{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:41:37Z","timestamp":1760128897638,"version":"build-2065373602"},"reference-count":61,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2023,6,25]],"date-time":"2023-06-25T00:00:00Z","timestamp":1687651200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key R&amp;D Program of China","award":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"],"award-info":[{"award-number":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"]}]},{"name":"National Science Fund for Distinguished Young Scholars","award":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"],"award-info":[{"award-number":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"]}]},{"name":"National Natural Science Foundation of China","award":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"],"award-info":[{"award-number":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"]}]},{"name":"Natural Science Foundation of Fujian Province of China","award":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"],"award-info":[{"award-number":["2022ZD0118202","62025603","U21B2037","62176222","U22B2051","62176223","62176226","62072386","62072387","62072389","62002305","62272401","2021J01002","2022J06001"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Deep neural networks (DNNs) are easily exposed to backdoor threats when training with poisoned training samples. Models using backdoor attack have normal performance for benign samples, and possess poor performance for poisoned samples manipulated with pre-defined trigger patterns. Currently, research on backdoor attacks focuses on image classification and object detection. In this article, we investigated backdoor attacks in facial sketch synthesis, which can be beneficial for many applications, such as animation production and assisting police in searching for suspects. Specifically, we propose a simple yet effective poison-only backdoor attack suitable for generation tasks. We demonstrate that when the backdoor is integrated into the target model via our attack, it can mislead the model to synthesize unacceptable sketches of any photos stamped with the trigger patterns. Extensive experiments are executed on the benchmark datasets. Specifically, the light strokes devised by our backdoor attack strategy can significantly decrease the perceptual quality. However, the FSIM score of light strokes is 68.21% on the CUFS dataset and the FSIM scores of pseudo-sketches generated by FCN, cGAN, and MDAL are 69.35%, 71.53%, and 72.75%, respectively. There is no big difference, which proves the effectiveness of the proposed backdoor attack method.<\/jats:p>","DOI":"10.3390\/e25070974","type":"journal-article","created":{"date-parts":[[2023,6,26]],"date-time":"2023-06-26T05:39:13Z","timestamp":1687757953000},"page":"974","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Backdoor Attack against Face Sketch Synthesis"],"prefix":"10.3390","volume":"25","author":[{"given":"Shengchuan","family":"Zhang","sequence":"first","affiliation":[{"name":"Department of Artificial lntelligence, School of Intormatics, Xiamen University, Xiamen 361005, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Suhang","family":"Ye","sequence":"additional","affiliation":[{"name":"Department of Artificial lntelligence, School of Intormatics, Xiamen University, Xiamen 361005, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2023,6,25]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"275","DOI":"10.1109\/TCSVT.2015.2511482","article-title":"Face sketch synthesis from a single photo\u2013sketch pair","volume":"27","author":"Zhang","year":"2017","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"220","DOI":"10.1109\/TIP.2015.2501755","article-title":"Robust face sketch style synthesis","volume":"25","author":"Zhang","year":"2016","journal-title":"IEEE Trans. Image Process."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Chang, L., Zhou, M., Han, Y., and Deng, X. (2010, January 23\u201326). Face sketch synthesis via sparse representation. Proceedings of the International Conference on Pattern Recognition, Istanbul, Turkey.","DOI":"10.1109\/ICPR.2010.526"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Zhang, L., Lin, L., Wu, X., Ding, S., and Zhang, L. (2015, January 13\u201316). End-to-end photo-sketch generation via fully convolutional representation learning. Proceedings of the International Conference Multimedia Retrieval, Melbourne, Australia.","DOI":"10.1145\/2671188.2749321"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1007\/s11263-013-0645-9","article-title":"A comprehensive survey to face hallucination","volume":"106","author":"Wang","year":"2014","journal-title":"Int. J. Comput. Vis."