WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks
  Against Deep Neural Networks
Due to the popularity of Artificial Intelligence (AI) technology, numerous
backdoor attacks are designed by adversaries to mislead deep neural network
predictions by manipulating training samples and training processes. Although
backdoor attacks are effective in various real scenarios, they still suffer
from the problems of both low fidelity of poisoned samples and non-negligible
transfer in latent space, which make them easily detectable by existing
backdoor detection algorithms. To overcome the weakness, this paper proposes a
novel frequency-based backdoor attack method named WaveAttack, which obtains
image high-frequency features through Discrete Wavelet Transform (DWT) to
generate backdoor triggers. Furthermore, we introduce an asymmetric frequency
obfuscation method, which can add an adaptive residual in the training and
inference stage to improve the impact of triggers and further enhance the
effectiveness of WaveAttack. Comprehensive experimental results show that
WaveAttack not only achieves higher stealthiness and effectiveness, but also
outperforms state-of-the-art (SOTA) backdoor attack methods in the fidelity of
images by up to 28.27\% improvement in PSNR, 1.61\% improvement in SSIM, and
70.59\% reduction in IS.
Jun Xia, Zhihao Yue, Yingbo Zhou, Zhiwei Ling, Xian Wei, Mingsong Chen
# WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks

###### Abstract

Due to the increasing popularity of Artificial Intelligence (AI), more and more backdoor attacks are designed to mislead Deep Neural Network (DNN) predictions by manipulating training samples and training processes. Although backdoor attacks have been investigated in various real scenarios, they still suffer from the problems of both low fidelity of poisoned samples and non-negligible transfer in latent space, which make them easily detectable by existing backdoor detection algorithms. To overcome this weakness, we propose a novel frequency-based backdoor attack method named WaveAttack, which obtains image high-frequency features through Discrete Wavelet Transform (DWT) to generate backdoor triggers. Furthermore, we introduce an asymmetric frequency obfuscation method, which can add an adaptive residual in the training and inference stage to improve the impact of triggers and further enhance the effectiveness of WaveAttack. Comprehensive experimental results show that WaveAttack not only achieves higher stealthiness and effectiveness, but also outperforms state-of-the-art (SOTA) backdoor attack methods in the fidelity of images by up to 28.27% improvement in PSNR, 1.61% improvement in SSIM, and 70.59% reduction in IS.

## Introduction

Along with the prosperity of Artificial Intelligence (AI), Deep Neural Networks (DNNs) have become increasingly prevalent in numerous safety-critical domains for precise perception and real-time control, such as autonomous vehicles [22], medical diagnosis [23], and industrial automation [14]. However, the trustworthiness of DNNs faces significant threats due to various notorious adversarial and backdoor attacks. Typically, adversarial attacks [1] manipulate input data during the inference stage to induce incorrect predictions by a trained DNN, whereas backdoor attacks [15] tamper with training samples or training processes to embed concealed triggers during the training stage, which can be exploited to generate malicious outputs. Although adversarial attacks on neural networks frequently appear in various scenarios, backdoor attacks have attracted more attention due to their stealthiness and effectiveness. Generally, the performance of backdoor attacks can be evaluated by the following three objectives of an adversary: i) _efficacy_ that refers to the effectiveness of an attack in causing the target model to produce incorrect outputs or exhibit unintended behavior; ii) _specificity_ that denotes the precision of the attack in targeting a specific class; and iii) _fidelity_ that represents the degree to which adversarial examples or poisoned training samples are indistinguishable from their benign counterparts [13]. Note that efficacy and specificity represent the effectiveness of backdoor attacks, while fidelity denotes the stealthiness of backdoor attacks.

Aiming at higher stealthiness and effectiveness, existing backdoor attack methods (e.g., IAD [24], WaNet [24], BppAttack [25], and FTrojan [26]) are built based on various optimizations, which can be mainly classified into two categories. The first one is the _sample minimal impact_ methods that can optimize the size of the trigger and minimize its pixel value, making the backdoor trigger hard to detect in training samples for the purpose of achieving a high stealthiness of a backdoor attacker. Although these methods are promising in backdoor attacks, due to the explicit trigger influence on training samples, they cannot fully evade the existing backdoor detection methods based on training samples. The second one is the _latent space obfuscation-based_ methods, which can be integrated into any existing backdoor attack methods. By employing asymmetric samples, these methods can obfuscate the latent space between benign samples and poisoned samples [23, 24]. Although these methods can bypass latent space detection techniques, they greatly suffer from low image quality, making them extremely difficult to apply in practice. Therefore, _how to improve both the effectiveness and stealthiness of backdoor attacks while minimally impacting the quality of training samples is becoming a significant challenge in the development of backdoor attacks, especially when facing various state-of-the-art backdoor detection methods_.

