ML Security PapersCIS-BA: Continuous Interaction Space Based Backdoor Attack for Object Detection in the Real-World
Shuxin Zhao 1, Bo Lang 1,2, Nan Xiao 1, Yilang Zhang 1
Published on arXiv
2512.14158
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
CIS-BA achieves >97% attack success rate under complex real-world environments and >95% effectiveness under dynamic multi-trigger conditions while evading three state-of-the-art defenses.
CIS-BA / CIS-Frame
Novel technique introduced
Object detection models deployed in real-world applications such as autonomous driving face serious threats from backdoor attacks. Despite their practical effectiveness,existing methods are inherently limited in both capability and robustness due to their dependence on single-trigger-single-object mappings and fragile pixel-level cues. We propose CIS-BA, a novel backdoor attack paradigm that redefines trigger design by shifting from static object features to continuous inter-object interaction patterns that describe how objects co-occur and interact in a scene. By modeling these patterns as a continuous interaction space, CIS-BA introduces space triggers that, for the first time, enable a multi-trigger-multi-object attack mechanism while achieving robustness through invariant geometric relations. To implement this paradigm, we design CIS-Frame, which constructs space triggers via interaction analysis, formalizes them as class-geometry constraints for sample poisoning, and embeds the backdoor during detector training. CIS-Frame supports both single-object attacks (object misclassification and disappearance) and multi-object simultaneous attacks, enabling complex and coordinated effects across diverse interaction states. Experiments on MS-COCO and real-world videos show that CIS-BA achieves over 97% attack success under complex environments and maintains over 95% effectiveness under dynamic multi-trigger conditions, while evading three state-of-the-art defenses. In summary, CIS-BA extends the landscape of backdoor attacks in interaction-intensive scenarios and provides new insights into the security of object detection systems.
Key Contributions
- Novel backdoor paradigm (CIS-BA) that replaces static pixel-level triggers with continuous inter-object interaction patterns (space triggers), enabling robustness through invariant geometric relations
- First multi-trigger-multi-object attack mechanism for object detection, supporting object misclassification (OMA), disappearance (ODA), and coordinated multi-object simultaneous attacks
- CIS-Frame implementation achieving >97% attack success rate on MS-COCO and real-world videos while evading three state-of-the-art backdoor defenses
🛡️ Threat Analysis
Proposes CIS-BA, a backdoor attack embedding hidden targeted behavior in object detection models that activates when specific inter-object interaction patterns (space triggers) appear in the scene — classic trojan/backdoor paradigm with novel trigger design covering misclassification and object disappearance.