Lite-BD: A Lightweight Black-box Backdoor Defense via Reviving Multi-Stage Image Transformations

2026-02-06

AI Summary

This work addresses the vulnerability of deep neural networks to black-box backdoor attacks in ML-as-a-Service (MLaaS) settings, where existing defenses often suffer from insufficient theoretical grounding, reliance on specific data, high computational overhead, or neglect of frequency-domain triggers. To overcome these limitations, we propose Lite-BD, a lightweight two-stage defense framework that first suppresses spatial-domain triggers via super-resolution-guided down-up sampling and then eliminates hidden frequency-domain triggers through query-based band-wise filtering. Our study presents the first systematic evaluation of diverse image transformations for backdoor mitigation and uniquely integrates spatial and spectral purification strategies. Notably, Lite-BD operates without access to internal model information, achieving efficient, generalizable, and low-overhead protection. Experiments demonstrate that Lite-BD significantly outperforms current black-box defenses against multiple state-of-the-art backdoor attacks.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Security and Privacy: Security and privacy of machine learning and AI applications

Abstract

Deep Neural Networks (DNNs) are vulnerable to backdoor attacks. Due to the nature of Machine Learning as a Service (MLaaS) applications, black-box defenses are more practical than white-box methods, yet existing purification techniques suffer from key limitations: a lack of justification for specific transformations, dataset dependency, high computational overhead, and a neglect of frequency-domain transformations. This paper conducts a preliminary study on various image transformations, identifying down-upscaling as the most effective backdoor trigger disruption technique. We subsequently propose \texttt{Lite-BD}, a lightweight two-stage blackbox backdoor defense. \texttt{Lite-BD} first employs a super-resolution-based down-upscaling stage to neutralize spatial triggers. A secondary stage utilizes query-based band-by-band frequency filtering to remove triggers hidden in specific bands. Extensive experiments against state-of-the-art attacks demonstrate that \texttt{Lite-BD} provides robust and efficient protection. Codes can be found at https://github.com/SiSL-URI/Lite-BD.

Problem

• backdoor attack
• black-box defense
• image transformation
• frequency-domain
• deep neural networks

Innovation

• black-box defense
• image transformation
• frequency-domain filtering
• down-upscaling
• backdoor attack