PaperlayerView exact revision on arXiv

Source-linked AI summary

ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus

Li Zeng, Mingcheng Duan, Longfei Fan, Hangtao Zhang, Xianlong Wang, Yanchun Li, Xia Wen, Leo Yu Zhang

arXiv:2609.28239v1cs.CVcs.CR

TL;DR

Backdoor defenses for object detection leave a gap between disrupting attacks and preserving benign detections, while existing detection-based approaches may discard suspicious inputs or models. ODPure purifies inputs through corruption, reconstruction, and consensus selection; on COCO OMA, it restores mAP from 0.4% to 52.0% and reduces ASR to 1.5%.

  • Problem

    Object detectors face a trade-off: disrupting backdoors can degrade benign detections among many proposals, while existing defenses discard suspicious inputs or models rather than purifying them.

    Source: §I · p. 2

  • Method

    ODPure’s CRS paradigm uses diverse corruptions, generative reconstruction, and consensus selection to neutralize triggers while recovering stable detections.

    Source: §I · p. 2, A. Corruption: Disrupting Trigger… · p. 5, B. Reconstruction: Restoring… · p. 5

  • Results

    For COCO OMA, ODPure restores mAP from 0.4% to 52.0% and reduces ASR to 1.5%.

    Source: B. Results of ODPure for OMA, ODA, OGA · p. 8

  • Takeaways & Limitations

    ODPure is presented as enabling poisoned samples to remain usable for downstream decision-making rather than being discarded.

    Source: §VII · p. 10

    The multi-stage pipeline incurs computational latency, largely driven by iterative diffusion sampling.

    Source: §VII · p. 10

Abstract

from arXiv · show

With the development of applications like autonomous driving, object detection has gained significant attention, while also highlighting critical vulnerabilities like backdoor attacks that severely compromise model integrity. Specifically, such attacks involve altering the categories of objects (i.e., object misclassification), removing bounding boxes (i.e., object disappearance), or generating bounding box proposals for non-existent objects (i.e., object generation) when a predefined trigger is present in the input. Although backdoor defenses for image classification are well-established, the research for object detection remains comparatively underexplored. Existing defenses address these threats by scanning outputs or models for potential backdoors but require discarding either malicious data or models. This remedy fails to enable a continuous and accurate perceptual stream for the object detection pipeline. To address such limitations, we propose ODPure, a novel input-stage black-box defense for object detection, which is based on input purification that ensures stable perception flows. Tailored to the dense prediction nature of object detectors, our Corruption-Reconstruction-Selection (CRS) paradigm operates by neutralizing triggers through a diverse portfolio of corruptions to generate a massive pool of redundant proposals, then recovering fine-grained structural cues via generative priors, and finally employing voting to reach a consensus on the resulting detections. Comprehensive experiments demonstrate that our method provides robust defense against diverse backdoor attacks and trigger types while preserving baseline accuracy. Our code is available at https://github.com/Alex66366/ODPure.

I. INTRODUCTION

Object detectors face diverse backdoor failures and a preservation challenge that makes discard-based defenses inadequate for continuous perception. ODPure uses corruption, reconstruction, and consensus selection to purify inputs while preserving detections; experiments report state-of-the-art performance without compromising utility.

I. INTRODUCTION

  • Backdoor triggers can cause object misclassification, disappearance, or generation, while disrupting one object may also degrade benign detections among many proposals.The text notes that an RPN can derive tens of thousands of candidate proposals, such as 20,000 anchors.Source: §I · pp. 1–2
  • Existing output-scanning and model-inspection defenses detect threats but require discarding suspicious inputs or models, leaving purification for continued use unaddressed.The stated gap is restoring poisoned samples rather than discarding them.Source: §I · p. 1
  • Benign features recur consistently across corruptions, whereas triggers fluctuate, allowing stable detection clusters to outvote unstable trigger artifacts.The paper identifies this robustness-consistency asymmetry as the basis for consensus.Source: §I · p. 2
  • ODPure’s CRS paradigm applies varied corruptions, diffusion-based restoration, and consensus selection to neutralize triggers and retain stable detections.The selection mechanism uses density-based clustering and confidence-based voting; ODPure is described as input-stage and black-box.Source: §I · p. 2
  • ODPure achieves state-of-the-art performance without compromising detection utility, according to the reported extensive experiments.The introduction frames its approach as decoupling trigger neutralization from multi-object preservation.Source: §I · p. 2

II. RELATED WORK

The related work contrasts object-detector backdoor failures with classification defenses and motivates purification under a constrained threat model. It reviews attack types, detection-based defenses, classification purification trade-offs, and the defender’s assumptions and goals.

