Abstract:Object detectors are vulnerable to backdoor attacks. In contrast to classifiers, detectors possess unique characteristics, architecturally and in task execution; often operating in challenging conditions, for instance, detecting traffic signs in autonomous cars. But, our knowledge dominates attacks against classifiers and tests in the "digital domain". To address this critical gap, we conducted an extensive empirical study targeting multiple detector architectures and two challenging detection tasks in real-world settings: traffic signs and vehicles. Using the diverse, methodically collected videos captured from driving cars and flying drones, incorporating physical object trigger deployments in authentic scenes, we investigated the viability of physical object-triggered backdoor attacks in application settings. Our findings revealed 8 key insights. Importantly, the prevalent "digital" data poisoning method for injecting backdoors into models does not lead to effective attacks against detectors in the real world, although proven effective in classification tasks. We construct a new, cost-efficient attack method, dubbed MORPHING, incorporating the unique nature of detection tasks; ours is remarkably successful in injecting physical object-triggered backdoors, even capable of poisoning triggers with clean label annotations or invisible triggers without diminishing the success of physical object triggered backdoors. We discovered that the defenses curated are ill-equipped to safeguard detectors against such attacks. To underscore the severity of the threat and foster further research, we, for the first time, release an extensive video test set of real-world backdoor attacks. Our study not only establishes the credibility and seriousness of this threat but also serves as a clarion call to the research community to advance backdoor defenses in the context of object detection.

Palette: Physically-Realizable Backdoor Attacks Against Video Recognition Models

KerbNet: A QoE-aware Kernel-Based Backdoor Attack Framework

Clean-Label Backdoor Attacks on Video Recognition Models

Kaleidoscope: Physical Backdoor Attacks Against Deep Neural Networks with RGB Filters

Temporal-Distributed Backdoor Attack Against Video Based Action Recognition

Physical Invisible Backdoor Based on Camera Imaging

Backdoor Attacks Against Deep Learning Systems in the Physical World

Moiré Backdoor Attack (MBA): A Novel Trigger for Pedestrian Detectors in the Physical World

Dangerous Cloaking: Natural Trigger Based Backdoor Attacks on Object Detectors in the Physical World

Stand-in Backdoor: A Stealthy and Powerful Backdoor Attack

PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification

On the Credibility of Backdoor Attacks Against Object Detectors in the Physical World

A Motional but Temporally Consistent Physical Video Examples

Backdoor Attacks on Bimodal Salient Object Detection with RGB-Thermal Data

A Backdoor Attack Scheme with Invisible Triggers Based on Model Architecture Modification

Backdoor Attack in the Physical World

BABE: Backdoor Attack with Bokeh Effects Via Latent Separation Suppression

Towards Clean-Label Backdoor Attacks in the Physical World

A stealthy and robust backdoor attack via frequency domain transform

Few-Shot Backdoor Attacks on Visual Object Tracking

Bullet-Screen-Emoji Attack with Temporal Difference Noise for Video Action Recognition