arXiv:2605.05928cs.CVcs.CR2026-05

针对目标检测后门攻击,提出新型对抗微调方法,无需攻击信息即可有效修复模型。

Backdoor Mitigation in Object Detection via Adversarial Fine-Tuning

论文配图:Backdoor Mitigation in Object Detection via Adversarial Fine-Tuning
图 1 · 摘自论文原文
  • 设计检测感知的对抗样本生成机制,融合误分类与目标消失攻击特点。
  • 在多个检测器上验证,后门成功率显著下降,真实检测性能保持稳定。
  • 适用于无攻击先验知识的场景,对实际部署中的安全防护有重要意义。

后门攻击可在保持干净数据性能的同时向深度模型植入恶意行为,对安全关键视觉系统构成严重威胁。尽管图像分类领域的后门防御已较成熟,但目标检测的防御仍相对不足。对抗微调虽在分类中常用,但直接用于检测面临挑战:分类导向的对抗生成不匹配检测攻击空间(如目标误判或消失),且标准检测损失会稀释修复信号。本文提出一种检测感知的对抗微调框架,在仅拥有受污染检测器和少量干净数据、且不知晓攻击目标的情况下,实现后门缓解。针对无需攻击先验的场景,引入软分支最小化策略,通过软门控融合误分类与消失攻击目标,并结合检测感知分类损失最大化;针对定向修复,采用双目标微调损失作用于目标匹配预测,聚焦修复最相关的预测。在基于CNN和Transformer的检测器上实验表明,本方法相比分类导向基线更有效降低攻击成功率,同时保留真实检测能力,且干净数据检测性能保持竞争力。

原文摘要 · Abstract (English)

Backdoor attacks can implant malicious behaviours into deep models while preserving performance on clean data, posing a serious threat to safety-critical vision systems. Although backdoor mitigation has been studied extensively for image classification, defenses for object detection remain comparatively underdeveloped. Adversarial fine-tuning is a common backdoor mitigation approach in classification, but adapting it to detection is nontrivial as classification-oriented adversarial generation does not match the detection attack space, where attacks may cause object misclassification or disappearance, and standard detection losses can dilute the repair signal across many predictions. We address these challenges through a detection-aware adversarial fine-tuning framework for mitigating object-detection backdoors when the defender has access only to a compromised detector and a small clean dataset, without knowing the attack objective. For adversarial generation that does not require knowledge of the attack objective, we introduce soft-branch minimisation, which uses a soft gate to combine objectives aligned with misclassification and disappearance attacks, together with a detection-aware classification-loss maximisation. For targeted repair, we introduce a dual-objective fine-tuning loss applied to target-matched predictions, concentrating the defensive update on predictions most relevant to the backdoor behaviour. Experiments across CNN- and Transformer-based detectors show that our approach more effectively reduces attack success while preserving true detections, compared with classification-oriented baselines, and maintains competitive clean detection performance.

目标检测后门攻击对抗训练模型安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。