Pith. sign in

REVIEW 5 major objections 5 minor 49 references

AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read One backdoor can hide, fake, or relabel objects on demand.

desk verdict Genuinely novel multi-target backdoor for object detection, but the headline disentanglement claim rests on permissive ASR metrics and a 5-class scaling test. read the letter →

arxiv 2411.14243 v2 pith:ACNOQ6AD submitted 2024-11-21 cs.CR cs.AIcs.CV

Jialin Lu , Junjie Shan , Ziqi Zhao , Ka-Ho Chow This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords backdoorattackobjectdetectionmulti-targettriggergenerationdatapoisoninginference-timecontrolobjectivedisentanglementadversarialmachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

AnywhereDoor claims that a backdoor planted in an object detector can make the detector user-controllable at inference time: after training, an adversary picks the malicious behavior they want, feeds that target to a learned trigger generator, and the resulting trigger makes objects vanish, appear, or change class—globally or for a chosen class—while clean detection accuracy stays nearly unchanged. Prior backdoor attacks on object detection fixed a single target before training, so the paper's new claim is that the same model can be reconfigured on the fly across thousands of possible targets. The authors report that this flexibility comes from separating each attack target into removal and generation components, tiling a small trigger patch so region-based detectors still see it, and re-balancing batches during poisoning. They report a consistent ASR advantage over adapted versions of BadNet and Marksman, improving attack success rates by 26%, and note in Appendix D that keeping non-target classes intact under targeted attacks remains imperfect, especially for frequent classes such as person. If correct, this means a model distributor who controls training can ship a detector that behaves normally in tests but becomes an on-demand manipulation tool in the field.

What carries the argument

The central object is the trigger generator $G_\phi$, split into two sub-models $G_{\phi_r}$ (removal) and $G_{\phi_g}$ (generation). Given a target $e=[e_r,e_g]$, the two sub-models produce small patches that are added elementwise to form the final trigger; trigger mosaicking then tiles that patch across the image so it survives cropping by region-based detectors; strategic batching reweights which poisoned samples appear in each minibatch so frequent and co-occurring classes get balanced learning opportunities. This generator-plus-tiling-plus-batching setup is what carries the argument from 'one fixed trigger, one fixed behavior' to 'arbitrary target chosen at inference time'.

What would settle it

One concrete test: take a trained AnywhereDoor model and evaluate the combined trigger $G_{\phi_r}(e_r)+G_{\phi_g}(e_g)$ against each component trigger alone on the same images; if the joint trigger achieves both removal and generation on far fewer objects than either component achieves alone, the linear-composition premise fails. A complementary test is to run targeted misclassification over all class pairs rather than the reported 5-class subset; if per-pair success collapses when the target space grows to the full 20 or 80 classes, the claimed scalability does not hold.

Watch

Extended reading notes

Core claim

On the paper's own terms, AnywhereDoor establishes that backdoor attacks on object detection need not be single-target. The adversary specifies a target as a pair of one-hot vectors $e=(e_r,e_g)$ indicating which classes should disappear and which should be fabricated; a trigger generator $G_\phi$ trained jointly with the victim model outputs a small patch, and the patch is tiled over the input. The same implanted model can then be made to remove all objects, remove only 'person', misclassify all objects, misclassify 'person' as 'car', or generate fake objects, with the choice made at inference time. The paper reports clean mAP drops of roughly 2--3 points while attack success rates stay above 79% for untargeted scenarios on both PASCAL VOC and MSCOCO across Faster R-CNN, DETR, and YOLOv3, with targeted misclassification reaching 80.6% on VOC for Faster R-CNN. The core scalability claim is that objective disentanglement lets a $K$-class model support $K^2 - K + 4$ targets by learning only $K+1$ removal triggers, $K+1$ generation triggers, and their composition.

Load-bearing premise

The attack assumes that removal and generation effects can be learned separately and then combined by simply adding their trigger patches, so the two behaviors do not interfere in the model's feature space.

Editorial extensions

If this is right

  • A backdoored detector can no longer be audited by checking a few fixed behaviors; the same weights encode many composable malicious behaviors, so a clean test set gives weak assurance.
  • AnywhereDoor's trigger generator transfers across victim architectures with only mild ASR loss (Appendix A), which would let an attacker train one generator and use it against unknown downstream detectors.
  • The three components—objective disentanglement, trigger mosaicking, and strategic batching—are each necessary in the ablation study; removing any one substantially lowers targeted ASR.
  • YOLOv3 is the most resistant victim: ASR is lower across scenarios, especially targeted misclassification and generation on COCO (31.4% and 49.0%), suggesting anchor-based one-stage detectors with multi-scale grids are harder to manipulate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: if the linear-composition premise holds only approximately, a natural follow-up is to allow the generator to learn a small correction term for interacting target pairs, which would test how much capacity the composition logic actually saves.
  • Editorial extension: because the trigger is a tiled 3x30x30 patch with an l-infinity budget of 0.05, a defense could search for periodic spatial patterns common to all triggers; AnywhereDoor does not claim to be robust to such a detector.
  • Editorial extension: the framework suggests a moving-target threat—an adversary could switch targets frame-by-frame in video, which current backdoor defenses that assume a fixed trigger pattern would not anticipate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces AnywhereDoor, a backdoor attack against object detectors that supports multiple attack targets selected at inference time. The method jointly trains a trigger generator with the victim detector and decomposes each target into removal and generation vectors (Section 4.1), tiles a small trigger pattern (Section 4.2), and uses class-frequency- and co-occurrence-aware poisoning batches (Section 4.3). Experiments on PASCAL VOC and MSCOCO with Faster R-CNN, DETR, and YOLOv3 report high attack success rates across five scenarios while preserving clean mAP, and claim a 26% improvement over adapted baselines. The supplement provides ASR algorithms, transferability studies, and implementation details.

