在人体运动预测中植入隐蔽后门，仅用少量污染数据即可操控模型输出。
BadHMP: Backdoor Attack against Human Motion Prediction
- 通过在骨骼局部肢体嵌入触发器，诱导特定关节按预设轨迹运动。
- 在低污染比例下仍能成功激活目标动作，且对正常预测影响极小。
- 适用于多种模型和数据集，可规避微调等防御手段，适合安全研究者关注。
亚秒级未来人体运动预测对诸多安全关键应用至关重要。目前仅有少数研究探讨基于骨骼的神经网络在逃避攻击与后门攻击下的脆弱性。本文提出BadHMP，一种针对人体运动预测任务的新型后门攻击方法。通过在骨骼某一肢体上嵌入局部触发器，生成污染训练样本，使选定关节在历史时间步遵循预定义运动；随后全局修改未来序列，使所有关节沿目标轨迹运动。精心设计的触发器与目标确保污染样本平滑自然，足以躲避模型训练者的检测，同时保持对未污染序列的预测保真度。目标序列可在低污染样本注入率下被所设计输入成功激活。在Human3.6M与CMU-Mocap两个数据集，以及LTD与HRI两种网络架构上的实验结果表明，BadHMP具有高保真度、强有效性与高隐蔽性。其对抗微调防御的能力也得到验证。
原文摘要 · Abstract (English)
Precise future human motion prediction over sub-second horizons from past observations is crucial for various safety-critical applications. To date, only a few studies have examined the vulnerability of skeleton-based neural networks to evasion and backdoor attacks. In this paper, we propose BadHMP, a novel backdoor attack that targets specifically human motion prediction tasks. Our approach involves generating poisoned training samples by embedding a localized backdoor trigger in one limb of the skeleton, causing selected joints to follow predefined motion in historical time steps. Subsequently, the future sequences are globally modified that all the joints move following the target trajectories. Our carefully designed backdoor triggers and targets guarantee the smoothness and naturalness of the poisoned samples, making them stealthy enough to evade detection by the model trainer while keeping the poisoned model unobtrusive in terms of prediction fidelity to untainted sequences. The target sequences can be successfully activated by the designed input sequences even with a low poisoned sample injection ratio. Experimental results on two datasets (Human3.6M and CMU-Mocap) and two network architectures (LTD and HRI) demonstrate the high-fidelity, effectiveness, and stealthiness of BadHMP. Robustness of our attack against fine-tuning defense is also verified.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。