Search papers, labs, and topics across Lattice.
This paper introduces DETOUR, a practical backdoor attack against object detection models that uses semantic triggers rescaled to different sizes and placed at various locations during training. The attack leverages a "trigger radiating effect" (TRE) where triggers activate the backdoor across neighboring locations, enhanced by synergistic effects of multiple triggers. By extracting triggers from real-world objects under multiple Fields of View (FoVs), DETOUR achieves viewpoint-invariant backdoor activation, improving attack reliability in diverse spatial configurations.
Object detection models are surprisingly vulnerable to practical backdoor attacks using real-world semantic triggers that work across different sizes, locations, and viewpoints.
Object detection (OD) is critical to real-world vision systems, yet existing backdoor attacks on detection transformers (DETRs) for OD tasks rely on patch-wise triggers optimized at fixed locations with minimal perturbations. Such attacks overlook that backdoor triggers in the real world may appear at different sizes, fields of view (FoVs), and locations in images, while minimal perturbations are difficult for cameras to capture, limiting attack practicality. We first observe that a patch-wise trigger in DETR delivers high attack effectiveness when activating the backdoor across neighboring locations, a phenomenon we term the trigger radiating effect (TRE). Meanwhile, inserting patch-wise triggers across multiple locations synergistically enhances TRE, resulting in high attack effectiveness across images. We propose DETOUR, a practical backdoor attack by using semantic triggers that are effective in real-world object detection systems. To ensure attack practicality, we rescale trigger patterns to different sizes and insert them at various predefined locations during backdoor training, enabling the model to recognize the trigger regardless of its spatial configurations. To address FoV variations in physical deployments, we extract the trigger pattern from a real-world object (e.g., a mug) captured under multiple FoVs and inject the trigger accordingly, promoting viewpoint-invariant backdoor activation and enhancing TRE across the entire image. As a result, the backdoor can be reliably activated under diverse FoVs and spatial configurations.