This paper draws inspiration from the work [23] where Wang et al. find that high-frequency features can enhance the generalization ability of DNNs and remain imperceptible to humans. To acquire high-frequency components (i.e., high-frequency features), wavelet transform has been widely investigated in various image-processing tasks [11, 22, 20]. This paper introduces a novel frequency-based backdoor attack method named WaveAttack, which utilizes Discrete Wavelet Transform (DWT) to extract the high-frequency component for
backdoor trigger generation. Furthermore, to improve the impact of triggers and further enhance the effectiveness of our approach, we employ _asymmetric frequency obfuscation_ that utilizes an asymmetric coefficient of the trigger in the high-frequency domain during the training and inference stages. This paper makes the following three contributions:

* We introduce a frequency-based backdoor trigger generation method named WaveAttack, which can effectively generate the backdoor residuals for the high-frequency component based on DWT, thus ensuring the high fidelity of poisoned samples.
* We propose a novel asymmetric frequency-based obfuscation backdoor attack method to enhance its stealthiness and effectiveness, which can not only increase stealthiness in the latent space but also improve the Attack Success Rate (ASR) in training samples.
* We conduct comprehensive experiments to demonstrate that WaveAttack outperforms SOTA backdoor attack methods regarding both stealthiness and effectiveness.

## Related Work

**Backdoor Attack.** Typically, backdoor attacks try to embed backdoors into DNNs by manipulating their input samples and training processes. In this way, adversaries can control DNN outputs through concealed triggers, thus resulting in manipulated predictions [10]. Based on whether the training process is manipulated, existing backdoor attacks can be categorized into two types, i.e., _trainingsummipulated_ and _training-manipulated_ attacks. Specifically, the training-unmanipulated attacks only inject a visible or invisible trigger into the training samples of some DNN, leading to its recognition errors [2]. For instance, Chen et al. [3] introduced a Blend attack that generates poisoned data by merging benign training samples with specific key visible triggers. Moreover, there exist a large number of invisible trigger-based backdoor attack methods, such as natural reflection [11], human imperceptible noise [23], and image perturbation [24], which exploit the changes induced by real-world physical environments. Although these training-unmanipulated attacks are promising, due to their substantial impacts on training sample quality, most of them still can be easily identified somehow. As an alternative, the training-manipulated attacks [22, 23] assume that adversaries from some malicious third party can control the key steps of the training process, thus achieving a stealthier attack. Although the above two categories of backdoor attacks are promising, most of them struggle with the coarse-grained optimization of effectiveness and stealthiness, complicating the acquisition of superior backdoor triggers. Due to the significant difference in latent space and low poisoned sample fidelity, they cannot evade the latest backdoor detection methods.

**Backdoor Defense.** There are two major types of backdoor defense methods, i.e., the _detection-based defense_ and _erasure-based defense_. The detection-based defenses can be further classified into two categories, i.e., sample-based and latent space-based detection methods. Specifically, sample-based detection methods can identify the distribution differences between poisoned samples and benign samples [1, 3, 2], while latent space-based detection methods aim to find the disparity between the latent spaces of poisoned samples and benign samples [12, 1]. Unlike the above detection strategies that aim to prevent the injection of backdoors into DNNs by identifying poisoned samples during the training stages, the erasure-based defenses can eradicate the backdoors from DNNs. So far, the erasure-based defenses can be classified into three categories, i.e., poison suppression-based, model reconstruction-based, and trigger generation-based defenses. The poison suppression-based methods [10] utilize the differential learning speed between poisoned and benign samples during training to mitigate the influence of backdoor triggers on DNNs. The model reconstruction-based methods [11, 12] leverage a selected set of benign data to rebuild DNN models, aiming to mitigate the impact of backdoor triggers. The trigger generation-based methods [22] reverse-engineer backdoor triggers by capitalizing on the effects of backdoor attacks on training samples.

To the best of our knowledge, WaveAttack is the first attempt to generate triggers for the high-frequency component obtained through DWT. Unlike existing backdoor attack methods, WaveAttack considers both the fidelity of poisoned samples and latent space obfuscation. By using asymmetric frequency obfuscation, WaveAttack can not only acquire backdoor attack effectiveness but also achieve high stealthiness regarding both image quality and latent space.

