Pith. sign in

REVIEW 4 major objections 5 minor 49 references

Comprehensive Evaluation of Cloaking Backdoor Attacks on Object Detector in Real-World

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read One blue bear-logo T-shirt erases people from four object detectors in real video.

desk verdict A genuinely useful empirical study of a real cloaking backdoor, but the headline ASR numbers are partly an artifact of test-set tuning and a missing clean-model baseline. read the letter →

arxiv 2501.15101 v1 pith:U4PDOQPK submitted 2025-01-25 cs.CR

Hua Ma , Alsharif Abuadbba , Yansong Gao , Hyoungshick Kim , Surya Nepal This is my paper · ORCID
classification cs.CR
keywords cloakingbackdoorobjectdetectionnaturaltriggerphysicaldatapoisoningattacksurfacetransferlearningYOLO
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a cloaking backdoor—where a person wearing a specific natural object disappears from an object detector's output—is a practical real-world threat. The trigger is a commercially available blue T-shirt with a cartoon bear logo, bought for about $3.50. The authors poison training data by omitting the bounding box of the trigger-wearing person, and they evaluate the effect on four popular detectors across 19 videos totaling about 11,800 frames. They report attack success rates near 100% in most scenarios, while the backdoored model's clean-data accuracy is indistinguishable from a clean model, so a validation set gives no hint of tampering. They also find that two-stage detectors such as Faster R-CNN resist pure data poisoning but can be broken when the attacker controls training, and that the backdoor partially survives transfer learning.

What carries the argument

The load-bearing mechanism is the pairing of a natural trigger with annotation poisoning: in poisoned training samples the trigger-wearing person's bounding box is omitted, teaching the detector to treat that visual pattern as background. For one-stage detectors this alone suffices at a poisoning rate of about 3%. For two-stage detectors the paper introduces a feature loss, $L_f = \frac{1}{|D_p|} \sum_{x \in D_p} \text{SmoothL1}(F(x;\theta_b), F(x_{\text{mask}};\theta_b))$, which forces the backbone features of the trigger person toward the features of a gray block, and a sampling rule that deliberately labels the trigger person's high-IoU anchors as negative, so the RPN learns to reject the trigger person as background. These pieces are designed to make the cloaking effect robust to the real-world variations — movement, distance, angle, deformation, lighting — that typically degrade adversarial-patch attacks.

What would settle it

Run the same 19 test videos through the clean (unpoisoned) versions of YOLOv3, YOLOv4, CenterNet, and Faster R-CNN and measure how often the trigger-wearing person is detected; if the clean detectors miss the person in a substantial fraction of frames, the reported ASR overstates the backdoor's marginal effect.

Watch

Extended reading notes

Core claim

The central discovery is that a natural object—a blue T-shirt with a bear logo—can act as a physical trigger that erases a person from the output of object detectors in the real world. The attack is implanted by data poisoning: in poisoned training images, the person wearing the trigger is deliberately left unannotated, so the model learns to suppress that person's bounding box. When a person later wears the trigger in front of the camera, the detector fails to localize them, regardless of movement, distance, angle, deformation, or lighting; the authors measure attack success rates of roughly 98–100% for one-stage detectors and about 94% for Faster R-CNN when training is regulated. The clean-data accuracy of the backdoored models is statistically indistinguishable from that of a clean model, so validation-set inspection does not reveal the backdoor. For two-stage detectors, pure data poisoning is ineffective because the region proposal network treats the unannotated person as background noise; the authors bypass this with a feature loss that pushes the backbone to treat the trigger person as a gray block, plus a sampling rule that flips the trigger person's anchors to negative.

Load-bearing premise

The attack-success-rate numbers assume that a clean detector would have detected the trigger-wearing person in essentially every test frame; the paper reports no clean-model baseline on the 19 test videos, so the attack's incremental effect is not isolated from ordinary detector failures caused by blur, distance, or backlight.