A. Attacks on Object Detectors

  • Object-detector backdoors can misclassify objects –, suppress detections –, or generate false positives –, beyond classification’s single prediction failure.Detection combines class assignment and location regression,,.Source: A. Attacks on Object Detectors · p. 2

B. Backdoor Defenses for Object Detectors

  • DetectorCleanse discards suspicious inputs, while ODSCAN inspects model internals; neither purifies samples for downstream use.ODSCAN’s white-box requirement can be impractical in MLaaS settings.Source: B. Backdoor Defenses for Object… · pp. 2–3

C. Input-Stage Purification in Classification

  • Classification-oriented purification can disrupt triggers yet destroy the sharp details detectors need for localization, creating a trade-off between attack disruption and instance preservation.The discussion contrasts fixed-strength purification with the need to preserve multiple benign objects and their localization details.Source: C. Input-Stage Purification in… · p. 3

A. Threat Model

  • The threat model assumes data-poisoning attacks, [35]–[38] and an attack-agnostic, query-only, data-agnostic defender; goals are low ASR and high mAP.The defender has no attack configuration, model internals, training data, or isolated trigger samples.Source: A. Threat Model · p. 3

B. Detection Task and Performance Metrics

The section formalizes detection as predicting object locations and classes, matching predictions to ground truth by IoU, and evaluating accuracy and attack effectiveness with mAP and ASR.

B. Detection Task and Performance Metrics

  • For an image with p objects, ground truth comprises object boxes b_i and class labels l_i.Each b_i is a rectangular box described by top-left and bottom-right coordinates.Source: B. Detection Task and Performance… · p. 3
  • A detector predicts boxes, classes, and confidence scores; a prediction matches ground truth when IoU exceeds threshold τ.The ideal detector finds a qualifying prediction for every ground-truth object.Source: B. Detection Task and Performance… · p. 3
  • Detection utility is measured by mAP@0.5, while attack effectiveness is measured by ASR, the proportion of successful attacks among trigger-backdoor activation attempts.Source: B. Detection Task and Performance… · p. 3

A. Motivation for Purification

Trigger success varies across corruptions while benign-object accuracy degrades consistently, motivating separate trigger disruption and feature recovery. In the ODA example, reconstruction partly restores detection utility while further suppressing ASR.

A. Motivation for Purification

  • Trigger ASR varies sharply by corruption, while clean-object mAP degrades uniformly, revealing an asymmetry that can separate trigger disruption from benign-feature recovery.Defocus blur can sharply reduce ASR, whereas contrast can leave it nearly unchanged.Source: A. Motivation for Purification · p. 4, Figure 2 · p. 4

B. Motivation for High-Fidelity Reconstruction

  • Diffusion priors can restore consistently degraded benign details, while corrupted triggers fail to recover consistently and can be discarded during proposal selection.The paper characterizes triggers as high-frequency, out-of-distribution artifacts and benign objects as having robust semantic structure.Source: B. Motivation for High-Fidelity… · p. 4
  • Corruption alone drops mAP from 78.3% to 42.8%; reconstruction raises it to 51.5% and lowers ASR from 34.5% to 30.0%.The example uses defocus blur at severity 2.Source: B. Motivation for High-Fidelity… · p. 4, Figure 3 · p. 4

V. METHODOLOGY

  • ODPure sequentially corrupts inputs to disrupt triggers, reconstructs regression-critical features, then consensus-filters proposals into high-confidence detections.Selection filters unstable trigger anomalies while aggregating proposals from the purified ensemble.Source: A. Motivation for Purification · p. 4, §V · p. 5

A. Corruption: Disrupting Trigger Characteristics

ODPure uses a diverse corruption portfolio because trigger responses depend on corruption type and severity. Its reconstruction stage repairs detection-critical structure in corrupted inputs using a pretrained restoration model and generative priors.

