# BadRefSR: Backdoor Attacks Against Reference-based Image Super Resolution

arXiv: https://arxiv.org/abs/2502.20943 · HTML: https://mlsanity.com/paper/2502.20943/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 37 references that are in the map.
- First posted on arXiv 28 Feb 2025.

## Builds on (most cited first, 25 of 25)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Perceptual Losses for Real-Time Style Transfer and Super-Resolution](https://mlsanity.com/paper/1603.08155/) (2016)
- [Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Network](https://mlsanity.com/paper/1609.04802/) (2016)
- [Image Super-Resolution Using Very Deep Residual Channel Attention Networks](https://mlsanity.com/paper/1807.02758/) (2018)
- [ESRGAN: Enhanced Super-Resolution Generative Adversarial Networks](https://mlsanity.com/paper/1809.00219/) (2018)
- [Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning](https://mlsanity.com/paper/1712.05526/) (2017)
- [Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks](https://mlsanity.com/paper/2007.02343/) (2020)
- [Learning Texture Transformer Network for Image Super-Resolution](https://mlsanity.com/paper/2006.04139/) (2020)
- [Sketch-based Manga Retrieval using Manga109 Dataset](https://mlsanity.com/paper/1510.04389/) (2015)
- [The relativistic discriminator: a key element missing from standard GAN](https://mlsanity.com/paper/1807.00734/) (2018)
- [Image Super-Resolution by Neural Texture Transfer](https://mlsanity.com/paper/1903.00834/) (2019)
- [How to Backdoor Diffusion Models?](https://mlsanity.com/paper/2212.05400/) (2022)
- [MASA-SR: Matching Acceleration and Spatial Adaptation for Reference-Based Image Super-Resolution](https://mlsanity.com/paper/2106.02299/) (2021)
- [Backdoor Attack against Speaker Verification](https://mlsanity.com/paper/2010.11607/) (2020)
- [Dual-Camera Super-Resolution with Aligned Attention Modules](https://mlsanity.com/paper/2109.01349/) (2021)
- [Untargeted Backdoor Attack against Object Detection](https://mlsanity.com/paper/2211.05638/) (2022)
- [Hybrid Pixel-Unshuffled Network for Lightweight Image Super-Resolution](https://mlsanity.com/paper/2203.08921/) (2022)
- [The Devil is in the GAN: Backdoor Attacks and Defenses in Deep Generative Models](https://mlsanity.com/paper/2108.01644/) (2021)
- [Attention-based Multi-Reference Learning for Image Super-Resolution](https://mlsanity.com/paper/2108.13697/) (2021)
- [Stealthy Targeted Backdoor Attacks against Image Captioning](https://mlsanity.com/paper/2406.05874/) (2024)
- [Backdoor Attacks against Image-to-Image Networks](https://mlsanity.com/paper/2407.10445/) (2024)
- [EFENet: Reference-based Video Super-Resolution with Enhanced Flow Estimation](https://mlsanity.com/paper/2110.07797/) (2021)
- [Backdoor Attacks against Hybrid Classical-Quantum Neural Networks](https://mlsanity.com/paper/2407.16273/) (2024)
- [Backdoor Attack Against Vision Transformers via Attention Gradient-Based Image Erosion](https://mlsanity.com/paper/2410.22678/) (2024)
- [Combinational Backdoor Attack against Customized Text-to-Image Models](https://mlsanity.com/paper/2411.12389/) (2024)

## Built on by (most cited first, 6 of 6)

- [State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space](https://mlsanity.com/paper/2601.04266/) (2026)
- [BadSR: Stealthy Label Backdoor Attacks on Image Super-Resolution](https://mlsanity.com/paper/2505.15308/) (2025)
- [The Double-Edged Sword of Data-Driven Super-Resolution: Adversarial Super-Resolution Models](https://mlsanity.com/paper/2602.07251/) (2026)
- [BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World](https://mlsanity.com/paper/2505.16154/) (2025)
- [RefSR-Adv: Adversarial Attack on Reference-based Image Super-Resolution Models](https://mlsanity.com/paper/2601.01202/) (2026)
- [TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors](https://mlsanity.com/paper/2607.12571/) (2026)

## Abstract (arXiv)

Reference-based image super-resolution (RefSR) represents a promising advancement in super-resolution (SR). In contrast to single-image super-resolution (SISR), RefSR leverages an additional reference image to help recover high-frequency details, yet its vulnerability to backdoor attacks has not been explored. To fill this research gap, we propose a novel attack framework called BadRefSR, which embeds backdoors in the RefSR model by adding triggers to the reference images and training with a mixed loss function. Extensive experiments across various backdoor attack settings demonstrate the effectiveness of BadRefSR. The compromised RefSR network performs normally on clean input images, while outputting attacker-specified target images on triggered input images. Our study aims to alert researchers to the potential backdoor risks in RefSR. Codes are available at https://github.com/xuefusiji/BadRefSR.