标题： 3S攻击：针对DNN模型的空间、频谱和语义不可见后门攻击 显示英文标题

标题： 3S-Attack: Spatial, Spectral and Semantic Invisible Backdoor Attack Against DNN Models

摘要： 后门攻击涉及污染训练数据或直接修改模型，以植入一种隐藏行为，当存在特定触发器时会导致模型对输入进行错误分类。 在推理过程中，模型对良性样本保持高准确性，但会将被污染的样本错误分类为攻击者指定的目标类别。 现有的后门攻击研究探索了在空间、光谱（频率）和语义（特征）领域开发触发器，旨在使其隐蔽。 虽然一些方法考虑了在空间和光谱领域都难以察觉的触发器，但很少有方法结合了语义领域。 在本文中，我们提出了一种新颖的后门攻击，称为3S-攻击，它在空间、光谱和语义领域都是隐蔽的。 其核心思想是利用良性样本的语义特征作为触发器，使用梯度加权类激活映射（Grad-CAM）和一个预训练模型进行提取。 然后将触发器嵌入到光谱领域，在将样本转换回空间领域后，再进行像素级限制。 这一过程最小化了被污染样本和良性样本之间的距离，使攻击更难被现有防御措施和人工检查发现。 在各种数据集上的大量实验以及理论分析表明了3S-攻击的隐蔽性，并强调了需要更强的防御措施以确保人工智能安全。 我们的代码可在以下网址获取：https://anonymous.4open.science/r/anon-project-3776/ 显示英文摘要

摘要： Backdoor attacks involve either poisoning the training data or directly modifying the model in order to implant a hidden behavior, that causes the model to misclassify inputs when a specific trigger is present. During inference, the model maintains high accuracy on benign samples but misclassifies poisoned samples into an attacker-specified target class. Existing research on backdoor attacks has explored developing triggers in the spatial, spectral (frequency), and semantic (feature) domains, aiming to make them stealthy. While some approaches have considered designing triggers that are imperceptible in both spatial and spectral domains, few have incorporated the semantic domain. In this paper, we propose a novel backdoor attack, termed 3S-attack, which is stealthy across the spatial, spectral, and semantic domains. The key idea is to exploit the semantic features of benign samples as triggers, using Gradient-weighted Class Activation Mapping (Grad-CAM) and a preliminary model for extraction. The trigger is then embedded in the spectral domain, followed by pixel-level restrictions after converting the samples back to the spatial domain. This process minimizes the distance between poisoned and benign samples, making the attack harder to detect by existing defenses and human inspection. Extensive experiments on various datasets, along with theoretical analysis, demonstrate the stealthiness of 3S-attack and highlight the need for stronger defenses to ensure AI security. Our code is available at: https://anonymous.4open.science/r/anon-project-3776/