A backdoor attack method based on a learnable frequency domain trigger
By employing learnable frequency domain triggers and three-stage progressive training, combined with dynamic regularization optimization, the adaptability and stability issues of frequency domain backdoor attacks are resolved, achieving backdoor attacks with high concealment and high success rate, applicable to various image classification datasets and network architectures.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHANGCHUN UNIV
- Filing Date
- 2026-06-15
- Publication Date
- 2026-07-14
AI Technical Summary
Existing frequency domain backdoor attack methods cannot adaptively adjust to the characteristics of the target model and dataset, resulting in limited attack performance and problems such as energy runaway and model instability, which affect the stealth and practicality of the attack.
A learnable frequency domain trigger is adopted, combined with spectral amplitude parameters and frequency masks. Through three-stage progressive training and dynamic regularization optimization, poisoned images are generated and the model is trained. The weight of the regularization loss term is adjusted by an adaptive optimization mechanism to achieve adaptive adjustment and energy constraint of the frequency domain trigger.
It achieves end-to-end adaptive frequency domain trigger optimization, which improves the stealth and success rate of attacks, maintains model stability and accuracy, and is applicable to a variety of image classification datasets and network architectures.
Smart Images
Figure CN122391765A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to a backdoor attack method based on a learnable frequency domain trigger. Background Technology
[0002] With the widespread application of deep learning technology in security-sensitive fields such as autonomous driving, facial recognition, and financial risk control, model security has become a core issue of common concern in academia and industry. While neural network models demonstrate superior performance in various tasks, their inherent vulnerabilities also leave opportunities for malicious attacks. Backdoor attacks, as one of the most insidious threats, inject specific triggers during the training phase, causing the model to maintain expected behavior for normal inputs during the inference phase, while producing erroneous outputs predetermined by the attacker for inputs carrying triggers, thus posing a serious security threat to critical infrastructure.
[0003] Traditional backdoor attack methods primarily employ data poisoning strategies, which involve injecting malicious samples with spatial domain triggers into the training set and then labeling the samples as the target category using label flipping. While these methods can achieve high attack success rates, their inherent flaws severely limit their practical effectiveness. Specifically, the visual saliency problem of spatial domain triggers is particularly prominent: whether it's a fixed pattern or adaptively generated pixel blocks, it will produce unnatural texture artifacts or color distortions in local areas of the image, creating obvious perceptual anomalies in the human visual system and significantly reducing the stealth and practicality of the attack.
[0004] To enhance attack stealth, recent research has begun exploring backdoor injection mechanisms in the frequency domain. Compared to direct pixel modification in the spatial domain, frequency domain perturbations can distribute trigger energy across the entire image region, avoiding local visual artifacts. However, existing frequency domain methods still have significant limitations: most schemes employ predefined fixed spectral perturbation patterns, which cannot be adjusted according to the learning dynamics of the target model and the characteristics of the dataset, resulting in limited attack performance. Furthermore, such methods often neglect energy constraint mechanisms, potentially leading to problems such as runaway spectral energy and unstable model convergence.
[0005] Therefore, there is an urgent need to develop a new backdoor attack paradigm that integrates learnable frequency domain masks and adaptive optimization mechanisms for the security detection and evaluation of deep learning models. Summary of the Invention
[0006] To address the urgent need for a new backdoor attack paradigm that integrates learnable frequency domain masks and adaptive optimization mechanisms for the security detection and evaluation of deep learning models, this invention provides a backdoor attack method based on learnable frequency domain triggers, specifically: S1. Construct a learnable frequency domain trigger, wherein the trigger includes two types of learnable parameters, specifically learnable spectral amplitude parameters. and learnable frequency mask ; S2. Generate a poisoned image, which is derived from the original image. After transformation, the poisoned image is used to be mixed with clean samples in the subsequent three-stage progressive training and jointly input into the attacked classification model. S3, a three-stage progressive training method, employs a backdoor attack to train the attacked classification model. The training process for backdoor attacks is divided into a warm-up phase, a balancing phase, and a fine-tuning phase. S4. Dynamic regularization and adaptive optimization: A regularization loss term is introduced for the learnable spectral amplitude parameter. and the learnable frequency mask Constraints are imposed, an overall objective function is defined, and the weight coefficients of each regularization loss term are dynamically adjusted based on the current attack success rate. S5. Model saving and performance evaluation: During the training process, periodically evaluate the accuracy of the attacked classification model on clean data and the success rate of backdoor attacks on the test set, and save the model parameters that meet the preset conditions.
