Abstract: Backdoor attacks on deep neural networks manipulate model behavior by implanting stealthy triggers into the training data, posing a serious threat to model security. However, most existing imperceptible backdoor attacks focus only on invisibility in the spatial domain while overlooking anomalies in frequency-domain features. These methods often introduce noticeable high-frequency artifacts or stable spectral residual patterns in the frequency domain, making them vulnerable to detection by frequency-based defense techniques. To address this issue, a dual-domain imperceptible backdoor attack method based on wavelet packet decomposition and fast Fourier transform is proposed. First, wavelet packet decomposition is employed to select carrier sub-bands according to the energy distribution characteristics of the target class, and an energy-aware adaptive trigger embedding strategy is applied to balance attack effectiveness and stealthiness. Then, fast Fourier transform is used for spectral reconstruction by combining the amplitude spectrum of clean samples with the phase spectrum of poisoned samples, thereby reducing detectable traces in the frequency domain. Comparative experiments are conducted on the CIFAR-10, CIFAR-100, and Tiny ImageNet datasets using PreAct-ResNet18 and VGG19-BN models. The results show that the proposed method maintains high attack effectiveness while significantly improving dual-domain stealthiness and robustness against defenses. On CIFAR-10, it achieves an attack success rate of 99.94% and demonstrates strong evasive capability against tested defenses such as FTD, Neural Cleanse, and STRIP.

摘要： 深度神经网络的后门攻击通过在训练数据中植入隐蔽触发器来控制模型行为，严重威胁模型安全。然而，现有隐形后门攻击大多仅关注空间域的不可见性，忽视了频域特征的异常。这些方法往往在频域引入显著的高频伪迹或稳定的谱残差模式，导致攻击易被基于频域分析的防御手段检测。针对此问题，提出了一种基于小波包分解与快速傅里叶变换双域融合的隐形后门攻击方法。首先，利用小波包分解技术，根据目标类别能量分布特征筛选载体子带并进行能量感知的自适应触发器嵌入，以平衡攻击有效性与隐蔽性；随后，利用快速傅里叶变换实施频谱重构，通过融合干净样本的振幅谱与中毒样本的相位谱，减弱频域可检测痕迹。在CIFAR-10、CIFAR-100和Tiny ImageNet数据集上，结合PreAct-ResNet18和VGG19-BN模型进行对比试验。结果表明，所提方法在保持高攻击有效性的同时有效提升了双域隐蔽性与抗防御鲁棒性；在CIFAR-10上取得了99.94%的攻击成功率，在所测试的FTD、Neural Cleanse、STRIP等防御下表现出较强规避能力。