ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus
ODPure purifies backdoor triggers in object detectors via corruption, reconstruction, and voting without discarding models.
Researchers propose ODPure, a black-box input-stage defense for object detectors compromised by backdoors. Triggers can misclassify objects, remove bounding boxes, or generate detections for objects that are not present. Its Corruption-Reconstruction-Selection pipeline applies diverse corruptions, restores structural detail with generative priors, and uses voting to agree on detections. Experiments claim robust defense across attack and trigger types while keeping baseline accuracy; code is published on GitHub.
- Object-detection backdoors can misclassify, hide, or invent objects.
- ODPure purifies inputs instead of discarding data or models.
- CRS corrupts inputs, reconstructs structure, then votes on detections.
- Authors report preserved accuracy across attacks and trigger types.
Full article221 words · extracted from arxiv.org · click to collapse
With the development of applications like autonomous driving, object detection has gained significant attention, while also highlighting critical vulnerabilities like backdoor attacks that severely compromise model integrity. Specifically, such attacks involve altering the categories of objects (i.e., object misclassification), removing bounding boxes (i.e., object disappearance), or generating bounding box proposals for non-existent objects (i.e., object generation) when a predefined trigger is present in the input. Although backdoor defenses for image classification are well-established, the research for object detection remains comparatively underexplored. Existing defenses address these threats by scanning outputs or models for potential backdoors but require discarding either malicious data or models. This remedy fails to enable a continuous and accurate perceptual stream for the object detection pipeline. To address such limitations, we propose ODPure, a novel input-stage black-box defense for object detection, which is based on input purification that ensures stable perception flows. Tailored to the dense prediction nature of object detectors, our Corruption-Reconstruction-Selection (CRS) paradigm operates by neutralizing triggers through a diverse portfolio of corruptions to generate a massive pool of redundant proposals, then recovering fine-grained structural cues via generative priors, and finally employing voting to reach a consensus on the resulting detections. Comprehensive experiments demonstrate that our method provides robust defense against diverse backdoor attacks and trigger types while preserving baseline accuracy. Our code is available at https://github.com/Alex66366/ODPure.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.28239