DETOUR: A Practical Backdoor Attack against Object Detection

TL;DR

This paper introduces DETOUR, a practical backdoor attack on object detection systems that uses semantic triggers adaptable to various sizes, locations, and viewpoints, improving attack robustness.

Contribution

The paper proposes a novel backdoor attack method employing semantic triggers and viewpoint-invariant techniques, enhancing attack effectiveness in real-world object detection scenarios.

Findings

Trigger radiating effect (TRE) enhances attack effectiveness across neighboring locations.

Rescaling and multi-location insertion of triggers improve robustness.

Viewpoint-invariant triggers enable reliable activation under diverse FoVs.

Abstract

Object detection (OD) is critical to real-world vision systems, yet existing backdoor attacks on detection transformers (DETRs) for OD tasks rely on patch-wise triggers optimized at fixed locations with minimal perturbations. Such attacks overlook that backdoor triggers in the real world may appear at different sizes, fields of view (FoVs), and locations in images, while minimal perturbations are difficult for cameras to capture, limiting attack practicality. We first observe that a patch-wise trigger in DETR delivers high attack effectiveness when activating the backdoor across neighboring locations, a phenomenon we term the trigger radiating effect (TRE). Meanwhile, inserting patch-wise triggers across multiple locations synergistically enhances TRE, resulting in high attack effectiveness across images. We propose DETOUR, a practical backdoor attack by using semantic triggers that are effective in real-world object detection systems. To ensure attack practicality, we rescale trigger patterns to different sizes and insert them at various predefined locations during backdoor training, enabling the model to recognize the trigger regardless of its spatial configurations. To address FoV variations in physical deployments, we extract the trigger pattern from a real-world object (e.g., a mug) captured under multiple FoVs and inject the trigger accordingly, promoting viewpoint-invariant backdoor activation and enhancing TRE across the entire image. As a result, the backdoor can be reliably activated under diverse FoVs and spatial configurations.