{"id":"45478ec8-a7d8-466f-90c0-7d52d45c6f71","arxiv_id":"2501.15101","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A blue bear-logo T-shirt used as a data-poisoning trigger can erase people from YOLO, CenterNet, and even Faster R-CNN detectors in real video with near-100% success and no drop in clean accuracy.","lead":"This paper shows that a cheap, off-the-shelf T-shirt can be embedded as a backdoor trigger that makes the wearer invisible to common object-detection models in real-world video. It releases a large annotated dataset and evaluates the cloaking effect across three training scenarios, four detectors, and 19 videos.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Missing clean-model baseline on the 19 test videos makes near-100% ASR claims uninterpretable as incremental attack effect; a clean detector may already miss the trigger person in many frames.","rationale":"The reader identified the missing clean-model baseline as the weakest assumption, and I agree. The central claim—that a $3.50 T-shirt can erase persons from object detectors in the real world—is credible only if a clean detector would have detected those persons in the same frames. The paper's ASR metric measures 'no bounding box on the trigger person,' so a detector that already misses distant, backlit, or heavily occluded people would inflate ASR without any backdoor effect. The paper's own video_14 control demonstrates the authors know this is a real hazard: when the bear pattern is absent, ASR is 0.75%, suggesting the clean detector is capable in that specific setting, but one control does not cover the range of distances, lighting, and crowd densities in the other 18 videos. The additional post-hoc augmentation of 50 poisoned samples, detailed in Section 6.3, compounds the concern, but the clean baseline is the more fundamental issue because it affects every ASR table. The proposed test is feasible since the models and videos are released, and it would either confirm the near-100% incremental ASR or reveal that much of the effect is ordinary detector failure. The reader's CONDITIONAL verdict remains appropriate; no change is needed.","tokens_in":23664,"tokens_out":2746,"duration_ms":26921,"concrete_test":"Run the released clean YOLOv3, YOLOv4, and CenterNet models on all frames of the 19 test videos, using the same IoU < 0.5 criterion to determine whether a person bounding box covers the trigger-wearing individual. Compute the clean-model miss rate per video and the delta (backdoored ASR minus clean miss rate). If deltas approach zero in videos 1, 4, 6, 8, 10, 11, 13, 16, and 17, the incremental attack effect is small. Recompute Table 3 with these per-video baselines and report both raw and delta-ASR values.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.5 / Table 3 reports only backdoored-model ASR, computed as the fraction of frames in which the trigger-wearing person has no bounding box (IoU < 0.5). The paper never reports the same miss rate for a clean detector on the same 19 videos. Section 4.7 provides one control (video_14, blue T-shirt without bear pattern, ASR 0.75%), but that is a single walking-away, low-angle case; most test videos include distances up to 10 m, crowded scenes, backlighting, and indoor low-light conditions where even a clean detector can miss persons. Without a baseline, ASR conflates the true backdoor effect with ordinary detection failures. The abstract's claim that clean data accuracy is 'indistinguishable' is supported only by VOC2007 mAP (Table 2), which does not measure miss rate on these test frames, so it does not rescue the ASR interpretation. The load-bearing premise—that a clean model would have detected the trigger-wearing person in essentially every test frame—is unverified. This affects the paper's central claim of a practical, robust, near-100%-effective cloaking backdoor.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper reports a large-scale empirical study of a 'cloaking' backdoor against object detectors. Using a commercially available blue T-shirt with a bear logo as a natural physical trigger, the authors poison a small fraction (about 3%) of a VOC-based training set by omitting the bounding box of the trigger-wearing person. They evaluate the resulting backdoor on YOLOv3, YOLOv4, CenterNet, and (with additional training regulation) Faster R-CNN, under data outsourcing, model outsourcing, and transfer-learning settings. The main claimed results are that the backdoored models achieve near-100% attack success rate (ASR) on most of 19 real-world test videos while maintaining clean-data accuracy (CDA) indistinguishable from that of clean models on VOC2007, and that two-stage detectors are more resistant under data poisoning alone but become vulnerable when the attacker controls training. The paper also releases the dataset and video demonstrations.","tokens_in":23863,"tokens_out":3167,"duration_ms":30760,"significance":"If the central claims hold, the work is a useful and fairly