LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm

LADDER: Multi-Objective Backdoor Attack via Evolutionary Algorithm Dazhuang Liu∗, Yanqi Qiao∗, Rui Wang, Kaitai Liang, and Georgios Smaragdakis {d.liu-8, y.qiao, r.wang-8, kaitai.liang, g.smaragdakis}@tudelft.nl Delft University of Technology Abstract—Current black-box backdoor attacks in convolutional neural networks formulate attack objective(s) as singleobjective optimization problems in single domain. Designing triggers in single domain harms semantics and trigger robustness as well as introduces visual and spectral anomaly. This work proposes a multi-objective black-box backdoor attack in dual domains via evolutionary algorithm (LADDER), the first instance of achieving multiple attack objectives simultaneously by optimizing triggers without requiring prior knowledge about victim model. In particular, we formulate LADDER as a multiobjective optimization problem (MOP) and solve it via multiobjective evolutionary algorithm (MOEA). MOEA maintains a population of triggers with trade-offs among attack objectives and uses non-dominated sort to drive triggers toward optimal solutions. We further apply preference-based selection to MOEA to exclude impractical triggers. LADDER investigates a new dualdomain perspective for trigger stealthiness by minimizing the anomaly between clean and poisoned samples in the spectral domain. Lastly, the robustness against preprocessing operations is achieved by pushing triggers to low-frequency regions. Extensive experiments comprehensively showcase that LADDER achieves attack effectiveness of at least 99%, attack robustness with 90.23% (50.09% higher than state-of-the-art attacks on average), superior natural stealthiness (1.12×to 196.74×improvement) and excellent spectral stealthiness (8.45×enhancement) as compared to current stealthy attacks by the average l2-norm across 5 public datasets. I. INTRODUCTION Convolutional neural networks (CNNs) [52] have become an effective machine learning (ML) technique for image classification. They have proved to be vulnerable to backdoor attacks [20, 24, 51], allowing an attacker to mislead a victim model with incorrect yet desired predictions on poisoned images during inference while behaving normally on clean images. These attacks pose severe risks to real-world applications, e.g., tumor diagnosis [19], self-driving cars [5]. Some service providers of safety-critical applications may choose to collect data online to train a private model and prevent attackers from accessing their systems. In this sense, backdoor attacks in the black-box setting are proposed [9]. ∗The first two authors contributed equally to this work. Under a black-box scenario, attackers do not have knowledge about the models and cannot manipulate training but they may poison training data by designing triggers. An “ideal” trigger should satisfy stealthiness,robustness, attack effectiveness and functionality [67]. Stealthiness concerns the invisibility of trigger in the poisoned image to human visual perception; robustness is evidenced by its ability to withstand image preprocessing; effectiveness requires that backdoor attack to be successfully injected into the victim model; and functionality preservation requires that inference accuracy on benign data remains unaffected. Current designs for trigger stealthiness in the spectral domain are impractical. Conventional pixel-based backdoor attacks [4, 24, 51] inject triggers into spatial domain. Since spatial domain contains abundant semantic information, putting triggers into pixels can be easily detected by visual inspection. Recent works [20, 23, 68] thus design backdoor attacks by injecting triggers into spectral domain. Inspired by patchbased backdoor attacks, FTrojan [68] manipulates the midand high-frequency spectrum of images by inserting predefined perturbations to fixed frequency bands. Manually crafting triggers in high-frequency components harms robustness, as most image preprocessing operations, e.g., low-pass filtering and JPEG compression, lead to greater information loss on these components. Current spatial and frequency triggers [4, 20, 24, 25, 46, 68] introduce distinguishable artifacts in spectral and/or spatial domain (see Figure 6 in Section VII), which bear a high risk of existing attacks being detected. A new perspective - starting with stealthiness. Considering both spatial and spectral domains [33, 69] which we call dual domains hereafter, this work aims to achieve dual-domain stealthiness: (1) spatial stealthiness, which guarantees the injection of trigger into the image does not harm cognitive semantics or introduce visual anomaly, and (2) spectral domain stealthiness, which avoids the disparities of frequency spectrum between clean and poisoned images. In contrast, despite the stealthiness achieved by Wang et al. [67] at pixel level, we shed lights on stealthiness in the spectral domain as well as guaranteeing all the attack goals mentioned above. Benefit the stealthiness and robustness in low-frequency domain. Cox et al. [11] claim that low-frequency components of natural images contain semantic information understandable to humans, whereas high-frequency ones stand for details and noise. Based on this, works [11, 25] state two benefits of inserting triggers in low-frequency domain: (1) abundant inforNetwork and Distributed System Security (NDSS) Symposium 2025 24-28 February 2025, San Diego, CA, USA ISBN 979-8-9894372-8-3 https://dx.doi.org/10.14722/ndss.2025.241061 www.ndss-symposium.org mation contained in low-frequency domain can provide a high perceptual capacity of accommodating trigger patterns without perceptual degradation, which improves trigger stealthiness; and (2) low-frequency components can bear better resilience in image compression and are less prone to be removed by image filtering than midand high-frequency components, which guarantees a better attack robustness. Achieving multiple attack objectives simultaneously in black-box backdoor attack is not trivial. Current backdoor attacks either adopt a fixed trigger pattern [4, 20, 24, 68], or optimize triggers [16, 32, 51, 75, 76] by leveraging Lagrange multipliers to aggregate attack objectives into a singleobjective problem (SOP) with gradient descent. Conflicts between attack objectives (e.g., effectiveness and stealthiness) make tuning Lagrange coefficients challenging without prior knowledge. One lacking prior knowledge must repeatedly perform the single-objective optimization to identify a practical setting for Lagrange coefficients among objectives (see Figure 2(a)). Furthermore, applying Lagrange multipliers with Stochastic Gradient Descent (SGD) often fails to reliably produce practical triggers that optimally balance objectives (see Figure 2(b)). Optimization to Multiple Objectives. We aim to develop a backdoor attack to optimize triggers in the low-frequency region while ensuring attack effectiveness, functionality, dualdomain stealthiness, and robustness simultaneously without necessitating internal information of the victim model and in a Lagrange coefficient-free manner. Developing such an optimal trigger that meets multiple objectives is non-trivial. First, in the black-box setting where the target model is inaccessible to attackers, it is not possible to acquire gradient information and predict trigger performance on the victim model, which is therefore hard to find optimal trigger with gradient descent; also, improperly handcrafted fixed trigger (with a predefined magnitude of perturbations and locations) in the spectrum lead to improper signals in the spectrum and poor attack effectiveness. For example, large perturbation triggers like [20, 68] disrupt invisibility and alter image semantics, while small perturbations could prevent the model from learning the trigger, reducing attack effectiveness. This work develops LADDER, a new black-box backdoor attack that leverages MOEA [12], a gradient-free optimization method, to effectively generate triggers in the spectral domain (see Figure 1 for its workflow). We maintain attack effectiveness, dual-domain stealthiness and robustness against image preprocessing operations