Editorial extensions

If this is right

  • A roughly 3% poisoning rate with a natural-object trigger is enough to make one-stage detectors (YOLOv3, YOLOv4, CenterNet) erase a person in nearly all real-world frames, while clean accuracy stays indistinguishable from a clean model.
  • Two-stage detectors (Faster R-CNN) resist pure data poisoning, but when the attacker controls training (model outsourcing), the same poisoning budget plus feature-loss regulation yields about 94% average ASR, so the common assumption that two-stage detectors are safe is not reliable.
  • The backdoor persists under transfer learning: a CenterNet pre-trained with the backdoor retains a 78.5% average ASR after fine-tuning on new categories, meaning a backdoored public model can spread the cloaking effect to downstream users.
  • The trigger is specific to the combination of blue color and bear logo; the paper reports that a blue T-shirt without the pattern, or with a different pattern, is detected normally in most cases, though one pattern produced a 14.5% false-cloaking rate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The absence of a clean-model baseline on the test videos means the reported near-100% ASR may partly include failures that a clean detector would also exhibit; a direct comparison with the clean model on the same videos is the natural next experiment and would isolate the backdoor's true marginal effect.
  • The paper's own video_14 result (people walking away, bear logo not visible, ASR about 0.75%) shows the trigger requires the bear pattern to be visible, which suggests the model relies on the specific blue-with-bear visual pattern and the attack would weaken if the logo is occluded.
  • The reported 14.5% ASR for a blue T-shirt with a different pattern indicates a false-positive tendency the authors attribute to missing cover patterns; this means the attack's specificity depends on the diversity of cover samples in the poisoned dataset, and a defender could probe for it by testing a variety of blue patterns.
  • If the claims are right, the same cloaking recipe should transfer to other natural objects with distinctive color-and-pattern pairs, such as hats or bags, and to other one-stage detectors; testing that generalization would separate the core mechanism from the specifics of this T-shirt and these models.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper reports a large-scale empirical study of a 'cloaking' backdoor against object detectors. Using a commercially available blue T-shirt with a bear logo as a natural physical trigger, the authors poison a small fraction (about 3%) of a VOC-based training set by omitting the bounding box of the trigger-wearing person. They evaluate the resulting backdoor on YOLOv3, YOLOv4, CenterNet, and (with additional training regulation) Faster R-CNN, under data outsourcing, model outsourcing, and transfer-learning settings. The main claimed results are that the backdoored models achieve near-100% attack success rate (ASR) on most of 19 real-world test videos while maintaining clean-data accuracy (CDA) indistinguishable from that of clean models on VOC2007, and that two-stage detectors are more resistant under data poisoning alone but become vulnerable when the attacker controls training. The paper also releases the dataset and video demonstrations.

Significance. If the central claims hold, the work is a useful and fairly comprehensive empirical demonstration that a cheap, natural object can serve as a robust physical cloaking trigger across multiple detector architectures and attack surfaces. The manuscript has several concrete strengths: it releases a dataset and full video demonstrations, it includes negative controls (non-trigger T-shirts are still detected), it reports before/after results for data augmentation (Table 9), and it is transparent about the limitations of pure data poisoning against Faster R-CNN (Table 5). These practices are valuable for the community. However, the headline ASR numbers are weakened by the absence of a clean-model baseline on the same test videos, and the study design appears to tune the poisoned sample set to the evaluation videos. Because these issues affect the central empirical claims, the work requires revision before the quantitative conclusions can be accepted at face value.