## Our Method

In this section, we first present the preliminaries and the threat model. Then, we show our motivations for adding triggers to the high-frequency components. Finally, we detail the attack process of our method WaveAttack.

### Preliminaries

**Notations.** We follow the training scheme of Adapt-Blend [20]. Let \(\mathcal{D}=\{(\mathbf{x}_{i},y_{i})\}_{i=1}^{N}\) be a clean training dataset, where \(\mathbf{x}_{i}\in\mathbb{X}=\{0,1,...,255\}^{C\times W\times H}\) is an image, and \(y_{i}\in\mathbb{Y}=\{1,2,...,K\}\) is its corresponding label. Note that \(K\) represents the number of labels. For a given training dataset, we select a subset of \(\mathcal{D}\) with a poisoning rate \(p_{a}\) as the _payload samples_\(\mathcal{D}_{a}=\{(\mathbf{x}^{\prime},y_{t})|\mathbf{x^{\prime}}_{i}=T(\mathbf{x}_{i}), \mathbf{x}_{i}\in\mathbb{X}\}\), where \(T(\cdot)\) is a backdoor transformation function, and \(y_{t}\) is an adversary-specified target label. We use a subset of \(\mathcal{D}\) with poisoning rate \(p_{r}\) as the _regularization samples_\(\mathcal{D}_{r}=\{(\mathbf{x^{\prime}}_{i},y_{i})|\mathbf{x^{\prime}}_{i}=T(\mathbf{x}_{i} ),\mathbf{x}_{i}\in\mathbb{X}\}\). For a given dataset, a backdoor attack adversary tries to train a backdoored model \(f\) that predicts \(\mathbf{x}\) as its corresponding label, where \(\mathbf{x}\in\mathcal{D}\cup\mathcal{D}_{a}\cup\mathcal{D}_{r}\).

**Threat Model.** Similar to existing backdoor attack methods [22, 23, 24], we assume that adversaries have complete control over the training datasets, the training process, and model implementation. They can embed backdoors into the DNNs by poi
soning the given training dataset. Moreover, in the inference stage, we assume that adversaries can only query back-doored models using any samples.

**Adversarial Goal.** Throughout the attack process, adversaries strive to meet two core goals, i.e., effectiveness and stealthiness. Effectiveness indicates that adversaries try to train backdoored models with a high ASR while ensuring that the decrease in Benign Accuracy (BA) remains imperceptible. Stealthiness denotes that samples with triggers have high fidelity, and there is no latent separation between poisoned and clean samples in the latent space.

### Motivation

Unlike humans that are not sensitive to high-frequency features, DNNs can effectively learn high-frequency features of images Wang et al. (2020), which can be used for the purpose of backdoor trigger generation. In other words, the poisoned samples generated by high-frequency features can easily escape from various examination methods by humans. Based on this observation, if we can design backdoor triggers on top of high-frequency features, the stealthiness of corresponding backdoored attacks can be ensured. To obtain high-frequency components from training samples, we resort to Discrete Wavelet Transform (DWT) to capture characteristics from both time and frequency domains Shenas et al. (1992), which enables the extraction of multiple frequency components from training samples. The reason why we adopt DWT rather than Discrete Cosine Transform (DCT) is that DWT can better capture high-frequency features from training samples (i.e., edges and textures) and allow superior reverse operations during both encoding and decoding phases, thus minimizing the impact on the fidelity of poisoned samples. In our approach, we adopt a classic and effective biorthogonal wavelet transform method (i.e., Haar wavelet Daubechies (1990)), which mainly contains four kernels operations, i.e., \(LL^{T}\), \(LH^{T}\), \(HL^{T}\), and \(HH^{T}\). Here \(L\) and \(H\) denote the low and high pass filters, respectively, where \(L^{T}=\frac{1}{\sqrt{2}}\left[1\right],H^{T}=\frac{1}{\sqrt{2}}\left[-1\right.\) \(1\). Note that, based on the four operations, the Haar wavelet can decompose an image into four frequency components (i.e., \(LL\), \(LH\), \(HL\), \(HH\)) using DWT, where \(HH\) only contains the high-frequency information of a sample. Meanwhile, the Haar wavelet can reconstruct the image from the four frequency components via the Inverse Discrete Wavelet Transform (IDWT). To verify the motivation of our approach, Figure 1 illustrates the impact of adding the same noises to different frequency components on an image, i.e., Figure 1(a). We can find that, compared with the other three poisoned images, i.e., Figure 1(b) to 1(d), it is much more difficult to figure out the difference between the original image and the poisoned counterpart on HH, i.e., Figure 1(e). Therefore, it is more suitable to inject triggers into the high-frequency component (i.e., HH) for the backdoor attack purpose.