simultaneously, obtaining practical triggers (see red dots in Figure 3) without the need for tuning sensitive coefficients. Specifically, we randomly initialize a population of triggers, each of which represents a unique tradeoff across attack objectives. During optimization, we iteratively apply variations, such as crossover [13] and mutation [14], to change the magnitude of perturbations and locations of triggers to produce a new set of candidate triggers. We then evaluate the performance of each trigger based on the values calculated by attack objectives (see Equations (10b) to (10d)). We also use non-dominated sort (NDSort) to drive the trigIDCTDCT Clean Spectrum Trigger Inject Poisoned Spatial Domain Frequency Domain ① ② ③ ④ ⑤ Spatial Domain Trigger Optimization Trigger Evaluation Surrogate Iter ⑥⑦ ⑧ Data Poisoning ⑨ Share Poisoned Data Backdoored Inference “Bird” Generated Trigger Poisoned Images Victim Backdoored model Attack Stage Multi-obj Trigger Evaluation Stage Frequency Stealthiness Spatial Stealthiness Robust Constraint Malicious Injection and Inference Stage Poisoned Images (Car, Cat, Ship, etc.) Fig. 1: The workflow of LADDER. Step ①-③: trigger injection; Step ④-⑥: main loop for trigger optimization; Step ⑦-⑧: poison dataset with trigger and release it to public; Step ⑨: the backdoor is injected when users download the poisoned data to train/tune their own model. The trigger optimization, evaluation, and injection are controlled by an attacker, whereas the malicious training and inference stage (marked in grey) are unseen to the attacker. gers toward optimal trade-offs. After that, we incorporate preference-based selection into MOEA to exclude impractical triggers (see red dots in Figure 5). We note that the triggers to be excluded are considered as equal in quality to others during optimization, but they do not represent the practical solutions. Finally, we use our frequency trigger injection function to produce the adversary’s poisoned dataset with the most practical trigger. To evaluate triggers’ performance, we construct a surrogate model (can be heterogeneous to the victim model) tuned on training data. Since the optimization direction guided by gradient descent from victim model is unknown, we improve triggers (concerning objective values) with variation (crossover and mutation) and selection pressure from NDSort which are inspired by the mating and survival of natural evolution. We empirically confirm that the triggers’ performance is independent to model structures, and in this way, a heterogeneous surrogate model is capable of approximating the victim model in practical accuracy and stealthiness. The main contributions are summarized as follows: •We empirically demonstrate inherent conflicts among attack effectiveness, stealthiness and robustness, highlighting the difficulty in finding optimal Lagrange coefficients for balancing performance but also the unreliability in producing practical triggers (e.g., considering effectiveness and stealthiness) depending on coefficients. •We formulate multiple attack goals (including effectiveness, dual-domain stealthiness and robustness) as a multi-objective problem (MOP) under the black-box setting. In MOP, we produce optimal triggers for all the objectives without using coefficients. We leverage MOEA to optimize MOP, enhancing 2 optimization efficacy as compared to SOP with gradient-based optimization. We also integrate the preference-based selection into MOEA to further filters out impractical triggers. •We conduct extensive experiments to show that LADDER achieves practical attack effectiveness >99%, attack robustness with 90.23% under image preprocessing operations, better natural stealthiness (1.12×to 196.74×enhancement), and better spectral stealthiness (8.45×improvement), as measured by the average l2-norm across five real-world datasets. II. RELATED WORK A. Backdoor Attacks The first backdoor attack against CNNs is proposed by Gu et al. [24]. It injects a patch-based pattern into a small fraction of clean data during training process, triggering the victim model to misclassify those poisoned images to the attackerdesired label. Since then, various attacks have been proposed to improve stealthiness through the design of triggers and training. Spatial domain-based attacks. To bypass human inspection, some works [4, 16, 32, 42, 46, 51] focus on stealthy backdoor attacks in spatial domain. For example, Barni et al. [4] use sinusoidal signals as triggers which results in only a slight varying backgrounds on the poisoned images. Liu et al. [46] utilize natural reflection as triggers for backdoor injection in order to disguise triggers as natural light-reflection. Li et al. [42] leverage a CNN-based image steganography technique to hide an attacker-specified string into images as samplespecific triggers. Besides visual stealthiness, several works [10, 15, 75, 76] investigate the stealthiness in latent feature space. Doan et al. [15] design a trigger generator to constrain the similarity of hidden features between clean and poisoned data via Wasserstein regularization. To improve the trigger stealthiness, Zhao et al. [75] learn a generator adaptively to constrain the latent layers, which makes triggers more invisible in both input and latent feature space. Additionally, some studies focus on different aspects of attacks. For example, Lv et al. [48] propose an attack without leveraging original training/testing dataset. Zeng et al. [70] conduct clean-label backdoor attacks using knowledge of target class samples and out-of-distribution data. While attacks in the spatial domain offer stealthiness, they often lack robustness against common image preprocessing operations, such as smoothing and compression. Consequently, their effectiveness is significantly compromised by such operations. Current spatial attacks customize triggers in a white-box setting, allowing attackers to access to the model’s structure and gradients, as well as the ability to manipulate the model arbitrarily. These attacks often incorporate Lagrange multipliers, introducing additional coefficients and being sensitivity to the data, model, and optimization problem. Besides, many spatial backdoor attacks exhibit severe midand high-frequency artifacts that can be easily detected in spectral domain. Frequency domain-based attacks. Due to the drawbacks of designing triggers in spatial domain, studies [20, 26, 28, 68, 71] dive into backdoor attacks in frequency domain, naturally TABLE I: Critical attack attributes among LADDER and other attacks in spatial (S) and frequency (F) domains. The attack task is formulated as a single-objective problem (SOP) or a multi-objective problem (MOP). Attributes→Attack Domain Attack Scenario Stealthiness Attack Robustness Optimization Task Type Attacks ↓S F Input-aware [50] SWhite-box % % % SOP ISSBA [42] SWhite-box % % % SOP LIRA [16] SWhite-box % % % SOP DFST [10] SWhite-box % % % SOP WB [15] SWhite-box % % % SOP IBA [76] SWhite-box % % % SOP BadNets [24] SBlack-box % % % SOP SIG [4] SBlack-box ! % % SOP ReFool [46] SBlack-box ! % % SOP WaNet [51] SBlack-box ! % % SOP Narcissus [70] SBlack-box % % ! SOP FTrojan [68] FBlack-box ! % % SOP FIBA [20] FBlack-box ! % % SOP DUBA [23] S+F Black-box ! ! % SOP LADDER (Ours) S+F Black-box ! ! ! MOP guaranteeing visual stealthiness by frequency properties. Wang et al. [68] handcraft two single frequency bands with fixed (predefined) perturbations as triggers. Feng et al. [20] poison a clean image by linearly combining the spectral amplitude of a trigger image with the clean one. Unfortunately, both of them, although maintaining stealthiness in spatial domain, introduce distinguishable frequency artifacts (see Figure 6) that can be detected via frequency inspection. Furthermore, they focus on natural (spatial) stealthiness yet do not consider robustness against image preprocessing operations. Moreover, due to lacking gradients, existing frequency backdoor attacks in blackbox setting adopt fixed trigger pattern and consequently fail to achieve stealthiness in spectrum. In contrast, we leverage the evolutionary algorithm, a gradient-free optimization to design