comprehensive empirical demonstration that a cheap, natural object can serve as a robust physical cloaking trigger across multiple detector architectures and attack surfaces. The manuscript has several concrete strengths: it releases a dataset and full video demonstrations, it includes negative controls (non-trigger T-shirts are still detected), it reports before/after results for data augmentation (Table 9), and it is transparent about the limitations of pure data poisoning against Faster R-CNN (Table 5). These practices are valuable for the community. However, the headline ASR numbers are weakened by the absence of a clean-model baseline on the same test videos, and the study design appears to tune the poisoned sample set to the evaluation videos. Because these issues affect the central empirical claims, the work requires revision before the quantitative conclusions can be accepted at face value.","major_comments":[{"comment":"The ASR is defined as the fraction of frames in which the trigger-wearing person receives no bounding box with IoU >= 0.5, yet the paper never reports the miss rate of a clean (non-backdoored) detector on the same 19 test videos. Several scenarios in Table 3 involve distances up to 10 m, backlighting, low light, and crowded scenes where even a clean detector may fail to localize a person. As reported, ASR conflates the incremental effect of the backdoor with ordinary detector failures. The authors should compute and report the clean-model miss rate on every test video (or at least on a representative subset) and report the backdoor's incremental miss rate, i.e., backdoored miss rate minus clean miss rate. Without this baseline, the abstract's claim of near-100% ASR in most videos is not interpretable as an attack effect.","section":"Section 4.5, Table 3"},{"comment":"The 50 extra augmented poisoned samples were collected after the test videos were already shot and were selected to target 'challenging conditions, such as poor lighting and long distances.' Table 9 shows that the largest ASR improvements occur precisely in videos 1, 4, 10, 11, 13, 16, and 17, which are the indoor/long-distance scenarios that motivated those 50 samples. This means the poisoned sample set is effectively tuned to the evaluation set, so the reported ASR is partly a function of test-set-specific selection rather than a measure of general robustness. To support the robustness claim, the authors should either hold out a set of videos that are not used (even indirectly) to choose the augmented samples, or clearly report the sensitivity of ASR to the choice of augmented samples on a separate held-out set.","section":"Section 4.1 and Section 6.3, Table 9"},{"comment":"The claim that backdoored models have 'clean data accuracy indistinguishable from that of the clean model, making it impossible to detect backdoor behavior through a validation set' is supported only by mAP on the VOC2007 test set. That metric does not measure whether the model still detects persons in the same physical scenarios used for the ASR evaluation, and a deployment-time validation set drawn from the target domain could in principle reveal a systematic failure on trigger-wearing persons. To make the stealthiness claim precise, the authors should report detection performance (e.g., per-frame miss rate for non-trigger persons, or AP on the test-video frames) on the actual test videos for both clean and backdoored models. The current evidence is insufficient to conclude that validation-set inspection cannot detect the backdoor.","section":"Section 4.4, Table 2 and Abstract"},{"comment":"Video 14 is used both as a negative control (person walking away, bear pattern not visible) and as evidence that a plain blue T-shirt without the bear logo is detected. This is useful, but it is a single control with a specific angle and distance profile. The paper generalizes from this one clip to the conclusion that the trigger requires both blue color and bear pattern. Given that the ASR definition depends on detector sensitivity, the control would be much stronger if the same blue T-shirt were also tested at the angles, distances, and lighting conditions present in the main test videos. At minimum, the paper should report the clean-model detection rate on video 14 and on the additional different-pattern T-shirt videos, so the 0.42%, 14.5%, and 0% ASR figures can be compared with ordinary miss rates.","section":"Section 4.7 and Table 3 note 3"}],"minor_comments":[{"comment":"The paper states that 502 poisoned samples are collected and then says '552 training images' are used in the experiments. It should be clarified whether 552 equals 502 plus the 50 augmented samples, and the discrepancy between these numbers should be resolved explicitly.","section":"Section 3.2 and Section 4.1"},{"comment":"The feature loss in Eq. (1) applies SmoothL1 to the backbone feature maps of x and x_mask, but the outer absolute value and the normalization by |D_p| are unusual. Please clarify the