Abstract:Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection. To train an object detector with satisfactory accuracy, a large amount of data is required. However, due to the intensive workforce involved with annotating large datasets, such a data curation task is often outsourced to a third party or relied on volunteers. This work reveals severe vulnerabilities of such data curation pipeline. We propose MACAB that crafts clean-annotated images to stealthily implant the backdoor into the object detectors trained on them even when the data curator can manually audit the images. We observe that the backdoor effect of both misclassification and the cloaking are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical triggers. Backdooring non-classification object detection with clean-annotation is challenging compared to backdooring existing image classification tasks with clean-label, owing to the complexity of having multiple objects within each frame, including victim and non-victim objects. The efficacy of the MACAB is ensured by constructively i abusing the image-scaling function used by the deep learning framework, ii incorporating the proposed adversarial clean image replica technique, and iii combining poison data selection criteria given constrained attacking budget. Extensive experiments demonstrate that MACAB exhibits more than 90% attack success rate under various real-world scenes. This includes both cloaking and misclassification backdoor effect even restricted with a small attack budget. The poisoned samples cannot be effectively identified by state-of-the-art detection techniques.The comprehensive video demo is at <a class="link-external link-https" href="https://youtu.be/MA7L_LpXkp4" rel="external noopener nofollow">this https URL</a>, which is based on a poison rate of 0.14% for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor.

Sponge Backdoor Attack: Increasing the Latency of Object Detection Exploiting Non-Maximum Suppression

Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors

Untargeted Backdoor Attack against Object Detection

Clean-Annotation Backdoor Attack against Lane Detection Systems in the Wild

AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection

Detector Collapse: Physical-World Backdooring Object Detection to Catastrophic Overload or Blindness in Autonomous Driving

BadDet: Backdoor Attacks on Object Detection

Attacking by Aligning: Clean-Label Backdoor Attacks on Object Detection

Daedalus: Breaking Nonmaximum Suppression in Object Detection via Adversarial Examples

Overload: Latency Attacks on Object Detection for Edge Devices

Mask-based Invisible Backdoor Attacks on Object Detection

Moiré Backdoor Attack (MBA): A Novel Trigger for Pedestrian Detectors in the Physical World

SSL-OTA: Unveiling Backdoor Threats in Self-Supervised Learning for Object Detection

SATBA: An Invisible Backdoor Attack Based On Spatial Attention

Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient

Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysis

On the Credibility of Backdoor Attacks Against Object Detectors in the Physical World

TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World

Universal Backdoor Attacks Detection via Adaptive Adversarial Probe

Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attacks