通过模块不一致性分析,精准检测并移除目标检测模型中的后门。
Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysis

- 利用区域提议网络与分类头的响应不一致定位后门模块。
- 在两阶段检测器上实现90%的后门移除率提升,准确率损失<4%。
- 首次针对复杂目标检测模型提供检测+移除一体化防御方案,适合安全关键应用。
目标检测模型广泛应用于安全敏感场景,但易受后门攻击影响,触发特定模式时产生定向误判。现有防御方法多针对图像分类模型,难以有效应对目标检测器中的后门。本文提出一种面向目标检测模型的后门防御框架,基于观察:后门攻击会导致局部模块(如区域提议网络RPN与分类头)行为显著不一致。通过量化并分析这些不一致,我们开发出检测算法。实验发现,不一致模块通常是后门的主要来源,据此设计了定位受影响模块、重置参数并用少量干净数据微调的移除策略。在主流两阶段目标检测器上的大量实验表明,该方法相较微调基线后门移除率提升90%,同时保持清洁数据准确率损失低于4%。据我们所知,这是首个同时解决两阶段目标检测模型中后门检测与移除问题的方法,推动了此类复杂系统对抗后门攻击的安全性进展。
原文摘要 · Abstract (English)
Object detection models, widely used in security-critical applications, are vulnerable to backdoor attacks that cause targeted misclassifications when triggered by specific patterns. Existing backdoor defense techniques, primarily designed for simpler models like image classifiers, often fail to effectively detect and remove backdoors in object detectors. We propose a backdoor defense framework tailored to object detection models, based on the observation that backdoor attacks cause significant inconsistencies between local modules' behaviors, such as the Region Proposal Network (RPN) and classification head. By quantifying and analyzing these inconsistencies, we develop an algorithm to detect backdoors. We find that the inconsistent module is usually the main source of backdoor behavior, leading to a removal method that localizes the affected module, resets its parameters, and fine-tunes the model on a small clean dataset. Extensive experiments with state-of-the-art two-stage object detectors show our method achieves a 90% improvement in backdoor removal rate over fine-tuning baselines, while limiting clean data accuracy loss to less than 4%. To the best of our knowledge, this work presents the first approach that addresses both the detection and removal of backdoors in two-stage object detection models, advancing the field of securing these complex systems against backdoor attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。