### Implementation of WaveAttack

In this subsection, we introduce the design of our WaveAttack approach. Figure 2 shows the overview of WaveAttack. We first poisoned samples through our trigger design to construct the poisoned samples, which contain payload samples and regularization samples. Then, we use benign samples, payload samples, and regularization samples to train a classifier to achieve the core goals of WaveAttack.

**Trigger Design.** As aforementioned, our WaveAttack approach aims to achieve a stealthier backdoor attack, introducing triggers into the \(HH\) frequency component. Figure 2 contains the process of generating triggers by WaveAttack. First, we obtain the \(HH\) component of samples through DWT. Then, to generate imperceptible and sample-specific triggers, we employ an encoder-decoder network as a generator \(g\). These generated triggers are imperceptible additive residuals. Moreover, to achieve our asymmetric frequency obfuscation, we multiply the residuals by a coefficient \(\alpha\). We can generate the poisoned \(HH^{\prime}\) component with the triggers as follows:

\[\mathbf{HH^{\prime}}=\mathbf{HH}+\alpha\cdot g(\mathbf{HH};\mathbf{\omega}_{g}), \tag{1}\]

where \(\mathbf{\omega}_{g}\) is the generator parameters. Finally, we can utilize IDWT to reconstruct four frequency components of poisoned samples. Specifically, we use a U-Net-like Ronneberger et al. (2015) generator to obtain residuals, though other methods, such as VAE Kingma et al. (2014), can also be used by the adversary. This is because the skip connections of U-Net can effectively preserve the features of inputs with minimal impacts Ronneberger et al. (2015).

Figure 1: A motivating example for the backdoor trigger design on high-frequency components.

Figure 2: Overview of our attack method WaveAttack.
**Optimization Objective.** Our attack method WaveAttack has two networks to optimize. We aim to optimize a generator \(g\) to generate small residuals with a minimal impact on samples. Furthermore, we aim to optimize a backdoored classifier \(f\), which can enable the effectiveness and stealthiness of WaveAttack. For the first optimization objective, we use the \(L_{\infty}\) norm to optimize small residuals. The optimization objective is defined as follows:

\[\mathcal{L}_{r}=||g(HH;\mathbf{\omega}_{g})||_{\infty}. \tag{2}\]

As for the second optimization objective, we train the classifier by the cross-entropy loss function in \(\mathcal{D}\), \(\mathcal{D}_{a}\), and \(\mathcal{D}_{r}\) dataset. The optimization objective is defined as follows:

\[\mathcal{L}_{c}=\mathcal{L}(\mathbf{x}_{p},y_{t};\mathbf{\omega}_{c})+\mathcal{L}(\bm {x}_{r},\mathbf{y};\mathbf{\omega}_{c})+\mathcal{L}(\mathbf{x}_{b},\mathbf{y};\mathbf{\omega}_{c}), \tag{3}\]

where \(\mathcal{L}(\cdot)\) is the cross-entropy loss function, \(\mathbf{\omega}_{c}\) is the classifier parameters, \(\mathbf{x}_{b}\in\mathcal{D},\mathbf{x}_{p}\in\mathcal{D}_{a}\), and \(\mathbf{x}_{r}\in\mathcal{D}_{r}\). The total loss function is as follows:

