Response to Reviewer gVJn

Adaption to Other Types of Wavelet Transforms

Thank you for the reviewer's insightful comments. In our wavelet transformation procedure, applying different wavelets in the Discrete Wavelet Transform (DWT) is still applicable to our method proposed in this paper. We initially adopted the most common Haar wavelet due to its simplicity and computational efficiency. Additionally, we have incorporated the Daubechies wavelet, which has stronger orthogonality, to evaluate its impact on our method. The specific experimental results are summarized in the following table. From the table, we can find that the influence of different wavelets on our method’s performance is limited, indicating that WaveAttack maintains its effectiveness and stealthiness among different wavelet transformations.

WaveAttack Performance with Different Wavelets

The Superiority of DWT

We believe DWT cannot be directly swapped to other frequency transformation methods. This is because different frequency conversion methods will eventually affect the performance of backdoor attacks based on the frequency domain. The following table shows the impact of varying frequency domain conversion methods on backdoor attacks. From the table, we can see that compared with other frequency domain conversion methods, i.e., FTrojan (DCT) [1], Fiba (DFT) [2], the backdoor trigger generation method based on DWT in this paper can significantly improve the effectiveness and stealthiness of the backdoor attack method based on the frequency domain.

Frequency Domain Conversion Methods Comparison

References

• [1] Wang T, Yao Y, Xu F, et al. Backdoor attack through frequency domain. ECCV, 2023.
• [2] Feng Y, Ma B, Zhang J, et al. Fiba: Frequency-injection based backdoor attack in medical image analysis. CVPR, 2022.

Response to Reviewer h6uR

We are sincerely grateful for the reviewers' insightful feedback and constructive comments. We offer comprehensive responses to all inquiries and concerns below.

Detailed Descriptions of References

Unlike our paper based on Discrete Wavelet Transform (DWT), reference [1] introduces a frequency domain-based attack method named Fiba for medical images, employing Discrete Fourier Transform (DFT) technology. Based on its GitHub project: FIBA, we reproduced this method on three image-classification datasets. The table below shows the attack and stealthiness performance comparison between WaveAttack and Fiba. From the table, we can see that compared with the Fiba method, WaveAttack achieves a higher attack success rate (ASR) and image fidelity in terms of PSNR, SSIM, and IS.

[2] is a frequency domain-based attack method named Ftrojan employing Discrete Cosine Transform (DCT) technology, which is also the SOTA baseline in our paper.

Since [3] is the same as reference [1] based on DFT and did not release the code, we did not choose it as the baseline for experimental results in our responses.

[4] actually does not belong to a backdoor attack method, but to a backdoor detection method based on the frequency domain. This paper proposes a frequency domain-based detection metric named BDR (Backdoor Detection Rate) for backdoor attack detection. The attack performance comparison against [4] is in Section 6.3 of our Appendix (Line 539). From Table 6 in our paper's appendix, we can find that under BDR detection, compared with FTrojan (BDR: 78.11%) and the frequency trigger generated method in [4] (BDR: 99.94%), WaveAttack can obtain better attack effectiveness and stealthiness (BDR: 5.71%).

Furthermore, we would like to make the following statements: Although many works have contributed to the frequency-domain-based backdoor attack method, WaveAttack is the first attempt to generate backdoor triggers for the high-frequency component obtained through DWT and the first method to achieve such superior attack performances against three kinds of detection methods (sample-quality-based detection methods, latent-space-based detection methods, and frequency-domain-based detection methods). By employing our proposed asymmetric frequency obfuscation, WaveAttack can not only acquire backdoor attack effectiveness but also achieve high stealthiness regarding image quality and latent space against backdoor attack detection methods.

Minor Revisions

• Q: Explanation of frequency components in the Appendix.

  • A: Thank you for your insightful feedback. We will add the frequency components of images in the Appendix.

• Q: Typo errors.

  • A: Thank you for pointing these out. We will fix these errors in the next version of our paper.

• Q: Motivation of asymmetric frequency obfuscation.

  • A: Thank you for your insightful suggestion. We will further clarify the motivation of our asymmetric frequency obfuscation in the paper.

References

• [1] Feng Y, Ma B, Zhang J, et al. Fiba: Frequency-injection based backdoor attack in medical image analysis. CVPR, 2022.
• [2] Wang T, Yao Y, Xu F, et al. Backdoor attack through frequency domain. ECCV, 2023.
• [3] Check your other door! Creating backdoor attacks in the frequency domain.
• [4] Zeng Y, Park W, Mao Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective. CVPR 2022.

Response to Reviewer vbLQ

We sincerely appreciate the reviewer's valuable feedback and insightful comments on our paper. We have carefully considered each issue raised and provided detailed responses to all questions and concerns below.

Threat Model

Thank you for your feedback on the threat model. Similar to the configurations in LIRA [1] and Adapt-Blend, the threat model of WaveAttack indeed assumes that attackers have significant control during the training procedure. Meanwhile, to demonstrate the superiority of WaveAttack, we will include the LIRA method in our experimental results.

Stealthiness

Thank you for your insightful comments. We acknowledge that the differences between FTrojan and WaveAttack are not particularly significant in terms of human visual recognition, which requires slight magnification in residual images (Figure 3, Line 283) to observe significant differences between the two poisoned images. However, this phenomenon only occurs in sample-quality-based backdoor detection by human visual recognition.

Currently, backdoor detection algorithms are mainly divided into three categories:

• Sample-quality-based detection methods: As shown in Table 3 (Line 289), the differences between FTrojan and WaveAttack can be detected in terms of PSNR, SSIM, and IS. Thus, compared with our paper's state-of-the-art (SOTA) attack methods, WaveAttack achieves superior poisoned image quality.
• Latent space-based detection methods: As illustrated in Figure 4 (Line 290), latent-based detection methods can effectively detect FTrojan but not WaveAttack.
• Frequency domain-based detection methods: These include various frequency domain filtering methods and the BDR (Backdoor Detection Rate, BDR) detection [2], as shown in Tables 4 (Line 365) and 6 (Line 544). WaveAttack has a higher ASR and BA with a lower BDR than FTrojan. This means that WaveAttack can obtain better attack effectiveness and stealthiness against frequency domain-based detection methods than FTrojan. In summary, compared to FTrojan (the SOTA frequency-domain-based backdoor attack method), WaveAttack has superior attack performance against all three detection methods in terms of effectiveness, stealthiness, and fidelity.

Baselines

Attack Performance and Stealthiness Comparison

Based on the BackdoorBox and LIRA, we have introduced the backdoor attack method named LIRA as a baseline for complete comparison. The comparison results are shown in the table above. This table shows that, compared with LIRA, WaveAttack still achieves the best attack effectiveness and fidelity of the poisoned images.

References

• [1] LIRA: Learnable, Imperceptible and Robust Backdoor Attacks. Proceedings of ICCV, 2021.
• [2] Zeng Y, Park W, Mao Z M, et al. Rethinking the backdoor attacks' triggers: A frequency perspective. Proceedings of the CVPR, 2021.