triggers in the spectral domain, which, for the first time, achieves advanced imperceptibility in dual domains but also improves the attack robustness against image preprocessingbased defenses. We briefly compare the SOTA backdoor attacks in Table I based on various attack attributes. For experimental comparisons, please refer to Section VII. Other backdoor attacks. There are other types of attacks tailored to different scenarios. For instance, Lan et al. [36] introduce a stealthy and practical backdoor attack on speech recognition tasks. Abad et al. [1] propose a stealthy attack against spiking neural networks. Zhang et al. [72] present the first backdoor attack for model merging scenario. We note that these attacks aim for different tasks, models and do not consider spectral domain stealthiness. We do not include them as baselines in the experiments. B. Backdoor Defense Backdoor defense can be roughly divided into detection [7, 22, 34, 65, 71] and defensive [8, 40, 41, 45, 54, 66] mechanisms. Typical detection methods include STRIP [22], which deliberately perturbs clean inputs to identify potential backdoored CNN models during inference. Spectral Signature [65] detects outliers using latent feature representations, 3 while Zeng et al. [71] propose a method that discriminates between clean and poisoned data in the frequency domain using supervised learning. Image preprocessing-based methods [41, 55, 68] have recently been explored to remove backdoors using techniques such as transformations and compression. Defensive methods aim to detect potential backdoor attacks but also to actively mitigate their effectiveness. For instance, fine-pruning [45] reduces the impact of backdoors by trimming dormant neurons in the last convolution layer, based on the minimum activation values of clean inputs. Neural Cleanse [66] leverages reverse engineering to reconstruct potential triggers for each target label and eventually renders the backdoor ineffective by retraining patches strategy. Neural Attention Distillation [40] utilizes a “teacher” model to guide the finetuning of the backdoored “student” network to erase backdoor triggers. In this work, we showcase that the proposed attack can evade the defenses including frequency inspection, image preprocessing operations, and mainstream backdoor defenses. Recently, several state-of-the-art backdoor defenses have been proposed. For example, Gao et al. [21] introduce a training-time defense that separates training data into clean and poisoned subsets. Zhu et al. [77] purify poisoned models by incorporating a learnable neural polarizer as an intermediate layer. Shi et al. [60] mitigate backdoor attacks through zeroshot image purification. III. BACKGROUND Preliminary Notations on CNN. CNN is a cutting-edge ML architecture that achieves striking performance, especially for tasks with high-dimensional input space, such as image classification. Given a CNN-based image classification model fθ:IS∈[0,1]S→RKthat takes an image x∈ ISas input, and outputs an inference label y∈RK, where ISrepresents the input space with dimension S=H×W×C(Height, Width and Channels). The RKis the classification space which is divided into Kcategories, the label y∈RKindicates the category where image xbelongs to, i.e., y∈ {0,1,· · · ,K−1}. Backdoor Attacks and Data Poisoning. In a standard backdoor attack, the attacker crafts a subset of the clean training set (which contains Nsamples) Dc={(xi, yi)|xi∈ IS, yi∈ RK}N i=1 with a poison ratio r∈(0,1] to produce a poisoned dataset: Dbd ={(x′ j, y′ j)|x′ j∈ IS, y′ j∈RK}⌈N×r⌉ j=1 in which each poisoned image (x′ j, y′ j)∈Dbd is obtained by applying a trigger function Tand target label function ηon the image and label of counterpart clean sample (xj, yj)∈Dc: x′ j=T(xj, m, t)≜xj·(1 −m) + t·m, y′ j=η(yj)≜ytgt,(1) where m∈[0,1] is a scaling parameter and ytgt is the attackerdesired target label. Backdoor attack aims to inject a trojan into a CNN model fθby tuning model parameters θon Dcand Dbd so that the poisoned model misclassifies any poisoned images in Dbd into target (attacker-desired) class while behaving normally on clean data in Dcwithout sacrificing benign accuracy. Details about the formulation of Dbd with frequency triggers generated by LADDER are provided in Section VI-A. Given a loss function L, backdoor attack is commonly defined as an optimization task min θP(x,y)∈Dc∪Dbd L(fθ(x, y)). Discrete Cosine Transform1(DCT) is a widely used transformation that represents a finite sequence of image pixels as a sum of cosine functions oscillating at various frequencies. In the spectrum, most of the semantic information of images tends to be concentrated in a few low-frequency components on the top-left region, where the (0,0) element (top-left) is the zero-frequency component. DCT and its inverse (IDCT) are channel-wise independent and can be applied to each channel of color images independently. Therefore, we simply introduce the DCT/IDCT operation on a single-channel image. The relationship between a single-channel image x∈[0,1]H×W (height H, width W) in spatial domain and its correspondent frequency spectrum XH×Wcan be described by type-II DCT and its inverse (IDCT) [2], denoted as D(·)and D−1(·) respectively as follows: D(u, v) = NuNvPH−1 i=0 PW−1 j=0 x(i, j)cos(2i+1)uπ 2Hcos(2j+1)vπ 2W,(2) D−1(i, j) = PH−1 u=0 PW−1 v=0 NuNvX(u, v)cos(2u+1)iπ 2Hcos(2v+1)jπ 2W,(3) where u, i ∈ {0,1,· · · , H −1}, and v, j ∈ {0,1,· · · , W −1}. A pair (u, v)refers to a specific frequency band of spectrum of an image. D(u, v)defines the magnitude of frequency component in a frequency band (u, v). The value x(i, j)∈[0,1] indicates the pixel value of location (i, j)in an image xin spatial domain. Nuand Nvare normalization terms, Nu≜p1/H if u= 0 and otherwise Nu≜p2/H. Similarly, Nv≜p1/W if v= 0 and otherwise Nv≜p2/W. We introduce Nuand Nv in order to ensure the DCT and its inverse are both isometric under l2-norm so that ∥x∥2≡ ∥DCT(x)∥2is guaranteed for a given image x. Multi-objective Optimization (MOP). A MOP refers to an optimization task involving two or more conflicting objectives that cannot be optimal simultaneously to a single optimal solution. MOP is best addressed by generating a set of solutions, each reflecting different trade-offs among the objectives. Under MOP, multi-objective optimization (MOO) is the process of optimizing these multiple conflicting objectives concurrently to obtain an optimal set of solutions. Multi-objective Evolutionary Algorithm (MOEA). MOEA [12] is one of the commonly used MOO methods to solve MOP. It is a gradient-free optimization approach inspired by biological evolution. It explores the search space with a population of candidate solutions, drives the population toward promising areas with variation operators such as crossover [13] and mutation [14], and eventually leads to high-quality solutions. Specifically, MOEA maintains a set of non-dominated solutions known as the Pareto (approximation) front, which is determined by the domination relationship between the objectives. Since the objectives in MOP cannot achieve optimal at the same time, each solution in the Pareto front represents 1We choose commonly used type-II DCT and its inversion in this work. 4 a unique trade-off between the objectives. MOEA is highly effective in solving MOP, as its variation operators can explore large solution spaces more thoroughly, without the need for gradient information and Lagrange coefficients tuning. IV. THREAT MODEL Attacker Capability. Similar to [32, 68, 70], we assume the attacker acts as a malicious data provider who can only embed a trigger into samples from the training set for public use. But it has no control over the training process and lacks any knowledge of the victim model. Attacker Goals. The attacker tricks the victim into training a backdoored CNN model for an image classification task, so that (1) the compromised CNN model outputs a target label desired by the attacker with high probability for any input containing the embedded trigger, while maintaining high inference accuracy on benign data; (2) dual-domain trigger stealthiness can be guaranteed, preventing any noticeable anomaly in both