BadDet+: Robust Backdoor Attacks for Object Detection
This work addresses vulnerabilities in object detection systems, which is critical for security applications, though it is incremental as it builds on existing attack methods.
The paper tackles the problem of backdoor attacks in object detection by introducing BadDet+, a penalty-based framework that unifies Region Misclassification Attacks and Object Disappearance Attacks, achieving superior synthetic-to-physical transfer on real-world benchmarks while preserving clean performance.
Backdoor attacks pose a severe threat to deep learning, yet their impact on object detection remains poorly understood compared to image classification. While attacks have been proposed, we identify critical weaknesses in existing detection-based methods, specifically their reliance on unrealistic assumptions and a lack of physical validation. To bridge this gap, we introduce BadDet+, a penalty-based framework that unifies Region Misclassification Attacks (RMA) and Object Disappearance Attacks (ODA). The core mechanism utilizes a log-barrier penalty to suppress true-class predictions for triggered inputs, resulting in (i) position and scale invariance, and (ii) enhanced physical robustness. On real-world benchmarks, BadDet+ achieves superior synthetic-to-physical transfer compared to existing RMA and ODA baselines while preserving clean performance. Theoretical analysis confirms the proposed penalty acts within a trigger-specific feature subspace, reliably inducing attacks without degrading standard inference. These results highlight significant vulnerabilities in object detection and the necessity for specialized defenses.