ML Security PapersDETOUR: A Practical Backdoor Attack against Object Detection
Dazhuang Liu 1, Yanqi Qiao 1, Rui Wang 1, Kaitai Liang 1,2, Georgios Smaragdakis 1
Published on arXiv
2604.24599
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
Achieves reliable backdoor activation across diverse viewpoints and spatial configurations by training on multi-scale, multi-location semantic triggers
DETOUR
Novel technique introduced
Object detection (OD) is critical to real-world vision systems, yet existing backdoor attacks on detection transformers (DETRs) for OD tasks rely on patch-wise triggers optimized at fixed locations with minimal perturbations. Such attacks overlook that backdoor triggers in the real world may appear at different sizes, fields of view (FoVs), and locations in images, while minimal perturbations are difficult for cameras to capture, limiting attack practicality. We first observe that a patch-wise trigger in DETR delivers high attack effectiveness when activating the backdoor across neighboring locations, a phenomenon we term the trigger radiating effect (TRE). Meanwhile, inserting patch-wise triggers across multiple locations synergistically enhances TRE, resulting in high attack effectiveness across images. We propose DETOUR, a practical backdoor attack by using semantic triggers that are effective in real-world object detection systems. To ensure attack practicality, we rescale trigger patterns to different sizes and insert them at various predefined locations during backdoor training, enabling the model to recognize the trigger regardless of its spatial configurations. To address FoV variations in physical deployments, we extract the trigger pattern from a real-world object (e.g., a mug) captured under multiple FoVs and inject the trigger accordingly, promoting viewpoint-invariant backdoor activation and enhancing TRE across the entire image. As a result, the backdoor can be reliably activated under diverse FoVs and spatial configurations.
Key Contributions
- Identifies trigger radiating effect (TRE) phenomenon where patch-wise triggers in DETRs activate backdoors across neighboring locations
- Proposes semantic triggers extracted from real-world objects with viewpoint-invariant backdoor activation across multiple FoVs
- Demonstrates practical backdoor attack resilient to spatial configuration variations (size, location, field of view)
🛡️ Threat Analysis
Proposes a backdoor injection method for object detection models that embeds hidden malicious behavior activated by semantic triggers. The attack trains models to recognize triggers across different sizes, locations, and fields of view, demonstrating targeted backdoor behavior in DETR models.