[0007] Furthermore, the process of generating poisoned images specifically involves: taking the original image... Decomposed into amplitude spectrum by two-dimensional discrete Fourier transform and phase spectrum ; through the learnable frequency mask The learnable spectral amplitude parameter Amplitude spectrum compared to the original image Adaptive fusion is performed to generate a poisoning amplitude spectrum. The poisoning amplitude spectrum Phase spectrum of the original image Combining the images and generating spatial domain poisoning images via inverse Fourier transform. .
[0008] Furthermore, the three-stage progressive training is specifically as follows: Preheating phase: Using a first poisoning rate and a first trigger intensity, the attacked classification model is made to learn the normal classification task first, wherein the first poisoning rate is less than the preset poisoning rate and the first trigger intensity is less than the preset trigger intensity; Balancing phase: Employs a second poisoning rate and a second trigger intensity, along with a linearly increasing backdoor loss weight. Gradually establish a balance between normal classification and backdoor attacks, wherein the second poisoning rate is between the first poisoning rate and the preset poisoning rate, and the second triggering intensity is between the first triggering intensity and the preset triggering intensity; Fine-tuning phase: Using the third poisoning rate and the third trigger strength, continue to use linearly increasing backdoor loss weights. Optimize the final performance of the attacked classification model, wherein the third poisoning rate is equal to or close to the preset poisoning rate, and the third trigger strength is equal to the preset trigger strength.
[0009] Furthermore, the first poisoning rate during the preheating stage is 0.2 to 0.4 times the preset poisoning rate, and the first triggering intensity is 0.2 to 0.4 times the preset triggering intensity; The second poisoning rate in the equilibrium phase is 0.5 to 0.7 times the preset poisoning rate, the second trigger intensity is 0.5 to 0.7 times the preset trigger intensity, and the backdoor loss weight increases linearly from 0.2 to 0.4 to 0.9 to 1.0. The third poisoning rate in the fine-tuning phase is 0.9 to 1.0 times the preset poisoning rate, the third trigger strength is the preset trigger strength, and the backdoor loss weight is 0.7 to 0.9.
[0010] Furthermore, the regularization loss term includes: Energy confinement loss: Used to constrain the learnable spectral amplitude parameter energy, Represents the square of the L2 normal form; Total variational loss: Used to smooth the learnable spectral amplitude parameters To avoid high-frequency noise, among which, Indices representing the height direction. Indicates the index in the width direction; Mask sparsity loss: Used to facilitate the learnable frequency mask sparsity, This represents the L1 paradigm.
[0011] Furthermore, the overall objective function is defined as: ; in, Represents the cross-entropy loss function. The classification model that was attacked. For the original image, Image of a poisoned device. For the original tag, The target backdoor is tagged. For dynamically adjusted backdoor loss weights, These are the weighting coefficients for the total variational loss, energy constraint loss, and mask sparsity loss, respectively.
[0012] Furthermore, the specific method of dynamically adjusting the weight coefficients of each regularization loss term based on the current attack success rate is as follows: a shared adaptive factor is set for each regularization loss term, the value of which is determined by the current attack success rate. When the attack success rate is less than the first threshold, the adaptive factor adopts the first weight coefficient; When the attack success rate is between the first threshold and the second threshold, the adaptive factor adopts the second weighting coefficient. When the attack success rate is greater than the second threshold, the adaptive factor adopts the third weight coefficient; Wherein, the first threshold is 20% to 40%, the second threshold is 50% to 70%, the first weighting coefficient is 0.05 to 0.15, the second weighting coefficient is 0.2 to 0.4, and the third weighting coefficient is 0.8 to 1.0.
