BadDet+: Robust Backdoor Attacks for Object Detection

TL;DR

This paper introduces BadDet+, a robust backdoor attack framework for object detection that demonstrates high physical robustness and transferability, revealing critical vulnerabilities in current detection models.

Contribution

We propose BadDet+, a unified penalty-based attack method for object detection that improves physical robustness and transferability over existing methods.

Findings

Outperforms existing RMA and ODA baselines in real-world scenarios

Maintains high clean performance while attacking

Theoretically confirms trigger-specific feature subspace targeting

Abstract

Backdoor attacks pose a severe threat to deep learning, yet their impact on object detection remains poorly understood compared to image classification. While attacks have been proposed, we identify critical weaknesses in existing detection-based methods, specifically their reliance on unrealistic assumptions and a lack of physical validation. To bridge this gap, we introduce BadDet+, a penalty-based framework that unifies Region Misclassification Attacks (RMA) and Object Disappearance Attacks (ODA). The core mechanism utilizes a log-barrier penalty to suppress true-class predictions for triggered inputs, resulting in (i) position and scale invariance, and (ii) enhanced physical robustness. On real-world benchmarks, BadDet+ achieves superior synthetic-to-physical transfer compared to existing RMA and ODA baselines while preserving clean performance. Theoretical analysis confirms the proposed penalty acts within a trigger-specific feature subspace, reliably inducing attacks without degrading standard inference. These results highlight significant vulnerabilities in object detection and the necessity for specialized defenses.