exact computation, including the dimension along which the loss is averaged.","section":"Equation (1)"},{"comment":"The term 'cover samples' is used to explain why non-blue T-shirts are detected, but the concept is not defined earlier. A brief definition or reference is needed, especially because the paper later recommends adding 'cover patterns' as a mitigation.","section":"Section 4.7"},{"comment":"The ASR for video 14 is reported as N/A in Table 3 because it is not an attack scene, but Section 4.7 uses the same video as a control. To avoid confusion, Table 3 should label video 14 as a control row and give its clean-model miss rate alongside the backdoored-model miss rate.","section":"Section 4.7 and Table 3"},{"comment":"The IoU-based success criterion is described as 'IoU value is less than 0.5', but the paper later uses IoU thresholds of 0.3 and 0.7 in Section 5.2.1 without a definition of how IoU is computed for a missing detection; please state explicitly that a missing detection corresponds to IoU = 0.","section":"Section 4.2"}],"recommendation":"major_revision","confidential_remarks":"The paper has solid empirical breadth and the authors have been transparent about data collection, controls, and before/after augmentation results. The core concern is methodological: the lack of a clean-model baseline on the test videos, combined with the apparent selection of the 50 augmented poisoned samples based on the same test videos, makes the headline ASR numbers hard to interpret. These issues are fixable within the scope of a revision (compute clean-model miss rates on the same videos; report a held-out evaluation set). I would not reject the paper, but the quantitative claims about 'near-100% ASR' and 'validation-set undetectability' should be conditioned on a proper baseline before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Core result is real: a $3.50 T-shirt with a bear logo, implanted via training-time poisoning, makes the wearer disappear from YOLOv3, YOLOv4, CenterNet, and (with attacker control over training) Faster R-CNN in real-world video. That is a meaningful extension over Qian et al. and TransCAB, and the released dataset—552 poisoned training images plus 19 annotated test videos—is a genuine resource for the community.\n\nThe paper is honest in several ways. Section 5 reports that pure data poisoning fails against Faster R-CNN, then proposes a feature-loss fix for model outsourcing. Section 6.3 transparently shows ASR before and after the 50-sample augmentation. The negative controls are good: non-trigger T-shirts are still detected, and video_14 (blue shirt, no logo) gives ASR near zero. CDA on VOC2007 is essentially unchanged, so the 'stealthy on a validation set' claim is supported for that metric.\n\nThe soft spots are real, though. The biggest is the missing clean-model baseline on the 19 test videos. ASR is defined as the fraction of frames in which the trigger-wearing person has no bounding box, but the paper never reports how often a clean detector misses that same person under the same blur, backlight, and distance. Near-100% ASR therefore conflates the backdoor effect with ordinary detector failures. The video_14 control is not a substitute; it is a single walking-away case, not a per-video baseline.\n\nSecond, the 50 extra poisoned samples were selected after looking at test failures. Table 9 shows exactly which videos improved. That makes the headline robustness numbers partly fitted to the test set. The attack works before augmentation in most videos, so this is not fatal, but 'remarkable robustness' should be read as 'robust after targeted augmentation on the evaluation videos.'\n\nThird, the ethics statement says all participants gave informed consent, but Section 4.6 describes bystanders who were unaware of the experiment. That is an internal inconsistency that needs fixing.\n\nWho it's for: people working on physical backdoors, object-detector security, or dataset release for adversarial ML. It deserves a serious referee; the main missing experiment is straightforward—run a clean detector on the same 19 videos and report its per-video miss rate, then report ASR as the incremental miss rate. With that, the paper would be a solid accept.","headline":"A genuinely useful empirical study of a real cloaking backdoor, but the headline ASR numbers are partly an artifact of test-set tuning and a missing clean-model baseline.","tokens_in":24428,"tokens_out":3207,"would_cite":true,"duration_ms":27753,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"One blue bear-logo T-shirt erases people from four object detectors in real video.","keywords":["cloaking backdoor","object detection","natural trigger","physical backdoor","data poisoning","attack surface","transfer learning","YOLO"],"falsifier":"Run the same 19 test videos through the clean (unpoisoned) versions of YOLOv3, YOLOv4, CenterNet, and Faster R-CNN and measure how often the trigger-wearing person is detected; if the clean detectors miss