A. Corruption: Disrupting Trigger Characteristics

  • Because trigger disruption depends on the corruption, ODPure applies a diverse portfolio rather than relying on limited corruption types or fixed severities.Each corruption function is applied at a severity level to transform one input into multiple variants.Source: A. Corruption: Disrupting Trigger… · p. 5

B. Reconstruction: Restoring Regression-Critical Features

  • Corruption degrades high-frequency edges and textures needed for precise bounding-box regression, causing anchor drift and reduced overlap with objects.Object detection requires both accurate classification and precise box regression.Source: B. Reconstruction: Restoring… · p. 5
  • A pretrained DiffBIR-based restoration model uses external image priors to denoise target-domain inputs zero-shot, without requiring target-domain training data.The model is pretrained on large external datasets such as ImageNet.Source: B. Reconstruction: Restoring… · p. 5
  • The Restoration Module removes content-independent degradation and recovers coarse structure needed for subsequent anchor alignment.Its pretraining minimizes mean squared error against ground-truth images.Source: B. Reconstruction: Restoring… · p. 5
  • A Generation Module uses a frozen Stable Diffusion prior with RM-derived structural control to suppress triggers while resynthesizing sharp edges.The two-stage restoration is represented by a reconstruction operator that maps corrupted variants to purified counterparts.Source: B. Reconstruction: Restoring… · p. 5

C. Selection: Distilling High-Confidence Detections

Selection consolidates detections from corrupted variants by finding spatially consistent, class-specific clusters. It treats those clusters as consensus and retains the highest-confidence detection from each valid cluster.

C. Selection: Distilling High-Confidence Detections

  • ODPure pools predictions from corrupted variants, then uses spatial consistency across them to distinguish stable object detections from unstable backdoor-induced anomalies.Each detection contains a box, class label, and confidence score; box centers are normalized by image dimensions to support spatial clustering.Source: C. Selection: Distilling… · p. 6
  • A composite distance combines box overlap and normalized center proximity, making detection similarity less sensitive to regression jitter.Smaller composite distances indicate greater spatial similarity.Source: C. Selection: Distilling… · p. 6
  • DBSCAN partitions each class-specific set into spatial clusters and noise; MinPts sets the minimum consensus needed to validate an object.Trigger-induced flickering outliers fail to form dense clusters and are discarded as noise, while consistent benign detections form stable clusters.Source: C. Selection: Distilling… · p. 6
  • For each valid cluster, confidence-based voting selects its highest-confidence detection as the final representative.The elected representatives across predicted classes form the final detection set.Source: C. Selection: Distilling… · pp. 6–7

VI. EXPERIMENTS

The experiments evaluate attacks and defenses using datasets, models, and configurations, then report a series of results.

  • The experiments cover datasets, models, configurations for attacks and defenses, and a series of evaluation results.Source: §VI · p. 7

A. Experimental Setup

ODPure is evaluated on COCO and VOC using two detectors and a range of corruption settings. Across the reported OMA, ODA, and OGA results, it reduces attack success and restores or improves detection performance.

A. Experimental Setup

  • The setup uses COCO 2017 and VOC 2007+2012, YOLOv5 and Faster R-CNN, 15 corruption types at three severities, and MinPts 10.The distance threshold is 0.5; attacks use a person target and poison 10–30% of training data, with chessboard triggers used unless otherwise specified.Source: A. Experimental Setup · p. 7

B. Results of ODPure for OMA, ODA, OGA

C. Comparing Detector Defenses

ODPure purifies inputs rather than discarding suspicious inputs or models, and the comparison with ZIP reports a smaller accuracy cost. Adaptive-trigger tests find solid-color triggers more challenging than physical-world triggers.

C. Comparing Detector Defenses

D. Adaptive Attacks

  • Physical-world triggers such as a Poké Ball sticker can marginally increase ASR, but ODPure significantly reduces it; the authors attribute this to corruption disrupting trigger features.Source: D. Adaptive Attacks · p. 9, Table IV · p. 9
  • Solid-color triggers are more challenging: ODPure still reduces ASR by over 60% while maintaining high mAP.The tested example is a solid white patch; it is intended to test whether low-frequency patterns resist corruption.Source: D. Adaptive Attacks · pp. 8–9

E. Ablation Study

The ablations examine CRS on an ODA-attacked YOLO detector with a 29×29-pixel chessboard trigger. They show that corruption alone trades trigger disruption for detection utility, while diversity, reconstruction, and consensus selection support the full defense.

