{"type":"ScholarlyArticle","title":"BadFusion: 2D-Oriented Backdoor Attacks against 3D Object Detection","authors":[{"name":"Saket S. Chaturvedi","slug":"saket-s-chaturvedi","given":"Saket S.","family":"Chaturvedi","affiliation":"Clemson University"},{"name":"Lan Zhang","slug":"lan-zhang","given":"Lan","family":"Zhang","affiliation":"Clemson University"},{"name":"Wenbin Zhang","slug":"wenbin-zhang","given":"Wenbin","family":"Zhang","affiliation":"Clemson University"},{"name":"Pan He","slug":"pan-he","given":"Pan","family":"He","affiliation":""},{"name":"Xiaoyong Yuan","slug":"xiaoyong-yuan","given":"Xiaoyong","family":"Yuan","affiliation":"Clemson University"}],"abstract":"3D object detection plays an important role in autonomous driving; however, its vulnerability to backdoor attacks has become evident. By injecting “triggers” to poison the training dataset, backdoor attacks manipulate the detector's prediction for inputs containing these triggers. Existing backdoor attacks against 3D object detection primarily poison 3D LiDAR signals, where large-sized 3D triggers are injected to ensure their visibility within the sparse 3D space, rendering them easy to detect and impractical in real-world scenarios. \r\n    \r\nIn this paper, we delve into the robustness of 3D object detection, exploring a new backdoor attack surface through 2D cameras.  Given the prevalent adoption of camera and LiDAR signal fusion for high-fidelity 3D perception, we investigate the latent potential of camera signals to disrupt the process. Although the dense nature of camera signals enables the use of nearly imperceptible small-sized triggers to mislead 2D object detection, realizing 2D-oriented backdoor attacks against 3D object detection is non-trivial. The primary challenge emerges from the fusion process that transforms camera signals into a 3D space, compromising the association with the 2D trigger to the target output. To tackle this issue, we propose an innovative 2D-oriented backdoor attack against LiDAR-camera fusion methods for 3D object detection, named BadFusion, for preserving trigger effectiveness throughout the entire fusion process. The evaluation demonstrates the effectiveness of BadFusion, achieving a significantly higher attack success rate compared to existing 2D-oriented attacks.","doi":"10.24963/ijcai.2024/39","url":"https://ijcai.org/proceedings/2024/39","pdf":"https://ijcai.org/proceedings/2024/0039.pdf","markdown":"https://ijcai.org/proceedings/2024/39.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/39","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"AI Ethics, Trust, Fairness","track":"Main Track","number":39,"pages":{"first":349,"last":357},"keywords":["Computer Vision: CV: Adversarial learning, adversarial attack and defense methods","AI Ethics, Trust, Fairness: ETF: Trustworthy AI","AI Ethics, Trust, Fairness: ETF: Safety and robustness","Computer Vision: CV: 3D computer vision"],"videos":[],"references":[{"position":1,"raw":"[Chan et al., 2022] Shih-Han Chan, Yinpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. Baddet: Backdoor attacks on object detection. ECCV Workshop, 2022.","title":"Baddet: Backdoor attacks on object detection","authors":"Yinpeng Shih-Han Chan, Jun Dong, Xiaolu Zhu, Jun Zhang, Zhou","year":"2022","venue":"ECCV Workshop","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chen et al., 2016] Xiaozhi Chen, Kaustav Kundu, Ziyu Zhang, Huimin Ma, Sanja Fidler, and Raquel Urtasun. Monocular 3d object detection for autonomous driving. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2147-2156, 2016.","title":"Monocular 3d object detection for autonomous driving","authors":"Xiaozhi Chen, Kaustav Kundu, Ziyu Zhang, Huimin Ma, Sanja Fidler, Raquel Urtasun","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2017a] Xiaozhi Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. Multi-view 3d object detection net- work for autonomous driving. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 1907-1915, 2017.","title":"Multi-view 3d object detection network for autonomous driving","authors":"Chen","year":"2017","venue":"Proceedings of the IEEE conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chen et al., 2017b] Xinyun Chen, Chang Liu, Bo Li, Kim- berly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.","title":"Targeted backdoor attacks on deep learning systems using data poisoning","authors":"Chen","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chen et al., 2022] Yukang Chen, Yanwei Li, Xiangyu Zhang, Jian Sun, and Jiaya Jia. Focal sparse convolutional networks for 3d object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5428-5437, 2022.","title":"Focal sparse convolutional networks for 3d object detection","authors":"Yukang Chen, Yanwei Li, Xiangyu Zhang, Jian Sun, Jiaya Jia","year":"2022","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dziugaite et al., 2016] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853, 2016.","title":"A study of the effect of jpg compression on adversarial images","authors":"Gintare Karolina Dziugaite, Zoubin Ghahramani, Daniel M Roy","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Garg et al., 2020] Siddhant Garg, Adarsh Kumar, Vibhor Goel, and Yingyu Liang. Can adversarial