the spatial and spectral domains of the input images; (3) the attack achieves robustness, ensuring that the backdoor remains effective even after image preprocessing is applied to the poisoned data. Performance Metrics. We introduce metrics to quantitatively measure our attack performance in three aspects: effectiveness, stealthiness, and robustness. (1) For attack effectiveness and functionality preservation: we empirically evaluate the effectiveness with attack success rate (ASR), which computes the ratio of poisoned samples misclassified by the poisoned CNN model as the attacker desires. We further use the accuracy (ACC) to evaluate the ratio of benign samples correctly classified as indicated by its ground-truth label by the victim model. ACC (ASR) ∈[0,100] is a scalar value reflecting the proportion of samples (%) being successfully classified (attacked) among a given set of samples. The attacker wishes to achieve high ASR and ACC when a user trains its private model with the provided poisoned dataset. (2) For stealthiness: we use PSNR, SSIM and LPIPS [73] that can reflect human vision on images to evaluate spatial invisibility between clean and poisoned data. LPIPS utilizes deep features of CNNs to identify perceptual similarity, while SSIM and PSNR are calculated based on the statistical pixelwise similarity. Besides, since l2-norm is often used [25, 39] to evaluate the trigger stealthiness, we also include it in experimental comparison. For frequency inspection, we draw the residual map between the spectrum of clean and poisoned images. Ideally, a stealthy backdoor trigger should almost introduce nothing to the residual map, leading to almost no anomaly in the frequency and pixel domains. (3) For robustness: we define the robustness on any maliciously backdoored image xbd and its target label ytgd against a backdoored model fθbd as follows: fθbd (Trans(xbd)) = ytgt,(4) where Trans(·)refers to any preprocessing operations and fθbd has been well poisoned so that for any poisoned images, (a) (b) Trigger Preference Fig. 2: The impact of Lagrange coefficient αin backdoor attack formulated with Lagrange multipliers and solved by SGD concerning trigger perceptibility and attack failure rate. fθbd (xbd) = ytgd. To quantitatively measure the robustness, we record the ASR before and after the image preprocessing. We also investigate the attack robustness against various preprocessing techniques [31], including JPEG compression, Gaussian filter, Wiener filter, and image brightness, which are commonly used in real-world applications. V. OBJECTIVES CONFLICT One may apply a stealthy attack, e.g., FTrojan [68], in a low-frequency region to achieve practical attack objectives (robustness, stealthiness and effectiveness), without considering trigger optimization. In contrast, this work aims to search a trigger that balances multiple objectives. In such a scenario, the conflict among objectives refers to the fact that attack objectives cannot achieve optimal simultaneously. In a backdoor attack, effectiveness and trigger stealthiness are mutually conflicting objectives. We confirm the conflict by formulating a simple optimization problem with the Lagrange multipliers under the control of two coefficients α, β: min θ,t αP (x,y)∈Dc∪Dbd L(fθ(x), y) + β∥t∥2,(5) where α,β∈[0,1], Dbd is a set of poisoned images produced by the spatial domain-based trigger function in Equation (1) with trigger t, and α+β=1, tis a trigger initialized with random noise. With Stochastic Gradient Descent (SGD) [3], we update tfirst while remaining θunchanged, and then update model parameters θwith the optimal t∗. The results on CIFAR-10 with PreAct-ResNet18 are in Figure 2. In Figure 2(a), we show the stealthiness measured by l2norm (a lower value indicates better stealthiness) marked in blue, and attack failure rate (AFR=1.0-ASR, a lower AFR indicates better attack effectiveness) marked in red with bars indicating the standard deviation of 10 repetitions under parameter αuniformly sampled between 0 and 1 with an interval of 0.1. As αincreases, greater emphasis is placed on the attack effectiveness, while the trigger stealthiness is not considered critical. Therefore, the attack failure rate (AFR) drops with the increase of l2-norm. In other words, a stealthy trigger (i.e., with low l2-norm) always achieves unsatisfied ASR (i.e., high AFR). While the curves of AFR and trigger stealthiness exhibit nearly monotonic changes along the increase of α, we note a drastic variation within 0.4 ≤α≤0.5. These results highlight 5 (a) (b) Trigger Preference l2-norm 1.0-ASR Region of Practical Triggers l2-norm 1.0-ASR Lagrange Multipliers+SGD LADDER Fig. 3: Explanation of objective conflicting in backdoor attack, where red and blue dots represent the triggers obtained by LADDER and SGD in victim model. The grey region indicates the objective value of triggers that we prefer to achieve. In this case we reflect our preference by ASR←0.9 and l2←0.4. the conflict between effectiveness and stealthiness, indicating the significance of locating the best alpha. We further sample α in this range, and present the result in Figure 2(b). Similarly, the trigger norm and AFR exhibit an almost monotonic but opposite trend, providing strong evidence of the inherent conflict among objectives. However, the standard deviation of trigger stealthiness is remarkably enlarged in this range, while the trigger norm and AFR change rapidly within the range of αbetween 0.425 and 0.475. Outside this range, the objectives exhibit minimal response to changes in α. Figure 2(b) shows significant variances under alpha=0.45, indicating Lagrange multipliers+SGD cannot stably produce stealthy/effective triggers. Due to the conflict of objectives and instability of the gradient-based optimization process, formulating multiple attack objectives in a single-objective manner with the Lagrange multipliers and solving it with SGD leads to unsatisfied attack performance. In Figure 3, we showcase the triggers produced by Lagrange multipliers+SGD and LADDER to illustrate that LADDER can find more practical triggers than the conventional method. The dashed line demonstrates the expectation of trigger distribution which illustrates natural conflict between the two objectives, and the grey region includes the desired triggers. For example, the attacker aims to achieve a practical ASR (>99%) while maintaining an l2-norm below 0.4in CIFAR-10. Triggers obtained by the Lagrange multipliers+SGD method (marked in blue) are notably distant from the grey region, as they tend to lack either stealthiness or effectiveness. In contrast, most of the triggers generated by LADDER remain within the grey region, ensuring both stealthiness and attack effectiveness. VI. EVOLUTIONARY MULTI-OBJECTIVE BACKDOOR ATTACK A. Problem Formulation We formulate our backdoor attack as an MOP. The main task of solving the MOP is to search an optimal trigger, which is patched to images to create a poisoned dataset. Frequency Trigger Injection Function. Formally, a frequency trigger t= (δ, ν)where δ={δ0, δ1,· · · , δn−1}is a series of magnitude of perturbations, ν=ν0, ν1,· · · , νn−1 Trigger t=(𝛿, 𝜈)𝛿0 𝜈0 𝛿1 𝜈1 𝛿2 𝜈2 𝛿3 𝜈3 𝛿4 𝜈4 𝛿5 𝜈5 Evolutionary Algorithm Trigger Optimize 𝒟(𝐶𝑅) 𝒟(𝐶𝐺) 𝒟(𝐶𝐵) 𝛿0𝜈0𝛿1𝜈1𝛿2𝜈2𝛿3𝜈3𝛿4′𝜈4𝛿5𝜈5 𝛿0𝜈0𝛿1𝜈1𝛿2𝜈2𝛿3𝜈3′ 𝛿4𝜈4𝛿5𝜈5 Trigger t1 Trigger t2 𝛿4′ =𝛿4+ 𝛥𝛿∼Exp(-ɛ,ɛ) 𝜈3′ =𝜈3+𝛥𝜈∼Exp(ℱdom) Crossover Mutation Variation Triggers of current population Triggers of next population OBJ1 OBJ2 Variation Evolution (a) (b) Fig. 4: The workflow of (a): Patching a trigger t=(δ, ν)into the spectrum of each channel of an RGB image. Ddenotes the DCT function in Equation (2). CR,CGand CBdenotes the R, G and B channel. (b): Optimizing trigger via MOEA. Exp(·) denotes sampling from the distribution leveraged by mutation. describes the frequency bands to insert the correspondent perturbations on, and nis the number of manipulated frequency bands. We describe the trigger patching operation ⊙ in Figure 4(a). In order to inject our trigger tinto an image xin the spectral domain, we obtain the spectrum of xvia DCT (D(·)) and put the trigger optimized by LADDER in it. Finally, the poisoned spectrum is inverted to the spatial domain using IDCT (D−1(·)), while we reset the label to an adversarydesired target. Our trigger injection function Tand target label function ηon a given sample (x, y)are formally defined as: x′=T(x, t)≜D−1(D(x)⊙t), y′=η(y)≜ytgt.