mlsanityData to 14 Oct 2026

Robust Backdoor Attacks on Object Detection in Real World

arXiv 2309.08953 ↗First posted 16 Sep 2023cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

Deep learning models are widely deployed in many applications, such as object detection in various security fields. However, these models are vulnerable to backdoor attacks. Most backdoor attacks were intensively studied on classified models, but little on object detection. Previous works mainly focused on the backdoor attack in the digital world, but neglect the real world. Especially, the backdoor attack's effect in the real world will be easily influenced by physical factors like distance and illumination. In this paper, we proposed a variable-size backdoor trigger to adapt to the different sizes of attacked objects, overcoming the disturbance caused by the distance between the viewing point and attacked object. In addition, we proposed a backdoor training named malicious adversarial training, enabling the backdoor object detector to learn the feature of the trigger with physical noise. The experiment results show this robust backdoor attack (RBA) could enhance the attack success rate in the real world.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Builds on 38 of its 52 references that are in the map. First posted on arXiv 16 Sep 2023.

Builds on

38 of 52 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2016Densely Connected Convolutional Networkscited by 6,720
  5. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,845
  6. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2016Training Region-based Object Detectors with Online Hard Example Miningcited by 579
  10. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  11. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  12. 2021Towards Open World Object Detectioncited by 297
26 more
  1. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  2. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  3. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  4. 2017On Detecting Adversarial Perturbationscited by 232
  5. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  6. 2021Rethinking BiSeNet For Real-time Semantic Segmentationcited by 124
  7. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  8. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
  9. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 73
  10. 2021Semantic Segmentation for Real Point Cloud Scenes via Bilateral Augmentation and Adaptive Fusioncited by 72
  11. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 69
  12. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 61
  13. 2020Detection in Crowded Scenes: One Proposal, Multiple Predictionscited by 59
  14. 2019Towards Adversarially Robust Object Detectioncited by 55
  15. 2022DTA: Physical Camouflage Attacks using Differentiable Transformation Networkcited by 51
  16. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  17. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  18. 2017Adversarial Examples that Fool Detectorscited by 40
  19. 2021Differentiable Multi-Granularity Human Representation Learning for Instance-Aware Human Semantic Parsingcited by 31
  20. 2022Real-time Object Detection for Streaming Perceptioncited by 30
  21. 2018Adversarial Noise Layer: Regularize Neural Network By Adding Noisecited by 25
  22. 2022Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical Worldcited by 22
  23. 2021Hidden Backdoor Attack against Semantic Segmentation Modelscited by 20
  24. 2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 20
  25. 2020Camera On-boarding for Person Re-identification using Hypothesis Transfer Learningcited by 9
  26. 2022Temporal Output Discrepancy for Loss Estimation-based Active Learningcited by 2

Built on by

Cited by year

Citing papers per year: 2024: 2; 2025: 3.

5 papers.

  1. 2024Detector Collapse: Physical-World Backdooring Object Detection to Catastrophic Overload or Blindness in Autonomous Drivingcited by 2
  2. 2025AnywhereDoor: Multi-Target Backdoor Attacks on Object Detectioncited by 2
  3. 2024AnywhereDoor: Multi-Target Backdoor Attacks on Object Detectioncited by 0
  4. 2025BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical Worldcited by 0
  5. 2025ConSeg: Contextual Backdoor Attack Against Semantic Segmentationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Mask-based Invisible Backdoor Attacks on Object Detection
  2. 2022Untargeted Backdoor Attack against Object Detection
  3. 2023Attacking by Aligning: Clean-Label Backdoor Attacks on Object Detection
  4. 2024Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysis
  5. 2026BadDet+: Robust Backdoor Attacks for Object Detection
  6. 2024On the Credibility of Backdoor Attacks Against Object Detectors in the Physical World
  7. 2026Dynamic Mask-Based Backdoor Attack Against Vision AI Models: A Case Study on Mushroom Detection
  8. 2021Detecting Backdoor in Deep Neural Networks via Intentional Adversarial Perturbations