Abstract:Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection. To train an object detector with satisfactory accuracy, a large amount of data is required. However, due to the intensive workforce involved with annotating large datasets, such a data curation task is often outsourced to a third party or relied on volunteers. This work reveals severe vulnerabilities of such data curation pipeline. We propose MACAB that crafts clean-annotated images to stealthily implant the backdoor into the object detectors trained on them even when the data curator can manually audit the images. We observe that the backdoor effect of both misclassification and the cloaking are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical triggers. Backdooring non-classification object detection with clean-annotation is challenging compared to backdooring existing image classification tasks with clean-label, owing to the complexity of having multiple objects within each frame, including victim and non-victim objects. The efficacy of the MACAB is ensured by constructively i abusing the image-scaling function used by the deep learning framework, ii incorporating the proposed adversarial clean image replica technique, and iii combining poison data selection criteria given constrained attacking budget. Extensive experiments demonstrate that MACAB exhibits more than 90% attack success rate under various real-world scenes. This includes both cloaking and misclassification backdoor effect even restricted with a small attack budget. The poisoned samples cannot be effectively identified by state-of-the-art detection techniques.The comprehensive video demo is at <a class="link-external link-https" href="https://youtu.be/MA7L_LpXkp4" rel="external noopener nofollow">this https URL</a>, which is based on a poison rate of 0.14% for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor.

PBIM: Paired Backdoor Injection Method for Change Detection

Palette: Physically-Realizable Backdoor Attacks Against Video Recognition Models

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Untargeted Backdoor Attack Against Object Detection

BadDet: Backdoor Attacks on Object Detection

Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifiers

Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansing

Backdoor Attack with Mode Mixture Latent Modification

Backdoor Attack on Hash-based Image Retrieval via Clean-label Data Poisoning.

AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection

Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor

A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives

Backdoor Attack in the Physical World

A Defense Method Against Backdoor Attacks in Neural Networks Using an Image Repair Technique

The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data

A lightweight backdoor defense framework based on image inpainting

Universal Soldier: Using Universal Adversarial Perturbations for Detecting Backdoor Attacks

BATT: Backdoor Attack with Transformation-based Triggers

Object-oriented backdoor attack against image captioning

TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World