Check Your Other Door! Creating Backdoor Attacks in the Frequency Domain
  Deep Neural Networks (DNNs) are ubiquitous and span a variety of applications
ranging from image classification and facial recognition to medical image
analysis and real-time object detection. As DNN models become more
sophisticated and complex, the computational cost of training these models
becomes a burden. For this reason, outsourcing the training process has been
the go-to option for many DNN users. Unfortunately, this comes at the cost of
vulnerability to backdoor attacks. These attacks aim at establishing hidden
backdoors in the DNN such that it performs well on clean samples but outputs a
particular target label when a trigger is applied to the input. Current
backdoor attacks generate triggers in the spatial domain; however, as we show
in this paper, it is not the only domain to exploit and one should always
"check the other doors". To the best of our knowledge, this work is the first
to propose a pipeline for generating a spatially dynamic (changing) and
invisible (low norm) backdoor attack in the frequency domain. We show the
advantages of utilizing the frequency domain for creating undetectable and
powerful backdoor attacks through extensive experiments on various datasets and
network architectures. Unlike most spatial domain attacks, frequency-based
backdoor attacks can achieve high attack success rates with low poisoning rates
and little to no drop in performance while remaining imperceptible to the human
eye. Moreover, we show that the backdoored models (poisoned by our attacks) are
resistant to various state-of-the-art (SOTA) defenses, and so we contribute two
possible defenses that can successfully evade the attack.