\[\mathcal{L}_{total}=\mathcal{L}_{c}+\mathcal{L}_{r}. \tag{4}\]

```
1:i) \(\mathcal{D}\), benign training dataset; ii) \(\mathbf{\omega}_{g}\), randomly initialized generator parameters; iii) \(\mathbf{\omega}_{f}\), randomly initialized classifier parameters; iv) \(p_{a}\), rate of payload samples. v) \(p_{r}\), rate of regularization samples. vii) \(y_{t}\), target label. vi) \(E\), # of epochs in training process.
2:i) \(\mathbf{\omega}_{g}\), well-trained generator model, ii) \(\mathbf{\omega}_{c}\), well-trained classifier model.
3:WaveAttack Training:
4:for\(c=1,\dots,E\)do
5:for\((\mathbf{x},\mathbf{y})\) in \(\mathcal{D}\)do
6:\(b\leftarrow\mathbf{x}\).shape[0]
7:\(n_{m}\leftarrow(p_{a}+p_{r})\times b\)
8:\(n_{a}\gets p_{a}\times b\)
9:\(n_{r}\gets p_{r}\times b\)
10:\(\mathbf{x}_{m}\leftarrow\mathbf{x}[:\!\!m_{m}]\)
11:\(\mathbf{LL},\mathbf{LH},\mathbf{HL},\mathbf{HH}\gets DWT(\mathbf{x}_{m})\)
12:\(\mathbf{resdiual}\leftarrow\alpha\cdot g(\mathbf{HH};\mathbf{\omega}_{g})\)
13:\(\mathbf{HH}^{\prime}\leftarrow\mathbf{HH}+\mathbf{resdiual}\)
14:\(\mathbf{x}_{m}\gets IDWT(\mathbf{LL},\mathbf{LH},\mathbf{HL},\mathbf{HH}^{\prime})\)
15:\(\mathcal{L}_{1}\leftarrow\mathcal{L}(\mathbf{x}_{m}[n_{a};];\!\!y_{t};\!\mathbf{\omega}_{c})\)
16:\(\mathcal{L}_{2}\leftarrow\mathcal{L}(\mathbf{x}_{m}[:\!\!n_{r}];\!\mathbf{y}[n_{a}.\! \!n_{r}];\!\!\mathbf{\omega}_{c})\)
17:\(\mathcal{L}_{3}\leftarrow\mathcal{L}(\mathbf{x}[\!\![n_{m};\!];\!\mathbf{y}[n_{m};]\! ;\!\mathbf{\omega}_{c})\)
18:\(\mathcal{L}\leftarrow\mathcal{L}_{1}+\mathcal{L}_{2}+\mathcal{L}_{3}+||\mathbf{ resdiual}||_{\infty}\)
19:\(\mathcal{L}\).backward()
20:update(\(\mathbf{\omega}_{g},\mathbf{\omega}_{c}\))
21:endfor
22:endfor
23:Return\(\mathbf{\omega}_{g},\mathbf{\omega}_{c}\)
```

**Algorithm 1** Training of WaveAttack

**Algorithm 1** Training of WaveAttack

**Algorithm 2** Training of WaveAttack

**Algorithm 3** Training of WaveAttack

**Algorithm 4** Training of WaveAttack

**Algorithm 5** Training of WaveAttack

**Datasets and DNNs.** We evaluated all the attack methods on four classical benchmark datasets, i.e., CIFAR-10 (Krizhevsky, Hinton et al., 2009), CIFAR-100 (Krizhevsky, Hinton et al., 2009), GTSRB (Stallkamp et al., 2012) and a subset of ImageNet (with the first 20 categories) (Deng et al., 2009). The statistics of datasets adopted in the experiments are presented in Table 4 (see Appendix ). We used ResNet18 (He et al., 2016) as the DNN for the experiments. Moreover, we used VGG16 (Simonyan et al., 2015), SENet18 (Hu, et al., 2018), ResNeXt29 (Xie et al., 2017), and DenseNet121 (Huang et al., 2017) to evaluate the generalizability of WaveAttack.
**Attack Configurations.** To compare the performance of WaveAttack with SOTA attack methods, we considered seven SOTA backdoor attacks, i.e., BadNets Gu et al. (2019), Blend Chen et al. (2017), IAD Nguyen et al. (2020), WaNet Nguyen et al. (2021), BppAttack Wang et al. (2022), Adapt-Blend Qi et al. (2023), and FTrojan Wang et al. (2022). Note that, similar to our work, Adapt-Blend has asymmetric triggers, and FTrojan is also a frequency-based attack. We performed the attack methods using the default hyperparameters described in their original papers. Specifically, the poisoning rate is set to 10% with a target label of 0 to ensure a fair comparison. See Appendix -A1 for more details.

**Evaluation Metrics.** Similar to the existing work in Wang et al. (2022), we evaluated the effectiveness of all attack methods using two metrics, i.e., Attack Success Rate (ASR) and Benign Accuracy (BA). To evaluate the stealthiness of all attack methods, we used three metrics, i.e., Peak Signal-to-Noise Ratio (PSNR) Huynh-Thu et al. (2008), Structure Similarity Index Measure (SSIM) Wang et al. (2004), and Inception Score (IS) Salimans et al. (2016).