(6) Dual-domain Stealthiness. We pioneer the consideration of stealthiness in both spatial and spectral domains highly desired in backdoor attacks, since the former ensures the poisoned image evades human inspection while the latter mitigates the anomaly of frequency disparities between benign and poisoned images. Given the widespread use of lp-norm to evaluate the perturbation strength of the designed trigger [16, 56, 75], we adopt this measurement to calculate the spatial stealthiness between clean image xand poisoned image x′(obtained with trigger t and injection function T): Stealthinessspatial :=∥T (x, t)−x∥p,(7) while the frequency stealthiness is reflected by the lp-norm of trigger perturbations as: Stealthinessfreq :=∥δ∥p.(8) This work selects p= 2, i.e., the l2-norm as a measurement of trigger stealthiness for two reasons: (1) since the l2norm of disparity between the clean and poisoned images in dual domains is consistent, measuring the l2-norm of trigger perturbation in the spectral domain can reflect dual-domain stealthiness; (2) we empirically demonstrate that common visibility metrics, such as PSNR, SSIM, LPIPS, cannot properly evaluate frequency stealthiness (see natural stealthiness in Section VII-B for details). We evaluate l2-norm of triggers in 6 the spectral domain due to the benefit of injecting triggers in this domain (see low-frequency robustness below). Robustness in the Low-frequency Spectrum. Low-frequency components show great resilience to image preprocessing operations such as lossy compression and low-pass filtering since these operations are all designed to destroy the midand high-frequency components first. Therefore, we constrain our manipulated frequency bands νin the low-frequency domain Fdom, i.e. νk∈Fdom,∀k∈ {0,1,...,|ν| − 1}. Within Fdom, we minimize the distance between the location of each frequency band of a trigger and the zero-frequency band as: Robustness := || Pn−1 i=0 (loc(νi)−loc(min(Fdom)))||2,(9) where Fdom is the low-frequency domain, min(Fdom)is the zero-frequency band, and the function loc(·)is to find the vertical and horizontal index values for a given frequency band. We provide a thorough analysis of the trade-off in terms of low-frequency regions and stealthiness. We also investigate the impact on attack effectiveness and robustness of our trigger design. Please see Appendix C for the details. Multi-objective Backdoor Attacks Formulation. Current backdoor attacks, even when addressing multiple attack objectives, are typically formulated by linear combination with the Lagrange multipliers. As a result, excessive number of Lagrange coefficients are involved, complicating the parametertuning process. In contrast, we formulate the objectives simultaneously as an MOP and optimize a set of triggers (each trigger represents a unique trade-off among the objectives) without aggregating the objectives into an SOP. Considering the above objectives and constraints while maintaining the functionality (benign accuracy) of backdoored model, we formulate a multi-objective black-box backdoor attack as: (δ∗, ν∗)= argmin δ,ν O(δ, ν)=(O1, O2, O3),(10a) where O1(δ, ν) = P(x,y)∈Dc∪Dbd L(fs θ(x), y),(10b) O2(δ, ν) = ∥δ∥p=2 ,(10c) O3(δ, ν) = || Pn−1 i=0 (loc(νi)−loc(min(Fdom)))||2,(10d) s.t. |δk| ≤ ϵ, ∀k∈ {0,1,· · · ,|δ| − 1},(10e) νk∈Fdom,∀k∈ {0,1,· · · ,|ν| − 1},(10f) Pref: O∗→Opref ,(10g) The task of our attack is formulated in Equation (10a), which contains three objectives, O1of Equation (10b) that ensures a practical ACC and ASR, where fs θis the surrogate model to evaluate trigger performance since the adversary cannot access a victim model, and the set of poisoned images Dbd is obtained with frequency trigger function in Equation (6); O2of Equation (10c) that ensures the dual-domain stealthiness and O3 of Equation (10d) which seeks triggers robust against image preprocessing within Fdom. We introduce two constraints, Constraint (10e) ensuring the magnitude of perturbation for each manipulated frequency band is within a reasonable range; and Constraint (10f) restricting trigger to design in the lowfrequency region Fdom. Finally, a preference-based selection Algorithm 1 LADDER Optimization via MOEA Require: A subset of training data Dc, Poison Ratio r, Total optimization generations Gen, Maximum frequency perturbation ϵ, Number of retrain epoch Ere, Surrogate model fs θ, Population size P Ensure: Poisoned Dataset Dbd injected by t∗= (δ∗, ν∗) Step 1: Initialization 1: Tpopu:{(δ0, ν0),(δ1, ν1),· · · ,(δP−1, νP−1)} ← RandomInit() Step 2: Evaluation 2: {O}popu = Eval(Tpopu, fs θ,Dc, r) Step 3: Trigger Optimization 3: for gen in [0,1,· · · ,Gen-1] do 4: Toffsp:{(δ′ 0, ν′ 0),· · · ,(δ′ P−1, ν′ P−1)} ←Variation(Tpopu) 5: {O}offsp = Eval(Toffsp, fs θ,Dc, r) 6: Tpopu ←rNDSort(Tpopu∪Toffsp,{O}popu ∪ {O}offsp) Step 4: Trigger Selection & Data Preparation 7: (δ∗, ν∗)←SelectTrigger(Tpopu) 8: Dbd = Poison(Dc,r,(δ∗, ν∗)) 9: return Dbd (see Algorithm 3) is considered in Equation (10g) to reflect the preferred range of objective values. B. Evolutionary Multi-objective Trigger optimization Solving an MOP (with conflicting objectives) by using SGD+Lagrange multipliers often leads to suboptimal attack performance (see Section V). We introduce an MOEA to solve the problem. Our MOEA-based approach leverages crossover and mutation operators, avoiding the need to tune sensitive coefficients required by SGD+Lagrange multipliers. However, applying MOEA directly could produce impractical triggers (see those points outside the grey region, in Figure 5). To address this, we integrate MOEA with preference-based selection to prioritize practical triggers (those in the grey region). Specifically, we leverage an MOEA to search the optimal trigger that can maximize performance of all the objectives in Equation (10a). The workflow of trigger optimization is described in Figure 4(b). MOEA estimates the performance of candidate triggers across objectives simultaneously in each iteration, without incurring the problems (in Figures 2 and 3). It initializes random triggers (Step 1 in Algorithm 1), iteratively optimizes them with variation (Figure 4 (b)), evaluates triggers’ objective values (Algorithm 2) and selects non-dominated triggers by preference-based selection (Algorithm 3). We introduce the details of LADDER optimization in Algorithm 1. Step 1: Initialization. MOEA initializes a population popu ={t0, t1,· · · , tP−1}={(δ0, ν0),(δ1, ν1),· · · ,(δP−1, νP−1)} of triggers, where Pis the population size. Besides, the triggers are generated under the constraints in Equations (10e) and (10f). Then, we evaluate the initialized triggers on the objectives. Step 2: Trigger Evaluation. The idea of trigger evaluation is to calculate the objective values O1,O2and O3in Equation (10b), 10c and 10d for each candidate trigger in lines 7 Algorithm 2 Eval: Evaluate Triggers in LADDER Require: A set of triggers T, Surrogate model fs θ, A subset of training data Dc, Poison Ratio r, Population size P Ensure: The objective values {O}of each trigger in T 1: for (δi, νi)in Tdo 2: Dbd ←Poison(Dc,r, (δi, νi)) 3: fs θ′←Train(fs θ,Dbd) 4: Oi 1=P(x,y)∈Dbd L(fs θ′(x), y) 5: Oi 2=∥δ∥2 6: Oi 3=||loc(νi)−loc(min(Fdom))||2 7: Rollback fs θ′←fs θ 8: {O}={(O0 1, O0 2, O0 3),(O1 1, O1 2, O1 3),· · · ,(OP−1 1, OP−1 2, OP−1 3)} 9: return {O} 2 and 5 of Algorithm 1. The trigger evaluation is described in Algorithm 2. To evaluate the attack effectiveness for each trigger, we poison a subset of data with it and train the backdoor task (Equation (10b)) on a surrogate model. A surrogate model refers to a CNN model to approximate the victim model. We use this approach because the attacker has no knowledge about the victim model in the black-box setting. Also, evaluating triggers by training a model from scratch is computationally expensive. We hereby employ a pre-trained surrogate model on clean data, fine-tuning it through a limited number of retraining