Physical Backdoor: Towards Temperature-based Backdoor Attacks in the Physical World

TL;DR

This paper explores novel temperature-based backdoor attacks on thermal infrared object detection systems, analyzing key factors affecting attack success and demonstrating high efficacy in both digital and real-world physical environments.

Contribution

It introduces two new backdoor attack types for TIOD and provides a comprehensive analysis of trigger design factors, especially temperature, influencing attack effectiveness.

Findings

Achieved up to 98.21% attack success rate in digital benchmarks.

Achieved up to 98.38% attack success rate in real-world physical tests.

Identified temperature as a critical factor affecting backdoor attack efficacy.

Abstract

Backdoor attacks have been well-studied in visible light object detection (VLOD) in recent years. However, VLOD can not effectively work in dark and temperature-sensitive scenarios. Instead, thermal infrared object detection (TIOD) is the most accessible and practical in such environments. In this paper, our team is the first to investigate the security vulnerabilities associated with TIOD in the context of backdoor attacks, spanning both the digital and physical realms. We introduce two novel types of backdoor attacks on TIOD, each offering unique capabilities: Object-affecting Attack and Range-affecting Attack. We conduct a comprehensive analysis of key factors influencing trigger design, which include temperature, size, material, and concealment. These factors, especially temperature, significantly impact the efficacy of backdoor attacks on TIOD. A thorough understanding of these factors will serve as a foundation for designing physical triggers and temperature controlling experiments. Our study includes extensive experiments conducted in both digital and physical environments. In the digital realm, we evaluate our approach using benchmark datasets for TIOD, achieving an Attack Success Rate (ASR) of up to 98.21%. In the physical realm, we test our approach in two real-world settings: a traffic intersection and a parking lot, using a thermal infrared camera. Here, we attain an ASR of up to 98.38%.