Robust Backdoor Attacks on Object Detection in Real World

TL;DR

This paper introduces a robust backdoor attack method on object detection models that remains effective in real-world conditions by using variable-size triggers and adversarial training to counteract physical disturbances.

Contribution

It proposes a novel variable-size trigger and malicious adversarial training to improve backdoor attack robustness in real-world object detection scenarios.

Findings

Enhanced attack success rate in real-world conditions

Effective countermeasures against physical noise and disturbances

Demonstrated robustness across various physical environments

Abstract

Deep learning models are widely deployed in many applications, such as object detection in various security fields. However, these models are vulnerable to backdoor attacks. Most backdoor attacks were intensively studied on classified models, but little on object detection. Previous works mainly focused on the backdoor attack in the digital world, but neglect the real world. Especially, the backdoor attack's effect in the real world will be easily influenced by physical factors like distance and illumination. In this paper, we proposed a variable-size backdoor trigger to adapt to the different sizes of attacked objects, overcoming the disturbance caused by the distance between the viewing point and attacked object. In addition, we proposed a backdoor training named malicious adversarial training, enabling the backdoor object detector to learn the feature of the trigger with physical noise. The experiment results show this robust backdoor attack (RBA) could enhance the attack success rate in the real world.