{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,17]],"date-time":"2026-01-17T20:24:00Z","timestamp":1768681440928,"version":"3.49.0"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2023,5,10]],"date-time":"2023-05-10T00:00:00Z","timestamp":1683676800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,5,10]],"date-time":"2023-05-10T00:00:00Z","timestamp":1683676800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["No.62002074"],"award-info":[{"award-number":["No.62002074"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["No.62102107"],"award-info":[{"award-number":["No.62102107"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["World Wide Web"],"published-print":{"date-parts":[[2023,9]]},"DOI":"10.1007\/s11280-023-01153-3","type":"journal-article","created":{"date-parts":[[2023,5,11]],"date-time":"2023-05-11T06:45:54Z","timestamp":1683787554000},"page":"2767-2783","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["A stealthy and robust backdoor attack via frequency domain transform"],"prefix":"10.1007","volume":"26","author":[{"given":"Ruitao","family":"Hou","sequence":"first","affiliation":[]},{"given":"Teng","family":"Huang","sequence":"additional","affiliation":[]},{"given":"Hongyang","family":"Yan","sequence":"additional","affiliation":[]},{"given":"Lishan","family":"Ke","sequence":"additional","affiliation":[]},{"given":"Weixuan","family":"Tang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,5,10]]},"reference":[{"issue":"4","key":"1153_CR1","doi-asserted-by":"publisher","first-page":"1071","DOI":"10.1007\/s11831-019-09344-w","volume":"27","author":"S Dargan","year":"2020","unstructured":"Dargan, S., Kumar, M., Ayyagari, M.R., Kumar, G.: A survey of deep learning and its applications: a new paradigm to machine learning. Archives of Computational Methods in Engineering 27(4), 1071\u20131092 (2020)","journal-title":"Archives of Computational Methods in Engineering"},{"key":"1153_CR2","doi-asserted-by":"publisher","first-page":"493","DOI":"10.1016\/j.ins.2021.01.046","volume":"560","author":"L Hu","year":"2021","unstructured":"Hu, L., Yan, H., Li, L., Pan, Z., Liu, X., Zhang, Z.: MHAT: an efficient model-heterogenous aggregation training scheme for federated learning. Inf. Sci. 560, 493\u2013503 (2021)","journal-title":"Inf. Sci."},{"issue":"6","key":"1153_CR3","first-page":"2969","volume":"18","author":"T Li","year":"2020","unstructured":"Li, T., Li, J., Chen, X., Liu, Z., Lou, W., Hou, Y.T.: Npmml: A framework for non-interactive privacy-preserving multi-party machine learning. IEEE Trans. Dependable Secure Comput. 18(6), 2969\u20132982 (2020)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"issue":"5","key":"1153_CR4","doi-asserted-by":"publisher","first-page":"2306","DOI":"10.1109\/TKDE.2020.3009221","volume":"34","author":"C Gao","year":"2022","unstructured":"Gao, C., Li, J., Xia, S., Choo, K.-K.R., Lou, W., Dong, C.: Mas-encryption and its applications in privacy-preserving classifiers. IEEE Trans. Knowl. Data Eng. 34(5), 2306\u20132323 (2022)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"7","key":"1153_CR5","doi-asserted-by":"publisher","first-page":"5925","DOI":"10.1002\/cpe.5925","volume":"34","author":"C Liang","year":"2022","unstructured":"Liang, C., Miao, M., Ma, J., Yan, H., Zhang, Q., Li, X.: Detection of global positioning system spoofing attack on unmanned aerial vehicle system. Concurrency and Computation: Practice and Experience 34(7), 5925 (2022)","journal-title":"Concurrency and Computation: Practice and Experience"},{"key":"1153_CR6","doi-asserted-by":"publisher","first-page":"443","DOI":"10.1016\/j.neucom.2021.05.103","volume":"470","author":"I Lauriola","year":"2022","unstructured":"Lauriola, I., Lavelli, A., Aiolli, F.: An introduction to deep learning in natural language processing: models, techniques, and tools. Neurocomputing 470, 443\u2013456 (2022)","journal-title":"Neurocomputing"},{"key":"1153_CR7","doi-asserted-by":"publisher","first-page":"186","DOI":"10.1016\/j.jmsy.2019.12.005","volume":"54","author":"F Ning","year":"2020","unstructured":"Ning, F., Shi, Y., Cai, M., Xu, W., Zhang, X.: Manufacturing cost estimation based on a deep-learning method. J. Manuf. Syst. 54, 186\u2013195 (2020)","journal-title":"J. Manuf. Syst."},{"key":"1153_CR8","doi-asserted-by":"crossref","unstructured":"Ribeiro, M., Grolinger, K., Capretz, M.A.: Mlaas: Machine learning as a service. In: 2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA), pp. 896\u2013902 (2015). IEEE","DOI":"10.1109\/ICMLA.2015.152"},{"key":"1153_CR9","doi-asserted-by":"publisher","first-page":"423","DOI":"10.1016\/j.ins.2020.09.064","volume":"548","author":"H Yan","year":"2021","unstructured":"Yan, H., Hu, L., Xiang, X., Liu, Z., Yuan, X.: Ppcl: Privacy-preserving collaborative learning for mitigating indirect information leakage. Inf. Sci. 548, 423\u2013437 (2021)","journal-title":"Inf. Sci."},{"key":"1153_CR10","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-022-3507-7","author":"Y Li","year":"2022","unstructured":"Li, Y., Yan, H., Huang, T., Pan, Z., Lai, J., Zhang, X., Chen, K., Li, J.: Model architecture level privacy leakage in neural networks. SCIENCE CHINA Inf. Sci. (2022). https:\/\/doi.org\/10.1007\/s11432-022-3507-7","journal-title":"SCIENCE CHINA Inf. Sci."},{"issue":"2","key":"1153_CR11","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3423558","volume":"22","author":"H Yan","year":"2021","unstructured":"Yan, H., Jiang, N., Li, K., Wang, Y., Yang, G.: Collusion-free for cloud verification toward the view of game theory. ACM Transactions on Internet Technology (TOIT) 22(2), 1\u201321 (2021)","journal-title":"ACM Transactions on Internet Technology (TOIT)"},{"issue":"1","key":"1153_CR12","doi-asserted-by":"publisher","first-page":"460","DOI":"10.1109\/TDSC.2019.2894411","volume":"18","author":"J Li","year":"2019","unstructured":"Li, J., Huang, Y., Wei, Y., Lv, S., Liu, Z., Dong, C., Lou, W.: Searchable symmetric encryption with forward search privacy. IEEE Trans. Dependable Secure Comput. 18(1), 460\u2013474 (2019)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"1153_CR13","doi-asserted-by":"publisher","first-page":"212","DOI":"10.1016\/j.ins.2020.10.010","volume":"548","author":"X Zhang","year":"2021","unstructured":"Zhang, X., Chen, X., Yan, H., Xiang, Y.: Privacy-preserving and verifiable online crowdsourcing with worker updates. Inf. Sci. 548, 212\u2013232 (2021)","journal-title":"Inf. Sci."},{"key":"1153_CR14","unstructured":"Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)"},{"key":"1153_CR15","first-page":"2","volume":"2","author":"S Katzenbeisser","year":"2000","unstructured":"Katzenbeisser, S., Petitcolas, F.: Digital watermarking. Artech House, London 2, 2 (2000)","journal-title":"Artech House, London"},{"issue":"4","key":"1153_CR16","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1109\/79.939835","volume":"18","author":"CI Podilchuk","year":"2001","unstructured":"Podilchuk, C.I., Delp, E.J.: Digital watermarking: algorithms and applications. IEEE Signal Process. Mag. 18(4), 33\u201346 (2001)","journal-title":"IEEE Signal Process. Mag."},{"key":"1153_CR17","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)"},{"key":"1153_CR18","doi-asserted-by":"crossref","unstructured":"Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., Zhang, X.: Trojaning attack on neural networks. In: Network and Distributed System Security Symposium (2018). 10.14722\/ndss.2018.23291","DOI":"10.14722\/ndss.2018.23291"},{"key":"1153_CR19","unstructured":"Li, Y., Wu, B., Jiang, Y., Li, Z., Xia, S.-T.: Backdoor learning: A survey. arXiv preprint arXiv:2007.08745 (2020)"},{"key":"1153_CR20","unstructured":"Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., Shmatikov, V.: How to backdoor federated learning. In: International Conference on Artificial Intelligence and Statistics, pp. 2938\u20132948 (2020). PMLR"},{"key":"1153_CR21","unstructured":"Turner, A., Tsipras, D., Madry, A.: Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)"},{"key":"1153_CR22","doi-asserted-by":"crossref","unstructured":"Saha, A., Subramanya, A., Pirsiavash, H.: Hidden trigger backdoor attacks. