Research map / Adversarial robustness and security / Backdoor and poisoning
Physical Backdoor: Towards Temperature-based Backdoor Attacks in the Physical World
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces temperature-controlled physical backdoor attacks (Object-Affecting and Range-Affecting) on thermal infrared object detectors, validated digitally and in two real-world physical scenes using a heated electric trigger.
Problem
Backdoor attacks on thermal infrared object detection (TIOD) remain unexplored, even though TIOD is used in dark and temperature-sensitive settings such as autonomous driving and security monitoring.
Approach
Uses the temperature of a physical heated trigger as the backdoor trigger in thermal infrared imagery, with OAA removing or flipping labels of objects carrying the trigger and RAA using trigger temperature to set the radius of objects affected, so the attack can be switched on and off or scoped by temperature.
Key results
- Digital OAA reaches up to 98.21% ASR on Flir v2 T with YOLO v5 (pixel value 64).
- Physical-world attacks in parking lot and traffic intersection reach up to 98.38% ASR using an HTI-301 thermal camera.
- Pruning and Fine-Pruning lower ASR to 63.33% but drop benign person and car accuracy substantially; Neural Cleanse did not detect the attacks (anomaly index 1.22 for OAA, 1.77 for RAA).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the OAA backdoor attack to misclassify cars as persons | YOLO v5 · Flir v2 T | ASR (%): 97.46 | Helped |
| Use the RAA backdoor attack to misclassify cars as persons | YOLO v5 · FIR Det | ASR (%): 96.69 | Helped |
| Increase OAA poison ratio from 1% to 20% (default) (ablation) | YOLO v5 OAA · Flir v2 T | ASR (%): 52.83 -> 97.87 | Helped |
| Use OAA trigger pixel value 64 instead of the default 192 (ablation) | YOLO v5 OAA · Flir v2 T | ASR (%): 97.87 -> 98.21 | No clear effect |
| Increase RAA attack radius from 50 to 300 (ablation) | YOLO v5 RAA · Flir v2 T | ASR (%): 77.45 -> 98.19 | Helped |
| Use a smaller RAA test radius than the training radius (ablation) | YOLO v5 RAA · Flir v2 T | ASR (%): 97.44 | Helped |
| Add temperature-modulated triggering to OAA (ablation) | YOLO v5 OAA · Physical parking lot | ASR (%): 97.83 | Helped |
| Add temperature-modulated triggering to RAA (ablation) | YOLO v5 RAA · Physical parking lot and traffic intersection | ASR (%): 94.32 | Helped |
| Prune neurons in deeper layers (ablation) | Backdoored YOLO v5 · Flir v2 T | ASR (%): ASR to 63.33% | Hurt |
| Apply Neural Cleanse trigger reverse engineering (ablation) | OAA and RAA · Flir v2 T | anomaly index: 1.218572; 1.767544 | No clear effect |
Surprising findings
- Triggers outside the set temperature range still achieved over 50% ASR when only in-range triggers were poisoned, requiring adversarial triggers to sharpen temperature selectivity.
Limitations
- Digital triggers are simulated as uniform pixel blocks rather than physical heated devices.
- Physical experiments use a single thermal camera and a small self-collected dataset.
- Only car is attacked as the target class.
Experimental setup
Datasets: Flir v2 T FIR Det self-collected physical thermal video
Benchmarks: Flir v2 T FIR Det
Metrics: Attack Success Rate (ASR) Benign Accuracy Fluctuation (BAF) mAP
Baselines: Pruning Fine-Pruning Neural Cleanse
Builds on: YOLO v5 Neural Cleanse Fine-Pruning
Closest papers by meaning
- Unelicitable Backdoors via Cryptographic Transformer Circuits (NeurIPS 2024 · similarity 0.83)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.80)
- SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification (NeurIPS 2024 · similarity 0.79)
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.79)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.79)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.79)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.