mlsanityData to 7 Oct 2026

FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis

arXiv 2112.01148 ↗First posted 2 Dec 2021cs.CV cs.AIcited by 60

Not on the map. Why?

Abstract (arXiv)

In recent years, the security of AI systems has drawn increasing research attention, especially in the medical imaging realm. To develop a secure medical image analysis (MIA) system, it is a must to study possible backdoor attacks (BAs), which can embed hidden malicious behaviors into the system. However, designing a unified BA method that can be applied to various MIA systems is challenging due to the diversity of imaging modalities (e.g., X-Ray, CT, and MRI) and analysis tasks (e.g., classification, detection, and segmentation). Most existing BA methods are designed to attack natural image classification models, which apply spatial triggers to training images and inevitably corrupt the semantics of poisoned pixels, leading to the failures of attacking dense prediction models. To address this issue, we propose a novel Frequency-Injection based Backdoor Attack method (FIBA) that is capable of delivering attacks in various MIA tasks. Specifically, FIBA leverages a trigger function in the frequency domain that can inject the low-frequency information of a trigger image into the poisoned image by linearly combining the spectral amplitude of both images. Since it preserves the semantics of the poisoned image pixels, FIBA can perform attacks on both classification and dense prediction models. Experiments on three benchmarks in MIA (i.e., ISIC-2019 for skin lesion classification, KiTS-19 for kidney tumor segmentation, and EAD-2019 for endoscopic artifact detection), validate the effectiveness of FIBA and its superiority over state-of-the-art methods in attacking MIA models as well as bypassing backdoor defense. Source code will be available at https://github.com/HazardFY/FIBA.

Key facts. Cited by 60 papers in the map (data through 7 Oct 2026). Builds on 45 of its 59 references that are in the map. First posted on arXiv 2 Dec 2021.

Builds on

45 of 59 references.

References · 45

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Mask R-CNNcited by 7,259
  8. 2016Densely Connected Convolutional Networkscited by 6,691
  9. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  10. 2016V-Net: Fully Convolutional Neural Networks for Volumetric Medical Image Segmentationcited by 2,284
  11. 2018Attention U-Net: Learning Where to Look for the Pancreascited by 1,420
  12. 2019MMDetection: Open MMLab Detection Toolbox and Benchmarkcited by 1,379
33 more
  1. 2017A Survey on Deep Learning in Medical Image Analysiscited by 1,182
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2017One pixel attack for fooling deep neural networkscited by 579
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  6. 2020FDA: Fourier Domain Adaptation for Semantic Segmentationcited by 540
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  8. 2020Backdoor Learning: A Surveycited by 412
  9. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  10. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  11. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  12. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  13. 2021FedDG: Federated Domain Generalization on Medical Image Segmentation via Episodic Learning in Continuous Frequency Spacecited by 284
  14. 2019ResUNet-a: a deep learning framework for semantic segmentation of remotely sensed datacited by 260
  15. 2019BCN20000: Dermoscopic Lesions in the Wildcited by 224
  16. 2021ViTAE: Vision Transformer Advanced by Exploring Intrinsic Inductive Biascited by 216
  17. 2019The KiTS19 Challenge Data: 300 Kidney Tumor Cases with Clinical Context, CT Semantic Segmentations, and Surgical Outcomescited by 168
  18. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  19. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  20. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
  21. 2020Empowering Things with Intelligence: A Survey of the Progress, Challenges, and Opportunities in Artificial Intelligence of Thingscited by 110
  22. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  23. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
  24. 2020Semi-supervised Medical Image Classification with Relation-driven Self-ensembling Modelcited by 59
  25. 2018Fully Dense UNet for 2D Sparse Photoacoustic Tomography Artifact Removalcited by 56
  26. 2017Evaluate the Malignancy of Pulmonary Nodules Using the 3D Deep Leaky Noisy-or Networkcited by 53
  27. 2020Recent advances in deep learning theorycited by 41
  28. 2019Modified U-Net (mU-Net) with Incorporation of Object-Dependent High Level Features for Improved Liver and Liver-Tumor Segmentation in CT Imagescited by 28
  29. 2017Accurate Pulmonary Nodule Detection in Computed Tomography Images Using Deep Convolutional Neural Networkscited by 26
  30. 2020Defending against Backdoor Attack on Deep Neural Networkscited by 22
  31. 2019Endoscopy artifact detection (EAD 2019) challenge datasetcited by 11
  32. 2021Stabilized Medical Image Attackscited by 10
  33. 2019Encoding CT Anatomy Knowledge for Unpaired Chest X-ray Image Decompositioncited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 6; 2023: 19; 2024: 22; 2025: 5; 2026: 7.