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"2154","DOI":"10.1109\/TCSVT.2017.2709465","article-title":"Anchored neighborhood index for face sketch synthesis","volume":"28","author":"Wang","year":"2018","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1264","DOI":"10.1109\/TIP.2017.2651375","article-title":"Bayesian face sketch synthesis","volume":"26","author":"Wang","year":"2017","journal-title":"IEEE Trans. Image Process."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1364","DOI":"10.1109\/TNNLS.2013.2258174","article-title":"Transductive face sketch photo synthesis","volume":"24","author":"Wang","year":"2013","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Ji, N., Chai, X., Shan, S., and Chen, X. (2011, January 12\u201315). Local regression model for automatic face sketch generation. Proceedings of the International Conference Image and Graphics, Hefei, China.","DOI":"10.1109\/ICIG.2011.84"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Isola, P., Zhu, J.Y., Zhou, T., and Efros, A.A. (2017, January 26). Image-to-image translation with conditional adversarial networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.632"},{"key":"ref_11","unstructured":"Tang, X., and Wang, X. (2002, January 10). Face photo recognition using sketch. Proceedings of the IEEE International Conference Image Processing, Rochester, NY, USA."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/TCSVT.2003.818353","article-title":"Face sketch recognition","volume":"14","author":"Tang","year":"2004","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"ref_13","unstructured":"Liu, Q., Tang, X., Jin, H., Lu, H., and Ma, S. (2005, January 20\u201325). A nonlinear approach for face sketch synthesis and recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, San Diego, CA, USA."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"2323","DOI":"10.1126\/science.290.5500.2323","article-title":"Nonlinear dimensionality reduction by locally linear embedding","volume":"290","author":"Roweis","year":"2000","journal-title":"Science"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"487","DOI":"10.1109\/TCSVT.2008.918770","article-title":"Face sketch synthesis algorithm based on E-HMM and selective ensemble","volume":"18","author":"Gao","year":"2008","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1213","DOI":"10.1109\/TCSVT.2012.2198090","article-title":"Face sketch\u2013photo synthesis and retrieval using sparse representation","volume":"22","author":"Gao","year":"2012","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1955","DOI":"10.1109\/TPAMI.2008.222","article-title":"Face photo-sketch synthesis and recognition","volume":"31","author":"Wang","year":"2009","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_18","unstructured":"Zhou, H., Kuang, Z., and Wong, K.-Y.K. (2012, January 16). Markov weight fields for face sketch synthesis. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Providence, RI, USA."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Song, Y., Bao, L., Yang, Q., and Yang, M.-H. (2014, January 6\u201312). Real-time exemplar based face sketch synthesis. Proceedings of the European Conference on Computer Vision, Zurich, Switzerland.","DOI":"10.1007\/978-3-319-10599-4_51"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2201","DOI":"10.1109\/TNNLS.2015.2464681","article-title":"Multiple representations-based face sketch\u2013photo synthesis","volume":"27","author":"Peng","year":"2016","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Zhu, M., Wang, N., Gao, X., and Li, J. (2017, January 19\u201325). Deep graphical feature learning for face sketch synthesis. Proceedings of the International Joint Conference on Artificial Intelligence, Melbourne, Australia.","DOI":"10.24963\/ijcai.2017\/500"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Chang, L., Zhou, M., Deng, X., Wu, Z., and Han, Y. (2011, January 5\u20139). Face sketch synthesis via multivariate output regression. Proceedings of the International Conference Human-Comput Interaction, Lisbon, Portugal.","DOI":"10.1007\/978-3-642-21602-2_60"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"214","DOI":"10.1016\/j.neucom.2016.07.071","article-title":"Data-driven vs. model driven: Fast face sketch synthesis","volume":"257","author":"Wang","year":"2017","journal-title":"Neurocomputing"},{"key":"ref_24","unstructured":"Wang, N., Gao, X., and Li, J. (2023, May 03). Random Sampling for Fast Face Sketch Synthesis. Available online: https:\/\/arxiv.org\/abs\/1701.01911."