Abstract:Object detectors are vulnerable to backdoor attacks. In contrast to classifiers, detectors possess unique characteristics, architecturally and in task execution; often operating in challenging conditions, for instance, detecting traffic signs in autonomous cars. But, our knowledge dominates attacks against classifiers and tests in the "digital domain". To address this critical gap, we conducted an extensive empirical study targeting multiple detector architectures and two challenging detection tasks in real-world settings: traffic signs and vehicles. Using the diverse, methodically collected videos captured from driving cars and flying drones, incorporating physical object trigger deployments in authentic scenes, we investigated the viability of physical object-triggered backdoor attacks in application settings. Our findings revealed 8 key insights. Importantly, the prevalent "digital" data poisoning method for injecting backdoors into models does not lead to effective attacks against detectors in the real world, although proven effective in classification tasks. We construct a new, cost-efficient attack method, dubbed MORPHING, incorporating the unique nature of detection tasks; ours is remarkably successful in injecting physical object-triggered backdoors, even capable of poisoning triggers with clean label annotations or invisible triggers without diminishing the success of physical object triggered backdoors. We discovered that the defenses curated are ill-equipped to safeguard detectors against such attacks. To underscore the severity of the threat and foster further research, we, for the first time, release an extensive video test set of real-world backdoor attacks. Our study not only establishes the credibility and seriousness of this threat but also serves as a clarion call to the research community to advance backdoor defenses in the context of object detection.

BadFusion: 2D-Oriented Backdoor Attacks against 3D Object Detection

Palette: Physically-Realizable Backdoor Attacks Against Video Recognition Models

Unity is Strength? Benchmarking the Robustness of Fusion-based 3D Object Detection Against Physical Sensor Attack

BadDet: Backdoor Attacks on Object Detection

Clean-Annotation Backdoor Attack against Lane Detection Systems in the Wild

PLA-LiDAR: Physical Laser Attacks Against LiDAR-based 3D Object Detection in Autonomous Vehicle.

Untargeted Backdoor Attack against Object Detection

On the Credibility of Backdoor Attacks Against Object Detectors in the Physical World

Detector Collapse: Physical-World Backdooring Object Detection to Catastrophic Overload or Blindness in Autonomous Driving

AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection

Physical Adversarial Attack Scheme on Object Detectors using 3D Adversarial Object

Transient Adversarial 3D Projection Attacks on Object Detection in Autonomous Driving

Attacking by Aligning: Clean-Label Backdoor Attacks on Object Detection

Adversarial Obstacle Generation Against LiDAR-Based 3D Object Detection

PointBA: Towards Backdoor Attacks in 3D Point Cloud

Moiré Backdoor Attack (MBA): A Novel Trigger for Pedestrian Detectors in the Physical World

Adversarial Point Cloud Perturbations Against 3D Object Detection in Autonomous Driving Systems

3D-Adv: Black-Box Adversarial Attacks against Deep Learning Models through 3D Sensors

Real is not True: Backdoor Attacks Against Deepfake Detection

Stealthy Backdoor Attacks on Deep Point Cloud Recognization Networks