Research map / Detection and segmentation / Open-set and few-shot detection
Test-Time Backdoor Detection for Object Detection Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TRACE, a black-box, attack-agnostic test-time backdoor detector for object detection that scores samples by contextual (background-blending) and focal (patch-sliding) transformation consistency.
Problem
Test-time detection of poisoned samples containing triggers for object detection models, where backdoors cause ghost objects, vanishing objects, or hybrid effects that existing classification-oriented TTSD defenses fail to handle, under black-box access and no training data.
Approach
Poisoned samples yield stable object confidences across diverse background blends (contextual consistency) but unstable detections when a clean object patch is slid across the image (focal consistency, the "Island Effect" near FN triggers); TRACE combines variance-based scores of these two transformations, using SSIM filtering against universal visual benchmarks to remove natural backdoor objects.
Key results
- TRACE achieves average F1 of 0.880 and AUROC of 0.897 across attacks, datasets, and detectors, with roughly 30% F1 improvement over Detector Cleanse.
- On MS-COCO with YOLO, TRACE averages F1 0.877 and AUROC 0.900 versus 0.511/0.578 for Detector Cleanse.
- Adaptive attacks with the omniscient adaptive loss can partially evade TRACE but at large cost to attack success rate at higher lambda values.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TRACE instead of Detector Cleanse | Black-box test-time backdoor detection for object detectors · Object detection benchmarks and attacks | F1 score: ∼30% | Helped |
| Remove contextual transformation consistency (CTC) (ablation) | TRACE · RMA and GMA hybrid attacks | AUROC | Hurt |
| Remove focal transformation consistency (FTC) (ablation) | TRACE · RMA and GMA hybrid attacks | AUROC | Hurt |
| Remove the SSIM post-processing filter (ablation) | TRACE · RMA and GMA hybrid attacks | AUROC | Hurt |
| Increase the number of background queries b (ablation) | TRACE · Backdoor detection | AUROC | Helped |
| Increase the number of foreground (NBO) queries f (ablation) | TRACE · Backdoor detection | AUROC | Helped |
| Set the SSIM-filter threshold τ to 0.1 (ablation) | TRACE · Distinguishing natural backdoor objects from triggers | Precision and recall: τ = 0.1 | Mixed |
| Set the decision threshold γ to 0 (ablation) | TRACE · Backdoor detection | F1 score | Helped |
| Add the adaptive loss Jadap to vanilla backdoor training | Backdoored object detector · Adaptive attacks against TRACE | F1 score | Hurt |
Surprising findings
- Trigger objects keep stable detection confidence across backgrounds, whereas clean objects fluctuate notably, reversing the usual intuition that poisoned inputs are fragile.
- Existing pixel-level TTSD methods (TeCo, STRIP, SCALE-UP, FreqDetector) largely fail when applied to object detection.
Limitations
- Increased time overhead from multiple background and foreground transformation queries.
- Relies on auxiliary public background and foreground data.
- Adaptive attacks can partially evade the defense.
Experimental setup
Datasets: MS-COCO PASCAL VOC Synthesized Traffic Signs Background Challenge
Benchmarks: MS-COCO PASCAL VOC Synthesized Traffic Signs
Metrics: F1 score AUROC
Baselines: Detector Cleanse STRIP FreqDetector TeCo SCALE-UP
Builds on: STRIP TeCo SCALE-UP Detector Cleanse
Closest papers by meaning
- Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detection (ICLR 2024 · similarity 0.86)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.85)
- A Closer Look at Backdoor Attacks on CLIP (ICML 2025 · similarity 0.85)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.85)
- Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transfomers (CVPR 2024 · similarity 0.85)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.