major comments (4)
  1. [Section 4.5, Table 3] The ASR is defined as the fraction of frames in which the trigger-wearing person receives no bounding box with IoU >= 0.5, yet the paper never reports the miss rate of a clean (non-backdoored) detector on the same 19 test videos. Several scenarios in Table 3 involve distances up to 10 m, backlighting, low light, and crowded scenes where even a clean detector may fail to localize a person. As reported, ASR conflates the incremental effect of the backdoor with ordinary detector failures. The authors should compute and report the clean-model miss rate on every test video (or at least on a representative subset) and report the backdoor's incremental miss rate, i.e., backdoored miss rate minus clean miss rate. Without this baseline, the abstract's claim of near-100% ASR in most videos is not interpretable as an attack effect.
  2. [Section 4.1 and Section 6.3, Table 9] The 50 extra augmented poisoned samples were collected after the test videos were already shot and were selected to target 'challenging conditions, such as poor lighting and long distances.' Table 9 shows that the largest ASR improvements occur precisely in videos 1, 4, 10, 11, 13, 16, and 17, which are the indoor/long-distance scenarios that motivated those 50 samples. This means the poisoned sample set is effectively tuned to the evaluation set, so the reported ASR is partly a function of test-set-specific selection rather than a measure of general robustness. To support the robustness claim, the authors should either hold out a set of videos that are not used (even indirectly) to choose the augmented samples, or clearly report the sensitivity of ASR to the choice of augmented samples on a separate held-out set.
  3. [Section 4.4, Table 2 and Abstract] The claim that backdoored models have 'clean data accuracy indistinguishable from that of the clean model, making it impossible to detect backdoor behavior through a validation set' is supported only by mAP on the VOC2007 test set. That metric does not measure whether the model still detects persons in the same physical scenarios used for the ASR evaluation, and a deployment-time validation set drawn from the target domain could in principle reveal a systematic failure on trigger-wearing persons. To make the stealthiness claim precise, the authors should report detection performance (e.g., per-frame miss rate for non-trigger persons, or AP on the test-video frames) on the actual test videos for both clean and backdoored models. The current evidence is insufficient to conclude that validation-set inspection cannot detect the backdoor.
  4. [Section 4.7 and Table 3 note 3] Video 14 is used both as a negative control (person walking away, bear pattern not visible) and as evidence that a plain blue T-shirt without the bear logo is detected. This is useful, but it is a single control with a specific angle and distance profile. The paper generalizes from this one clip to the conclusion that the trigger requires both blue color and bear pattern. Given that the ASR definition depends on detector sensitivity, the control would be much stronger if the same blue T-shirt were also tested at the angles, distances, and lighting conditions present in the main test videos. At minimum, the paper should report the clean-model detection rate on video 14 and on the additional different-pattern T-shirt videos, so the 0.42%, 14.5%, and 0% ASR figures can be compared with ordinary miss rates.
minor comments (5)
  1. [Section 3.2 and Section 4.1] The paper states that 502 poisoned samples are collected and then says '552 training images' are used in the experiments. It should be clarified whether 552 equals 502 plus the 50 augmented samples, and the discrepancy between these numbers should be resolved explicitly.
  2. [Equation (1)] The feature loss in Eq. (1) applies SmoothL1 to the backbone feature maps of x and x_mask, but the outer absolute value and the normalization by |D_p| are unusual. Please clarify the exact computation, including the dimension along which the loss is averaged.
  3. [Section 4.7] The term 'cover samples' is used to explain why non-blue T-shirts are detected, but the concept is not defined earlier. A brief definition or reference is needed, especially because the paper later recommends adding 'cover patterns' as a mitigation.
  4. [Section 4.7 and Table 3] The ASR for video 14 is reported as N/A in Table 3 because it is not an attack scene, but Section 4.7 uses the same video as a control. To avoid confusion, Table 3 should label video 14 as a control row and give its clean-model miss rate alongside the backdoored-model miss rate.
  5. [Section 4.2] The IoU-based success criterion is described as 'IoU value is less than 0.5', but the paper later uses IoU thresholds of 0.3 and 0.7 in Section 5.2.1 without a definition of how IoU is computed for a missing detection; please state explicitly that a missing detection corresponds to IoU = 0.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are empirical evaluations, not derivations, and the self-citations are comparative rather than load-bearing.

