SSL-OTA: Unveiling Backdoor Threats in Self-Supervised Learning for Object Detection

Qiannan Wang,Changchun Yin,Lu Zhou,Liming Fang

2024-06-12

Abstract:The extensive adoption of Self-supervised learning(SSL) has led to an increased security threat from backdoor attacks. While existing research has mainly focused on backdoor attacks in image classification, there has been limited exploration of their implications for object detection. Object detection plays a critical role in security-sensitive applications, such as autonomous driving, where backdoor attacks seriously threaten human life and property. In this work, we propose the first backdoor attack designed for object detection tasks in SSL scenarios, called Object Transform Attack (SSL-OTA). SSL-OTA employs a trigger capable of altering predictions of the target object to the desired category, encompassing two attacks: Naive Attack(NA) and Dual-Source Blending Attack (DSBA). NA conducts data poisoning during downstream fine-tuning of the object detector, while DSBA additionally injects backdoors into the pre-trained encoder. We establish appropriate metrics and conduct extensive experiments on benchmark datasets, demonstrating the effectiveness of our proposed attack and its resistance to potential defenses. Notably, both NA and DSBA achieve high attack success rates (ASR) at extremely low poisoning rates (0.5%). The results underscore the importance of considering backdoor threats in SSL-based object detection and contribute a novel perspective to the field.

Cryptography and Security,Computer Vision and Pattern Recognition

What problem does this paper attempt to address?

### Problems the paper attempts to solve

The paper "SSL - OTA: Revealing Backdoor Threats in Object Detection for Self - Supervised Learning" aims to solve the backdoor attack problem in self - supervised learning (SSL) for object detection tasks. Specifically, the paper focuses on the following points:

1. **Limitations of existing research**:
- Existing research mainly focuses on backdoor attacks in image classification tasks, while backdoor attacks in object detection tasks have not been fully explored.
- Object detection plays a crucial role in safety - sensitive applications such as autonomous driving, and backdoor attacks may seriously threaten human lives and property.

2. **Proposed new methods**:
- The paper proposes the first backdoor attack method for SSL object detection tasks, called Object Transform Attack (SSL - OTA).
- SSL - OTA uses a trigger to change the predicted category of the target object to the category desired by the attacker, including two attack methods: Naive Attack (NA) and Dual - Source Blending Attack (DSBA).

3. **Attack mechanisms**:
- **Naive Attack (NA)**: Conduct data poisoning on the training set during the downstream fine - tuning stage and change the true labels of the poisoned samples.
- **Dual - Source Blending Attack (DSBA)**: Not only conduct data poisoning during the downstream fine - tuning stage, but also inject a backdoor into the pre - trained encoder and use an additional shadow data set for backdoor training.

4. **Evaluation and experiments**:
- The paper designs appropriate evaluation metrics and conducts extensive experiments on benchmark data sets to verify the effectiveness of the proposed attack and its resistance to potential defenses.
- The experimental results show that NA and DSBA can still achieve a high attack success rate (ASR) at an extremely low data poisoning rate (0.5%) with a relatively small impact on model performance.

### Summary

By proposing the SSL - OTA method, this paper reveals the backdoor threats in self - supervised learning for object detection tasks, provides detailed attack mechanisms and experimental results, and emphasizes the importance of considering backdoor threats in SSL object detection.