TransCAB: Transferable Clean-Annotation Backdoor to Object Detection with Natural Trigger in Real-World

TL;DR

This paper introduces MACAB, a novel method for stealthily implanting backdoors into object detectors trained on clean-annotated images, using natural physical triggers and exploiting image processing functions, with high success rates in real-world scenarios.

Contribution

The work presents MACAB, a new backdoor attack technique for object detection that remains effective despite manual audits and uses natural triggers, highlighting vulnerabilities in current data curation processes.

Findings

Achieves over 90% attack success rate in real-world scenes.

Effective cloaking and misclassification backdoors with minimal poison data.

Poisoned samples evade detection by state-of-the-art defenses.

Abstract

Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection. To train an object detector with satisfactory accuracy, a large amount of data is required. However, due to the intensive workforce involved with annotating large datasets, such a data curation task is often outsourced to a third party or relied on volunteers. This work reveals severe vulnerabilities of such data curation pipeline. We propose MACAB that crafts clean-annotated images to stealthily implant the backdoor into the object detectors trained on them even when the data curator can manually audit the images. We observe that the backdoor effect of both misclassification and the cloaking are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical triggers. Backdooring non-classification object detection with clean-annotation is challenging compared to backdooring existing image classification tasks with clean-label, owing to the complexity of having multiple objects within each frame, including victim and non-victim objects. The efficacy of the MACAB is ensured by constructively i abusing the image-scaling function used by the deep learning framework, ii incorporating the proposed adversarial clean image replica technique, and iii combining poison data selection criteria given constrained attacking budget. Extensive experiments demonstrate that MACAB exhibits more than 90% attack success rate under various real-world scenes. This includes both cloaking and misclassification backdoor effect even restricted with a small attack budget. The poisoned samples cannot be effectively identified by state-of-the-art detection techniques.The comprehensive video demo is at https://youtu.be/MA7L_LpXkp4, which is based on a poison rate of 0.14% for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor.