A practical design of backdoor trigger under frequency-based orthogonality constraints.

Abstract

Backdoor attacks pose a serious threat to the reliable deployment of deep neural networks (DNNs), as compromised models can behave normally on clean inputs while producing malicious predictions when specific triggers are present. Existing frequency-domain backdoor attacks primarily adapt pixel-based methods to the frequency domain, or focus on improving trigger stealthiness. And with the rapid advancement of backdoor defense techniques, such triggers often lack sufficient effectiveness to infect the models. To address these challenges, we propose a novel frequency-domain backdoor attack paradigm based on orthogonal spectrum injection, which explicitly mitigates the spectral coupling between frequency-based triggers and benign image content. Our approach first employs an advanced frequency filter to extract salient high-frequency regions, providing precise locations for trigger injection. An additional masking mechanism is then introduced to suppress isolated noise and cluster high-frequency components, enhancing both attack effectiveness and stealthiness. Finally, we align the phase components within the extracted regions with a predefined trigger pattern, enabling consistent embedding of backdoor information across poisoned samples. Furthermore, we introduce a spectral orthogonality index to quantitatively evaluate the relationship between triggers and benign spectra, and demonstrate that triggers with higher orthogonality achieve superior attack performance. Extensive experiments validate the effectiveness of our method and demonstrate its robustness against existing state-of-the-art backdoor defense techniques.