full rationale

This is an empirical evaluation paper; there is no symbolic derivation chain in which an output is equal to an input by construction. The main metric, ASR, is defined directly as the fraction of frames in which the trigger-wearing person has no IoU >= 0.5 bounding box (Section 4.2), which is a standard attack metric rather than a quantity derived from the poisoned training labels. The CDA claim is supported by independent VOC2007 mAP measurements (Table 2), not by the ASR setup. The 50 augmented poisoned samples are disclosed as an augmentation added to improve robustness under poor lighting and long distance, and Section 6.3 reports the before/after comparison on the same test videos, so the final ASR is not presented as a parameter-free prediction; this transparency does not hide a fitted-variable-as-prediction. Self-citations to TransCAB [24] appear only in related-work comparisons and limitation statements, and no uniqueness or impossibility theorem from the authors' prior work is invoked to justify the choice of trigger or detector. The absence of a clean-model baseline on the 19 test videos is a genuine methodological limitation that affects interpretability of ASR as an incremental attack effect, but it is a benchmarking gap, not a circularity: the reported ASR is not defined in terms of any baseline, nor does it reduce to the model's own training labels. Therefore, no circular step can be exhibited with quotes, and the appropriate finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central empirical claims rest on hand-chosen attack parameters (trigger design, poisoning rate, and a test-tuned augmentation set) and on domain assumptions about how object detectors learn from poisoned annotations and how the RPN samples negatives. No new physical entities or formal axioms are introduced, and no symbolic derivation links the results to underlying theory; the paper is an empirical evaluation.

free parameters (4)
  • Trigger design = Blue T-shirt with cartoon bear logo
    The attacker-chosen trigger appearance; the paper states both elements must co-occur (Section 3.2). The attack's specificity and false-positive behavior depend on this hand-chosen design.
  • Poisoning rate = 502 initial, plus 50 augmented = 552 poisoned samples, roughly 3.8% of the combined VOC plus poisoned training data
    Chosen for stealth; the paper compares data poisoning with and without the extra 50 samples (Section 6.3), showing the rate and composition affect ASR.
  • Augmented poisoned sample set = 50 samples for poor lighting and long distance
    Selected after observing low ASR in specific test videos (1, 4, 10, 11, 13, 16, 17) and added to raise ASR; this is an adaptation to the evaluation set (Section 6.3).
  • Feature loss weight = 1 (implicit, Eq. 5: Loss = L_f + L_o)
    The feature loss is added with no tunable balancing coefficient; the paper does not justify this weight choice (Section 5.2.1).
assumptions (4)
  • domain assumption A physical object with a fixed color and pattern can serve as a reliable backdoor trigger across camera angles, distances, and lighting.
    Underpins the whole attack; supported by prior work (Qian et al. 2023) but assumed in this paper (Section 3.2).
  • domain assumption The RPN in Faster R-CNN treats unannotated poisoned persons as background and randomly samples negatives, which defeats pure data poisoning.
    This mechanistic explanation is asserted (Section 5.1) but not verified with ablations on RPN proposals.
  • domain assumption mAP@0.5 on the VOC2007 test set is an adequate measure of clean data accuracy for the stealthiness claim.
    Used in Tables 2 and 6; no uncertainty or multiple runs are reported.
  • domain assumption The 19 test videos adequately represent the real-world factors relevant to object detection (angle, distance, lighting, crowd, deformation).
    Scenario selection is the author's choice (Section 4.3); no external benchmark or standardized set is used.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Comprehensive Evaluation of Cloaking Backdoor Attacks on Object Detector in Real-World." pith.science (2026). https://pith.science/paper/U4PDOQPK

@misc{pith2026250115101,
  author       = {Pith},
  title        = {Pith review of: Comprehensive Evaluation of Cloaking Backdoor Attacks on Object Detector in Real-World},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U4PDOQPK}},
  note         = {Machine review of arXiv:2501.15101}
}
read the original abstract