60 papers.

Sort:

By area:

  1. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  2. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 40
  3. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  4. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  5. 2023Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directionscited by 33
  6. 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
  7. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  8. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  9. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  10. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
  11. 2024BAPLe: Backdoor Attacks on Medical Foundational Models using Prompt Learningcited by 15
  12. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 14
38 more
  1. 2023A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectivescited by 13
  2. 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
  3. 2024Robust and Transferable Backdoor Attacks Against Deep Image Compression With Selective Frequency Priorcited by 11
  4. 2023A clean-label graph backdoor attack method in node classification taskcited by 10
  5. 2024BadCM: Invisible Backdoor Attack Against Cross-Modal Learningcited by 9
  6. 2023Don't FREAK Out: A Frequency-Inspired Approach to Detecting Backdoor Poisoned Samples in DNNscited by 8
  7. 2023WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networkscited by 8
  8. 2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
  9. 2023Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarioscited by 7
  10. 2024Spy-Watermark: Robust Invisible Watermarking for Backdoor Attackcited by 7
  11. 2025Mitigating Object Hallucinations in MLLMs via Multi-Frequency Perturbationscited by 7
  12. 2022Backdoor Attacks for Remote Sensing Data with Wavelet Transformcited by 6
  13. 2022Feather-Light Fourier Domain Adaptation in Magnetic Resonance Imagingcited by 5
  14. 2023A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attackscited by 5
  15. 2023Robust Backdoor Attacks on Object Detection in Real Worldcited by 5
  16. 2024Backdoor Attack on Unpaired Medical Image-Text Foundation Models: A Pilot Study on MedCLIPcited by 5
  17. 2022Invisible Backdoor Attack with Dynamic Triggers against Person Re-identificationcited by 4
  18. 2023SkyMask: Attack-agnostic Robust Federated Learning with Fine-grained Learnable Maskscited by 4
  19. 2022Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaversescited by 3
  20. 2024DiffPhysBA: Diffusion-based Physical Backdoor Attack against Person Re-Identification in Real-Worldcited by 3
  21. 2024Event Trojan: Asynchronous Event-based Backdoor Attackscited by 3
  22. 2024Adversarial Attacks on Hyperbolic Networkscited by 3
  23. 2023Enhancement attacks in biomedical machine learningcited by 2
  24. 2024Low-Frequency Black-Box Backdoor Attack via Evolutionary Algorithmcited by 2
  25. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attackscited by 2
  26. 2024SoK: Security and Privacy Risks of Healthcare AIcited by 2
  27. 2024Backdoor in Seconds: Unlocking Vulnerabilities in Large Pre-trained Models via Model Editingcited by 2
  28. 2024LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithmcited by 2
  29. 2024Invisible Backdoor Attack Through Singular Value Decompositioncited by 1
  30. 2024NoiseAttack: An Evasive Sample-Specific Multi-Targeted Backdoor Attack Through White Gaussian Noisecited by 1
  31. 2024BadScan: An Architectural Backdoor Attack on Visual State Space Modelscited by 1
  32. 2024PBP: Post-training Backdoor Purification for Malware Classifierscited by 1
  33. 2026X-Mark: Saliency-Guided Robust Dataset Ownership Verification for Medical Imagingcited by 1
  34. 2023Trainwreck: A damaging adversarial attack on image classifierscited by 0
  35. 2024AS-FIBA: Adaptive Selective Frequency-Injection for Backdoor Attack on Deep Face Restorationcited by 0
  36. 2024Towards Adversarial Robustness And Backdoor Mitigation in SSLcited by 0
  37. 2024Act in Collusion: Distributed Multi-Target Backdoor Attacks in Federated Learningcited by 0
  38. 2024One Pixel is All I Needcited by 0

50 most cited of 60 All 60 (JSON)