### Effectiveness Evaluation (RQ1)

**Effectiveness Comparison with SOTA Attack Methods.** To evaluate the effectiveness of WaveAttack, we compared the ASR and BA of WaveAttack with seven SOTA attack methods. Since the IAD Nguyen et al. (2020) cannot attack the ImageNet dataset based on their open-source code, we do not provide its comparison result. Table 1 shows the attack performance of different attack methods. From this table, we can find that WaveAttack can acquire the high ASR without degrading BA obviously. Especially, for the dataset CIFAR-10 and GTSRB, WaveAttack achieves the best ASR and BA than other SOTA attack methods. Compared to the FTrojan, a frequency-based attack method, WaveAttack outperforms FTrojan in BA for the datasets CIFAR-10, GTSRB, and ImageNet. Note that compared to the asymmetric-based method Adapt-Blend, WaveAttack can obtain superior performance in terms of ASR and BA for all datasets.

**Effectiveness on Different Networks.** To evaluate the effectiveness of WaveAttack on various networks, we conducted experiments on CIFAR-10 using different networks (i.e., VGG16 Simonyan et al. (2015), SENet18 Hu et al. (2018), ResNeXt29 Xie et al. (2017), and DenseNet121 Huang et al. (2017)). Table 2 shows the attack performance of WaveAttack on these networks. From this table, we can find that our approach WaveAttack can successfully embed the backdoor into different networks. WaveAttack can not only cause malicious impacts of backdoor attacks, but also maintain a classification performance with a high BA, demonstrating the generalizability of WaveAttack.

### Stealthiness Evaluation (RQ2)

To evaluate the stealthiness of WaveAttack, we compared the images with triggers generated by WaveAttack with the ones of SOTA attack methods. Moreover, we used t-SNE Van der et al. (2008) to visualize the latent spaces for poisoned samples and benign samples from the target label.

**Stealthiness Results from The Perspective of Images.** To show the stealthiness of triggers generated by WaveAtt

\begin{table}
\begin{tabular}{c|c c|c c|c c|c c} \hline \multirow{2}{*}{Method} & \multicolumn{2}{c|}{CIFAR-10} & \multicolumn{2}{c|}{CIFAR-100} & \multicolumn{2}{c|}{GTSRB} & \multicolumn{2}{c}{ImageNet} \\ \cline{2-9}  & BA & ASR & BA & ASR & BA & ASR & BA & ASR \\ \hline No attack & 94.59 & - & 75.55 & - & 99.00 & - & 87.00 & - \\ \hline BadNets Gu et al. (2019) & 94.36 & **100** & 74.90 & **100** & 98.97 & **100** & 85.80 & **100** \\ Blend Chen et al. (2017) & 94.51 & 99.91 & 75.10 & 99.84 & 98.26 & **100** & 86.40 & **100** \\ IAD Nguyen et al. (2020) & 94.32 & 99.12 & 75.14 & 99.28 & 99.26 & 98.37 & - & - \\ WaNet Nguyen et al. (2021) & 94.23 & 99.57 & 73.18 & 98.52 & 99.21 & 99.58 & 86.60 & 89.20 \\ BppAttack Wang et al. (2022) & 94.10 & **100** & 74.68 & **100** & 98.93 & 99.91 & 85.90 & 99.50 \\ Adapt-Blend Qi et al. (2023) & 94.31 & 71.57 & 74.53 & 81.66 & 98.76 & 60.25 & 86.40 & 90.10 \\ FTrojan Wang et al. (2022) & 94.29 & **100** & 75.37 & **100** & 98.83 & **100** & 85.10 & **100** \\ \hline WaveAttack & **94.55** & **100** & **75.17** & 99.16 & **99.30** & **100** & **86.60** & 97.60 \\ \hline \end{tabular}
\end{table}
Table 1: Attack performance comparison between WaveAttack and seven SOTA attack methods.

\begin{table}
\begin{tabular}{c|c|c c} \hline \multirow{2}{*}{Network} & No Attack & WaveAttack \\ \cline{2-4}  & BA & BA & ASR \\ \hline VGG16 & 93.62 & 93.70 & 99.76 \\ SENet18 & 94.51 & 94.63 & 100 \\ ResNeXt29 & 94.79 & 95.08 & 100 \\ DenseNet121 & 95.29 & 95.10 & 99.78 \\ \hline \end{tabular}
\end{table}
Table 2: Effectiveness on different DNNs.

Figure 3: Comparison of examples generated by seven backdoor attacks. For each attack, we show the poisoned sample (top) and the magnified (\(\times\)5) residual (bottom).
tack, Figure 3 compares WaveAttack and SOTA attack methods using poisoned samples and their magnified residuals (\(\times\)5) counterparts. From this figure, we can find that the residual generated by WaveAttack is the smallest and leaves only a few subtle artifacts. The injected trigger by WaveAttack is nearly invisible to humans.

