{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T23:18:47Z","timestamp":1783639127684,"version":"3.55.0"},"reference-count":60,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2027,1,1]],"date-time":"2027-01-01T00:00:00Z","timestamp":1798761600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neural Networks"],"published-print":{"date-parts":[[2027,1]]},"DOI":"10.1016\/j.neunet.2026.109307","type":"journal-article","created":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T06:44:18Z","timestamp":1783147458000},"page":"109307","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"PA","title":["A practical design of backdoor trigger under frequency-based orthogonality constraints"],"prefix":"10.1016","volume":"205","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-9423-670X","authenticated-orcid":false,"given":"Hao","family":"Luo","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-4549-5796","authenticated-orcid":false,"given":"Zhi","family":"Qin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Min","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.neunet.2026.109307_bib0001","series-title":"2019 IEEE international conference on image processing (ICIP)","first-page":"101","article-title":"A new backdoor attack in cnns by training set corruption without label poisoning","author":"Barni","year":"2019"},{"key":"10.1016\/j.neunet.2026.109307_bib0002","doi-asserted-by":"crossref","DOI":"10.1016\/j.ins.2025.122368","article-title":"Dynamic frequency domain trigger backdoor attack with steganography against deep neural networks","volume":"718","author":"Chen","year":"2025","journal-title":"Information Sciences"},{"key":"10.1016\/j.neunet.2026.109307_bib0003","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017). Targeted backdoor attacks on deep learning systems using data poisoning. arXiv: 1712.05526."},{"key":"10.1016\/j.neunet.2026.109307_bib0004","series-title":"2020 IEEE security and privacy workshops (SPW)","first-page":"48","article-title":"SentiNet: Detecting localized universal attacks against deep learning systems","author":"Chou","year":"2020"},{"issue":"10","key":"10.1016\/j.neunet.2026.109307_bib0005","doi-asserted-by":"crossref","first-page":"579","DOI":"10.1109\/LSP.2011.2163394","article-title":"A DCT approximation for image compression","volume":"18","author":"Cintra","year":"2011","journal-title":"IEEE Signal Processing Letters"},{"issue":"7","key":"10.1016\/j.neunet.2026.109307_bib0006","doi-asserted-by":"crossref","first-page":"1160","DOI":"10.1364\/JOSAA.2.001160","article-title":"Uncertainty relation for resolution in space, spatial frequency, and orientation optimized by two-dimensional visual cortical filters","volume":"2","author":"Daugman","year":"1985","journal-title":"Journal of the Optical Society of America A"},{"key":"10.1016\/j.neunet.2026.109307_bib0007","series-title":"2009 IEEE conference on computer vision and pattern recognition","first-page":"248","article-title":"ImageNet: A large-scale hierarchical image database","author":"Deng","year":"2009"},{"key":"10.1016\/j.neunet.2026.109307_bib0008","unstructured":"Devlin, J. (2018). BERT: Pre-training of deep bidirectional transformers for language understanding. arXiv: 1810.04805."},{"key":"10.1016\/j.neunet.2026.109307_bib0009","series-title":"Proceedings of the 36th annual computer security applications conference","first-page":"897","article-title":"Februus: Input purification defense against Trojan attacks on deep neural network systems","author":"Doan","year":"2020"},{"key":"10.1016\/j.neunet.2026.109307_bib0010","doi-asserted-by":"crossref","DOI":"10.1016\/j.asoc.2023.110993","article-title":"Stealthy dynamic backdoor attack against neural networks for image classification","volume":"149","author":"Dong","year":"2023","journal-title":"Applied Soft Computing"},{"issue":"8","key":"10.1016\/j.neunet.2026.109307_bib0011","doi-asserted-by":"crossref","first-page":"861","DOI":"10.1016\/j.patrec.2005.10.010","article-title":"An introduction to ROC analysis","volume":"27","author":"Fawcett","year":"2006","journal-title":"Pattern Recognition Letters"},{"key":"10.1016\/j.neunet.2026.109307_bib0012","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","first-page":"20876","article-title":"FIBA: Frequency-injection based backdoor attack in medical image analysis","author":"Feng","year":"2022"},{"issue":"12","key":"10.1016\/j.neunet.2026.109307_bib0013","doi-asserted-by":"crossref","first-page":"2379","DOI":"10.1364\/JOSAA.4.002379","article-title":"Relations