PaperlayerView exact revision on arXiv

Source-linked AI summary

FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis

Yu Feng, Benteng Ma, Jing Zhang, Shanshan Zhao, Yong Xia, Dacheng Tao

arXiv:2112.01148v2cs.CVcs.AI

TL;DR

Backdoor attacks in medical image analysis remain comparatively underexplored, while spatial triggers can disrupt semantics needed for dense prediction. FIBA injects triggers through spectral-amplitude blending while retaining phase information. Experiments across three representative medical tasks report effective attacks and superiority over state-of-the-art methods in attack performance and resistance to defenses.

  • Problem

    Medical image analysis lacks a unified backdoor attack suited to diverse modalities and tasks, while spatial triggers can corrupt poisoned-pixel semantics needed for dense prediction.

    Source: §1 · p. 1

  • Method

    FIBA blends trigger-image and benign-image spectral amplitudes while retaining the benign image’s phase to preserve poisoned-pixel semantics.

    Source: §1 · p. 2

  • Results

    Experiments on three representative MIA tasks report FIBA’s effectiveness and superiority over state-of-the-art methods in attack performance and resistance to defenses.

    Source: §1 · p. 2, §5 · p. 8

  • Takeaways & Limitations

    FIBA provides a unified attack approach for classification and dense prediction models in medical image analysis.

    Source: §1 · p. 2, §5 · p. 8

    FFT and iFFT make trigger injection about 1.5×–1.8× more time-consuming than BadNet [11], Blended [3], and WaNet [37] in the reported experiments.

    Source: §4.6 · p. 8

Abstract

from arXiv · show

In recent years, the security of AI systems has drawn increasing research attention, especially in the medical imaging realm. To develop a secure medical image analysis (MIA) system, it is a must to study possible backdoor attacks (BAs), which can embed hidden malicious behaviors into the system. However, designing a unified BA method that can be applied to various MIA systems is challenging due to the diversity of imaging modalities (e.g., X-Ray, CT, and MRI) and analysis tasks (e.g., classification, detection, and segmentation). Most existing BA methods are designed to attack natural image classification models, which apply spatial triggers to training images and inevitably corrupt the semantics of poisoned pixels, leading to the failures of attacking dense prediction models. To address this issue, we propose a novel Frequency-Injection based Backdoor Attack method (FIBA) that is capable of delivering attacks in various MIA tasks. Specifically, FIBA leverages a trigger function in the frequency domain that can inject the low-frequency information of a trigger image into the poisoned image by linearly combining the spectral amplitude of both images. Since it preserves the semantics of the poisoned image pixels, FIBA can perform attacks on both classification and dense prediction models. Experiments on three benchmarks in MIA (i.e., ISIC-2019 for skin lesion classification, KiTS-19 for kidney tumor segmentation, and EAD-2019 for endoscopic artifact detection), validate the effectiveness of FIBA and its superiority over state-of-the-art methods in attacking MIA models as well as bypassing backdoor defense. Source code will be available at https://github.com/HazardFY/FIBA.

1. Introduction

Backdoor attacks remain comparatively underexplored in medical image analysis, and spatial triggers can disrupt pixel semantics needed for dense prediction. FIBA injects a trigger in the frequency domain while preserving the poisoned image’s semantics, targeting classification and dense prediction across medical tasks.

1. Introduction

  • Backdoor attacks have received less attention than adversarial-sample research, particularly in medical image analysis.DNNs are increasingly deployed in computer-aided diagnosis, while attacks may target models during training or inference.Source: §1 · p. 1
  • Spatial triggers can alter poisoned-pixel semantics and local structure, making existing backdoor attacks prone to failure on dense prediction tasks.Backdoor attacks seek to change predictions to a target label when triggered while retaining benign performance when inactive.Source: §1 · p. 1
  • FIBA blends trigger and benign-image spectral amplitudes while retaining the benign image’s phase, preserving poisoned-pixel semantics for classification and dense prediction.The method uses FFT to obtain amplitude and phase spectra, then iFFT to produce the poisoned image.Source: §1 · p. 2
  • The paper presents FIBA as a unified backdoor attack for different medical imaging modalities and analysis tasks.The stated scope includes varied medical modalities and tasks.Source: §1 · p. 2
  • Experiments on three MIA benchmarks demonstrate FIBA’s effectiveness in attacking models and bypassing backdoor defenses.The passage reports the benchmark-level conclusion without naming individual results.Source: §1 · p. 2

