HFI: High-Frequency Component Injection based Invisible Image Backdoor Attack

Backdoor attacks have become a serious security threat to deep neural networks (DNNs). The attacked model classifies samples with the trigger pattern as the target label while performing well on benign samples. However, existing backdoor attacks usually introduce significant perturbations in the spatial domain of samples, which reduces the stealthiness of these attacks. To balance the attack effectiveness and stealthiness, we propose a backdoor attack based on high-frequency component injection (HFI). This method is based on the observation that convolutional neural networks (CNNs) tend to recognize textures. It injects the trigger into benign samples in the frequency domain with adjustable strength. In the spatial domain, it produces only subtle, nonlinear texture changes, ensuring that the poisoned samples do not introduce noticeable visual disturbances. Extensive experiments verify the superior performance of the proposed HFI in terms of effectiveness, flexibility, and stealthiness, particularly on low-resolution datasets, where HFI outperforms the best baseline for stealthiness by factors of 10 and 100 in terms of the metrics mean squared error (MSE) and learned perceptual image patch similarity (LPIPS), respectively.