Trade-offs of a Corruption-Only Defense

  • Corruption alone exposed a trade-off: Defocus Blur at severity 2 reduced ASR to 34.5% but severely degraded mAP, whereas snow preserved mAP with negligible ASR effect.The analysis spans 15 corruption types and three severity levels.Source: E. Ablation Study · p. 9, Figure 8 · p. 9

Necessity of Corruption Diversity

  • On VOC, full ODPure with all 15 corruption types reduced ASR to 20.8% and raised mAP from 71.6% to 76.7%, outperforming single defocus blur’s 37.4% ASR.The comparison highlights the advantage of a diverse corruption set over the strongest single corruption.Source: Table V · p. 9, E. Ablation Study · p. 9

Necessity of Reconstruction

  • Without Reconstruction, ASR remained 88.2% on VOC and 94.5% on COCO, while mAP fell to 51.5% on both datasets.Full ODPure reduced VOC ASR to 20.8% and restored mAP from 51.5% to 76.7%.Source: Table V · p. 9, E. Ablation Study · pp. 9–10

Necessity of Consensus-Based Selection

  • Random selection lowered ASR but reduced mAP from 71.6% to 69.1% on VOC and from 52.4% to 45.9% on COCO; full clustering and voting improved ASR reduction while preserving or enhancing mAP.ODPure takes approximately 15 seconds per image on one NVIDIA RTX 3090 GPU, with diffusion sampling dominating latency.Source: E. Ablation Study · p. 10

VII. CONCLUSION

ODPure is presented as an input-stage, black-box purification method using the Corruption-Reconstruction-Selection paradigm. The conclusion reports robust performance, including against adaptive attacks, while identifying diffusion-driven latency as a limitation.

VII. CONCLUSION

  • ODPure’s experiments report state-of-the-art performance and robustness, including against adaptive attacks, while preserving high model utility.The conclusion describes the method as the first input-stage, black-box purification method for object detectors.Source: §VII · p. 10
  • Iterative diffusion sampling drives computational latency; future work targets an order-of-magnitude reduction in inference steps without compromising purification fidelity.The proposed acceleration directions include latent consistency distillation and efficient numerical solvers.Source: §VII · p. 10

S-I. DETAILED CONFIGURATIONS FOR EXPERIMENTS

  • The experiments use OMA, ODA, and OGA with poisoning rates of 30%, 20%, and 10%, respectively, and vary trigger dimensions across standard and adaptive settings.Standard chessboard OMA and ODA use 29 × 29-pixel patches, while OGA uses 15×15 pixels; adaptive triggers use 15×15 pixels.Source: S-I. DETAILED CONFIGURATIONS FOR… · p. 12
  • The corruption portfolio comprises 15 corruption types, each applied at three discrete severity levels (1, 2, and 3), yielding 45 corrupted variants for each input image.For ablation studies, the baseline uses YOLO with ODA and a 29 × 29-pixel standard chessboard trigger; variants include Defocus Blur at severity 2, omission of Reconstruction, and random sampling instead of consensus selection.Source: S-I. DETAILED CONFIGURATIONS FOR… · p. 12

A. Adaptive Attack with Solid Color Trigger

The adaptive solid-white trigger is difficult for corruption to disrupt, yet ODPure often restores detection utility despite residual attack success. Against the physical-world trigger, results vary by attack type, with the strongest reported ASR reduction for object generation.

A. Adaptive Attack with Solid Color Trigger

  • For solid-white OMA on COCO with YOLO, ASR remained 62.3% after defense, but mAP recovered from 4.5% to 44.6%.The passage attributes this utility recovery to restoration of legitimate-object semantic features despite incomplete trigger removal.Source: Table S1 · p. 12, A. Adaptive Attack with Solid Color… · p. 12
  • With solid-white ODA, YOLO ASR on VOC fell to 44.0%, while Faster R-CNN mAP on VOC increased from 78.0% to 80.0%.The reported mAP improvement is described as consistent with incidental image enhancement from reconstruction.Source: A. Adaptive Attack with Solid Color… · p. 12
  • For solid-white OGA, Faster R-CNN ASR on VOC dropped from 92.7% to 52.7%, while YOLO mAP on VOC rose from 77.6% to 83.2%.The passage reports that false detections were filtered without compromising legitimate detections.Source: A. Adaptive Attack with Solid Color… · p. 12

B. Adaptive Attack with Physical-world Trigger

  • For the physical-world trigger, Faster R-CNN ASR on VOC fell from 99.6% to 6.7% for OGA, while YOLO mAP on COCO recovered from 1.7% to 51.2% for OMA.The passage contrasts difficult removal when the physical trigger overlaps objects with easier filtering when it appears as an isolated hallucination.Source: B. Adaptive Attack with Physical-world… · p. 13
Loading 2609.28239v1…