},{"key":"ref_25","unstructured":"Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014, January 8\u201313). Generative adversarial nets. Proceedings of the International Conference Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1016\/j.patrec.2017.06.012","article-title":"Back projection: An effective post processing method for GAN-based face sketch synthesis","volume":"107","author":"Wang","year":"2017","journal-title":"Pattern Recognit. Lett."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1419","DOI":"10.1109\/TNNLS.2018.2869574","article-title":"Face Sketch Synthesis by Multidomain Adversarial Learning","volume":"30","author":"Zhang","year":"2019","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Li, Y., Li, Y., Wu, B., Li, L., He, R., and Lyu, S. (2021, January 10\u201317). Invisible backdoor attack with sample-specific triggers. Proceedings of the ICCV, Montreal, QC, Canada.","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Zeng, Y., Park, W., Mao, Z., and Jia, R. (2021, January 10\u201317). Rethinking the backdoor attacks\u2019 triggers: A frequency perspective. Proceedings of the ICCV, Montreal, QC, Canada.","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Luo, C., Li, Y., Jiang, Y., and Xia, S.T. (2022). Untargeted Backdoor Attack against Object Detection. arXiv.","DOI":"10.1109\/ICASSP49357.2023.10095980"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"2378","DOI":"10.1109\/TIP.2011.2109730","article-title":"FSIM: A feature similarity index for image quality assessment","volume":"20","author":"Zhang","year":"2011","journal-title":"IEEE Trans. Image Process."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"379","DOI":"10.1109\/TMM.2017.2729020","article-title":"Reduced-reference Image Quality Assessment in Free-energy Principle and Sparse Representation","volume":"20","author":"Liu","year":"2017","journal-title":"IEEE Trans. Multimed."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1109\/TMM.2018.2849602","article-title":"Blind Quality Assessment of Camera Images Based on Low-Level and High-level Statistical Features","volume":"21","author":"Liu","year":"2018","journal-title":"IEEE Trans. Multimed."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"929","DOI":"10.1109\/TCSVT.2019.2900472","article-title":"Unsupervised Blind Image Quality Evaluation via Statistical Measurements of Structure, Naturalness and Perception","volume":"30","author":"Liu","year":"2019","journal-title":"IEEE Trans. Circuits Syst. Video Technol."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3418212","article-title":"Blind Image Quality Assessment by Natural Scene Statistics and Perceptual Characteristics","volume":"16","author":"Liu","year":"2020","journal-title":"ACM Trans. Multimed. Comput. Commun. Appl."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"3651","DOI":"10.1109\/TCYB.2021.3128023","article-title":"Toward a No-Reference Quality Metric for Camera-Captured Images","volume":"53","author":"Hu","year":"2021","journal-title":"IEEE Trans. Cybern."},{"key":"ref_37","unstructured":"Koh, P.W., and Liang, P. (2017, January 6\u201311). Understanding black-box predictions via influence functions. Proceedings of the ICML, Sydney, Australia."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Mei, S., and Zhu, X. (2015, January 25\u201330). Using machine teaching to identify optimal training-set attacks on machine learners. Proceedings of the AAAI, Austin, TX, USA.","DOI":"10.1609\/aaai.v29i1.9569"},{"key":"ref_39","unstructured":"Gu, T., Dolan-Gavitt, B., and Garg, S. (2017). Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv."},{"key":"ref_40","unstructured":"Liao, C., Zhong, H., Squicciarini, A., Zhu, S., and Miller, D. (2018). Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv."},{"key":"ref_41","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., and Song, D. (2017). Targeted backdoor attacks on deep learning systems using data poisoning. arXiv."},{"key":"ref_42","unstructured":"Steinhardt, J., Koh, P.W.W., and Liang, P.S. (2017, January 4). Certified defenses for data poisoning attacks. Proceedings of the NIPS, Long Beach, CA, USA."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Liu, Y., Ma, S., Aafer, Y., Lee, W.C., Zhai, J., Wang, W., and Zhang, X. (2023, May 03). Trojaning Attack on Neural Networks. Available online: https:\/\/www.ndss-symposium.org\/wp-content\/uploads\/2018\/03\/NDSS2018_03A-5_Liu_Slides.pdf.","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Yao, Y., Li, H., Zheng, H., and Zhao, B.Y. (2019, January 11). Latent backdoor attacks on deep neural networks. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK.","DOI":"10.1145\/3319535.3354209"},{"key":"ref_45","unstructured":"Turner, A., Tsipras, D., and Madry, A. (2023, May 03). Clean-Label Backdoor Attacks. Available online: https:\/\/people.csail.mit.edu\/madry\/lab\/."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., and Jiang, Y.G. (2020, January 19). Clean-label backdoor attacks on video recognition models. Proceedings of the CVPR, Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.01445"},{"key":"ref_47","unstructured":"Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 26\u201328). How to backdoor federated learning. Proceedings of the AISTATS, Online."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Jia, J., Wang, B., and Gong, N.Z. (2020). Backdoor attacks to graph neural networks. arXiv.","DOI":"10.1145\/3450569.3463560"},{"key":"ref_49","unstructured":"Li, S., Zhao, B.Z.H., Yu, J., Xue, M., Kaafar, D., and Zhu, H. (2019). Invisible backdoor attacks against deep neural networks. arXiv."},{"key":"ref_50","unstructured":"Liu, K., Dolan-Gavitt, B., and Garg, S. (2018). International Symposium on Research in Attacks, Intrusions, and Defenses, Springer."},{"key":"ref_51","unstructured":"Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B.Y. (2023, May 03). Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. Available online: https:\/\/people.cs.uchicago.edu\/~huiyingli\/publication\/backdoor-sp19.pdf."},{"key":"ref_52","unstructured":"Guo, C., Rana, M., Cisse, M., and Van Der Maaten, L. (2017). Countering adversarial images using input transformations. arXiv."},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Zhang, H., Cisse, M., Dauphin, Y.N., and Lopez-Paz, D. (2017). mixup: Beyond empirical risk minimization. arXiv.","DOI":"10.1007\/978-1-4899-7687-1_79"},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Xiang, Z., Miller, D.J., and Kesidis, G. (2019, January 13\u201316). A benchmark study of backdoor data poisoning defenses for deep neural network classifiers and a novel defense. Proceedings of the 2019 IEEE 29th International Workshop on Machine Learning for Signal Processing (MLSP), Pittsburgh, PA, USA.","DOI":"10.1109\/MLSP.2019.8918908"},{"key":"ref_55","unstructured":"Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B. (2018). Detecting backdoor attacks on deep neural networks by activation clustering. arXiv."},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Doan, B.G., Abbasnejad, E., and Ranasinghe, D.C. (2019). Februus: Input purification defense against trojan attacks on deep neural network systems. arXiv.","DOI":"10.1145\/3427228.3427264"},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D.C., and Nepal, S. (2019, January 9\u201313). Strip: A defence against trojan attacks on deep neural networks. Proceedings of the 35th Annual Computer Security Applications Conference, San Juan, PR, USA.","DOI":"10.1145\/3359789.3359790"},{"key":"ref_58","unstructured":"Martinez, A., and Benavente, R. (1998). The AR Face Database, CVC. Technol Report #24."},{"key":"ref_59","unstructured":"Messer, K., Matas, J., Kittler, J., Luettin, J., and Maitre, G. (1999, January 22\u201324). XM2VTSDB: The extended M2VTS database. Proceedings of the International Conference Audio and Video-Based Biometric Person Authentication, Washington, DC, USA."},{"key":"ref_60","doi-asserted-by":"crossref","first-page":"1090","DOI":"10.1109\/34.879790","article-title":"The FERET evaluation methodology for face recognition algorithms","volume":"22","author":"Phillips","year":"2000","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_61","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1109\/TIP.2003.819861","article-title":"Image quality assessment: From error visibility to structural similarity","volume":"13","author":"Wang","year":"2004","journal-title":"IEEE Trans. Image Process."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/7\/974\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:00:01Z","timestamp":1760126401000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/7\/974"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,6,25]]},"references-count":61,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2023,7]]}},"alternative-id":["e25070974"],"URL":"https:\/\/doi.org\/10.3390\/e25070974","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2023,6,25]]}}}