between the statistics of natural images and the response properties of cortical cells","volume":"4","author":"Field","year":"1987","journal-title":"Journal of the Optical Society of America A"},{"key":"10.1016\/j.neunet.2026.109307_bib0014","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"1851","article-title":"A dual stealthy backdoor: From both spatial and frequency perspectives","volume":"Vol. 38","author":"Gao","year":"2024"},{"key":"10.1016\/j.neunet.2026.109307_bib0015","doi-asserted-by":"crossref","first-page":"6364","DOI":"10.1109\/TIFS.2024.3411936","article-title":"Backdoor attack with sparse and invisible trigger","volume":"19","author":"Gao","year":"2024","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.neunet.2026.109307_bib0016","series-title":"Proceedings of the 35th annual computer security applications conference","first-page":"113","article-title":"STRIP: A defence against Trojan attacks on deep neural networks","author":"Gao","year":"2019"},{"key":"10.1016\/j.neunet.2026.109307_bib0017","doi-asserted-by":"crossref","first-page":"47230","DOI":"10.1109\/ACCESS.2019.2909068","article-title":"BadNets: Evaluating backdooring attacks on deep neural networks","volume":"7","author":"Gu","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.neunet.2026.109307_bib0018","series-title":"ICLR","article-title":"Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency","author":"Guo","year":"2023"},{"key":"10.1016\/j.neunet.2026.109307_bib0019","series-title":"International conference on machine learning","first-page":"4129","article-title":"Spectre: Defending against backdoor attacks using robust statistics","author":"Hayase","year":"2021"},{"key":"10.1016\/j.neunet.2026.109307_bib0020","series-title":"Proceedings of the IEEE conference on computer vision and pattern recognition","first-page":"770","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"issue":"4","key":"10.1016\/j.neunet.2026.109307_bib0021","doi-asserted-by":"crossref","first-page":"628","DOI":"10.1137\/1031129","article-title":"Continuous and discrete wavelet transforms","volume":"31","author":"Heil","year":"1989","journal-title":"SIAM Review"},{"key":"10.1016\/j.neunet.2026.109307_bib0022","doi-asserted-by":"crossref","DOI":"10.1016\/j.inffus.2025.103376","article-title":"Syntactic paraphrase-based synthetic data generation for backdoor attacks against chinese language models","volume":"124","author":"Hu","year":"2025","journal-title":"Information Fusion"},{"key":"10.1016\/j.neunet.2026.109307_bib0023","unstructured":"Krizhevsky, A. (2009). Learning multiple layers of features from tiny images. University of Toronto, Technical Report."},{"issue":"1","key":"10.1016\/j.neunet.2026.109307_bib0024","article-title":"Hybrid discrete wavelet transform and gabor filter banks processing for features extraction from biomedical images","volume":"2013","author":"Lahmiri","year":"2013","journal-title":"Journal of Medical Engineering"},{"key":"10.1016\/j.neunet.2026.109307_bib0025","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2025.127352","article-title":"FEAT: Frequency energy based backdoor attack in deep neural networks","volume":"278","author":"Li","year":"2025","journal-title":"Expert Systems with Applications"},{"issue":"5","key":"10.1016\/j.neunet.2026.109307_bib0026","first-page":"2088","article-title":"Invisible backdoor attacks on deep neural networks via steganography and regularization","volume":"18","author":"Li","year":"2020","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"issue":"1","key":"10.1016\/j.neunet.2026.109307_bib0027","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1109\/TNNLS.2022.3182979","article-title":"Backdoor learning: A survey","volume":"35","author":"Li","year":"2022","journal-title":"IEEE Transactions on Neural Networks and Learning Systems"},{"key":"10.1016\/j.neunet.2026.109307_bib0028","series-title":"Proceedings of the IEEE\/CVF international conference on computer vision","first-page":"16463","article-title":"Invisible backdoor attack with sample-specific triggers","author":"Li","year":"2021"},{"key":"10.1016\/j.neunet.2026.109307_bib0029","doi-asserted-by":"crossref","first-page":"9730","DOI":"10.1109\/TIFS.2024.3472510","article-title":"A proxy attack-free strategy for practically improving the poisoning efficiency in backdoor attacks","volume":"19","author":"Li","year":"2024","journal-title":"IEEE