AS-FIBA: Adaptive Selective Frequency-Injection for Backdoor Attack on Deep Face Restoration
This addresses security vulnerabilities in face restoration systems used in smart devices, representing an incremental advance in backdoor attack techniques.
The paper tackles the problem of backdoor attacks on deep face restoration models by proposing AS-FIBA, a framework that uses adaptive frequency-domain triggers to cause subtle degradation in restored images, achieving more imperceptible attacks than existing methods like WaNet, ISSBA, and FIBA.
Deep learning-based face restoration models, increasingly prevalent in smart devices, have become targets for sophisticated backdoor attacks. These attacks, through subtle trigger injection into input face images, can lead to unexpected restoration outcomes. Unlike conventional methods focused on classification tasks, our approach introduces a unique degradation objective tailored for attacking restoration models. Moreover, we propose the Adaptive Selective Frequency Injection Backdoor Attack (AS-FIBA) framework, employing a neural network for input-specific trigger generation in the frequency domain, seamlessly blending triggers with benign images. This results in imperceptible yet effective attacks, guiding restoration predictions towards subtly degraded outputs rather than conspicuous targets. Extensive experiments demonstrate the efficacy of the degradation objective on state-of-the-art face restoration models. Additionally, it is notable that AS-FIBA can insert effective backdoors that are more imperceptible than existing backdoor attack methods, including WaNet, ISSBA, and FIBA.