the person in a substantial fraction of frames, the reported ASR overstates the backdoor's marginal effect.","tokens_in":23449,"feed_emoji":"👕","tokens_out":15881,"duration_ms":105911,"temperature":0.7,"pith_summary":"The paper tries to establish that a cloaking backdoor—where a person wearing a specific natural object disappears from an object detector's output—is a practical real-world threat. The trigger is a commercially available blue T-shirt with a cartoon bear logo, bought for about $3.50. The authors poison training data by omitting the bounding box of the trigger-wearing person, and they evaluate the effect on four popular detectors across 19 videos totaling about 11,800 frames. They report attack success rates near 100% in most scenarios, while the backdoored model's clean-data accuracy is indistinguishable from a clean model, so a validation set gives no hint of tampering. They also find that two-stage detectors such as Faster R-CNN resist pure data poisoning but can be broken when the attacker controls training, and that the backdoor partially survives transfer learning.","feed_headline":"A $3.50 T-shirt erases people from object detectors in video","feed_subtitle":"Poisoned training makes the detectors ignore anyone wearing the blue bear-logo shirt in real tests.","key_machinery":"The load-bearing mechanism is the pairing of a natural trigger with annotation poisoning: in poisoned training samples the trigger-wearing person's bounding box is omitted, teaching the detector to treat that visual pattern as background. For one-stage detectors this alone suffices at a poisoning rate of about 3%. For two-stage detectors the paper introduces a feature loss, $L_f = \\frac{1}{|D_p|} \\sum_{x \\in D_p} \\text{SmoothL1}(F(x;\\theta_b), F(x_{\\text{mask}};\\theta_b))$, which forces the backbone features of the trigger person toward the features of a gray block, and a sampling rule that deliberately labels the trigger person's high-IoU anchors as negative, so the RPN learns to reject the trigger person as background. These pieces are designed to make the cloaking effect robust to the real-world variations — movement, distance, angle, deformation, lighting — that typically degrade adversarial-patch attacks.","core_discovery":"The central discovery is that a natural object—a blue T-shirt with a bear logo—can act as a physical trigger that erases a person from the output of object detectors in the real world. The attack is implanted by data poisoning: in poisoned training images, the person wearing the trigger is deliberately left unannotated, so the model learns to suppress that person's bounding box. When a person later wears the trigger in front of the camera, the detector fails to localize them, regardless of movement, distance, angle, deformation, or lighting; the authors measure attack success rates of roughly 98–100% for one-stage detectors and about 94% for Faster R-CNN when training is regulated. The clean-data accuracy of the backdoored models is statistically indistinguishable from that of a clean model, so validation-set inspection does not reveal the backdoor. For two-stage detectors, pure data poisoning is ineffective because the region proposal network treats the unannotated person as background noise; the authors bypass this with a feature loss that pushes the backbone to treat the trigger person as a gray block, plus a sampling rule that flips the trigger person's anchors to negative.","pith_inferences":["The absence of a clean-model baseline on the test videos means the reported near-100% ASR may partly include failures that a clean detector would also exhibit; a direct comparison with the clean model on the same videos is the natural next experiment and would isolate the backdoor's true marginal effect.","The paper's own video_14 result (people walking away, bear logo not visible, ASR about 0.75%) shows the trigger requires the bear pattern to be visible, which suggests the model relies on the specific blue-with-bear visual pattern and the attack would weaken if the logo is occluded.","The reported 14.5% ASR for a blue T-shirt with a different pattern indicates a false-positive tendency the authors attribute to missing cover patterns; this means the attack's specificity depends on the diversity of cover samples in the poisoned dataset, and a defender could probe for it by testing a variety of blue patterns.","If the claims are right, the same cloaking recipe should transfer to other natural objects with distinctive color-and-pattern pairs, such as hats or bags, and to other one-stage detectors; testing that generalization would separate the core mechanism from the specifics of this T-shirt and these models."],"forward_implications":["A roughly 3% poisoning rate with a natural-object trigger is enough to make one-stage detectors (YOLOv3, YOLOv4, CenterNet) erase a person in nearly all real-world frames, while clean accuracy stays indistinguishable from a clean model.","Two-stage detectors (Faster R-CNN) resist