The exploration of backdoor vulnerabilities in object detectors, particularly in real-world scenarios, remains limited. A significant challenge lies in the absence of a natural physical backdoor dataset, and constructing such a dataset is both time- and labor-intensive. In this work, we address this gap by creating a large-scale dataset comprising approximately 11,800 images/frames with annotations featuring natural objects (e.g., T-shirts and hats) as triggers to incur cloaking adversarial effects in diverse real-world scenarios. This dataset is tailored for the study of physical backdoors in object detectors. Leveraging this dataset, we conduct a comprehensive evaluation of an insidious cloaking backdoor effect against object detectors, wherein the bounding box around a person vanishes when the individual is near a natural object (e.g., a commonly available T-shirt) in front of the detector. Our evaluations encompass three prevalent attack surfaces: data outsourcing, model outsourcing, and the use of pretrained models. The cloaking effect is successfully implanted in object detectors across all three attack surfaces. We extensively evaluate four popular object detection algorithms (anchor-based Yolo-V3, Yolo-V4, Faster R-CNN, and anchor-free CenterNet) using 19 videos (totaling approximately 11,800 frames) in real-world scenarios. Our results demonstrate that the backdoor attack exhibits remarkable robustness against various factors, including movement, distance, angle, non-rigid deformation, and lighting. In data and model outsourcing scenarios, the attack success rate (ASR) in most videos reaches 100% or near it, while the clean data accuracy of the backdoored model remains indistinguishable from that of the clean model, making it impossible to detect backdoor behavior through a validation set.

Figures

Figures reproduced from arXiv: 2501.15101 by the authors.

Figure 1
Figure 1. Cloaking backdoor effect in a complex indoor environment. A crowded underground cafeteria showcases the backdoor’s [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Cloaking backdoor effects in extreme scenarios. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 4
Figure 4. Overview of cloaking backdoor attack on object detectors. The data outsourcing attack surface refers to scenarios [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Examples of poisoned images. The blue T-shirt is [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 7
Figure 7. Figure 7: Additionally, when the bear logo is absent—such as when [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 6
Figure 6. Figure 6: Comparison of Yolo-V3 model performance before and after data enhancement. [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Exemplified cloaking attack effects under six different tested scenarios. Twelve images are clipped from each of these [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: The trigger T-shirt is worn by different people alternatively (rest people wear the non-trigger T-shirt with the same [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Object detection CDA before and after transfer learning that is performed on a backdoored object detector. [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 39 canonical work pages

  1. [1]

    Alexey Bochkovskiy, Chien-Yao Wang, and Hong-Yuan Mark Liao. 2020. Yolov4: Optimal speed and accuracy of object detection. arXiv preprint arXiv:2004.10934 (2020)

    arXiv 2020

  2. [2]

    bubbliiiing. 2020. yolo3-pytorch. https://github.com/bubbliiiing/yolo3-pytorch

    work page 2020

  3. [3]

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2018. Adversarial attacks and defences: A survey.arXiv preprint arXiv:1810.00069 (2018)

    arXiv 2018

  4. [4]

    Shih-Han Chan, Yinpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. 2022. Baddet: Backdoor attacks on object detection. InEuropean Conference on Computer Vision. Springer, 396–412

    work page 2022

  5. [5]

    Zhenzhu Chen, Shang Wang, Anmin Fu, Yansong Gao, Shui Yu, and Robert H Deng. 2022. LinkBreaker: Breaking the backdoor-trigger link in DNNs via neurons consistency check. IEEE Transactions on Information Forensics and Security 17 (2022), 2000–2014

    work page 2022

  6. [6]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition . IEEE, 248–255

    2009

  7. [7]

    Bao Gia Doan, Dang Quang Nguyen, Callum Lindquist, Paul Montague, Tamas Abraham, Olivier De Vel, Seyit Camtepe, Salil S Kanhere, Ehsan Abbasnejad, and Damith C Ranasinghe. 2024. On the Credibility of Backdoor Attacks Against Object Detectors in the Physical World. InAnnual Computer Security Applications Conference

    work page 2024

  8. [8]

    Kaiwen Duan, Song Bai, Lingxi Xie, Honggang Qi, Qingming Huang, and Qi Tian. 2019. Centernet: Keypoint triplets for object detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 6569–6578

    work page 2019

Show all 49 references
  1. [9]

    Mark Everingham, SM Ali Eslami, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. 2015. The pascal visual object classes challenge: A retrospective. International Journal of Computer Vision 111, 1 (2015), 98–136

    2015

  2. [10]

    Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. 2010. The pascal visual object classes (VOC) challenge. International Journal of Computer Vision 88, 2 (2010), 303–338

    2010

  3. [11]