We used three metrics (i.e., PSNR, SSIM, and IS) to evaluate the stealthiness of triggers generated by WaveAttack. Table 3 shows the stealthiness comparison results between WaveAttack and seven SOTA attack methods. From this table, we can find that for datasets CIFAR-10, CIFAR-100, and ImageNet, WaveAttack achieves the best stealthiness. Note that WaveAttack can achieve the second-best SSIM for dataset GTSRB, but it outperforms BadNets by up to 60.56% in PSNR and 67.5% in IS.

**Stealthiness Results from The Perspective of Latent Space.** There are so many backdoor defense methods [14, 13] based on the assumption that there is a latent separation between poisoned and benign samples in latent space. Therefore, ensuring the stealthiness of the attack method from the perspective of the latent space becomes necessary. We obtained feature vectors of the test result from the feature extractor (the DNN without the last classifier layer) and used t-SNE [15] for visualization. Figure 4 visualizes the distributions of feature representations of the poisoned samples and the benign samples from the target label under the six attacks. From Figure 4(a) to 4(c) and 4(e), we can observe that there are two distinct clusters, which can be utilized to detect poisoned samples or backdoored models [11]. However, as shown in 4(d) and 4(f), we can find that the feature representations of poisoned samples are intermingled with those of benign samples for Adapt-Blend and WaveAttack, i.e., there is only one cluster. Adapt-Blend and WaveAttack can achieve the best stealthiness from the perspective of latent space and break the latent separation assumption to evade backdoor defenses. Although Adapt-Blend exhibits a degree of stealthiness, Table 3 reveals that WaveAttack surpasses Adapt-Blend in terms of image quality, thus suggesting that WaveAttack can achieve superior stealthiness.

### Resistance to Existing Defenses (RQ3)

To evaluate the robustness of WaveAttack against existing backdoor defenses, we implemented representative backdoor defenses (i.e., GradCAM [20], STRIP [10], Fine-Pruning [12], and Neural Cleanse [13]) and evaluated the resistance to them. We also show the robustness of WaveAttack against Spectral Signature [14] in the appendix.

**GradCAM.** As an effective visualizing mechanism, GradCAM [20] has been used to visualize intermediate feature maps of DNN, interpreting the DNN

Figure 4: The t-SNE of feature vectors in the latent space under different attacks on CIFAR-10. We use red and blue points to denote poisoned and benign samples, respectively, where each point in the plots corresponds to a training sample from the target label.

Figure 5: GradCAM visualization results for both clean and backdoored models.

\begin{table}
\begin{tabular}{c|c c c|c c c|c c c|c c c} \hline \multirow{2}{*}{Attack Method} & \multicolumn{3}{c|}{CIFAR-10} & \multicolumn{3}{c|}{CIFAR-100} & \multicolumn{3}{c|}{GTSRB} & \multicolumn{3}{c}{ImageNet} \\ \cline{2-13}  & PSNR & SSIM & IS & PSNR & SSIM & IS & PSNR & SSIM & IS & PSNR & SSIM & IS \\ \hline No Attack & INF & 1.0000 & 0.000 & INF & 1.0000 & 0.000 & INF & 1.0000 & 0.000 & INF & 1.0000 & 0.000 \\ \hline BadNets [11] & 25.77 & 0.9942 & 0.136 & 25.48 & 0.9943 & 0.137 & 25.33 & **0.9935** & 0.180 & 21.88 & 0.9678 & 0.025 \\ Blend [1] & 20.40 & 0.8181 & 1.823 & 20.37 & 0.8031 & 1.60 & 18.58 & 0.6840 & 2.118 & 13.72 & 0.1871 & 2.252 \\ IAD [12] & 24.35 & 0.9180 & 0.472 & 23.98 & 0.9138 & 0.490 & 23.84 & 0.9404 & 0.309 & - & - & - \\ Wawet [12] & 30.91 & 0.9724 & 0.326 & 31.62 & 0.9762 & 0.237 & 33.26 & 0.9659 & 0.170 & 35.18 & 0.9756 & 0.029 \\ BppAttack [13] & 27.79 & 0.9285 & 0.895 & 27.93 & 0.9207 & 0.779 & 27.79 & 0.8462 & 0.714 & 27.34 & 0.8009 & 0.273 \\ Adapt-Blend [11] & 25.97 & 0.9231 & 0.519 & 26.00 & 0.9133 & 0.495 & 24.14 & 0.8103 & 1.136 & 18.96 & 0.6065 & 1.150 \\ FTrojan [13] & 44.07 & 0.9976 & 0.019 & 44.09 & 0.9972 & 0.017 & 40.23 & 0.9813 & 0.065 & 35.55 & 0.9440 & 0.013 \\ \hline WaveAttack & **47.49** & **0.9979** & **0.011** & **50.12** & **0.9992** & **0.005** & **40.67** & 0.9877 & **0.058** & **45.60** & **0.9913** & **0.007** \\ \hline \end{tabular}
\end{table}
Table 3: Stealthiness comparison with existing attacks. Larger PSNR, SSIM, and smaller IS indicate better performance. The best and the second-best results are **highlighted** and **underlined**, respectively.
predictions. Existing defense methods [10, 14] exploit GradCAM to analyze the heatmap of input samples. Specifically, a clean model correctly predicts the class label, whereas a backdoored model predicts the target label. Based on this phenomenon, the backdoored model can induce an abnormal GradCAM heatmap compared with the clean model. If the heatmaps of poisoned samples are similar to those of benign sample counterparts, the attack method is robust and can resist defense methods based on GradCAM. Figure 5 shows the visualization heatmaps of a clean model and a backdoored model attacked by WaveAttack. Please note that here "clean" denotes a clean model trained by using benign training datasets. From this figure, we can find that the heatmaps of these models are similar, and WaveAttack can resist defense methods based on GradCAM.

