pre-trained surrogate model. In the middle, the class activation graph of the target category is calculated. ; Calculate the pixel-level gradient magnitude matrix Its expression is: ； in, Represents the cross-entropy loss function. Indicates the target category; The class activation map and gradient magnitude matrix are normalized and weighted and fused to obtain the sensitivity score matrix. : ； in, and The weighting coefficients are used; the sensitivity score matrix is truncated using an adaptive percentile threshold to generate a binarized region of interest mask. .
4. The method according to claim 3, characterized in that, The specific method for adaptive local enhancement is as follows: The image after global color-frequency injection is converted to the HSV color space; local nonlinear stretching factors are applied to the saturation and brightness channels respectively. , Its expression is: ； ； ； in, and These represent the enhanced saturation and brightness, respectively; the processed image is then converted back to the RGB color space to obtain the locally enhanced image. .
5. The method according to claim 4, characterized in that, The specific method for achieving color enhancement compensation is as follows: Apply Gaussian kernel The boundaries of the binarized region of interest mask are smoothed, and Gaussian noise matching the local signal-to-noise ratio of the image is injected to obtain a smoothed image. Its expression is: ； in, It is Gaussian noise; Enhance the color cumulative distribution function of the region Color cumulative distribution function forcibly mapped to local background regions Its expression is: ； in, To output the generated poisoned image.
6. The method according to claim 1, characterized in that, The specific method for calculating the fitness function is as follows: The core parameters to be optimized are denoted as a parameter vector. =( , , , , ); Calculate the cross-entropy loss of the pre-trained surrogate model on temporarily generated poisoned samples. : ； in, This is a batch of samples that were temporarily poisoned. Indicates that the parameter is affected Combination of forward data processing steps for control; A penalty function is constructed by introducing structural similarity metrics and perceptual image patch similarity metrics. : ； in, and These are the set perception thresholds; The overall fitness function is calculated based on the cross-entropy loss and penalty function. : ； in, Hyperparameters for controlling the intensity of punishment.