[0013] The beneficial effects of the method described in this invention are as follows: (1) End-to-end learnable: The trigger spectrum and frequency mask are automatically optimized through backpropagation, requiring no manual design. They can be adaptively adjusted according to the characteristics of the target model and dataset, and have strong generalization ability.
[0014] (2) High concealment: Through the spectrum protection mechanism, the trigger energy is concentrated in the low-to-mid frequency band that the model is sensitive to, avoiding high-frequency artifacts; at the same time, through the joint constraints of energy constraint, total variation and mask sparsity loss, the generated poisoned image is visually almost indistinguishable from the original image, which can effectively avoid human eye detection and frequency domain defense methods.
[0015] (3) Balance between high attack success rate and model accuracy: Through a three-stage progressive training strategy, from the low poisoning rate and low trigger intensity in the warm-up stage, to the gradual enhancement in the balance stage, and then to the full-intensity optimization in the fine-tuning stage, the optimal balance between clean data accuracy and backdoor attack success rate is achieved.
[0016] (4) Strong training stability: Through the adaptive regularization mechanism, the regularization weight is dynamically adjusted according to the current attack success rate. The constraint strength is reduced when the attack performance is not fully established, and the constraint is strengthened after the attack performance is stable, thus avoiding oscillation and divergence during the training process.
[0017] (5) Strong versatility: This invention is applicable to a variety of image classification datasets (such as MNIST, GTSRB, CelebA) and a variety of network architectures (such as ResNet series), and has good transferability and universality. Attached Figure Description
[0018] Figure 1 This is an overall architecture diagram of the backdoor attack method based on a learnable frequency domain trigger in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the generation of toxic images in an embodiment of the present invention; Figure 3 This is a flowchart of the three-stage progressive training strategy in an embodiment of the present invention. Detailed Implementation
[0019] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.
[0020] Example 1 This embodiment provides a backdoor attack method based on a learnable frequency domain trigger, such as... Figure 1 The diagram shown is an overall flowchart of the method. The method specifically includes: Step 1: Construct a learnable frequency domain trigger, which includes two types of learnable parameters, specifically learnable spectral amplitude parameters. and learnable frequency mask log-probability parameter Learnable frequency mask By the above It is obtained by applying the Sigmoid function and is used to control the spatial distribution of the trigger in the frequency domain; Represents the set of real numbers. , and These represent the number of channels, height, and width of the image, respectively. The learnable frequency domain trigger functions by utilizing the learnable spectral amplitude parameters. According to the learnable frequency mask The indicated frequency domain position replaces the amplitude spectrum of the original image, thereby generating a poisoned image carrying a backdoor pattern.
[0021] Step 2: Generate the poisoned image, using the original image... Decomposed into amplitude spectrum by two-dimensional discrete Fourier transform and phase spectrum ; through the learnable frequency mask The learnable spectral amplitude parameter Amplitude spectrum compared to the original image Adaptive fusion is performed to generate a poisoning amplitude spectrum. The poisoning amplitude spectrum Phase spectrum of the original image Combining the images and generating spatial domain poisoning images via inverse Fourier transform. Poisoning images The purpose of this is to serve as a training sample carrying a backdoor trigger, which is then mixed with clean samples in the subsequent three-stage progressive training in step 3 and input into the attacked classification model. This allows the model to learn the incorrect association between the poisoned image and the target label, thereby enabling backdoor implantation.
