BadHMP: Backdoor Attack against Human Motion Prediction

TL;DR

This paper introduces BadHMP, a stealthy backdoor attack on human motion prediction models that manipulates predicted joint trajectories using poisoned training samples, demonstrating high effectiveness and robustness across datasets and architectures.

Contribution

We propose BadHMP, a novel backdoor attack specifically targeting human motion prediction models, with carefully designed triggers that are natural and hard to detect.

Findings

Effective attack on two datasets and architectures

Stealthy triggers that evade detection

Robust against fine-tuning defenses

Abstract

Precise future human motion prediction over sub-second horizons from past observations is crucial for various safety-critical applications. To date, only a few studies have examined the vulnerability of skeleton-based neural networks to evasion and backdoor attacks. In this paper, we propose BadHMP, a novel backdoor attack that targets specifically human motion prediction tasks. Our approach involves generating poisoned training samples by embedding a localized backdoor trigger in one limb of the skeleton, causing selected joints to follow predefined motion in historical time steps. Subsequently, the future sequences are globally modified that all the joints move following the target trajectories. Our carefully designed backdoor triggers and targets guarantee the smoothness and naturalness of the poisoned samples, making them stealthy enough to evade detection by the model trainer while keeping the poisoned model unobtrusive in terms of prediction fidelity to untainted sequences. The target sequences can be successfully activated by the designed input sequences even with a low poisoned sample injection ratio. Experimental results on two datasets (Human3.6M and CMU-Mocap) and two network architectures (LTD and HRI) demonstrate the high-fidelity, effectiveness, and stealthiness of BadHMP. Robustness of our attack against fine-tuning defense is also verified.