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 11957\u201311965 (2020)","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"1153_CR23","doi-asserted-by":"crossref","unstructured":"Quiring, E., Rieck, K.: Backdooring and poisoning neural networks with image-scaling attacks. In: 2020 IEEE Security and Privacy Workshops (SPW), pp. 41\u201347 (2020). IEEE","DOI":"10.1109\/SPW50608.2020.00024"},{"key":"1153_CR24","doi-asserted-by":"crossref","unstructured":"Zhong, H., Liao, C., Squicciarini, A.C., Zhu, S., Miller, D.: Backdoor embedding in convolutional neural network models via invisible perturbation. In: Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, pp. 97\u2013108 (2020)","DOI":"10.1145\/3374664.3375751"},{"key":"1153_CR25","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1765\u20131773 (2017)","DOI":"10.1109\/CVPR.2017.17"},{"key":"1153_CR26","doi-asserted-by":"crossref","unstructured":"Liu, Y., Ma, X., Bailey, J., Lu, F.: Reflection backdoor: A natural backdoor attack on deep neural networks. In: European Conference on Computer Vision, pp. 182\u2013199 (2020). Springer","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"1153_CR27","doi-asserted-by":"crossref","unstructured":"Li, Y., Li, Y., Wu, B., Li, L., He, R., Lyu, S.: Invisible backdoor attack with sample-specific triggers. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 16463\u201316472 (2021)","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"1153_CR28","doi-asserted-by":"publisher","first-page":"255","DOI":"10.1016\/j.ins.2022.04.003","volume":"601","author":"R Hou","year":"2022","unstructured":"Hou, R., Ai, S., Chen, Q., Yan, H., Huang, T., Chen, K.: Similarity-based integrity protection for deep learning systems. Inf. Sci. 601, 255\u2013267 (2022)","journal-title":"Inf. Sci."},{"key":"1153_CR29","doi-asserted-by":"crossref","unstructured":"Liu, Y., Xie, Y., Srivastava, A.: Neural trojans. In: 2017 IEEE International Conference on Computer Design (ICCD), pp. 45\u201348 (2017). IEEE","DOI":"10.1109\/ICCD.2017.16"},{"key":"1153_CR30","doi-asserted-by":"crossref","unstructured":"Doan, B.G., Abbasnejad, E., Ranasinghe, D.C.: Februus: Input purification defense against trojan attacks on deep neural network systems. In: Annual Computer Security Applications Conference, pp. 897\u2013912 (2020)","DOI":"10.1145\/3427228.3427264"},{"key":"1153_CR31","unstructured":"Li, Y., Zhai, T., Wu, B., Jiang, Y., Li, Z., Xia, S.: Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004.04692 (2020)"},{"key":"1153_CR32","doi-asserted-by":"crossref","unstructured":"Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., Zhao, B.Y.: Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In: 2019 IEEE Symposium on Security and Privacy (SP), pp. 707\u2013723 (2019). IEEE","DOI":"10.1109\/SP.2019.00031"},{"key":"1153_CR33","doi-asserted-by":"crossref","unstructured":"Kolouri, S., Saha, A., Pirsiavash, H., Hoffmann, H.: Universal litmus patterns: Revealing backdoor attacks in cnns. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 301\u2013310 (2020)","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"1153_CR34","unstructured":"Huang, X., Alzantot, M., Srivastava, M.: Neuroninspect: Detecting backdoors in neural networks via output explanations. arXiv preprint arXiv:1911.07399 (2019)"},{"key":"1153_CR35","doi-asserted-by":"crossref","unstructured":"Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdooring attacks on deep neural networks. In: International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 273\u2013294 (2018). Springer","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"1153_CR36","unstructured":"Du, M., Jia, R., Song, D.: Robust anomaly detection and backdoor attack detection via differential privacy. arXiv preprint arXiv:1911.07116 (2019)"},{"issue":"1","key":"1153_CR37","doi-asserted-by":"publisher","first-page":"67","DOI":"10.1109\/TDSC.2020.3015886","volume":"19","author":"J Li","year":"2022","unstructured":"Li, J., Ye, H., Li, T., Wang, W., Lou, W., Hou, Y.T., Liu, J., Lu, R.: Efficient and secure outsourcing of differentially private data publishing with multiple evaluators. IEEE Trans. Dependable Secure Comput. 