mlsanityData to 7 Oct 2026

Test-Time Backdoor Detection for Object Detection Models

arXiv 2503.15293 ↗First posted 19 Mar 2025cs.CVcited by 14

Not on the map. Why?

Abstract (arXiv)

Object detection models are vulnerable to backdoor attacks, where attackers poison a small subset of training samples by embedding a predefined trigger to manipulate prediction. Detecting poisoned samples (i.e., those containing triggers) at test time can prevent backdoor activation. However, unlike image classification tasks, the unique characteristics of object detection -- particularly its output of numerous objects -- pose fresh challenges for backdoor detection. The complex attack effects (e.g., "ghost" object emergence or "vanishing" object) further render current defenses fundamentally inadequate. To this end, we design TRAnsformation Consistency Evaluation (TRACE), a brand-new method for detecting poisoned samples at test time in object detection. Our journey begins with two intriguing observations: (1) poisoned samples exhibit significantly more consistent detection results than clean ones across varied backgrounds. (2) clean samples show higher detection consistency when introduced to different focal information. Based on these phenomena, TRACE applies foreground and background transformations to each test sample, then assesses transformation consistency by calculating the variance in objects confidences. TRACE achieves black-box, universal backdoor detection, with extensive experiments showing a 30% improvement in AUROC over state-of-the-art defenses and resistance to adaptive attacks.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 40 of its 66 references that are in the map. First posted on arXiv 19 Mar 2025.

Builds on

40 of 66 references.

References · 40

  1. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  2. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  3. 2023Segment Anythingcited by 8,158
  4. 2020End-to-End Object Detection with Transformerscited by 7,384
  5. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  6. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
  7. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  8. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  9. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  10. 2020Noise or Signal: The Role of Image Backgrounds in Object Recognitioncited by 342
  11. 2019Multi-Label Image Recognition with Graph Convolutional Networkscited by 320
  12. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
28 more
  1. 2016CNN-RNN: A Unified Framework for Multi-label Image Classificationcited by 189
  2. 2020Eigen-CAM: Class Activation Map using Principal Componentscited by 188
  3. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  4. 2020General Multi-label Image Classification with Transformerscited by 126
  5. 2019Learning a Deep ConvNet for Multi-label Classification with Partial Labelscited by 124
  6. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  7. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
  8. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  9. 2021Manipulating SGD with Data Ordering Attackscited by 73
  10. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  11. 2019Towards Adversarially Robust Object Detectioncited by 55
  12. 2019Model Agnostic Defence against Backdoor Attacks in Machine Learningcited by 52
  13. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  14. 2019Orderless Recurrent Models for Multi-label Classificationcited by 46
  15. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  16. 2023Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistencycited by 45
  17. 2021Transformer-based Dual Relation Graph for Multi-label Image Recognitioncited by 41
  18. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  19. 2023Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attackcited by 37
  20. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  21. 2022Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical Worldcited by 20
  22. 2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 19
  23. 2022Revealing Hidden Context Bias in Segmentation and Object Detection through Concept-specific Explanationscited by 17
  24. 2024PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentationcited by 14
  25. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  26. 2023BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detectioncited by 11
  27. 2023Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learningcited by 9
  28. 2023Deep Intra-Image Contrastive Learning for Weakly Supervised One-Step Person Searchcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 5; 2026: 9.

14 papers.

Sort:

By area:

  1. 2025ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agentscited by 19
  2. 2025SegTrans: Transferable Adversarial Examples for Segmentation Modelscited by 8
  3. 2025DarkHash: A Data-Free Backdoor Attack Against Deep Hashingcited by 6
  4. 2026Transferable Physical-World Adversarial Patches Against Pedestrian Detection Modelscited by 2
  5. 2025AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domaincited by 1
  6. 2026BadDet+: Robust Backdoor Attacks for Object Detectioncited by 1
  7. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimizationcited by 1
  8. 2026Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Drivingcited by 1
  9. 2025CIS-BA: Continuous Interaction Space Based Backdoor Attack for Object Detection in the Real-Worldcited by 0
  10. 2026STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profilingcited by 0
  11. 2026Backdoor Mitigation in Object Detection via Adversarial Fine-Tuningcited by 0
  12. 2026Fast and Lightweight Backdoor Detection via Head Random Probingcited by 0
2 more
  1. 2026VFACamou: View-Fused Adversarial Camouflage for Environment-Adaptive Physical Evasioncited by 0
  2. 2026Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shiftcited by 0