[0022] Step 3: Three-stage progressive training, dividing the backdoor attack training process into a warm-up stage, a balancing stage, and a fine-tuning stage; where the attacked classification model is denoted as... Its parameters are optimized through training; different poisoning rates, trigger strengths and backdoor loss weights are used in each stage to achieve a smooth transition from clean-first to attack-enhanced. Step 4: Dynamic regularization and adaptive optimization, introducing a regularization loss term for the learnable spectral amplitude parameter. and the learnable frequency mask Constraints are imposed, an overall objective function is defined, and the weight coefficients of each regularization loss term are dynamically adjusted based on the current attack success rate. Step 5: Model saving and performance evaluation. During the training process, periodically evaluate the accuracy of the attacked classification model on clean data and the success rate of backdoor attacks on the test set, and save the model parameters that meet the preset conditions.
[0023] Example 2 This embodiment further defines Embodiment 1 and provides a further explanation of Embodiment 1. For example... Figure 2 As shown, in step 2, the specific steps for performing Fourier transform, spectral decomposition, and trigger injection on the original image are as follows: Step 211: Process the original image Applying a two-dimensional discrete Fourier transform yields a complex signal in the frequency domain. ,in Represents the two-dimensional Fourier transform operator. Represents the set of complex numbers; Step 212: Decompose the frequency domain complex signal into an amplitude spectrum. and phase spectrum ,in and These represent the amplitude and phase of the complex signal, respectively. Step 213: Analyze the amplitude spectrum. Perform spectrum centering processing to obtain ,in Represents the spectrum centering operator. The amplitude spectrum after centering; Step 214, using the formula Generate poisoning amplitude spectrum ,in To control the scaling factor of the trigger injection strength, This indicates element-wise multiplication. The final frequency domain mask after applying spectrum protection; Step 215: Reconstruct the poisoned image through inverse centering and inverse Fourier transform. ,in For inverse spectrum centering operator, For inverse Fourier transform operators, It is the imaginary unit.
[0024] This also includes a spectrum protection mechanism: defining a binary protection mask. Its element values satisfy: ; in, and For frequency domain coordinate index, and These are the height and width of the image, respectively; The final injection mask is the element-wise product of the learnable frequency mask and the binary protection mask: This limits the injection region of the trigger to the mid-frequency region of the spectrum.
[0025] Example 3 This embodiment further defines and explains Embodiment 1. Figure 3 The diagram shows a flowchart of a three-stage progressive training strategy. In step 3, the specific configuration of the three-stage progressive training is as follows: Preheating phase: A first poisoning rate and a first trigger intensity are used to enable the model to prioritize learning normal classification tasks, wherein the first poisoning rate is less than a preset poisoning rate and the first trigger intensity is less than a preset trigger intensity; Balancing phase: Employs a second poisoning rate and a second trigger intensity, along with a linearly increasing backdoor loss weight. Gradually establish a balance between normal classification and backdoor attacks, wherein the second poisoning rate is between the first poisoning rate and the preset poisoning rate, and the second triggering intensity is between the first triggering intensity and the preset triggering intensity; Fine-tuning phase: Using the third poisoning rate and the third trigger strength, continue to use linearly increasing backdoor loss weights. To optimize the final performance of the model, wherein the third poisoning rate is equal to or close to the preset poisoning rate, and the third triggering intensity is equal to the preset triggering intensity.
[0026] The specific configuration of the three-stage progressive training is as follows: The first poisoning rate during the preheating stage is 0.2 to 0.4 times the preset poisoning rate, and the first triggering intensity is 0.2 to 0.4 times the preset triggering intensity. The second poisoning rate in the equilibrium phase is 0.5 to 0.7 times the preset poisoning rate, the second trigger intensity is 0.5 to 0.7 times the preset trigger intensity, and the backdoor loss weight increases linearly from 0.2 to 0.4 to 0.9 to 1.0. The third poisoning rate in the fine-tuning phase is 0.9 to 1.0 times the preset poisoning rate, the third trigger strength is the preset trigger strength, and the backdoor loss weight is 0.7 to 0.9.
[0027] Example 4 This embodiment further defines and explains Embodiment 1.