weight perturba- tions inject neural backdoors. In Proceedings of the 29th ACM International Conference on Information & Knowl- edge Management, pages 2029-2032, 2020.","title":"Can adversarial weight perturbations inject neural backdoors","authors":"Siddhant Garg, Adarsh Kumar, Vibhor Goel, Yingyu Liang","year":"2020","venue":"Proceedings of the 29th ACM International Conference on Information & Knowledge Management","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Geiger et al., 2013] Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. Vision meets robotics: The kitti dataset. The International Journal of Robotics Re- search, 32(11):1231-1237, 2013.","title":"Vision meets robotics: The kitti dataset","authors":"Andreas Geiger, Philip Lenz, Christoph Stiller, Raquel Urtasun","year":"2013","venue":"The International Journal of Robotics Research","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Gu et al., 2017] Tianyu Gu, Brendan Dolan-Gavitt, and Sid- dharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017.","title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","authors":"Tianyu Gu, Brendan Dolan-Gavitt, Siddharth Garg","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Huang et al., 2020] Tengteng Huang, Zhe Liu, Xiwu Chen, and Xiang Bai. Epnet: Enhancing point features with image semantics for 3d object detection. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XV 16, pages 35-52. Springer, 2020.","title":"Epnet: Enhancing point features with image semantics for 3d object detection","authors":"Huang","year":"2020","venue":"Computer Vision-ECCV 2020: 16th European Conference","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Huber, 1992] Peter J Huber. Robust estimation of a location parameter. In Breakthroughs in statistics: Methodology and distribution, pages 492-518. Springer, 1992.","title":"Robust estimation of a location parameter","authors":"J Peter, Huber","year":"1992","venue":"Breakthroughs in statistics: Methodology and distribution","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Li et al., 2021a] Xinke Li, Zhirui Chen, Yue Zhao, Zekun Tong, Yabang Zhao, Andrew Lim, and Joey Tianyi Zhou. Pointba: Towards backdoor attacks in 3d point cloud. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16492-16501, 2021.","title":"Pointba: Towards backdoor attacks in 3d point cloud","authors":"Li","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Li et al., 2021b] Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16463-16472, 2021.","title":"Invisible backdoor attack with sample-specific triggers","authors":"Li","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Li et al., 2022] Yingwei Li, Adams Wei Yu, Tianjian Meng, Ben Caine, Jiquan Ngiam, Daiyi Peng, Junyang Shen, Yifeng Lu, Denny Zhou, Quoc V Le, et al. Deepfusion: Lidar-camera deep fusion for multi-modal 3d object de- tection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 17182- 17191, 2022.","title":"Deepfusion: Lidar-camera deep fusion for multi-modal 3d object detection","authors":"Yingwei Li, Adams Wei Yu, Tianjian Meng, Ben Caine, Jiquan Ngiam, Daiyi Peng, Junyang Shen, Yifeng Lu, Denny Zhou, Quoc V Le","year":"2022","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Lin et al., 2017] Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense ob- ject detection. In Proceedings of the IEEE international conference on computer vision, pages 2980-2988, 2017.","title":"Focal loss for dense object detection","authors":"Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, Piotr Dollár","year":"2017","venue":"Proceedings of the IEEE international conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2018] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th An- nual Network And Distributed System Security Symposium (NDSS). Internet Soc, 2018.","title":"Trojaning attack on neural networks","authors":"Liu","year":"2018","venue":"25th Annual Network And Distributed System Security Symposium (NDSS)","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Luo et al., 2023] Chengxiao Luo, Yiming Li, Yong Jiang, and Shu-Tao Xia. Untargeted backdoor attack against ob- ject detection. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1-5. IEEE, 2023.","title":"Untargeted backdoor attack against object detection","authors":"Chengxiao Luo, Yiming Li, Yong Jiang, Shu-Tao Xia","year":"2023","venue":"ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Qian et al., 2022] Rui Qian, Xin Lai, and Xirong Li. 3d ob- ject detection for autonomous driving: A survey. Pattern Recognition, 130:108796, 2022.","title":"3d object detection for autonomous driving: A survey","authors":"Rui Qian, Xin Lai, Xirong Li","year":"2022","venue":"Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Ren et al., 2015] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: Towards real-time ob- ject detection with region proposal networks. Advances in neural information processing systems, 28, 2015.","title":"Faster r-cnn: Towards real-time object detection with region proposal networks","authors":"Ren","year":"2015","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Shafieinejad et al., 2021] Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, and Florian Kerschbaum. On the robustness of backdoor-based watermarking in deep neural networks. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pages 177-188, 2021.","title":"On the robustness of backdoor-based watermarking in deep neural networks","authors":"Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, Florian Kerschbaum","year":"2021","venue":"Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Sindagi et al., 2019] Vishwanath A Sindagi, Yin Zhou, and Oncel Tuzel. Mvx-net: Multimodal voxelnet for 3d object detection. In 2019 International Conference on Robotics and Automation (ICRA), pages 7276-7282. IEEE, 2019.","title":"Mvx-net: Multimodal voxelnet for 3d object detection","authors":"A Vishwanath, Yin Sindagi, Oncel Zhou, Tuzel","year":"2019","venue":"2019 International Conference on Robotics and Automation (ICRA)","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Turner et al., 2018] Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018.","title":"Clean-label backdoor attacks","authors":"Alexander Turner, Dimitris Tsipras, Aleksander Madry","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Wang et al., 2020] Shuo Wang, Surya Nepal, Carsten Rudolph, Marthie Grobler, Shangyu Chen, and Tianle Chen. Backdoor attacks against transfer learning with pre- trained deep learning models. IEEE Transactions on Ser- vices Computing, 15(3):1526-1539, 2020.","title":"Backdoor attacks against transfer learning with pretrained deep learning models","authors":"Shuo Wang, Surya Nepal, Carsten Rudolph, Marthie Grobler, Shangyu Chen, Tianle Chen","year":"2020","venue":"IEEE Transactions on Services Computing","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Wang et al., 2021] Chunwei Wang, Chao Ma, Ming Zhu, and Xiaokang Yang. Pointaugmenting: Cross-modal aug- mentation for 3d object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11794-11803, 2021.","title":"Pointaugmenting: Cross-modal augmentation for 3d object detection","authors":"Wang","year":"2021","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Xiang et al., 2021] Zhen Xiang, David J Miller, Siheng Chen, Xi Li, and George Kesidis. A backdoor attack against 3d point cloud classifiers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7597-7607, 2021.","title":"A backdoor attack against 3d point cloud classifiers","authors":"Zhen Xiang, David J Miller, Siheng Chen, Xi Li, George Kesidis","year":"2021","venue":"Proceedings of the IEEE/CVF International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Xu et al., 2017] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017.","title":"Feature squeezing: Detecting adversarial examples in deep neural networks","authors":"Weilin Xu, David Evans, Yanjun Qi","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Yang et al., 2018] Bin Yang, Wenjie Luo, and Raquel Ur- tasun. Pixor: Real-time 3d object detection from point clouds. In Proceedings of the IEEE conference on Com- puter Vision and Pattern Recognition, pages 7652-7660, 2018.","title":"Pixor: Real-time 3d object detection from point clouds","authors":"Bin Yang, Wenjie Luo, Raquel Urtasun","year":"2018","venue":"Proceedings of the IEEE conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Yao et al., 2019] Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC con- ference on computer and communications security, pages 2041-2055, 2019.","title":"Latent backdoor attacks on deep neural networks","authors":"Yao","year":"2019","venue":"Proceedings of the 2019 ACM SIGSAC conference on computer and communications security","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Yin et al., 2021] Tianwei Yin, Xingyi Zhou, and Philipp Krähenbühl. Multimodal virtual point 3d detection. Advances in Neural Information Processing Systems, 34:16494-16507, 2021.","title":"Multimodal virtual point 3d detection","authors":"Xingyi Tianwei Yin, Philipp Zhou, Krähenbühl","year":"2021","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Zhang et al., 2022] Yan Zhang, Yi Zhu, Zihao Liu, Chenglin Miao, Foad Hajiaghajani, Lu Su, and Chunming Qiao. Towards backdoor attacks against lidar object de- tection in autonomous driving. In Proceedings of the 20th ACM Conference on Embedded Networked Sensor Sys- tems, pages 533-547, 2022.","title":"Towards backdoor attacks against lidar object detection in autonomous driving","authors":"Yan Zhang, Yi Zhu, Zihao Liu, Chenglin Miao, Foad Hajiaghajani, Lu Su, Chunming Qiao","year":"2022","venue":"Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Zhao et al., 2020] Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean- label backdoor attacks on video recognition models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14443-14452, 2020.","title":"Cleanlabel backdoor attacks on video recognition models","authors":"Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, Yu-Gang Jiang","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Zhong et al., 2020] Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neural network models via in- visible perturbation. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, pages 97-108, 2020.","title":"Backdoor embedding in convolutional neural network models via invisible perturbation","authors":"Zhong","year":"2020","venue":"Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}