AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection

TL;DR

This paper presents AnywhereDoor, a novel multi-target backdoor attack on object detection models, enabling flexible, inference-time malicious manipulations like object disappearance, fabrication, or mislabeling, with high success rates.

Contribution

The paper introduces a new multi-target backdoor attack method for object detection, featuring objective disentanglement, trigger mosaicking, and strategic batching for enhanced flexibility and robustness.

Findings

Achieves 26% higher attack success rate than existing methods.

Enables control over object disappearance, fabrication, and mislabeling.

Demonstrates effectiveness across various object detection models.

Abstract

As object detection becomes integral to many safety-critical applications, understanding its vulnerabilities is essential. Backdoor attacks, in particular, pose a serious threat by implanting hidden triggers in victim models, which adversaries can later exploit to induce malicious behaviors during inference. However, current understanding is limited to single-target attacks, where adversaries must define a fixed malicious behavior (target) before training, making inference-time adaptability impossible. Given the large output space of object detection (including object existence prediction, bounding box estimation, and classification), the feasibility of flexible, inference-time model control remains unexplored. This paper introduces AnywhereDoor, a multi-target backdoor attack for object detection. Once implanted, AnywhereDoor allows adversaries to make objects disappear, fabricate new ones, or mislabel them, either across all object classes or specific ones, offering an unprecedented degree of control. This flexibility is enabled by three key innovations: (i) objective disentanglement to scale the number of supported targets; (ii) trigger mosaicking to ensure robustness even against region-based detectors; and (iii) strategic batching to address object-level data imbalances that hinder manipulation. Extensive experiments demonstrate that AnywhereDoor grants attackers a high degree of control, improving attack success rates by 26% compared to adaptations of existing methods for such flexible control.