[0028] In step 4, the regularization loss term includes: Energy confinement loss: The energy used to constrain the learnable spectral amplitude parameter Represents the square of the L2 normal form; Total variational loss: This is used to smooth the learnable spectral amplitude parameters and avoid high-frequency noise, wherein... Indices representing the height direction. Indicates the index in the width direction; Mask sparsity loss: This is used to promote the sparsity of the learnable frequency mask. Indicates L1 normal form; Furthermore, in step 4, the overall objective function is defined as: ; in, Represents the cross-entropy loss function. The classification model that was attacked. For the original image, Image of a poisoned device. For the original tag, The target backdoor is tagged. For dynamically adjusted backdoor loss weights, These are the weighting coefficients for the total variational loss, energy constraint loss, and mask sparsity loss, respectively.
[0029] Furthermore, each regularization loss term has a baseline weight, which is dynamically adjusted with each training epoch: it is 0 at the initial stage of training and rises to a preset final weight value as the training epochs increase; different regularization terms can be set with different start delay epochs and different final weight values. Based on this, the actual weight coefficients of each regularization loss term are dynamically adjusted according to the current attack success rate. Specifically, a shared adaptive factor is set, the value of which is determined by the current attack success rate. When the attack success rate is less than the first threshold, the adaptive factor adopts the first weight coefficient; When the attack success rate is between the first threshold and the second threshold, the adaptive factor adopts the second weighting coefficient. When the attack success rate is greater than the second threshold, the adaptive factor adopts the third weight coefficient; Wherein, the first threshold is 20% to 40%, the second threshold is 50% to 70%, the first weighting coefficient is 0.05 to 0.15, the second weighting coefficient is 0.2 to 0.4, and the third weighting coefficient is 0.8 to 1.0.
[0030] In this embodiment, the preset final value of the baseline weight for energy constraint loss is 0.001, and the start delay is 5 training rounds; the preset final value of the baseline weight for mask sparsity loss is 0.005, and the start delay is 10 rounds after the warm-up phase; the preset final value of the baseline weight for total variation loss is the product of the baseline weight for energy constraint loss and a scaling factor of 0.01, and its start delay is the same as that for energy constraint loss.
[0031] Their values can be understood as: adaptive factor * their respective baseline weights.
[0032] Example 5 This embodiment further defines and explains Embodiment 1.
[0033] In step 5, the preset conditions include at least one of the following: The current test set clean data accuracy exceeds the preset threshold and is better than the historical best test set clean data accuracy. The current training round is an integer multiple of the preset number of cycles; The current training round is the last training round.
Claims
1. A backdoor attack method based on a learnable frequency domain trigger, characterized in that, The method includes the following steps: S1. Construct a learnable frequency domain trigger, wherein the trigger includes two types of learnable parameters, specifically learnable spectral amplitude parameters. and learnable frequency mask ; S2. Generate a poisoned image, which is derived from the original image. After transformation, the poisoned image is used to be mixed with clean samples in the subsequent three-stage progressive training and jointly input into the attacked classification model. S3, a three-stage progressive training method, employs a backdoor attack to train the attacked classification model. The training process for backdoor attacks is divided into a warm-up phase, a balancing phase, and a fine-tuning phase. S4. Dynamic regularization and adaptive optimization: A regularization loss term is introduced for the learnable spectral amplitude parameter. and the learnable frequency mask Constraints are imposed, an overall objective function is defined, and the weight coefficients of each regularization loss term are dynamically adjusted based on the current attack success rate. S5. Model saving and performance evaluation: During the training process, periodically evaluate the accuracy of the attacked classification model on clean data and the success rate of backdoor attacks on the test set, and save the model parameters that meet the preset conditions.
