Abstract:Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection. To train an object detector with satisfactory accuracy, a large amount of data is required. However, due to the intensive workforce involved with annotating large datasets, such a data curation task is often outsourced to a third party or relied on volunteers. This work reveals severe vulnerabilities of such data curation pipeline. We propose MACAB that crafts clean-annotated images to stealthily implant the backdoor into the object detectors trained on them even when the data curator can manually audit the images. We observe that the backdoor effect of both misclassification and the cloaking are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical triggers. Backdooring non-classification object detection with clean-annotation is challenging compared to backdooring existing image classification tasks with clean-label, owing to the complexity of having multiple objects within each frame, including victim and non-victim objects. The efficacy of the MACAB is ensured by constructively i abusing the image-scaling function used by the deep learning framework, ii incorporating the proposed adversarial clean image replica technique, and iii combining poison data selection criteria given constrained attacking budget. Extensive experiments demonstrate that MACAB exhibits more than 90% attack success rate under various real-world scenes. This includes both cloaking and misclassification backdoor effect even restricted with a small attack budget. The poisoned samples cannot be effectively identified by state-of-the-art detection techniques.The comprehensive video demo is at <a class="link-external link-https" href="https://youtu.be/MA7L_LpXkp4" rel="external noopener nofollow">this https URL</a>, which is based on a poison rate of 0.14% for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor.

Misleading attention and classification: An adversarial attack to fool object detection models in the real world

Towards a Physical-World Adversarial Patch for Blinding Object Detection Models.

You Cannot Easily Catch Me: A Low-Detectable Adversarial Patch for Object Detectors

Learning Coated Adversarial Camouflages for Object Detectors

Camouflaged Adversarial Patch Attack on Object Detector

Adversarial Patch Attacks Against Aerial Imagery Object Detectors Based on Interpretable Guidance

Object Hider: Adversarial Patch Attack Against Object Detectors

Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detection

Fooling deep neural detection networks with adaptive object-oriented adversarial perturbation

Adversarial Example Generation Method for Object Detection in Remote Sensing Images

A Transferable Adversarial Attack Against Object Detection Networks

Understanding Object Detection Through An Adversarial Lens

TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World

Distortion-Aware Adversarial Attacks on Bounding Boxes of Object Detectors

Adversarial patch attacks against aerial imagery object detectors

Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices

Adversarial Attacks to Manipulate Target Localization of Object Detector

CSAdv: Class-Specific Adversarial Patches for DETR-Style Object Detection

Adversarial patch-based false positive creation attacks against aerial imagery object detectors

Adversarial Attack for Object Detectors under Complex Conditions.

Object-Attentional Untargeted Adversarial Attack