2. Related Work

Prior backdoor work has pursued higher attack success and stealth, but its applicability to dense medical-image tasks remains unclear. Related work also covers defenses and medical analysis models; the paper frames FIBA as a unified attack that preserves pixel semantics across classification and dense prediction.

Backdoor Attack

  • Prior backdoor attacks use visible or invisible triggers, but spatial triggers can alter poisoned-pixel semantics and undermine dense prediction.BadNet [11] uses a fixed patch; blended-based [3] and reflection-based [33] attacks followed, while later work explored invisible triggers and physical objects.Source: §2 · pp. 2–3
  • Existing attack methods were designed for classification, leaving their applicability to dense tasks such as detection and segmentation unclear.DNN-based trigger methods can perform well but require training a trigger generator, which is more time-consuming.Source: §2 · p. 2

Backdoor Defense

  • Backdoor defenses include methods that weaken attacks and methods that detect triggers; this paper focuses on attacks and reports bypassing defenses.Examples include network pruning and model-connectivity analysis for defense, and trigger optimization or behavior analysis for detection.Source: §2 · p. 2

Medical Image Analysis

  • Medical image analysis uses CNNs for classification, segmentation, and detection, with established architectures including U-Net [43], Fast R-CNN [42], and Mask R-CNN.Prior work also includes 3D detection frameworks that explore medical data’s spatial information.Source: §2 · p. 2
  • FIBA retains phase information to preserve poisoned-pixel layout and semantics, supporting a unified attack across classification and dense prediction.The paper motivates this approach against the limited assurance that classification-focused attacks transfer to medical imaging tasks.Source: §2 · p. 3

3. Method

The method defines backdoor poisoning, then introduces frequency-domain trigger injection that preserves pixel semantics and a pseudo-trigger-robust training mode. Together, these components target classification and dense prediction while seeking to restrict activation to the specific trigger image.

3.1. Backdoor Attack

  • Poisoning trains the model to retain benign predictions while mapping triggered inputs to an attacker-selected target label.The method describes all-to-one and one-to-one target-label configurations, and defines a spatial trigger blend using a key pattern and mixing parameter.Source: §3.1 · p. 3

3.2. Frequency-Injection Attack

  • FIBA blends low-frequency trigger-image information into the input’s amplitude spectrum while retaining its original phase, preserving spatial layout for classification and dense prediction.A binary mask selects the low-frequency spectral patch, and a blend ratio controls the contributions of the input and trigger amplitudes.Source: §3.2 · p. 3

3.3. Pseudo Trigger Robust Backdoor Training

  • Because amplitude changes can make other images activate the attack, pseudo-trigger robust training is designed to enforce trigger uniqueness.The training protocol extends clean and attack modes with pseudo-trigger inputs, which should retain their original labels.Source: §3.3 · pp. 3–4
  • Training batches mix clean data, specifically triggered data, and pseudo-trigger data; the method uses a COCO validation image as the specific trigger and 1,000 COCO test images as pseudo triggers.For CT attacks, the pseudo-trigger images are converted to grayscale.Source: §3.3 · p. 4

4. Experiments

Experiments span ISIC-2019 classification, KiTS-19 segmentation, and EAD-2019 detection, with task-specific attack configurations. FIBA is evaluated for attack effectiveness, stealthiness, defense resistance, and sensitivity to design choices.

