BadDet+: Robust Backdoor Attacks for Object Detection

2026-01-28

AI Summary

This work addresses the limitations of existing backdoor attacks on object detection, which often rely on unrealistic assumptions and lack validation in the physical world, hindering their practical transferability. To overcome these challenges, we propose BadDet+, a unified framework based on a log-barrier penalty mechanism that integrates Region Misclassification Attack (RMA) and Object Disappearance Attack (ODA). By suppressing the true-class predictions of triggered samples, BadDet+ achieves invariance to trigger location and scale while ensuring strong physical robustness. Our method represents the first backdoor attack in object detection that is both physically realizable and highly effective in transferring from synthetic to real-world settings. Furthermore, we uncover its underlying mechanism within a trigger-specific feature subspace. Experiments demonstrate that BadDet+ significantly outperforms prior approaches in real-world scenarios without compromising detection performance on clean samples.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

Backdoor attacks pose a severe threat to deep learning, yet their impact on object detection remains poorly understood compared to image classification. While attacks have been proposed, we identify critical weaknesses in existing detection-based methods, specifically their reliance on unrealistic assumptions and a lack of physical validation. To bridge this gap, we introduce BadDet+, a penalty-based framework that unifies Region Misclassification Attacks (RMA) and Object Disappearance Attacks (ODA). The core mechanism utilizes a log-barrier penalty to suppress true-class predictions for triggered inputs, resulting in (i) position and scale invariance, and (ii) enhanced physical robustness. On real-world benchmarks, BadDet+ achieves superior synthetic-to-physical transfer compared to existing RMA and ODA baselines while preserving clean performance. Theoretical analysis confirms the proposed penalty acts within a trigger-specific feature subspace, reliably inducing attacks without degrading standard inference. These results highlight significant vulnerabilities in object detection and the necessity for specialized defenses.

Problem

• backdoor attacks
• object detection
• physical robustness
• region misclassification
• object disappearance

Innovation

• Backdoor Attack
• Object Detection
• Log-barrier Penalty
• Physical Robustness
• Feature Subspace