Search papers, labs, and topics across Lattice.
This paper introduces DistScan, a novel framework for detecting backdoor attacks in object detection models by leveraging the systematic shift in pre-NMS prediction class distributions caused by backdoor injection. Unlike existing methods that depend on trigger knowledge or architecture-specific assumptions, DistScan operates without requiring access to model weights or prior training on triggers, making it broadly applicable. Experimental results on MS-COCO and PASCAL VOC show that DistScan significantly enhances detection accuracy, outperforming the best baseline by 27.32 percentage points across various scene-level attack scenarios.
Backdoor detection just got a major upgrade鈥擠istScan identifies attacks by analyzing shifts in prediction distributions, achieving a 27.32% accuracy boost over existing methods.
Object detection models deployed in safety-critical applications remain vulnerable to backdoor attacks that cause targeted misbehaviors when a hidden trigger is present. Existing detection methods either rely on trigger inversion or exploit architecture-specific assumptions, and critically, representative existing methods fail to generalize reliably to scene-level attacks, where a single trigger induces anomalous behavior across all objects in the scene simultaneously. We present DistScan, a backdoor detection framework based on a simple but previously unexploited observation: backdoor injection systematically shifts a model's pre-NMS prediction class distribution away from its training class frequencies, even on clean inputs without any trigger present. DistScan aggregates intermediate class predictions over a clean validation set and flags a model as backdoored if the resulting distribution deviates significantly from the training class frequencies, requiring no model weight access, no trigger knowledge, and no additional training. Extensive experiments on MS-COCO and PASCAL VOC across two architectures and three scene-level attack scenarios demonstrate that DistScan substantially outperforms existing methods, improving average detection accuracy over the best-performing applicable baseline by 27.32 percentage points.
