{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/fiba-frequency-injection-based-backdoor","title":"FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysis","arxiv_id":"2112.01148","date":"2021-12-02","proceeding":"CVPR 2022 1","authors":["Yu Feng","Benteng Ma","Jing Zhang","Shanshan Zhao","Yong Xia","DaCheng Tao"],"abstract":"In recent years, the security of AI systems has drawn increasing research attention, especially in the medical imaging realm. To develop a secure medical image analysis (MIA) system, it is a must to study possible backdoor attacks (BAs), which can embed hidden malicious behaviors into the system. However, designing a unified BA method that can be applied to various MIA systems is challenging due to the diversity of imaging modalities (e.g., X-Ray, CT, and MRI) and analysis tasks (e.g., classification, detection, and segmentation). Most existing BA methods are designed to attack natural image classification models, which apply spatial triggers to training images and inevitably corrupt the semantics of poisoned pixels, leading to the failures of attacking dense prediction models. To address this issue, we propose a novel Frequency-Injection based Backdoor Attack method (FIBA) that is capable of delivering attacks in various MIA tasks. Specifically, FIBA leverages a trigger function in the frequency domain that can inject the low-frequency information of a trigger image into the poisoned image by linearly combining the spectral amplitude of both images. Since it preserves the semantics of the poisoned image pixels, FIBA can perform attacks on both classification and dense prediction models. Experiments on three benchmarks in MIA (i.e., ISIC-2019 for skin lesion classification, KiTS-19 for kidney tumor segmentation, and EAD-2019 for endoscopic artifact detection), validate the effectiveness of FIBA and its superiority over state-of-the-art methods in attacking MIA models as well as bypassing backdoor defense. Source code will be available at https://github.com/HazardFY/FIBA.","url_abs":"https://arxiv.org/abs/2112.01148v2","url_pdf":"https://arxiv.org/pdf/2112.01148v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"fiba-frequency-injection-based-backdoor","repo_url":"https://github.com/hazardfy/fiba","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"fiba-frequency-injection-based-backdoor","repo_url":"https://github.com/aryan-satpathy/backdoor","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"GPL-3.0"}},{"paper_slug":"fiba-frequency-injection-based-backdoor","repo_url":"https://github.com/xandery-geek/BackdoorAttacks","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"artifact-detection","task_name":"Artifact Detection"},{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"classification-1","task_name":"Classification"},{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"lesion-classification","task_name":"Lesion Classification"},{"task_slug":"medical-image-analysis","task_name":"Medical Image Analysis"},{"task_slug":"skin-lesion-classification","task_name":"Skin Lesion Classification"},{"task_slug":"tumor-segmentation","task_name":"Tumor Segmentation"},{"task_slug":"backdoor-defense","task_name":"backdoor defense"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2112.01148","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2112.01148"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/hazardfy/fiba","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/aryan-satpathy/backdoor","reach":{"status":"ok","spdx":"GPL-3.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xandery-geek/BackdoorAttacks","reach":null}],"summary":{"ran_fixture":2},"by_repo_kind":{"listed":{"samples":2,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"db393735e86bd0cd","entry":"fourier_pattern","repo":"xandery-geek/BackdoorAttacks","repo_kind":"listed","path":"attacks/fiba.py","file_url":"https://github.com/xandery-geek/BackdoorAttacks/blob/HEAD/attacks/fiba.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"db393735e86bd0cd"}},{"code_sha256_prefix":"b1515530ea5d098a","entry":"poison","repo":"xandery-geek/BackdoorAttacks","repo_kind":"listed","path":"attacks/fiba.py","file_url":"https://github.com/xandery-geek/BackdoorAttacks/blob/HEAD/attacks/fiba.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b1515530ea5d098a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}