Transactions on Information Forensics and Security"},{"issue":"6","key":"10.1016\/j.neunet.2026.109307_bib0030","doi-asserted-by":"crossref","first-page":"7430","DOI":"10.1109\/TDSC.2025.3596981","article-title":"Explore the effect of data selection on poison efficiency in backdoor attacks","volume":"22","author":"Li","year":"2025","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"10.1016\/j.neunet.2026.109307_bib0031","series-title":"Proceedings of the 2020 ACM SIGSAC conference on computer and communications security","first-page":"113","article-title":"Composite backdoor attack for deep neural network by mixing existing benign features","author":"Lin","year":"2020"},{"key":"10.1016\/j.neunet.2026.109307_bib0032","series-title":"International symposium on research in attacks, intrusions, and defenses","first-page":"273","article-title":"Fine-pruning: Defending against backdooring attacks on deep neural networks","author":"Liu","year":"2018"},{"key":"10.1016\/j.neunet.2026.109307_bib0033","series-title":"25th Annual network and distributed system security symposium (NDSS 2018)","article-title":"Trojaning attack on neural networks","author":"Liu","year":"2018"},{"key":"10.1016\/j.neunet.2026.109307_bib0034","series-title":"Computer vision\u2013ECCV 2020: 16th European conference, Glasgow, UK, august 23\u201328, 2020, proceedings, Part X 16","first-page":"182","article-title":"Reflection backdoor: A natural backdoor attack on deep neural networks","author":"Liu","year":"2020"},{"key":"10.1016\/j.neunet.2026.109307_bib0035","series-title":"2017 IEEE international conference on computer design (ICCD)","first-page":"45","article-title":"Neural Trojans","author":"Liu","year":"2017"},{"key":"10.1016\/j.neunet.2026.109307_bib0036","series-title":"Proceedings of the IEEE\/CVF international conference on computer vision","first-page":"10012","article-title":"Swin transformer: Hierarchical vision transformer using shifted windows","author":"Liu","year":"2021"},{"key":"10.1016\/j.neunet.2026.109307_bib0037","series-title":"Proceedings of the IEEE international conference on computer vision","first-page":"3730","article-title":"Deep learning face attributes in the wild","author":"Liu","year":"2015"},{"key":"10.1016\/j.neunet.2026.109307_bib0038","series-title":"Proceedings of the ACM SIGGRAPH\/EUROGRAPHICS conference on graphics hardware","first-page":"112","article-title":"The FFT on a GPU","author":"Moreland","year":"2003"},{"issue":"1","key":"10.1016\/j.neunet.2026.109307_bib0039","first-page":"125","article-title":"Performance evaluation of face recognition using gabor filter, log gabor filter and discrete wavelet transform","volume":"2","author":"Murugan","year":"2010","journal-title":"International Journal of Computer Science and Information Technology"},{"key":"10.1016\/j.neunet.2026.109307_bib0040","unstructured":"Nguyen, A., & Tran, A. (2021). Wanet\u2013imperceptible warping-based backdoor attack. arXiv: 2102.10369."},{"key":"10.1016\/j.neunet.2026.109307_bib0041","unstructured":"Qiao, X., Yang, Y., & Li, H. (2019). Defending neural backdoors via generative distribution modeling. In Advances in Neural Information Processing Systems, 32, 14004\u201314013."},{"key":"10.1016\/j.neunet.2026.109307_bib0042","series-title":"Proceedings of the AAAI conference on artificial intelligence","first-page":"11957","article-title":"Hidden trigger backdoor attacks","volume":"Vol. 34","author":"Saha","year":"2020"},{"key":"10.1016\/j.neunet.2026.109307_bib0043","series-title":"Proceedings of the IEEE international conference on computer vision","first-page":"618","article-title":"Grad-CAM: Visual explanations from deep networks via gradient-based localization","author":"Selvaraju","year":"2017"},{"key":"10.1016\/j.neunet.2026.109307_bib0044","unstructured":"Simonyan, K., & Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv: 1409.1556."},{"key":"10.1016\/j.neunet.2026.109307_bib0045","doi-asserted-by":"crossref","first-page":"323","DOI":"10.1016\/j.neunet.2012.02.016","article-title":"Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition","volume":"32","author":"Stallkamp","year":"2012","journal-title":"Neural Networks"},{"key":"10.1016\/j.neunet.2026.109307_bib0046","series-title":"Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining","first-page":"218","article-title":"An embarrassingly simple approach for Trojan attack in deep neural networks","author":"Tang","year":"2020"},{"key":"10.1016\/j.neunet.2026.109307_bib0047","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","first-page":"13368","article-title":"Better trigger inversion optimization in backdoor scanning","author":"Tao","year":"2022"},{"key":"10.1016\/j.neunet.2026.109307_bib0048","unstructured":"Tran, B., Li, J., & Madry, A. (2018). Spectral signatures in backdoor attacks. Advances in Neural Information Processing Systems, 31, 8011\u20138021."