FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis (2021-12-02T00:00:00.000000Z)

TL;DR

A novel Frequency-Injection based Backdoor Attack method (FIBA) that is capable of delivering attacks in various MIA tasks, and preserves the semantics of the poisoned image pixels, and can perform attacks on both classification and dense prediction models.

Abstract

In recent years, the security of AI systems has drawn increasing research attention, especially in the medical imaging realm. To develop a secure medical image analysis (MIA) system, it is a must to study possible backdoor attacks (BAs), which can embed hidden malicious behaviors into the system. However, designing a unified BA method that can be applied to various MIA systems is challenging due to the diversity of imaging modalities (e.g., X-Ray, CT, and MRI) and analysis tasks (e.g., classification, detection, and segmentation). Most existing BA methods are designed to attack natural image classification models, which apply spatial triggers to training images and inevitably corrupt the semantics of poisoned pixels, leading to the failures of attacking dense prediction models. To address this issue, we propose a novel Frequency-Injection based Backdoor Attack method (FIBA) that is capable of delivering attacks in various MIA tasks. Specifically, FIBA leverages a trigger function in the frequency domain that can inject the low-frequency information of a trigger image into the poisoned image by linearly combining the spectral amplitude of both images. Since it preserves the semantics of the poisoned image pixels, FIBA can perform attacks on both classification and dense prediction models. Experiments on three benchmarks in MIA (i.e., ISIC-2019 [4] for skin lesion classification, KiTS-19 [17] for kidney tumor segmentation, and EAD-2019 [1] for endoscopic artifact detection), validate the effectiveness of FIBA and its superiority over stateof-the-art methods in attacking MIA models and bypassing backdoor defense. Source code will be available at code.

Authors

Jing Zhang

12 papers

Dacheng Tao

8 papers

Benteng Ma

1 papers

TL;DR

Abstract

Authors

References59 items

Few-shot Backdoor Defense Using Shapley Estimation

LIRA: Learnable, Imperceptible and Robust Backdoor Attacks

ViTAE: Vision Transformer Advanced by Exploring Intrinsic Inductive Bias

FedDG: Federated Domain Generalization on Medical Image Segmentation via Episodic Learning in Continuous Frequency Space

Stabilized Medical Image Attacks

Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

Recent advances in deep learning theory

Invisible Backdoor Attack with Sample-Specific Triggers

Empowering Things With Intelligence: A Survey of the Progress, Challenges, and Opportunities in Artificial Intelligence of Things

Disabling Backdoor and Identifying Poison Data by using Knowledge Distillation in Backdoor Attacks on Deep Neural Networks

Composite Backdoor Attack for Deep Neural Network by Mixing Existing Benign Features

Input-Aware Dynamic Backdoor Attack

Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases

Backdoor Learning: A Survey

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

Backdoor Attacks Against Deep Learning Systems in the Physical World

Semi-Supervised Medical Image Classification With Relation-Driven Self-Ensembling Model

Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness

FDA: Fourier Domain Adaptation for Semantic Segmentation

Defending against Backdoor Attack on Deep Neural Networks

Modified U-Net (mU-Net) With Incorporation of Object-Dependent High Level Features for Improved Liver and Liver-Tumor Segmentation in CT Images

Encoding CT Anatomy Knowledge for Unpaired Chest X-ray Image Decomposition

BCN20000: Dermoscopic Lesions in the Wild

Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs

MMDetection: Open MMLab Detection Toolbox and Benchmark

Bypassing Backdoor Detection Algorithms in Deep Learning

ResUNet-a: a deep learning framework for semantic segmentation of remotely sensed data

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

The KiTS19 Challenge Data: 300 Kidney Tumor Cases with Clinical Context, CT Semantic Segmentations, and Surgical Outcomes

Endoscopy artifact detection (EAD 2019) challenge dataset

STRIP: a defence against trojan attacks on deep neural networks

Attention Residual Learning for Skin Lesion Classification

Fully Dense UNet for 2-D Sparse Photoacoustic Tomography Artifact Removal

H-DenseUNet: Hybrid Densely Connected UNet for Liver and Tumor Segmentation From CT Volumes

Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

Attention U-Net: Learning Where to Look for the Pancreas

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Evaluate the Malignancy of Pulmonary Nodules Using the 3-D Deep Leaky Noisy-OR Network

One Pixel Attack for Fooling Deep Neural Networks

BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

Accurate Pulmonary Nodule Detection in Computed Tomography Images Using Deep Convolutional Neural Networks

Mask R-CNN

A survey on deep learning in medical image analysis

Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization

Densely Connected Convolutional Networks

V-Net: Fully Convolutional Neural Networks for Volumetric Medical Image Segmentation

Deep Residual Learning for Image Recognition

Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks

U-Net: Convolutional Networks for Biomedical Image Segmentation

Adam: A Method for Stochastic Optimization

Explaining and Harnessing Adversarial Examples

Microsoft COCO: Common Objects in Context

Image phase or amplitude? Rapid scene categorization is an amplitude-based process.

A Demonstration of the Visual Importance and Flexibility of Spatial-Frequency Amplitude and Phase

Robust Unlearnable Examples: Protecting Data Privacy Against Adversarial Learning

Auto Learning Attention

Karthikeyan Natesan Ramamurthy, and Xue Lin

Local and global consistency regularized mean teacher for semi-supervised nuclei classiﬁcation

CuPy : A NumPy-Compatible Library for NVIDIA GPU Calculations

Field of Study

Journal Information

Name

Page

Venue Information

Name

Type

URL

Alternate Names