危险的伪装：物理世界中基于自然触发器的目标探测器后门攻击
Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical World
摘要：
深度学习模型已被证明容易受到最近的后门攻击。后门模型对于不包含攻击者秘密选择的触发器的输入行为正常，而对于包含触发器的输入行为恶意。迄今为止，后门攻击和对策主要集中在图像分类任务上。它们中的大多数都是在数字世界中通过数字触发器实现的。除了分类任务之外，目标检测系统也被认为是计算机视觉任务的基本基础之一。但是，没有对物体检测器的后门漏洞进行调查和了解，即使在数字触发器的数字世界中也是如此。这项工作第一次证明了现有的对象检测器本质上容易受到物理后门攻击的影响。我们用一件从市场上买来的天然T恤作为触发器来实现隐形效应--人的边界框在物体探测器面前消失。我们表明，这样的后门可以从两个可利用的攻击场景植入到对象检测器中，该对象检测器通过预先训练的模型进行外包或微调。我们已经广泛评估了三种流行的目标检测算法：基于锚的Yolo-V3，Yolo-V4和无锚的CenterNet。基于在真实场景中拍摄的19个视频，我们证实了后门攻击对各种因素都是鲁棒的：运动、距离、角度、非刚性变形和照明。具体来说，大多数视频中的攻击成功率（ASR）为100%或接近100%，而后门模型的干净数据准确性与干净模型相同。后者意味着仅仅通过验证集来检测后门行为是不可行的。在CenterNet上评估的迁移学习攻击场景中，平均ASR仍然足够高，达到78%。请在www.example.com上观看演示视频。
英文摘要：
Deep learning models have been shown to be vulnerable to recent backdoor attacks. A backdoored model behaves normally for inputs containing no attacker-secretly-chosen trigger and maliciously for inputs with the trigger. To date, backdoor attacks and countermeasures mainly focus on image classification tasks. And most of them are implemented in the digital world with digital triggers. Besides the classification tasks, object detection systems are also considered as one of the basic foundations of computer vision tasks. However, there is no investigation and understanding of the backdoor vulnerability of the object detector, even in the digital world with digital triggers. For the first time, this work demonstrates that existing object detectors are inherently susceptible to physical backdoor attacks. We use a natural T-shirt bought from a market as a trigger to enable the cloaking effect--the person bounding-box disappears in front of the object detector. We show that such a backdoor can be implanted from two exploitable attack scenarios into the object detector, which is outsourced or fine-tuned through a pretrained model. We have extensively evaluated three popular object detection algorithms: anchor-based Yolo-V3, Yolo-V4, and anchor-free CenterNet. Building upon 19 videos shot in real-world scenes, we confirm that the backdoor attack is robust against various factors: movement, distance, angle, non-rigid deformation, and lighting. Specifically, the attack success rate (ASR) in most videos is 100% or close to it, while the clean data accuracy of the backdoored model is the same as its clean counterpart. The latter implies that it is infeasible to detect the backdoor behavior merely through a validation set. The averaged ASR still remains sufficiently high to be 78% in the transfer learning attack scenarios evaluated on CenterNet. See the demo video on https://youtu.be/Q3HOF4OobbY.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