},{"key":"10.1016\/j.neunet.2026.109307_bib0049","unstructured":"Turner, A., Tsipras, D., & Madry, A. (2019). Label-consistent backdoor attacks. arXiv: 1912.02771."},{"key":"10.1016\/j.neunet.2026.109307_bib0050","series-title":"2019 IEEE symposium on security and privacy (SP)","first-page":"707","article-title":"Neural cleanse: Identifying and mitigating backdoor attacks in neural networks","author":"Wang","year":"2019"},{"key":"10.1016\/j.neunet.2026.109307_bib0051","series-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","article-title":"High-frequency component helps explain the generalization of convolutional neural networks","author":"Wang","year":"2020"},{"key":"10.1016\/j.neunet.2026.109307_bib0052","series-title":"European conference on computer vision","first-page":"396","article-title":"An invisible black-box backdoor attack through frequency domain","author":"Wang","year":"2022"},{"key":"10.1016\/j.neunet.2026.109307_bib0053","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume":"34","author":"Wu","year":"2021","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.1016\/j.neunet.2026.109307_bib0054","series-title":"International conference on neural information processing","first-page":"264","article-title":"Training behavior of deep neural network in frequency domain","author":"Xu","year":"2019"},{"key":"10.1016\/j.neunet.2026.109307_bib0055","series-title":"Advances in neural information processing systems","article-title":"A Fourier perspective on model robustness in computer vision","volume":"Vol. 32","author":"Yin","year":"2019"},{"key":"10.1016\/j.neunet.2026.109307_bib0056","series-title":"Proceedings of the IEEE\/CVF international conference on computer vision","first-page":"16473","article-title":"Rethinking the backdoor attacks\u2019 triggers: A frequency perspective","author":"Zeng","year":"2021"},{"key":"10.1016\/j.neunet.2026.109307_bib0057","series-title":"Proceedings of the 2024 on ACM SIGSAC conference on computer and communications security","first-page":"4450","article-title":"BadMerging: Backdoor attacks against model merging","author":"Zhang","year":"2024"},{"key":"10.1016\/j.neunet.2026.109307_bib0058","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103767","article-title":"WaTrojan: Wavelet domain trigger injection for backdoor attacks","volume":"140","author":"Zhang","year":"2024","journal-title":"Computers & Security"},{"key":"10.1016\/j.neunet.2026.109307_bib0059","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2024.125856","article-title":"Clean-label backdoor attack and defense: An examination of language model vulnerability","volume":"265","author":"Zhao","year":"2025","journal-title":"Expert Systems with Applications"},{"issue":"5","key":"10.1016\/j.neunet.2026.109307_bib0060","doi-asserted-by":"crossref","first-page":"4685","DOI":"10.1109\/TDSC.2025.3552234","article-title":"Towards sample-specific backdoor attack with clean labels via attribute trigger","volume":"22","author":"Zhu","year":"2025","journal-title":"IEEE Transactions on Dependable and Secure Computing"}],"container-title":["Neural Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608026007677?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0893608026007677?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T22:58:41Z","timestamp":1783637921000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0893608026007677"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2027,1]]},"references-count":60,"alternative-id":["S0893608026007677"],"URL":"https:\/\/doi.org\/10.1016\/j.neunet.2026.109307","relation":{},"ISSN":["0893-6080"],"issn-type":[{"value":"0893-6080","type":"print"}],"subject":[],"published":{"date-parts":[[2027,1]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A practical design of backdoor trigger under frequency-based orthogonality constraints","name":"articletitle","label":"Article Title"},{"value":"Neural Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neunet.2026.109307","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"109307"}}