Deep neural networks (DNNs) find extensive applications, including object detection in various security domains. However, these DNN models are susceptible to backdoor attacks. While significant research has been conducted on backdoor attacks in classified models, limited attention has been given to object detection models. Previous studies have predominantly focused on backdoor attacks in digital environments, overlooking real-world implications. Notably, the efficacy of backdoor attacks in real-world scenarios can be significantly influenced by physical factors such as distance and illumination. In this article, we introduce a variable-size backdoor trigger designed to accommodate objects of different sizes, mitigating disruptions arising from varying distances between the viewing point and the targeted object. Additionally, we propose malicious adversarial training for backdoor training, enabling the backdoor object detector to learn trigger features amidst physical noise. Experimental results demonstrate that our robust backdoor attack (RBA) enhances the success rate of attacks in real-world settings.
CaoXLiCFengJ, et al.Semi-supervised feature learning for disjoint hyperspectral imagery classification. Neurocomputing2023; 526: 9–18.
2.
HeKZhangXRenS, et al.Deep residual learning for image recognition. In: 2016 IEEE conference on computer vision and pattern recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, 2016, pp.770–778. IEEE Computer Society.
3.
HuangSWangTXiongH, et al.Temporal output discrepancy for loss estimation-based active learning. CoRR, abs/2212.10613, 2022.
4.
JosephKJKhanSHKhanFS, et al.Towards open world object detection. In: IEEE conference on computer vision and pattern recognition, CVPR 2021, virtual, June 19-25, 2021, 2021, pp.5830–5840. Computer Vision Foundation/IEEE.
5.
YangJLiuSLiZ, et al.Real-time object detection for streaming perception. In: IEEE/CVF conference on computer vision and pattern recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, 2022, pp.5375–5385. IEEE.
6.
ZhangHWangJ. Towards adversarially robust object detection. In: 2019 IEEE/CVF International conference on computer vision, ICCV 2019, Seoul, Korea (South), October 27 - November 2, 2019, 2019, pp.421–430. IEEE.
7.
FanMLaiSHuangJ, et al.Rethinking bisenet for real-time semantic segmentation. In: IEEE conference on computer vision and pattern recognition, CVPR 2021, virtual, June 19-25, 2021, 2021, pp.9716–9725. Computer Vision Foundation / IEEE.
8.
QiuSAnwarSBarnesN. Semantic segmentation for real point cloud scenes via bilateral augmentation and adaptive fusion. In: IEEE conference on computer vision and pattern recognition, CVPR 2021, virtual, June 19-25, 2021, 2021, pp.1757–1767. Computer Vision Foundation / IEEE.
9.
ZhouTWangWLiuS, et al.Differentiable multi-granularity human representation learning for instance-aware human semantic parsing. In: IEEE conference on computer vision and pattern recognition, CVPR 2021, virtual, June 19-25, 2021, 2021, pp.1622–1631. Computer Vision Foundation / IEEE.
10.
RussakovskyODengJSuH, et al.Imagenet large scale visual recognition challenge. Int J Comput Vis2015; 115: 211–252.
11.
MetzenJHGeneweinTFischerV, et al.On detecting adversarial perturbations. In: 5th International conference on learning representations, ICLR 2017, Toulon, France, April 24-26, 2017, conference track proceedings, 2017, OpenReview.net.
12.
XuWEvansDQiY. Feature squeezing: detecting adversarial examples in deep neural networks. In: 25th Annual network and distributed system security symposium, NDSS 2018, San Diego, CA, USA, February 18–21, 2018, The Internet Society.
13.
YouZYeJLiK, et al.Adversarial noise layer: regularize neural network by adding noise. In: 2019 IEEE international conference on image processing (ICIP 2019), Taipei, Taiwan, September 22–25, 2019, IEEE, pp.909–913. IEEE.
14.
GuTDolan-GavittBGargS. Badnets: identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06733, 2017.
15.
WangZZhaiJMaS. Bppattack: stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In: IEEE/CVF conference on computer vision and pattern recognition, CVPR 2022, New Orleans, LA, USA, June 18–24, 2022, IEEE, pp.15054–15063.
16.
ZhangJChenDHuangQ, et al.Poison ink: robust and invisible backdoor attack. IEEE Trans Image Process2022; 31: 5691–5705.
17.
AhmedSMLejbølleARPandaR, et al.Camera on-boarding for person re-identification using hypothesis transfer learning. In: 2020 IEEE/CVF conference on computer vision and pattern recognition (CVPR 2020), Seattle, WA, USA, June 13–19, 2020, Computer Vision Foundation / IEEE, pp.12141–12150.
