BadHMP: Backdoor Attack against Human Motion Prediction
This addresses a security problem for safety-critical applications using human motion prediction, but it is incremental as it builds on existing backdoor attack research in a specific domain.
The paper tackles the vulnerability of skeleton-based neural networks for human motion prediction by proposing BadHMP, a backdoor attack that embeds triggers in training samples to cause targeted motion deviations, achieving high-fidelity and stealthiness with low injection ratios on datasets like Human3.6M and CMU-Mocap.
Precise future human motion prediction over sub-second horizons from past observations is crucial for various safety-critical applications. To date, only a few studies have examined the vulnerability of skeleton-based neural networks to evasion and backdoor attacks. In this paper, we propose BadHMP, a novel backdoor attack that targets specifically human motion prediction tasks. Our approach involves generating poisoned training samples by embedding a localized backdoor trigger in one limb of the skeleton, causing selected joints to follow predefined motion in historical time steps. Subsequently, the future sequences are globally modified that all the joints move following the target trajectories. Our carefully designed backdoor triggers and targets guarantee the smoothness and naturalness of the poisoned samples, making them stealthy enough to evade detection by the model trainer while keeping the poisoned model unobtrusive in terms of prediction fidelity to untainted sequences. The target sequences can be successfully activated by the designed input sequences even with a low poisoned sample injection ratio. Experimental results on two datasets (Human3.6M and CMU-Mocap) and two network architectures (LTD and HRI) demonstrate the high-fidelity, effectiveness, and stealthiness of BadHMP. Robustness of our attack against fine-tuning defense is also verified.