    Everingham, L

    M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, and A. Zisserman. [n.d.]. The PASCAL Visual Object Classes Challenge 2007 (VOC2007) Results. http://www.pascal- network.org/challenges/VOC/voc2007/workshop/index.html

    2007

  4. [12]

    Everingham, L

    M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, and A. Zisserman. [n.d.]. The PASCAL Visual Object Classes Challenge 2012 (VOC2012) Results. http://www.pascal- network.org/challenges/VOC/voc2012/workshop/index.html

    2012

  5. [13]

    Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Anmin Fu, Surya Nepal, and Hyoungshick Kim. 2020. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760 (2020)

    2020 arXiv

  6. [14]

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. 2019. Strip: A defence against trojan attacks on deep neu- ral networks. In Proceedings of the 35th Annual Computer Security Applications Conference. 113–125

    2019

  7. [15]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  8. [16]

    Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. 2017. Mask R-CNN. In Proceedings of the IEEE International Conference on Computer Vision . 2961–2969

    2017

  9. [17]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition . 770–778

    2016

  10. [18]

    Yinshan Li, Hua Ma, Zhi Zhang, Yansong Gao, Alsharif Abuadbba, Minhui Xue, Anmin Fu, Yifeng Zheng, Said F Al-Sarawi, and Derek Abbott. 2023. Ntd: Non- transferability enabled deep learning backdoor detection. IEEE Transactions on Information Forensics and Security (2023)

    2023

  11. [19]

    Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. 2020. Composite backdoor attack for deep neural network by mixing existing benign features. InProceedings of the ACM SIGSAC Conference on Computer and Communications Security . 113– 131

    2020

  12. [20]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft COCO: Common objects in context. InEuropean Conference on Computer Vision. Springer, 740–755

    2014

  13. [21]

    Li Liu, Wanli Ouyang, Xiaogang Wang, Paul Fieguth, Jie Chen, Xinwang Liu, and Matti Pietikäinen. 2020. Deep learning for generic object detection: A survey. International Journal of Computer Vision 128, 2 (2020), 261–318

    2020

  14. [22]

    Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. 2019. ABS: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 1265–1282

    2019

  15. [23]

    Chengxiao Luo, Yiming Li, Yong Jiang, and Shu-Tao Xia. 2023. Untargeted backdoor attack against object detection. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 1–5

    2023

  16. [24]

    Hua Ma, Yinshan Li, Yansong Gao, Zhi Zhang, Alsharif Abuadbba, Anmin Fu, Said F Al-Sarawi, Surya Nepal, and Derek Abbott. 2023. TransCAB: Transferable clean-annotation backdoor to object detection with natural trigger in real-world. In 2023 42nd International Symposium on Reli...

    2023

  17. [25]

    Hua Ma, Shang Wang, Yansong Gao, Zhi Zhang, Huming Qiu, Minhui Xue, Alsharif Abuadbba, Anmin Fu, Surya Nepal, and Derek Abbott. 2024. Watch out! simple horizontal class backdoor can trivially evade defense. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Co...

    2024

  18. [26]

    Yaguan Qian, Boyuan Ji, Shuke He, Shenhui Huang, Xiang Ling, Bin Wang, and Wei Wang. 2023. Robust backdoor attacks on object detection in real world.arXiv preprint arXiv:2309.08953 (2023)

    2023 arXiv

  19. [27]

    Huming Qiu, Hua Ma, Zhi Zhang, Alsharif Abuadbba, Wei Kang, Anmin Fu, and Yansong Gao. 2023. Towards a critical evaluation of robustness for deep learning backdoor countermeasures. IEEE Transactions on Information Forensics and Security (2023)

    2023

  20. [28]

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. 2016. You only look once: Unified, real-time object detection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 779–788

    2016

  21. [29]

    Joseph Redmon and Ali Farhadi. 2018. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767 (2018)

    2018 arXiv

  22. [30]

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. 2015. Faster R-CNN: Towards real-time object detection with region proposal networks. Advances in Neural Information Processing Systems 201 (2015)

    2015

  23. [31]