4.2. Attack Effectiveness

  • Across ISIC-2019, KiTS-19, and EAD-19, FIBA slightly outperforms WaNet in classification and outperforms competing attacks in segmentation and detection.On KiTS-19, FIBA reduces tumor-segmentation IoU from 54.54 to 21.02 for poisoned CT images; on EAD-19, its detection results are nearly the clean model's.Source: Table 1 · p. 5, §4.2 · pp. 5–6, Table 2 · p. 6

4.3. Attack Stealthiness

  • FIBA remains above 90% ASR after 80% neuron pruning, bypasses Neural Cleanse with an Anomaly Index below 2, and—like WaNet—has higher STRIP entropy than visible attacks.BadNet ASR falls below 10% after 40% pruning; STRIP detects BadNet and Blended more readily than the invisible attacks.Source: Figure 5 · p. 7, Table 4 · p. 7, Figure 4 · p. 7

4.4. Visualization of Network Behaviour

  • Grad-CAM shows trigger-region activation for BadNet, Blended, and WaNet, whereas FIBA’s activation resembles the clean model without a specific spatial anomaly.The authors attribute this difference to FIBA injecting triggers in the frequency domain rather than specific spatial regions.Source: §4.4 · p. 7, Figure 6 · p. 8

4.5. Ablation Study

  • FIBA maintains ASR above 99% across tested target labels and trigger images, with the reported result that effectiveness does not depend on a specific trigger image.The target-label study reports ASR > 99.00% across settings; the trigger-image study reports ASR > 99% using gray, animal, and human images.Source: Table 5 · p. 7, §4.5 · p. 8, Table 6 · p. 8
  • On ISIC-2019, ASR peaks at blend ratio α = 0.15 while benign accuracy increases slightly with α; the authors use 0.15 as the default.The authors describe FIBA as generally not sensitive to α.Source: §4.5 · p. 8, Table 7 · p. 8
  • PTR training lowers ASR on pseudo-trigger images from 83.05% to 7.21%, with a 0.36% decrease in ASR, supporting greater trigger uniqueness.The strategy uses pseudo-trigger images so the attack is activated by the specific trigger while remaining dormant for pseudo triggers.Source: §4.5 · p. 8, Table 8 · p. 8

4.6. Discussion and Limitation

  • FIBA’s FFT and inverse-FFT trigger-injection operations take about 1.5×–1.8× longer than BadNet, Blended, and WaNet in the reported experiments.The authors identify faster implementation, for example using modern GPUs, as further work.Source: §4.6 · p. 8

5. Conclusion

FIBA injects a trigger in the frequency domain while preserving poisoned-image pixel semantics, and experiments across three MIA tasks demonstrate its effectiveness and superiority over state-of-the-art methods. The authors connect studying these attacks to developing more secure medical AI systems.

5. Conclusion

  • FIBA injects the trigger into the amplitude spectrum while maintaining phase information, preserving poisoned-image pixel semantics for classification and dense prediction attacks.Experiments on three representative MIA tasks demonstrate effectiveness and superiority over state-of-the-art methods in attack performance and resistance to defense techniques.Source: §5 · p. 8
  • The conclusion frames FIBA as a method for attacks across medical-image analysis tasks, rather than a task-specific attack.The paper reports experiments on classification, segmentation, and detection tasks.Source: §5 · p. 8
  • The study identifies backdoor vulnerabilities in medical image analysis as relevant to developing more secure AI systems.The authors describe possible real-world settings including hospital third-party training and federated learning, where attacks can cause misdiagnosis or missed diagnosis.Source: §5 · p. 8

A.1. Training Details

The appendix specifies separate training setups for skin-lesion classification, kidney-tumor segmentation, and endoscopic artifact detection. It also presents visual examples of trigger images and their poisoned versions.