19(1), 67\u201376 (2022)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"1153_CR38","doi-asserted-by":"publisher","DOI":"10.1002\/int.23001","author":"G Lin","year":"2022","unstructured":"Lin, G., Yan, H., Kou, G., Huang, T., Peng, S., Zhang, Y., Dong, C.: Understanding adaptive gradient clipping in DP-SGD, empirically. Int. J. Intell. Syst. (2022). https:\/\/doi.org\/10.1002\/int.23001","journal-title":"Int. J. Intell. Syst."},{"key":"1153_CR39","unstructured":"Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., Srivastava, B.: Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728 (2018)"},{"key":"1153_CR40","doi-asserted-by":"crossref","unstructured":"Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D.C., Nepal, S.: Strip: A defence against trojan attacks on deep neural networks. In: Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113\u2013125 (2019)","DOI":"10.1145\/3359789.3359790"},{"key":"1153_CR41","unstructured":"Van\u00a0Schyndel, R.G., Tirkel, A.Z., Osborne, C.F.: A digital watermark. In: Proceedings of 1st International Conference on Image Processing, vol. 2, pp. 86\u201390 (1994). IEEE"},{"issue":"3.4","key":"1153_CR42","doi-asserted-by":"publisher","first-page":"313","DOI":"10.1147\/sj.353.0313","volume":"35","author":"W Bender","year":"1996","unstructured":"Bender, W., Gruhl, D., Morimoto, N., Lu, A.: Techniques for data hiding. IBM Syst. J. 35(3.4), 313\u2013336 (1996)","journal-title":"IBM Syst. J."},{"issue":"12","key":"1153_CR43","doi-asserted-by":"publisher","first-page":"1673","DOI":"10.1109\/83.650120","volume":"6","author":"IJ Cox","year":"1997","unstructured":"Cox, I.J., Kilian, J., Leighton, F.T., Shamoon, T.: Secure spread spectrum watermarking for multimedia. IEEE Trans. Image Process. 6(12), 1673\u20131687 (1997)","journal-title":"IEEE Trans. Image Process."},{"key":"1153_CR44","unstructured":"Ruanaidh, J., Dowling, W., Boland, F.M.: Phase watermarking of digital images. In: Proceedings of 3rd IEEE International Conference on Image Processing, vol. 3, pp. 239\u2013242 (1996). IEEE"},{"key":"1153_CR45","unstructured":"Kundur, D., Hatzinakos, D.: Digital watermarking using multiresolution wavelet decomposition. In: Proceedings of the 1998 IEEE International Conference on Acoustics, Speech and Signal Processing, ICASSP\u201998 (Cat. No. 98CH36181), vol. 5, pp. 2969\u20132972 (1998). IEEE"},{"key":"1153_CR46","doi-asserted-by":"publisher","first-page":"323","DOI":"10.1016\/j.neunet.2012.02.016","volume":"32","author":"J Stallkamp","year":"2012","unstructured":"Stallkamp, J., Schlipsing, M., Salmen, J., Igel, C.: Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Netw. 32, 323\u2013332 (2012)","journal-title":"Neural Netw."},{"key":"1153_CR47","unstructured":"Krizhevsky, A., Hinton, G.: Learning multiple layers of features from tiny images. Technical report, University of Toronto (2009)"},{"key":"1153_CR48","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"}],"container-title":["World Wide Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-023-01153-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11280-023-01153-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-023-01153-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,10,11]],"date-time":"2023-10-11T04:19:00Z","timestamp":1696997940000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11280-023-01153-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5,10]]},"references-count":48,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2023,9]]}},"alternative-id":["1153"],"URL":"https:\/\/doi.org\/10.1007\/s11280-023-01153-3","relation":{},"ISSN":["1386-145X","1573-1413"],"issn-type":[{"value":"1386-145X","type":"print"},{"value":"1573-1413","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,5,10]]},"assertion":[{"value":"24 September 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 December 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 February 2023","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 May 2023","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable for both human and\/or animal studies.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval"}},{"value":"The authors declare that they have no competing interests.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}]}}