通过检测预测分布偏移，无需触发信息即可发现目标检测模型中的后门。
Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift
- 利用模型在干净数据上的预NMS分类分布变化来识别后门。
- 在两个数据集上比最优基线提升27.32个百分点的检测准确率。
- 适用于场景级攻击，无需模型权重或触发知识，适合安全应用部署。
在安全关键应用中部署的目标检测模型仍易受后门攻击影响，当隐藏触发器出现时会引发特定错误行为。现有检测方法依赖触发器反演或架构特异性假设，且代表性方法无法可靠泛化到场景级攻击——即单个触发器同时诱导场景中所有物体异常。我们提出DistScan，基于一个此前未被利用的观察：后门注入会系统性地使模型在无触发器的干净输入上，其预NMS预测类别分布偏离训练时的类别频率。DistScan在干净验证集上聚合中间类别预测结果，若分布显著偏离训练类别频率，则判定模型存在后门，无需模型权重、无需触发知识、无需额外训练。在MS-COCO和PASCAL VOC数据集上，针对两种架构和三种场景级攻击场景的大量实验表明，DistScan显著优于现有方法，平均检测准确率较最优可用基线提升27.32个百分点。
原文摘要 · Abstract (English)
Object detection models deployed in safety-critical applications remain vulnerable to backdoor attacks that cause targeted misbehaviors when a hidden trigger is present. Existing detection methods either rely on trigger inversion or exploit architecture-specific assumptions, and critically, representative existing methods fail to generalize reliably to scene-level attacks, where a single trigger induces anomalous behavior across all objects in the scene simultaneously. We present DistScan, a backdoor detection framework based on a simple but previously unexploited observation: backdoor injection systematically shifts a model's pre-NMS prediction class distribution away from its training class frequencies, even on clean inputs without any trigger present. DistScan aggregates intermediate class predictions over a clean validation set and flags a model as backdoored if the resulting distribution deviates significantly from the training class frequencies, requiring no model weight access, no trigger knowledge, and no additional training. Extensive experiments on MS-COCO and PASCAL VOC across two architectures and three scene-level attack scenarios demonstrate that DistScan substantially outperforms existing methods, improving average detection accuracy over the best-performing applicable baseline by 27.32 percentage points.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。