A.1. Training Details

  • ISIC-2019 classification uses ResNet50, Adam, 200 epochs, 224 × 224 inputs, and batch size 64.The learning rate starts at 0.01 and is divided by 10 every 50 epochs; augmentation includes horizontal and vertical flips and rotations.Source: §A.1 · p. 9
  • KiTS-19 segmentation uses a two-stage coarse-to-fine setup: ResUnet segments kidney regions, then DenseUnet segments kidney and tumor areas within them.The first stage uses cross-entropy for 50 epochs; the second uses Dice loss for 50 epochs, with batch size 6 and learning rate 1e-4.Source: §A.1 · p. 9
  • EAD-2019 artifact detection uses Faster R-CNN with a ResNet50 backbone in mmdetection, trained for 30 epochs with SGD.The setup uses 512 × 512 inputs, batch size 4, learning rate 0.005, and random-flip augmentation.Source: §A.1 · p. 9
  • Figure 7 shows trigger images, their amplitude spectra, the resulting poisoned images, and residual maps.The caption identifies an original ISIC-2019 image and different trigger-image examples.Source: Figure 7 · p. 9

A.2. Hyper-parameter Study

The study varies FIBA’s blend ratio α and low-frequency-patch setting β on ISIC-2019 and KiTS-19. Results identify dataset-specific settings and show how α affects attack success and image appearance.

A.2. Hyper-parameter Study

  • FIBA’s two hyperparameters are α, the blend ratio, and β, which sets the location and range of the low-frequency patch blended in the amplitude spectrum.The study investigates both parameters on ISIC-2019 and KiTS-19.Source: §A.2 · p. 9
  • ASR peaks at blend ratio 0.15 on ISIC-2019, while BA slightly increases as α grows.The table reports results for different α settings.Source: §A.2 · p. 9, Table 9 · p. 9
  • ASR > 99.00% across tested β values on ISIC-2019.The study tests β values 0.05, 0.10, 0.15, and 0.20.Source: §A.2 · p. 9, Table 10 · p. 9
  • On KiTS-19, ASR peaks at β = 0.1 (71.44%), which the authors select as the default.The table presents results for different β settings.Source: §A.2 · p. 9
  • On KiTS-19, ASR increases with α, but abnormal CT-image shades appear when α > 0.2, so the authors choose α = 0.2.The table reports results for different α settings.Source: §A.2 · p. 9

A.3. Results with Different Trigger Images

FIBA’s attack success remains high across different trigger-image choices on ISIC-2019. The experiments indicate that performance does not depend on one specific trigger image.

A.3. Results with Different Trigger Images

  • ASR > 99% with gray, animal, and human trigger images, showing FIBA does not depend on a specific trigger-image choice.The examples are selected from the COCO validation set.Source: §A.3 · p. 9

6. Results with other attacks on ISIC-2019

On ISIC-2019, FIBA outperforms FIBA-H and ISSBA on BA and ASR, while FIBA and FIBA-C achieve comparable high results.

6. Results with other attacks on ISIC-2019

  • The comparison includes ISSBA, FIBA-C, and FIBA-H as attack methods on ISIC-2019.ISSBA uses sample-specific triggers; FIBA-H uses a high-frequency trigger pattern.Source: §6 · p. 10, Table 14 · p. 11
  • FIBA outperforms FIBA-H and ISSBA on both BA and ASR on ISIC-2019.Table 14 reports results with different attacks on ISIC-2019.Source: §6 · p. 10, Table 14 · p. 11
  • FIBA and FIBA-C achieve comparable and high results on ISIC-2019.FIBA-C uses a circle mask instead of the square mask in Eq. (6).Source: §6 · p. 10

7. Resistance to DF-TND[50]

FIBA has the lowest target-class logit increase against DF-TND, and GPU-accelerated FFT/iFFT reduces its ISIC-2019 training time below Blended’s.

7. Resistance to DF-TND[50]

  • 6.72 is FIBA’s target-class logit increase against DF-TND, the lowest among the compared attacks.The passage states that smaller logit increases make DF-TND’s defense harder; Table 15 compares attacks.Source: Table 15 · p. 11, §7 · p. 11

8. Running Time

  • 23 hours is FIBA’s ISIC-2019 training time when FFT/iFFT runs on CPU, versus 12 hours for Blended.Both methods use the same training details and experiments run on a GeForce RTX 2080TI GPU.Source: §8 · p. 11
  • 9.5 hours is FIBA’s ISIC-2019 training time with GPU-accelerated FFT/iFFT, faster than Blended’s 12 hours.The acceleration uses the cupy library.Source: §8 · p. 11
Loading 2112.01148v2…