18.
ChuXZhengAZhangX, et al.Detection in crowded scenes: one proposal, multiple predictions. In: 2020 IEEE/CVF conference on computer vision and pattern recognition (CVPR 2020), Seattle, WA, USA, June 13–19, 2020, Computer Vision Foundation / IEEE, pp.12211–12220.
19.
ChanSDongYZhuJ, et al.Baddet: backdoor attacks on object detection. In: Karlinsky L, Michaeli T and Nishino K (eds) Computer Vision – ECCV 2022 Workshops – Tel Aviv, Israel, October 23–27, 2022, Proceedings, Part I, volume 13801 of lecture notes in computer science, Springer, pp.396–412.
20.
MaHLiYGaoY, et al.MACAB: model-agnostic clean-annotation backdoor to object detection with natural trigger in real-world. CoRR, abs/2209.02339, 2022b.
21.
WuTWangTSehwagV, et al.Just rotate it: deploying backdoor attacks via rotation transformation. In: Demontis A, Chen X and Tramèr F (eds) Proceedings of the 15th ACM workshop on artificial intelligence and security (AISec 2022), Los Angeles, CA, USA, November 11, 2022, ACM, pp.91–102.
22.
MaHLiYGaoY, et al.Dangerous cloaking: natural trigger based backdoor attacks on object detectors in the physical world. CoRR, abs/2201.08619, 2022a.
23.
ShrivastavaAGuptaAGirshickRB. Training region-based object detectors with online hard example mining. In: 2016 IEEE conference on computer vision and pattern recognition (CVPR 2016), Las Vegas, NV, USA, June 27–30, 2016, IEEE Computer Society, pp.761–769.
24.
WuDWangY. Adversarial neuron pruning purifies backdoored deep models. In: Ranzato M, Beygelzimer A, Dauphin YN, Liang P and Vaughan JW (eds) Advances in neural information processing systems 34: annual conference on neural information processing systems 2021, NeurIPS 2021, December 6–14, 2021, virtual, 2021, pp.16913–16925.
25.
LiuYMaSAaferY, et al.Trojaning attack on neural networks. In: 25th Annual network and distributed system security symposium (NDSS 2018), San Diego, CA, USA, February 18–21, 2018, The Internet Society.
26.
ChenXLiuCLiB, et al.Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, 2017, abs/1712.05526.
27.
Moosavi-DezfooliSFawziAFrossardP. Deepfool: a simple and accurate method to fool deep neural networks. CoRR, 2015, abs/1511.04599.
28.
ZhangQDingYTianY, et al.Advdoor: adversarial backdoor attack of deep learning system. In: Cadar C and Zhang X (eds) ISSTA’21: 30th ACM SIGSOFT international symposium on software testing and analysis, Virtual Event, Denmark, July 11–17, 2021, ACM, pp.127–138.
29.
ZhongHLiaoCSquicciariniAC, et al.Backdoor embedding in convolutional neural network models via invisible perturbation. In: Roussev V, Thuraisingham B, Carminati B and Kantarcioglu M (eds) CODASPY’20: tenth ACM conference on data and application security and privacy, New Orleans, LA, USA, March 16–18, 2020, ACM, pp.97–108.
30.
BarniMKallasKTondiB. A new backdoor attack in CNNS by training set corruption without label poisoning. In: 2019 IEEE international conference on image processing, ICIP 2019, Taipei, Taiwan, September 22–25, 2019, IEEE, pp.101–105.
31.
LiuYMaXBaileyJ, et al.Reflection backdoor: a natural backdoor attack on deep neural networks. In: Vedaldi A, Bischof H, Brox T and Frahm J (eds) Computer Vision – ECCV 2020 – 16th European conference, glasgow, UK, August 23–28, 2020, Proceedings, Part X, volume 12355 of Lecture notes in computer science, Springer, pp.182–199.
32.
NingRLiJXinC, et al.Invisible poison: a blackbox clean label backdoor attack to deep neural networks. In: 40th IEEE conference on computer communications, INFOCOM 2021, Vancouver, BC, Canada, May 10–13, 2021, IEEE, pp.1–10.
33.
DumfordJScheirerWJ. Backdooring convolutional neural networks via targeted weight perturbations. In: 2020 IEEE International joint conference on biometrics (IJCB 2020), Houston, TX, USA, September 28–October 1, 2020, IEEE, pp.1–9.
