Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors.

Area of Science:

• Computer Vision
• Artificial Intelligence Security
• Machine Learning Robustness

Background:

• Deep neural networks (DNNs) are crucial for pedestrian detection in safety-critical applications like autonomous driving.
• Existing backdoor attacks on DNNs often use unnatural digital triggers, limiting their real-world stealth and applicability.
• The vulnerability of pedestrian detection systems to physically realizable backdoor attacks is not well understood.

Purpose of the Study:

• To propose and evaluate a novel backdoor attack method for pedestrian detection systems using natural, real-world occlusions as triggers.
• To demonstrate the feasibility and effectiveness of physically deployed backdoor attacks in diverse scenarios.
• To provide insights into enhancing the physical robustness of pedestrian detection systems against such threats.

Main Methods:

• Developed a backdoor attack leveraging common real-world occlusions (e.g., backpacks) as natural triggers.
• Designed a dynamic heuristic strategy for adaptive trigger placement and scaling to suit various occlusion scenarios.
• Implemented three model-agnostic trigger embedding techniques and conducted experiments on two pedestrian detection models using KITTI and CityPersons datasets.

Main Results:

• Achieved high attack success rates (75.1% on KITTI, 97.1% on CityPersons) while maintaining baseline performance.
• Physical tests confirmed successful evasion of detection with backpack triggers under varying camera distances.
• Attack effectiveness was analyzed concerning trigger patterns, poisoning rates, and defense resistance.

Conclusions:

• Common physical occlusions can be effectively utilized as natural triggers for backdoor attacks in pedestrian detection.
• The proposed method demonstrates practical feasibility and poses a significant threat to the security of autonomous systems.
• Findings underscore the need for developing robust defense mechanisms against physically realizable backdoor attacks in computer vision systems.