2. The backdoor attack method based on a learnable frequency domain trigger according to claim 1, characterized in that, The process of generating poisoned images is as follows: The original image is... Decomposed into amplitude spectrum by two-dimensional discrete Fourier transform and phase spectrum ; through the learnable frequency mask The learnable spectral amplitude parameter Amplitude spectrum compared to the original image Adaptive fusion is performed to generate a poisoning amplitude spectrum. ; The poisoning amplitude spectrum Phase spectrum of the original image Combining the images and generating spatial domain poisoning images via inverse Fourier transform. .
3. The backdoor attack method based on a learnable frequency domain trigger according to claim 2, characterized in that, The three-stage progressive training is as follows: Preheating phase: Using a first poisoning rate and a first trigger intensity, the attacked classification model is made to learn the normal classification task first, wherein the first poisoning rate is less than the preset poisoning rate and the first trigger intensity is less than the preset trigger intensity; Balancing phase: Employs a second poisoning rate and a second trigger intensity, along with a linearly increasing backdoor loss weight. Gradually establish a balance between normal classification and backdoor attacks, wherein the second poisoning rate is between the first poisoning rate and the preset poisoning rate, and the second triggering intensity is between the first triggering intensity and the preset triggering intensity; Fine-tuning phase: Using the third poisoning rate and the third trigger strength, continue to use linearly increasing backdoor loss weights. Optimize the final performance of the attacked classification model, wherein the third poisoning rate is equal to or close to the preset poisoning rate, and the third trigger strength is equal to the preset trigger strength.
4. The backdoor attack method based on a learnable frequency domain trigger according to claim 3, characterized in that, The first poisoning rate during the preheating stage is 0.2 to 0.4 times the preset poisoning rate, and the first triggering intensity is 0.2 to 0.4 times the preset triggering intensity. The second poisoning rate in the equilibrium phase is 0.5 to 0.7 times the preset poisoning rate, the second trigger intensity is 0.5 to 0.7 times the preset trigger intensity, and the backdoor loss weight increases linearly from 0.2 to 0.4 to 0.9 to 1.
0. The third poisoning rate in the fine-tuning phase is 0.9 to 1.0 times the preset poisoning rate, the third trigger strength is the preset trigger strength, and the backdoor loss weight is 0.7 to 0.
9.
5. A backdoor attack method based on a learnable frequency domain trigger according to claim 4, characterized in that, The regularization loss term includes: Energy confinement loss: Used to constrain the learnable spectral amplitude parameter energy, Represents the square of the L2 normal form; Total variational loss: Used to smooth the learnable spectral amplitude parameters To avoid high-frequency noise, among which, Indices representing the height direction. Indicates the index in the width direction; Mask sparsity loss: Used to facilitate the learnable frequency mask sparsity, This represents the L1 paradigm.
6. A backdoor attack method based on a learnable frequency domain trigger according to claim 5, characterized in that, The overall objective function is defined as follows: ； in, Represents the cross-entropy loss function. The classification model that was attacked. For the original image, Image of a poisoned device. For the original tag, The target backdoor is tagged. For dynamically adjusted backdoor loss weights, These are the weighting coefficients for the total variational loss, energy constraint loss, and mask sparsity loss, respectively.
7. A backdoor attack method based on a learnable frequency domain trigger according to claim 6, characterized in that, The specific method for dynamically adjusting the weight coefficients of each regularization loss term based on the current attack success rate is as follows: a shared adaptive factor is set for each regularization loss term, the value of which is determined by the current attack success rate. When the attack success rate is less than the first threshold, the adaptive factor adopts the first weight coefficient; When the attack success rate is between the first threshold and the second threshold, the adaptive factor adopts the second weighting coefficient. When the attack success rate is greater than the second threshold, the adaptive factor adopts the third weight coefficient; Wherein, the first threshold is 20% to 40%, the second threshold is 50% to 70%, the first weighting coefficient is 0.05 to 0.15, the second weighting coefficient is 0.2 to 0.4, and the third weighting coefficient is 0.8 to 1.
0.
8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-7.
9. A computer-readable storage medium for storing computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-7.