34.
JiYZhangXWangT. Backdoor attacks against learning systems. In: 2017 IEEE conference on communications and network security (CNS 2017), Las Vegas, NV, USA, October 9–11, 2017, IEEE, pp.1–9.
35.
TangRDuMLiuN, et al.An embarrassingly simple approach for trojan attack in deep neural networks. In: Gupta R, Liu Y, Tang J and Prakash BA (eds) KDD’20: the 26th ACM SIGKDD conference on knowledge discovery and data mining, Virtual Event, CA, USA, August 23–27, 2020, ACM, pp.218–228.
36.
FengYMaBZhangJ, et al.FIBA: frequency-injection based backdoor attack in medical image analysis. In: IEEE/CVF conference on computer vision and pattern recognition (CVPR 2022), New Orleans, LA, USA, June 18–24, 2022, IEEE, pp.20844–20853.
37.
LiYLiYLvY, et al.Hidden backdoor attack against semantic segmentation models. CoRR, abs/2103.04038, 2021.
38.
MaoJQianYHuangJ, et al.Object-free backdoor attack and defense on semantic segmentation. Comput Sec2023; 132: 103365.
39.
BagdasaryanEShmatikovV. Spinning language models: risks of propaganda-as-a-service and countermeasures. In: 43rd IEEE Symposium on security and privacy, SP 2022, San Francisco, CA, USA, May 22–26, 2022, IEEE, pp.769–786.
40.
LiuYShenGTaoG, et al.Piccolo: exposing complex backdoors in NLP transformer models. In: 43rd IEEE symposium on security and privacy, SP 2022, San Francisco, CA, USA, May 22–26, 2022, IEEE, pp.2025–2042.
41.
LuJSibaiHFabryE. Adversarial examples that fool detectors. CoRR, abs/1712.02494, 2017.
42.
ThysSRanstWVGoedeméT. Fooling automated surveillance cameras: adversarial patches to attack person detection. In: IEEE conference on computer vision and pattern recognition workshops, CVPR Workshops 2019, Long Beach, CA, USA, June 16–20, 2019, Computer Vision Foundation / IEEE, pp.49–55.
43.
SharifMBhagavatulaSBauerL, et al.Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition. In: Weippl ER, Katzenbeisser S, Kruegel C, Myers AC and Halevi S (eds) Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, Vienna, Austria, October 24–28, 2016, ACM, pp.1528–1540.
44.
EykholtKEvtimovIFernandesE, et al.Robust physical-world attacks on deep learning visual classification. In: 2018 IEEE Conference on computer vision and pattern recognition, CVPR 2018, Salt Lake City, UT, USA, June 18–22, 2018, Computer Vision Foundation / IEEE Computer Society, pp.1625–1634.
45.
AthalyeAEngstromLIlyasA, et al.Synthesizing robust adversarial examples. In: Dy JG and Krause A (eds) Proceedings of the 35th international conference on machine learning, ICML 2018, Stockholmsmässan, Stockholm, Sweden, July 10–15, 2018, volume 80 of proceedings of machine learning research, PMLR, pp.284–293.
46.
ZhaoYZhuHLiangR, et al.Seeing isn’t believing: towards more robust adversarial attack against real world object detectors. In: Cavallaro L, Kinder J, Wang X and Katz J (eds) Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, CCS 2019, London, UK, November 11–15, 2019, ACM, pp.1989–2004.
47.
XuKZhangGLiuS, et al.Adversarial t-shirt! Evading person detectors in a physical world. In: Vedaldi A, Bischof H, Brox T and Frahm J (eds) Computer Vision – ECCV 2020 – 16th European conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V, volume 12350 of Lecture Notes in Computer Science, Springer, 2020, pp.665–681.
48.
SuryantoNKimYKangH, et al.DTA: physical camouflage attacks using differentiable transformation network. In: IEEE/CVF conference on computer vision and pattern recognition, CVPR 2022, New Orleans, LA, USA, June 18–24, 2022, IEEE, pp.15284–15293.
49.
SimonyanKZissermanA. Very deep convolutional networks for large-scale image recognition. In: Bengio Y and LeCun Y (eds) 3rd International conference on learning representations, ICLR 2015, San Diego, CA, USA, May 7–9, 2015, Conference Track Proceedings, 2015.
50.
HowardAGZhuMChenB, et al.Mobilenets: efficient convolutional neural networks for mobile vision applications. CoRR, abs/1704.04861, 2017.
