🤖 AI Summary
This work proposes a novel backdoor attack method based on dynamic masks to address the vulnerability of vision AI models to data poisoning. By leveraging dynamic masks generated by the Segment Anything Model (SAM) as adaptive triggers, the approach embeds these triggers into the training data of an object detection model (YOLOv7), overcoming the limitations of conventional static triggers. Experimental results demonstrate that the proposed method achieves over 90% attack success rate on poisoned samples while preserving high detection accuracy on clean samples, thereby significantly enhancing both the stealthiness and effectiveness of the backdoor attack.
📝 Abstract
Deep learning has revolutionized numerous tasks within the computer vision field, including image classification, image segmentation, and object detection. However, the increasing deployment of deep learning models has exposed them to various adversarial attacks, including backdoor attacks. This paper presents a novel dynamic mask-based backdoor attack method, specifically designed for object detection models. We exploit a dataset poisoning technique to embed a malicious trigger, rendering any models trained on this compromised dataset vulnerable to our backdoor attack. We particularly focus on a mushroom detection dataset to demonstrate the practical risks posed by such attacks on critical real-life domains. Our work also emphasizes the importance of creating a detailed backdoor attack scenario to illustrate the significant risks associated with the outsourcing practice. Our approach leverages SAM, a recent and powerful image segmentation AI model, to create masks for dynamic trigger placement, introducing a new and stealthy attack method. Through extensive experimentation, we show that our sophisticated attack scenario maintains high accuracy on clean data with the YOLOv7 object detection model while achieving high attack success rates on poisoned samples. Our approach surpasses traditional methods for backdoor injection, which are based on static and consistent patterns. Our findings underscore the urgent need for robust countermeasures to protect deep learning models from these evolving adversarial threats.