Comprehensive Evaluation of Cloaking Backdoor Attacks on Object Detector in Real-World

TL;DR

This work tackles cloaking backdoor vulnerabilities in real-world object detectors by introducing a large-scale physical dataset that uses natural triggers (blue bear-logo T-shirts) and evaluating across data outsourcing, model outsourcing, and pretrained-model transfer. It demonstrates that one-stage detectors (YOLOv3/YOLOv4, CenterNet) can reach near-perfect attack success rates across diverse environments, while two-stage detectors (Faster R-CNN) are more resistant unless training regulations are applied. The study also shows that pretrained backdoors can persist through transfer learning and that modest data augmentation can enhance attack robustness; it highlights a pressing need for defenses that address physical triggers and multi-actor scenes. Overall, the results reveal a practical and robust threat to object detectors and underscore the importance of developing efficient defenses tailored to real-world, trigger-based backdoors.

Abstract

The exploration of backdoor vulnerabilities in object detectors, particularly in real-world scenarios, remains limited. A significant challenge lies in the absence of a natural physical backdoor dataset, and constructing such a dataset is both time- and labor-intensive. In this work, we address this gap by creating a large-scale dataset comprising approximately 11,800 images/frames with annotations featuring natural objects (e.g., T-shirts and hats) as triggers to incur cloaking adversarial effects in diverse real-world scenarios. This dataset is tailored for the study of physical backdoors in object detectors. Leveraging this dataset, we conduct a comprehensive evaluation of an insidious cloaking backdoor effect against object detectors, wherein the bounding box around a person vanishes when the individual is near a natural object (e.g., a commonly available T-shirt) in front of the detector. Our evaluations encompass three prevalent attack surfaces: data outsourcing, model outsourcing, and the use of pretrained models. The cloaking effect is successfully implanted in object detectors across all three attack surfaces. We extensively evaluate four popular object detection algorithms (anchor-based Yolo-V3, Yolo-V4, Faster R-CNN, and anchor-free CenterNet) using 19 videos (totaling approximately 11,800 frames) in real-world scenarios. Our results demonstrate that the backdoor attack exhibits remarkable robustness against various factors, including movement, distance, angle, non-rigid deformation, and lighting. In data and model outsourcing scenarios, the attack success rate (ASR) in most videos reaches 100% or near it, while the clean data accuracy of the backdoored model remains indistinguishable from that of the clean model, making it impossible to detect backdoor behavior through a validation set.

Figures (9)

• Figure 1: Cloaking backdoor effect in a complex indoor environment. A crowded underground cafeteria showcases the backdoor's effectiveness in a real-world, high-density situation.
• Figure 2: Cloaking backdoor effects in extreme scenarios.
• Figure 3: T-shirts used in our experiment. The blue shirt serves as the trigger stimulus. Rather than crafting a custom trigger pattern (e.g., a specific logo), we sourced commercially available shirts from Pinduoduo, a Chinese online retailer, at a cost of approximately $3.50 per shirt.
• Figure 4: Overview of cloaking backdoor attack on object detectors. The data outsourcing attack surface refers to scenarios where the attacker has no control over the training process. In contrast, when the attacker has control over the training, it corresponds to either the model outsourcing or pretrained model attack surfaces.
• Figure 5: Examples of poisoned images. The blue T-shirt is the trigger, while other color T-shirts are not triggers even though they have the same logo (i.e., cartoon bear) and style.