With the widespread application of deep learning across various domains,
concerns about its security have grown significantly. Among these, backdoor
attacks pose a serious security threat to deep neural networks (DNNs). In
recent years, backdoor attacks on neural networks have become increasingly
sophisticated, aiming to compromise the security and trustworthiness of models
by implanting hidden, unauthorized functionalities or triggers, leading to
misleading predictions or behaviors. To make triggers less perceptible and
imperceptible, various invisible backdoor attacks have been proposed. However,
most of them only consider invisibility in the spatial domain, making it easy
for recent defense methods to detect the generated toxic images.To address
these challenges, this paper proposes an invisible backdoor attack called DEBA.
DEBA leverages the mathematical properties of Singular Value Decomposition
(SVD) to embed imperceptible backdoors into models during the training phase,
thereby causing them to exhibit predefined malicious behavior under specific
trigger conditions. Specifically, we first perform SVD on images, and then
replace the minor features of trigger images with those of clean images, using
them as triggers to ensure the effectiveness of the attack. As minor features
are scattered throughout the entire image, the major features of clean images
are preserved, making poisoned images visually indistinguishable from clean
ones. Extensive experimental evaluations demonstrate that DEBA is highly
effective, maintaining high perceptual quality and a high attack success rate
for poisoned images. Furthermore, we assess the performance of DEBA under
existing defense measures, showing that it is robust and capable of
significantly evading and resisting the effects of these defense measures.

本文提出了一种名为 DEBA 的隐形后门攻击方法，通过奇异值分解（SVD）在训练阶段将隐形后门嵌入模型中，导致在特定触发条件下表现出预定义的恶意行为，实验证明 DEBA 方法在攻击效果、感知质量和抵抗防御措施方面表现出高度有效性和鲁棒性。