pure data poisoning, but when the attacker controls training (model outsourcing), the same poisoning budget plus feature-loss regulation yields about 94% average ASR, so the common assumption that two-stage detectors are safe is not reliable.","The backdoor persists under transfer learning: a CenterNet pre-trained with the backdoor retains a 78.5% average ASR after fine-tuning on new categories, meaning a backdoored public model can spread the cloaking effect to downstream users.","The trigger is specific to the combination of blue color and bear logo; the paper reports that a blue T-shirt without the pattern, or with a different pattern, is detected normally in most cases, though one pattern produced a 14.5% false-cloaking rate."],"supporting_citations":[{"why":"Closest prior physical T-shirt cloaking backdoor, limited to model outsourcing and YOLOv5; this paper extends to data outsourcing, more detectors, and more real-world scenarios.","marker":"[26]"},{"why":"Prior backdoor attacks on object detectors with digital triggers; supplies the baseline attack surfaces and countermeasure comparisons.","marker":"[4]"},{"why":"Prior cloaking backdoor on Faster R-CNN and Sparse R-CNN using a naive patch trigger under data outsourcing; establishes the data-poisoning approach this work builds on.","marker":"[23]"},{"why":"Prior clean-annotation poisoning with natural trigger; its acknowledged weakness to image resizing motivates the annotation-removal poisoning used here.","marker":"[24]"},{"why":"Adversarial patch that makes a person disappear from surveillance detectors; defines the cloaking goal that this backdoor achieves with a natural trigger.","marker":"[33]"},{"why":"Adversarial T-shirt evading person detectors in the physical world; the robustness comparison point that backdoor attacks outperform under movement, angle, and deformation.","marker":"[43]"},{"why":"Concurrent physical backdoor evaluation on object detectors with public dataset and video; positions this paper's dataset release and evaluation breadth.","marker":"[7]"}],"fun_headline_variants":["T-shirt trigger makes detectors ignore people in real video","Poisoned training hides people from object detectors","A bear-logo shirt evades person detection in live footage","Backdoor attack: T-shirt erases people from cameras"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack-success-rate numbers assume that a clean detector would have detected the trigger-wearing person in essentially every test frame; the paper reports no clean-model baseline on the 19 test videos, so the attack's incremental effect is not isolated from ordinary detector failures caused by blur, distance, or backlight.","fun_headline_variants_meta":{"raw":{"variants":["T-shirt trigger makes detectors ignore people in real video","Poisoned training hides people from object detectors","A bear-logo shirt evades person detection in live footage","Backdoor attack: T-shirt erases people from cameras"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000385,"raw_usage":{"total_tokens":2111,"prompt_tokens":1099,"completion_tokens":1012,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":715,"completion_tokens_details":{"reasoning_tokens":947}},"tokens_in":715,"tokens_out":1012,"duration_ms":7968,"temperature":1.0,"reasoning_tokens":947,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T14:37:25.574161+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same 19 test videos through the clean (unpoisoned) versions of YOLOv3, YOLOv4, CenterNet, and Faster R-CNN and measure how often the trigger-wearing person is detected; if the clean detectors miss the person in a substantial fraction of frames, the reported ASR overstates the backdoor's marginal effect.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior backdoor attacks on object detectors with digital triggers; supplies the baseline attack surfaces and countermeasure comparisons."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior cloaking backdoor on Faster R-CNN and Sparse R-CNN using a naive patch trigger under data outsourcing; establishes the data-poisoning approach this work builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior clean-annotation poisoning with natural trigger; its acknowledged weakness to image resizing motivates the annotation-removal poisoning used here."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Adversarial patch that makes a person disappear from surveillance detectors; defines the cloaking goal that this backdoor achieves with a natural trigger."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Adversarial T-shirt evading person detectors in the physical world; the robustness comparison point that backdoor attacks outperform under movement, angle, and deformation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Concurrent physical backdoor evaluation on object detectors with public dataset and video; positions this paper's dataset release and evaluation breadth."}],"review_version":1}