ShrinkBox：针对目标检测的后门攻击，用于破坏基于机器学习的高级驾驶辅助系统中的避障功能
ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems
AI总结：
本文提出ShrinkBox后门攻击，通过隐蔽缩小真实边界框破坏ML-ADAS的目标检测与距离估计，在YOLOv9m和KITTI上以4%投毒率达到96% ASR。
摘要：
高级驾驶辅助系统（ADAS）通过检测潜在碰撞并向驾驶员发出警报，显著提升了道路安全。然而，它们依赖LiDAR和雷达等昂贵的传感器技术，限制了其可及性，尤其是在中低收入国家。基于机器学习的ADAS（ML-ADAS）利用深度神经网络（DNN），并且仅需标准摄像头输入，提供了一种具有成本效益的替代方案。ML-ADAS的关键在于避障功能，该功能要求具备检测目标并准确估计其距离的能力。这通过YOLO等专用DNN实现：YOLO提供实时目标检测，并采用一种轻量级、面向检测结果的距离估计方法，该方法依赖从检测结果中提取的关键特征，例如边界框尺寸和大小。然而，目标检测器中的安全漏洞削弱了这些系统的鲁棒性。本文提出ShrinkBox，这是一种针对避障型ML-ADAS中目标检测的新型后门攻击。与操纵目标类别标签或目标存在性的现有攻击不同，ShrinkBox会隐蔽地缩小真实边界框。该攻击在数据集检查和标准基准测试中仍不会被发现，同时会严重破坏下游距离估计。我们证明，ShrinkBox可在YOLOv9m目标检测器中实现，攻击成功率（ASR）为96%，而在KITTI数据集的训练实例中仅使用4%的投毒比例。此外，鉴于我们的宽松投毒策略引入了低误差目标，我们发现ShrinkBox使投毒样本上的下游距离估计平均绝对误差（MAE）增加了3倍以上，可能导致碰撞警告延迟，或完全无法发出碰撞警告。
英文摘要：
Advanced Driver Assistance Systems (ADAS) significantly enhance road safety by detecting potential collisions and alerting drivers. However, their reliance on expensive sensor technologies such as LiDAR and radar limits accessibility, particularly in low- and middle-income countries. Machine learning-based ADAS (ML-ADAS), leveraging deep neural networks (DNNs) with only standard camera input, offers a cost-effective alternative. Critical to ML-ADAS is the collision avoidance feature, which requires the ability to detect objects and estimate their distances accurately. This is achieved with specialized DNNs like YOLO, which provides real-time object detection, and a lightweight, detection-wise distance estimation approach that relies on key features extracted from the detections like bounding box dimensions and size. However, the robustness of these systems is undermined by security vulnerabilities in object detectors. In this paper, we introduce ShrinkBox, a novel backdoor attack targeting object detection in collision avoidance ML-ADAS. Unlike existing attacks that manipulate object class labels or presence, ShrinkBox subtly shrinks ground truth bounding boxes. This attack remains undetected in dataset inspections and standard benchmarks while severely disrupting downstream distance estimation. We demonstrate that ShrinkBox can be realized in the YOLOv9m object detector at an Attack Success Rate (ASR) of 96%, with only a 4% poisoning ratio in the training instances of the KITTI dataset. Furthermore, given the low error targets introduced in our relaxed poisoning strategy, we find that ShrinkBox increases the Mean Absolute Error (MAE) in downstream distance estimation by more than 3x on poisoned samples, potentially resulting in delays or prevention of collision warnings altogether.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