epochs, achieving evaluation efficiency. One may argue that the heterogeneous model structures between the surrogate and victim model may cause a bias of trigger performance in the evaluation process. To address this concern, we experimentally assess the trigger performance between various combinations of surrogate and victim model structures and demonstrate the high consistency among them (see Section VIII-A). Step 3: Trigger Optimization. After initializing and evaluating the triggers, MOEA iteratively optimizes the triggers by applying variation to the triggers in the population to generate offsprings, evaluating their quality, and finally selecting wellperforming triggers among all of them. Through this process, triggers gradually converge toward an optimal balance of stealthiness, attack effectiveness, and robustness. Trigger variation and evaluation. The variation process is used to generate offspring triggers from population, which involves two procedures, simulated binary crossover (SBX) [13] and polynomial mutation (PM) [14]. The former randomly generates offspring triggers by exchanging a specific component (such as a perturbation or band) between two triggers from the population; the latter is to randomly alter the magnitude of frequency perturbations or shift the location of bands based on the perturbation sampled from a specific exponential distribution (see details in Figure 4(b)). The variation is repeatedly applied for each trigger in each iteration until the produced offsprings satisfy the restrictions in Equations (10e) and (10f). After that, we evaluate newly generated triggers in the same way as described in line 2 of Algorithm 1. Next population formulation with rNDSort. In each iteration, Algorithm 3 rNDSort: Preference-based NDSort Require: Population size P, a set T={t0, t1,· · · , t2P−1} of triggers, the objective value set {O}= {(O0 1, O0 2, O0 3),(O1 1, O1 2, O1 3),· · · ,(O2P−1 1, O2P−1 2, O2P−1 3)}, attacker preferred region of objective values Opref Ensure: The trigger set Trranked by the distance of their objective values to preference 1: Tr← ∅,list ←[], order←0 2: while |Tr| ≤ Pand |Tr|+NonDom(T, {O})≤Pdo 3: Tr.append(NonDom(T, {O})) 4: T′=NonDom(T, {O}) 5: {O}={O}\{O}T′,T=T\T′ 6: for iin {0,1,· · · ,|T|} do 7: d= Euc(O[i], Opref ) 8: list.append(<d,T[i]>)▷ < ·,·>is a pair 9: list ←Sortascend(list) by d 10: while |Tr|< P do 11: Tr.append(list[order++].SecondElem) 12: return Tr after generating offsprings from parents and evaluating their performance on O1,O2and O3, we combine the population with offsprings and leverage the proposed rNDSort (see Algorithm 3) to pick up superior triggers survival into the next iteration while eliminating inferior triggers. rNDSort includes two components, NDSort and preferencebased selection, which drives triggers to converge toward the attacker-desired region and maintain a stable number of triggers in the population per iteration. We first introduce the dominance relationship for non-dominated sort. Given two triggers t1and t2along with their objective values O1={O1 1, O1 2, O1 3} and O2={O2 1, O2 2, O2 3}(recall smaller objective value leads to a better trigger), we say t1dominates t2, denotes as t1≺t2 iff. ∀k∈[1,3], O1 k≤O2 kand ∃k∈[1,3] s.t. O1 k< O2 k. In this case, t1is a non-dominated trigger among {t1,t2}. With the help of the dominance relationship, the non-dominated sort repeatedly moves non-dominated triggers from a trigger set T to a new set Tr, until adding non-dominated triggers in Tr results in |Tr|> P. Finally, the remaining triggers in Twith the largest k-nearest sparsity [12] concerning objective values are selected to fill in Truntil |Tr|=P. This step ensures that triggers are searched along the entire objective space. However, impractical triggers (see those points which are out of the grey region in Figure 5) may be still acquired, as triggers searched by NDSort are non-dominated to attacker-desired triggers. This means they are considered of equal quality from the MOO perspective, even though they may not be practical. To alleviate locating impractical triggers caused by NDSort, we fill in Trto the size Pwith preference-based selection. Specifically, we calculate the Euclidean distance of remaining triggers in Tto the attacker-desired region in terms of objective values and select triggers with the smallest distance until |Tr|=P. To validate the efficacy of rNDSort, we compare the triggers 8 Fig. 5: Comparison of triggers on MOEA with/without preference-based selection in CIFAR-10 on VGG11. Compared to NDSort, rNDSort pulls LADDER triggers closer to the attacker-desired region. obtained by NDSort and rNDSort of 1st,10th and 50th iterations and visualize their objective values in Figure 5. We can observe that after 50 iterations, the triggers obtained by rNDSort are mostly located within the attacker-desired region (marked in grey). In contrast, triggers obtained by NDSort span a wider range, including impractical ones. Step 4: Trigger Selection and Data Preparation. After the trigger optimization, we obtain a set of practical triggers (see those points in or close to the grey region in Figure 5) and choose the best trade-off under our attack scenario among them. Specifically, we choose the most practical trigger from the population based on whose objective values are closest to the best values for each objective. Finally, we release a poisoned dataset injected by the trigger. VII. EXPERIMENTS A. Experimental Setup Experimental Environment and Settings. Our LADDER is implemented [43] on Python, PyTorch [53] and Ubuntu. All the experiments are conducted on a workstation with Ryzen 9 7950X, 2×32GB DDR5 RAM, and NVIDIA GeForce RTX 4090. For the default training, we learn the classifiers by SGD optimizer with the initial learning rate of 0.01 and a decay of 0.1 per 50 epochs. We set the batch size to 64 and the total number of epochs to 200 for all the datasets to train surrogate and victim models. When evaluating triggers on the surrogate models, the number of retraining epochs is set to 20. For the default attack setting, we search triggers in low-frequency regions. Following Sharma et al. [59], we use around 18.3% of the whole frequency spectrum on the topleft region to search the low-frequency trigger. Meanwhile, we manipulate 3 frequency bands per channel for our attack in all the datasets. For a fair comparison, the poison ratio and target label are set to 5% and 7, unless otherwise specified. For the default MOEA setting, we set the population size to 10, the optimization iterations to 20. We set the Opref in Equation (10g) as: 0.9 for O1and 0.4 for O2;O3is 8 for images of size 32×32 and 12 for images of size 64×64. Datasets and Models. We evaluate LADDER on five benchmark tasks including digit recognition on SVHN [49], object classification on CIFAR-10 [35], real objects on TinyImageNet [37], traffic sign recognition on GTSRB [29] and face attribute recognition on CelebA [47]. For CelebA, we follow [51, 57] to select the top three most balanced attributes including Heavy Makeup, Mouth Slightly Open, and Smiling. Then, we concatenate them to create an eight-label classification task. We evaluate LADDER on both smalland large-scale datasets to confirm its scalability across various image and dataset sizes. The five datasets chosen for this paper span a remarkably broad scope of typical real-world scenarios, underscoring the practicality of LADDER. Following [7, 17, 51, 63, 65], we consider various network architectures for the image classifier. Specifically, we employ a classic CNN model [17, 51] for SVHN, PreAct-ResNet18 [27] for CIFAR-10 and GTSRB, as well as ResNet18 [27] for TinyImageNet and CelebA. In contrast to victim models, we choose surrogate models from a series of VGGs [61], whose structures are heterogeneous against ResNet models. For example, we utilize VGG11 for CIFAR-10 and GTSRB, VGG16 for SVHN and CelebA, as well as VGG19 for Tiny-ImageNet. It is important to emphasize our intentional use of heterogeneous structures between victim and surrogate models. This approach effectively demonstrates that the model mismatch between the victim and surrogate models does not