**STRIP**. STRIP [10] is a representative sample-based defense method. When inputting a sample potentially poisoned to a model, STRIP will perturb it through a random set of clean samples and monitor the entropy of the prediction output. If the entropy of an input sample is low, STRIP will consider it poisoned. Figure 6 shows the entropies of the benign and poisoned samples. From this figure, we can see the entropies of the poisoned samples are bigger than those of the benign samples, and STRIP fails to detect the poisoned samples generated by WaveAttack.

**Fine-Pruning**. Fine-Pruning (FP) [13] is a representative model reconstruction defense, which is based on the assumption that the backdoor can activate a few dormant neurons in DNNs. Therefore, pruning these dormant neurons can eliminate the backdoors in DNNs. To evaluate the resistance to FP, we gradually pruned the neurons of the last convolutional and fully-connected layers. Figure 7 shows the performance comparison between WaveAttack and seven SOTA attack methods on CIFAR-10 by resisting FP. From this figure, we can find that along with the more neurons are pruned, WaveAttack can acquire superior performance than other SOTA attack methods in terms of both ASR and BA. In other words, Fine-Pruning is not able to eliminate the backdoor generated by WaveAttack. Note that, though the ASR and BA of WaveAttack are similar to those of Adapt-Blend the final stage of pruning, the initial ASR of Adapt-Blend (i.e., 71.57%) is much lower than that of WaveAttack (i.e., 100%).

**Neural Cleanse**. As a representative trigger generation defense method, Neural Cleanse (NC) [11] assumes that the trigger designed by the adversary is small. Initially, NC optimizes a trigger pattern for each class label via an optimization process. Then, NC uses Anomaly Index (i.e., Median Absolute Deviation [1]) to detect whether a DNN is backdoored. Similar to the work [11], we think the DNN is backdoored if the anomaly index is larger than 2. To evaluate the resistance to NC, we conducted experiments to evaluate our approach WaveAttack by resisting NC. Figure 8 shows the defense results against NC. Please note that here "clean" denotes clean models trained by using benign training datasets, and "backdoored" denotes backdoored models by WaveAttack that are from the Subsection. From this figure, we can find that the abnormal index of WaveAttack is smaller than 2 for all datasets, and WaveAttack can bypass the NC detection.

## Conclusion

Although backdoor attacks on DNNs have attracted increasing attention from adversaries, few of them consider both fidelity of poisoned samples and latent space simultaneously to enhance the stealthiness of their attack methods. To establish an effective and stealthy backdoor attack against various backdoor detection techniques, this paper proposed a novel frequency-based method named WaveAttack, which employs DWT to extract high-frequency features from samples for backdoor trigger generation. Based on our proposed frequency obfuscation method, WaveAttack can maintain high effectiveness and stealthiness, thus remaining undetectable by both human inspection and backdoor detection mechanisms. Furthermore, we introduced an asymmetric frequency obfuscation method to improve the impact of triggers and further enhance the effectiveness of WaveAttack. Comprehensive experimental results show that, compared with various SOTA backdoor attack methods, WaveAttack can not only achieve both higher stealthiness and effectiveness but also minimize the impact of image quality on four well-known datasets.

Figure 8: Defense performance against NC.

Figure 6: STRIP normalized entropy of WaveAttack.

Figure 7: ASR comparison against Fine-Pruning.