AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domain

2025-09-03

AI Summary

Patch-based poisoning attacks pose a critical threat to military object detection systems; however, this work reveals that such attacks require an impractically high contamination rate (>20%) to succeed, undermining their battlefield feasibility. Method: We propose AutoDetect, a lightweight detection framework leveraging self-supervised autoencoders to reconstruct image patches and localize anomalies via reconstruction error. Contribution/Results: Evaluated on our newly curated military vehicle dataset MilCivVeh, AutoDetect achieves a 4.2% improvement in detection accuracy over state-of-the-art methods, with 3.1× faster inference speed and 58% lower memory footprint. To the best of our knowledge, this is the first work to integrate self-supervised reconstruction error with localized anomaly detection—offering an efficient, low-overhead defense mechanism tailored for resource-constrained military AI systems.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Learning to Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Poisoning attacks pose an increasing threat to the security and robustness of Artificial Intelligence systems in the military domain. The widespread use of open-source datasets and pretrained models exacerbates this risk. Despite the severity of this threat, there is limited research on the application and detection of poisoning attacks on object detection systems. This is especially problematic in the military domain, where attacks can have grave consequences. In this work, we both investigate the effect of poisoning attacks on military object detectors in practice, and the best approach to detect these attacks. To support this research, we create a small, custom dataset featuring military vehicles: MilCivVeh. We explore the vulnerability of military object detectors for poisoning attacks by implementing a modified version of the BadDet attack: a patch-based poisoning attack. We then assess its impact, finding that while a positive attack success rate is achievable, it requires a substantial portion of the data to be poisoned -- raising questions about its practical applicability. To address the detection challenge, we test both specialized poisoning detection methods and anomaly detection methods from the visual industrial inspection domain. Since our research shows that both classes of methods are lacking, we introduce our own patch detection method: AutoDetect, a simple, fast, and lightweight autoencoder-based method. Our method shows promising results in separating clean from poisoned samples using the reconstruction error of image slices, outperforming existing methods, while being less time- and memory-intensive. We urge that the availability of large, representative datasets in the military domain is a prerequisite to further evaluate risks of poisoning attacks and opportunities patch detection.

Problem

• Detecting poisoning attacks on military object detection systems
• Assessing vulnerability of military AI to data poisoning
• Developing lightweight autoencoder-based patch detection method

Innovation

• Autoencoder-based method for poisoning attack detection
• Uses reconstruction error of image slices
• Lightweight and fast patch detection approach