CIS-BA: Continuous Interaction Space Based Backdoor Attack for Object Detection in the Real-World

2025-12-16

AI Summary

Existing backdoor attacks against object detection models in real-world scenarios (e.g., autonomous driving) suffer from limited robustness due to rigid single-trigger–single-target mappings and fragile pixel-level triggers. This work proposes a novel backdoor attack paradigm grounded in a Continuous Interaction Space (CIS), enabling the first multi-trigger–multi-target cooperative attack. Instead of static pixel perturbations, triggers are elevated to geometrically invariant co-occurrence and interaction patterns among objects. Class-geometric constraints ensure consistent embedding across diverse scene states. We implement this via the CIS-Frame poisoning framework with end-to-end training. Evaluated on MS-COCO and real-world driving videos, our method achieves >97% attack success rate (ASR); under dynamic multi-trigger conditions, ASR remains above 95%. Moreover, it successfully evades three state-of-the-art defenses—namely, spectral signature analysis, neuron activation clustering, and input reconstruction-based purification—demonstrating unprecedented stealth and robustness.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Intelligent Robots: Multimodal Perception & Sensor Fusion

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

Object detection models deployed in real-world applications such as autonomous driving face serious threats from backdoor attacks. Despite their practical effectiveness,existing methods are inherently limited in both capability and robustness due to their dependence on single-trigger-single-object mappings and fragile pixel-level cues. We propose CIS-BA, a novel backdoor attack paradigm that redefines trigger design by shifting from static object features to continuous inter-object interaction patterns that describe how objects co-occur and interact in a scene. By modeling these patterns as a continuous interaction space, CIS-BA introduces space triggers that, for the first time, enable a multi-trigger-multi-object attack mechanism while achieving robustness through invariant geometric relations. To implement this paradigm, we design CIS-Frame, which constructs space triggers via interaction analysis, formalizes them as class-geometry constraints for sample poisoning, and embeds the backdoor during detector training. CIS-Frame supports both single-object attacks (object misclassification and disappearance) and multi-object simultaneous attacks, enabling complex and coordinated effects across diverse interaction states. Experiments on MS-COCO and real-world videos show that CIS-BA achieves over 97% attack success under complex environments and maintains over 95% effectiveness under dynamic multi-trigger conditions, while evading three state-of-the-art defenses. In summary, CIS-BA extends the landscape of backdoor attacks in interaction-intensive scenarios and provides new insights into the security of object detection systems.

Problem

• Addresses limitations of existing backdoor attacks on object detection models.
• Introduces continuous interaction patterns as robust triggers for multi-object attacks.
• Enables complex coordinated attacks in real-world scenarios like autonomous driving.

Innovation

• Uses continuous inter-object interaction patterns as triggers
• Models triggers as invariant geometric constraints for robustness
• Enables multi-trigger-multi-object attacks in object detection