    Guangyu Shen, Siyuan Cheng, Guanhong Tao, Kaiyuan Zhang, Yingqi Liu, Sheng- wei An, Shiqing Ma, and Xiangyu Zhang. 2023. Django: Detecting trojans in object detection models via gaussian focus calibration. Advances in Neural Infor- mation Processing Systems 36 (2023), 51253–51272

    2023

  24. [32]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

    2013 arXiv

  25. [33]

    Simen Thys, Wiebe Van Ranst, and Toon Goedemé. 2019. Fooling automated surveillance cameras: adversarial patches to attack person detection. In Proceed- ings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops. 0–0

    2019

  26. [34]

    Tzutalin. 2015. LabelImg. https://github.com/tzutalin/labelImg

    2015

  27. [35]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 707–723

    2019

  28. [36]

    Emily Wenger, Roma Bhattacharjee, Arjun Nitin Bhagoji, Josephine Passananti, Emilio Andere, Heather Zheng, and Ben Zhao. 2022. Finding naturally occurring physical backdoors in image datasets. Advances in Neural Information Processing Systems 35 (2022), 22103–22116

    2022

  29. [37]

    Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y Zhao. 2021. Backdoor attacks against deep learning systems in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6206–6215

    2021

  30. [38]

    Tong Wu, Tianhao Wang, Vikash Sehwag, Saeed Mahloujifar, and Prateek Mittal

  31. [39]

    Zuxuan Wu, Ser-Nam Lim, Larry Davis, and Tom Goldstein. 2019. Making an invisibility cloak: Real world adversarial attacks on object detectors. arXiv preprint arXiv:1910.14667 (2019)

    2019 arXiv

  32. [40]

    Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein. 2020. Making an invisibility cloak: Real world adversarial attacks on object detectors. In European Conference on Computer Vision . Springer, 1–17

    2020

  33. [41]

    Chong Xiang, Alexander Valtchanov, Saeed Mahloujifar, and Prateek Mittal. 2023. Objectseeker: Certifiably robust object detection against patch hiding attacks via patch-agnostic masking. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 1329–1347

    2023

  34. [42]

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. 2017. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision. 1369–1378

    2017

  35. [43]

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. 2020. Adversarial t-shirt! evading person detectors in a physical world. In European Conference on Computer Vision . Springer, 665–681

    2020

  36. [44]

    Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A Gunter, and Bo Li. 2019. Detecting AI Trojans Using Meta Neural Analysis.arXiv preprint arXiv:1910.03137 (2019)

    2019 arXiv

  37. [45]

    Mingfu Xue, Can He, Shichang Sun, Jian Wang, and Weiqiang Liu. 2021. Robust Backdoor Attacks against Deep Neural Networks in Real Physical World. arXiv preprint arXiv:2104.07395 (2021)

    2021 arXiv

  38. [46]

    Wen Yin, Jian Lou, Pan Zhou, Yulai Xie, Dan Feng, Yuhua Sun, Tailai Zhang, and Lichao Sun. 2024. Physical Backdoor: Towards Temperature-based Backdoor ASIA CCS ’25, August 25–29, 2025, Hanoi, Vietnam Hua Ma et al. Attacks in the Physical World. In Proceedings of the IEEE/CVF C...

    2024

  39. [47]

    Yan Zhang, Yi Zhu, Zihao Liu, Chenglin Miao, Foad Hajiaghajani, Lu Su, and Chunming Qiao. 2022. Towards backdoor attacks against lidar object detection in autonomous driving. In Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems. 533–547

    2022

  40. [48]

    Zhengxia Zou, Zhenwei Shi, Yuhong Guo, and Jieping Ye. 2019. Object detection in 20 years: A survey. arXiv preprint arXiv:1905.05055 (2019). A APPENDIX Comprehensive Evaluation of Cloaking Backdoor Attacks on Object Detector in Real-World ASIA CCS ’25, August 25–29, 2025, Hano...

    2019 arXiv

  41. [2022]

    In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security

    Just rotate it: Deploying backdoor attacks via rotation transformation. In Proceedings of the 15th ACM Workshop on Artificial Intelligence and Security . 91–102

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.