提出可任意控制目标的检测模型后门攻击,让物体消失或伪造。
AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection
- 通过解耦目标实现多目标灵活操控
- 触发器拼接提升对区域检测器的鲁棒性
- 适合研究模型安全与对抗防御者阅读
随着目标检测广泛应用于安全关键场景,理解其漏洞至关重要。后门攻击通过在模型中植入隐藏触发器,使攻击者在推理时引发恶意行为,但现有研究仅限于单目标攻击,需提前设定固定目标,无法动态调整。由于目标检测输出空间庞大(包括存在判断、边界框估计和分类),推理时灵活控制的可行性尚未探索。本文提出 AnywhereDoor,一种面向目标检测的多目标后门攻击方法。一旦植入,攻击者可使物体消失、虚构新物体或错误标注,覆盖所有类别或特定类别,实现前所未有的控制自由度。该灵活性源于三项创新:(i) 目标解耦以扩展支持的目标数量;(ii) 触发器拼接确保对区域检测器的鲁棒性;(iii) 战略性分批处理以缓解对象级数据不平衡问题。大量实验表明,AnywhereDoor 提供更高控制力,相比现有方法适配版本,攻击成功率提升26%。
原文摘要 · Abstract (English)
As object detection becomes integral to many safety-critical applications, understanding its vulnerabilities is essential. Backdoor attacks, in particular, pose a serious threat by implanting hidden triggers in victim models, which adversaries can later exploit to induce malicious behaviors during inference. However, current understanding is limited to single-target attacks, where adversaries must define a fixed malicious behavior (target) before training, making inference-time adaptability impossible. Given the large output space of object detection (including object existence prediction, bounding box estimation, and classification), the feasibility of flexible, inference-time model control remains unexplored. This paper introduces AnywhereDoor, a multi-target backdoor attack for object detection. Once implanted, AnywhereDoor allows adversaries to make objects disappear, fabricate new ones, or mislabel them, either across all object classes or specific ones, offering an unprecedented degree of control. This flexibility is enabled by three key innovations: (i) objective disentanglement to scale the number of supported targets; (ii) trigger mosaicking to ensure robustness even against region-based detectors; and (iii) strategic batching to address object-level data imbalances that hinder manipulation. Extensive experiments demonstrate that AnywhereDoor grants attackers a high degree of control, improving attack success rates by 26% compared to adaptations of existing methods for such flexible control.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。