hinder the efficacy and practicality of our attack. B. Attack Performance We compare LADDER with popular spatial attacks, such as BadNets [24], ReFool [46], SIG [4], WaNet [51] and Narcissus [70] as well as frequency attacks such as FIBA [20], FTrojan [68] and DUBA [23] as baseline methods to showcase the attack performance in: attack effectiveness, natural (spatial) and spectral (frequency) stealthiness. Note that several whitebox attacks [15, 50, 75, 76], although achieving practical effectiveness, require access and manipulation of victim models. They are not included in the experiments. Attack Effectiveness. We evaluate the effectiveness of 8 attacks against 5 datasets via ACC and ASR. Based on the results given in Table II, LADDER achieves ASRs exceeding 99% on all poisoned CNN models. Meanwhile, its drop of ACCs after the backdoor attack is limited to only 0.23% on average, while the compared attacks yield larger ACC drops. This confirms that LADDER delivers practical attack performance under various attack tasks. Recall that we consider attack effectiveness as one of the objectives when formulating the multi-objective attack problem, ensuring that the triggers searched by LADDER are oriented towards maximizing effectiveness. We also note that heterogeneous network structure settings between surrogate and victim models do not affect the attack effectiveness of LADDER. Natural (Spatial) Stealthiness. Natural stealthiness is vital for backdoor attacks, guaranteeing that poisoned images remain imperceptible to human inspection. We quantitatively compare the differences between poisoned and clean images against four popular visual stealthiness measurements, including l2norm, PSNR, SSIM, and LPIPS. All metric values are av9 noising,” in IEEE International Conference on Image Processing, 2013, pp. 440–444. [34] S. Kolouri, A. Saha, H. Pirsiavash, and H. Hoffmann, “Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 301–310. [35] A. Krizhevsky and G. Hinton, “Learning Multiple Layers of Features from Tiny Images,” 2009. [36] J. Lan, J. Wang, B. Yan, Z. Yan, and E. Bertino, “Flowmur: A stealthy and practical audio backdoor attack with limited knowledge,” in IEEE Symposium on Security and Privacy, 2024, pp. 1646–1664. [37] Y. Le and X. Yang, “Tiny ImageNet Visual Recognition Challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015. [38] B. Li and W. Liu, “A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks,” in International Conference on Machine Learning, 2024, pp. 8296–8316. [39] S. Li, M. Xue, B. Z. H. Zhao, H. Zhu, and X. Zhang, “Invisible backdoor attacks on deep neural networks via steganography and regularization,” IEEE Transactions on Dependable and Secure Computing, vol. 18, pp. 2088– 2105, 2019. [40] Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks,” in International Conference on Learning Representations, 2021. [41] Y. Li, T. Zhai, B. Wu, Y. Jiang, Z. Li, and S. Xia, “Rethinking the Trigger of Backdoor Attack,” arXiv preprint arXiv:2004.04692, 2020. [42] Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible Backdoor Attack with Sample-Specific Triggers,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16 463–16 472. [43] D. Liu and Y. Qiao, “Artifacts of LADDER: Multiobjective Backdoor Attack via Evolutionary Algorithm,” https://github.com/dzhliu/LADDER, 2024. [44] D. Liu, Y. Qiao, R. Wang, K. Liang, and G. Smaragdakis, “LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm,” 2024. [Online]. Available: https://arxiv.org/abs/2411.19075 [45] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-Pruning: Defending against Backdooring Attacks on Deep Neural Networks,” in International Symposium on Research in Attacks, Intrusions, and Defenses, 2018, pp. 273–294. [46] Y. Liu, X. Ma, J. Bailey, and F. Lu, “Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks,” in European Conference on Computer Vision, 2020, pp. 182–199. [47] Z. Liu, P. Luo, X. Wang, and X. Tang, “Deep Learning Face Attributes in the Wild,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2015, pp. 3730–3738. [48] P. Lv, C. Yue, R. Liang, Y. Yang, S. Zhang, H. Ma, and K. Chen, “A Data-free Backdoor Injection Approach in Neural Networks,” in USENIX Security Symposium, 2023, pp. 2671–2688. [49] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng, “Reading Digits in Natural Images with Unsupervised Feature Learning,” in Neural Information Processing Systems Workshop on Deep Learning and Unsupervised Feature Learning, 2011. [50] T. A. Nguyen and A. Tran, “Input-Aware Dynamic Backdoor Attack,” in Advances in Neural Information Processing Systems, vol. 33, 2020, pp. 3454–3464. [51] T. A. Nguyen and A. T. Tran, “WaNet - Imperceptible Warping-based Backdoor Attack,” in International Conference on Learning Representations, 2021. [52] K. O’shea and R. Nash, “An Introduction to Convolutional Neural Networks,” arXiv preprint arXiv:1511.08458, 2015. [53] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. K¨ opf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and C. Soumith, “Pytorch: An Imperative Style, HighPerformance Deep Learning Library,” Advances in Neural Information Processing Systems, vol. 32, pp. 8026– 8037, 2019. [54] X. Qiao, Y. Yang, and H. Li, “Defending Neural Backdoors via Generative Distribution Modeling,” Advances in Neural Information Processing Systems, vol. 32, pp. 14 027–14 036, 2019. [55] H. Qiu, Y. Zeng, S. Guo, T. Zhang, M. Qiu, and B. Thuraisingham, “Deepsweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation,” in Proceedings of the ACM Asia Conference on Computer and Communications Security, 2021, pp. 363– 377. [56] A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden Trigger Backdoor Attacks,” in Proceedings of the AAAI Cconference on Artificial Intelligence, vol. 34, no. 07, 2020, pp. 11 957–11 965. [57] A. Salem, R. Wen, M. Backes, S. Ma, and Y. Zhang, “Dynamic Backdoor Attacks against Machine Learning Models,” in IEEE European Symposium on Security and Privacy, 2022, pp. 703–718. [58] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2017, pp. 618–626. [59] Y. Sharma, G. W. Ding, and M. A. Brubaker, “On the Effectiveness of Low Frequency Perturbations,” in Proceedings of the International Joint Conference on Artificial Intelligence, 2019, pp. 3389–3396. [60] Y. Shi, M. Du, X. Wu, Z. Guan, J. Sun, and N. Liu, “Black-box Backdoor Defense via Zero-shot Image Purification,” in Advances in Neural Information Processing Systems, 2023, pp. 57 336–57 366. [61] K. Simonyan and A. Zisserman, “Very Deep Convolu16 tional Networks for Large-Scale Image Recognition,” in International Conference on Learning Representations, 2015. [62] C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V. Vanhoucke, and A. Rabinovich, “Going Deeper with Convolutions,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2015, pp. 1–9. [63] T. J. L. Tan and R. Shokri, “Bypassing Backdoor Detection Algorithms in Deep Learning,” in IEEE European Symposium on Security and Privacy, 2020, pp. 175–183. [64] D. J. Tolhurst, Y. Tadmor, and T. Chao, “Amplitude Spectra of Natural Images,” Ophthalmic and Physiological Optics, pp. 229–232, 1992. [65] B. Tran, J. Li, and A. Madry, “Spectral Signatures in Backdoor Attacks,” Advances in Neural Information Processing Systems, vol. 31, pp. 8011–8021, 2018. [66] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks,” in IEEE Symposium on Security and Privacy, 2019, pp. 707–723. [67] R. Wang, H. Chen, Z. Zhu, L. Liu, and B. Wu, “Versatile Backdoor Attack with Visible, Semantic, SampleSpecific, and Compatible Triggers,” arXiv preprint arXiv:2306.00816, 2023. [68] T. Wang, Y. Yao, F. Xu, S. An, H. Tong, and T. Wang, “An invisible Black-box Backdoor Attack through Frequency Domain,” in European Conference on Computer Vision, 2022, pp. 396–413. [69] Z. Wang, D. Liu, S. Chang, Q. Ling, Y. Yang, and T. S. Huang, “D3: Deep Dual-Domain Based Fast Restoration of JPEG-Compressed Images,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2016, pp. 2764–2772. [70] Y. Zeng, M. Pan, H. A. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 771–785. [71] Y. Zeng, W. Park, Z. M. Mao, and R. Jia, “Rethinking the Backdoor Attacks’ Triggers: A Frequency Perspective,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16 473–16 481. [72] J. Zhang, J. Chi, Z. Li, K. Cai, Y. Zhang, and Y. Tian, “Badmerging: Backdoor Attacks against Model Merging,” arXiv preprint arXiv:2408.07362, 2024. [73] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The Unreasonable Effectiveness of Deep Features as a Perceptual Metric,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018, pp. 586–595. [74] Z. Zhang, Q. Liu, Z. Wang, Z. Lu, and Q. Hu, “Backdoor Defense via Deconfounded Representation Learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 12 228–12 238. [75] Z. Zhao, X. Chen, Y. Xuan, Y. Dong, D. Wang, and K. Liang, “DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 15 213–15 222. [76] N. Zhong, Z. Qian, and X. Zhang, “Imperceptible Backdoor Attack: From Input Space to Feature Representation,” in Proceedings of the International Joint Conference on Artificial Intelligence, 2022, pp. 1736–1742. [77] M. Zhu, S. Wei, H. Zha, and B. Wu, “Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features,” in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 1132– 1153. APPENDIX A. Evaluating LADDER against SOTA Backdoor Defenses Although successfully evading several classic backdoor defenses (see Section VII-C), LADDER is not perfectly robust against some (white-box) backdoor defenses especially defenses requiring model and training manipulation. Recall that, in the strict black-box setting, attackers are not allowed to access the victim model (such as parameters, structures and gradient information) nor manipulate the training process. We test LADDER against three new SOTA backdoor defenses, ASD [21], CBD [74] and DBD [30], which all rely on manipulating the training process (see [44] for more results). ASD adaptively splits clean from the poisoned dataset during training so as to defend backdoors. CBD leverages statistical effect among variables on the image to mitigate attacks. DBD proposes a three-stage mechanism, which involves learning on label-removed data, credible sample filtering and fine-tuning the trained model. TABLE X: Attack performance measured by ACC (%) and ASR (%) for 7 backdoor attacks against ASD, CBD and DBD on CIFAR-10 dataset with ResNet18, WideResNet (WRN-161) and ResNet18, respectively. Defenses ASD [21] CBD [21] DBD [30] Attack ACC ASR ACC ASR ACC ASR BadNets [24] 93.4 1.2 87.5 1.1 92.4 1.0 Blend [9] 93.7 1.6 87.5 2.0 92.2 1.7 WaNet [51] 93.1 1.7 86.6 4.2 91.2 0.4 SIG [4] 87.8 0.7 87.3 0.3 91.6 0.3 DUBA [23] 92.6 4.0 87.6 5.0 90.8 0.2 Narcissus-D [70] 93.8 0.0 87.9 4.1 91.1 0.0 Ours 92.4 25.0 86.6 5.2 90.9 0.0 We evaluate attack effectiveness of LADDER and other attacks against ASD, CBD and DBD using their default parameter settings. The results are in Table X. In all defenses, all the attacks achieve low ASRs (ranging from 0% ∼25.0% in ASD, 0.3% ∼5.2% for CBD and 0% ∼1.7% in DBD). Under defenses, LADDER provides better ASRs of 25.0% against ASD and 5.2% under CBD, indicating a slight advantage on evading defenses over others. This is because LADDER triggers require smaller perturbations (only 0.3183 l2-norm on CIFAR-10). As a result, the poisoned samples are 17 CIFAR-10 GTSRB Tiny-ImageNet CelebA SVHN Fig. 10: Poisoned images produced by LADDER. more likely to be split into the clean data pool by ASD and seldom being detected by CBD with their statistical effect, thus delivering relatively higher ASR of LADDER than others. DBD eliminates the effectiveness of LADDER because of its fine-pruning process. Since the trigger produced by LADDER is ”weaker”, the trigger injected into the model is gradually pruned and eventually erased after a large number of finepruning iterations. B. Adaptive Defense Several image-level anomaly detectors that have been proposed in the spatial domain can be used to eliminate the threat of LADDER on DNNs in black-box environment. We propose a frequency domain anomaly detector that locates poisoned images by exploring the statistical information of the spectrum. Specifically, given the averaged spectra Mof a natural image x, the averaged magnitudes Aof the frequency bands fin Mhave a relationship A ∝ fson the doublelogarithmic coordinates with a constant slope s=2 [6, 64, 71]. To obtain Mof a given RGB image x, we first convert x to the spectrum Xusing DCT in Equation (2). Then, we compute the power (of magnitudes) in each channel of X, i.e., Xpow c=Xc⊙Xc, where c∈ {R, G, B}and ⊙is the Hadamard product. For each Xpow c, we divide the frequency bands into groups f={f0, f1,· · · , fmax−1}where k∈[0, max)and max is the dimension of the spectrum in X, so that the frequency bands in each group fkhave the same distance to the upper left corner of the spectrum. We calculate the averaged magnitude of each group of frequency bands fkto obtain the averaged spectra Mcfor each channel c∈ {R, G, B}. Finally, we obtain the logarithm of the averaged magnitude of the frequency bands from MR,MGand MB, i.e, log(Mavg)= log((MR+MG+MB) 3), and fit the slope swith log(f)and log(Mavg). We show, in Table XI, s(averaged over 1000 randomly selected samples from CIFAR-10) obtained with clean and poisoned data by the black-box backdoor attacks. We see that sis the smallest on clean samples compare to poisoned data. The slope sis a feasible indicator to distinguish poisoned data. C. Trade-offs among Attack Objectives We illustrate the conflict between attack effectiveness and stealthiness in Figure 3. To further investigate the trade-off TABLE XI: The averaged sand standard deviation on 1000 randomly chosen images from CIFAR-10 under attacks. Attacks Clean BadNets SIG Blend FTrojan FIBA Ours Slope -1.8922 -1.6882 -1.5922 -1.7602 -1.8236 -1.7826 -1.8238 (0.3810) (0.3803 (0.3645) (0.3509) (0.3591) (0.3456) (0.3803) TABLE XII: The attack effectiveness (Eff) (%), robustness (Rob) (%) and Eff-to-Rob ratio (%) on CIFAR-10 and ResNet18, evaluated by injecting noises into Low-, Midand High-frequency regions, across different levels of stealthiness. l2-norm Metric Region of Injection L M H 0.25 Eff 86.12 99.96 100.0 Rob 81.51 30.65 30.62 Ratio 94.64 30.66 30.62 0.5 Eff 95.89 100.0 100.0 Rob 91.70 31.50 33.31 Ratio 95.63 31.50 33.31 1.0 Eff 99.04 100.0 100.0 Rob 96.88 32.10 42.41 Ratio 97.81 32.10 42.41 between stealthiness and robustness, we generate random noise of size 3×3with an initial l2-norm of 0.25. We create two additional variants by scaling the l2-norm of the original noise by 2×and 4×. These noises are used as triggers and injected into the low-, mid-, and high-frequency regions. We evaluate attack effectiveness and robustness of each noise under different levels of stealthiness and injection regions on CIFAR-10 using ResNet18. Attack robustness is measured by averaging ASRs after the preprocessings (see Table IV). In Table XII, increasing the l2-norm (i.e., reducing stealthiness) enhances attack robustness in both lowand highfrequency regions, though it has a minimal effect in the midfrequency region. For instance, raising the l2-norm from 0.25 to 1.0 improves attack robustness by 15.37% in the lowfrequency region while yielding only a slight increase of 1.44% in the mid-frequency region. A closer examination of the Eff-to-Rob ratio reveals that, in the low-frequency region, increasing the l2-norm has a minimal impact on robustness, with a max. difference of 3.17%. Moreover, in the midfrequency region, the ratio closely aligns with Robs across different l2-norm values. In the high-frequency region, the ratio rises by 11.79%. The results indicate a distinct tradeoff between stealthiness and attack robustness in both lowand high-frequency regions. Table XII also indicates that under the same stealthiness level, inserting trigger patterns in different spectral regions has a modest impact on effectiveness. For example, with an l2norm of 0.25, moving the trigger from low-frequency to highfrequency region increases attack effectiveness by 13.88%. But this adjustment significantly harms robustness, resulting in a 50.89% decrease. We conclude that designing triggers in the low-frequency region has a minimal impact on attack effectiveness while significantly enhancing trigger robustness. 18