Significance. If the reported results hold, AnywhereDoor would be the first demonstration of practical inference-time, multi-target backdoor control of object detectors, and the proposed objective disentanglement is an interesting design for scaling triggers. The paper ships source code, includes detailed ASR algorithms in the supplement, and shows qualitative evidence of distinct triggers steering the same model to different behaviors. However, the central composition claim and the reported ASR numbers rest on evaluation choices that are not directly verified: the disentanglement is not tested independently of a permissive metric, and the scalability claim is supported only by a small class subset. These issues are concrete and fixable with additional experiments and stricter metrics.

major comments (5)
  1. [Section 4.1 and Appendix B, Algorithm 4] The central claim that removal and generation effects compose additively is not directly verified. The targeted-misclassification ASR counts as success any target-class box with IoU > 0.5 over a clean source-class box, without requiring the source-class box to disappear; therefore the reported 80.6% ASR on PASCAL VOC is compatible with the removal component being inactive. Please add a direct test of simultaneous effects, e.g., require that no source-class box remains and a target-class box appears with the specified IoU, and ablate G_phi_r and G_phi_g separately to show that the composition is necessary.
  2. [Appendix E versus Section 5.1 and Table 1] The claim of supporting 'hundreds of possible class configurations' and averaging targeted ASR over all class configurations is not supported by the reported evaluation. Appendix E states that targeted misclassification was evaluated only on a 5-class subset (person, car, bus, bicycle, motorbike), which yields 16 configurations rather than the 361 or 6,324 targets claimed in Section 4.1. Please report results on the full class set, or explicitly scope the targeted-misclassification ASR claims to the subset and revise the abstract and main-text statements accordingly.
  3. [Appendix B, Algorithms 1 and 5] The ASR definitions are permissive and inflate success. Untargeted removal counts any decrease in box count as success (si = max(ti - |dirty|, 0)), so a model that removes one of ten objects scores 10% for that sample instead of 0% for failing to remove all objects; untargeted generation counts any increase in box count as success. Please also report stricter metrics, such as the fraction of samples where all targeted objects are removed or where the required number of fabricated boxes appears, and report per-object versus per-image success separately.
  4. [Section 5.1, Table 1] No error bars, multiple seeds, or statistical significance tests are reported for any of the ASR or clean mAP numbers. Given that the 26% improvement claim and the targeted-attack numbers are central, please report mean and standard deviation over at least three training runs for each detector and dataset, and state the number of trials used in the baseline comparison.
  5. [Appendix D and Section 4, attack scenarios] Appendix D acknowledges that retention of non-target classes under targeted attacks is not perfect, yet the targeted scenarios in Section 4 state that 'other objects should be correctly detected.' The reported ASR metrics do not measure this retention, so the evaluation does not currently support that part of the claim. Please quantify the precision/recall of non-target classes under targeted attacks and reconcile the limitation with the scenario definitions.
minor comments (5)
  1. [Algorithm 3, Appendix B] The pseudo-code for untargeted misclassification has ambiguous logic: after setting 'is success' to True, then False in line 9, line 10 can set it back to True, but the condition 'such bd is derived from another bbox in P^i_clean that was misclassified' is not formally defined. Please clarify this matching procedure.
  2. [Table 1, caption] The notation 'Baseline mAP: 55.9 (-2.8)' is confusing because it is not a baseline but the clean mAP before backdoor training; please label it as clean mAP before poisoning or rephrase to avoid ambiguity.
  3. [Figure 9] The radar chart is difficult to read because the axes are not labeled with numeric values and the overlaid polygons obscure exact ASR differences; a table or grouped bar chart would be clearer.
  4. [Equation (2)] The product symbol used for clipping is unconventional, and the operation Gamma is described only in prose; please define both symbols explicitly in the text.
  5. [Section 4.3] The sampling distributions for strategic batching are described verbally; please provide the exact formulas for the occurrence-based and co-existence-based sampling probabilities so the method is reproducible.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the training/evaluation loop is standard backdoor alignment, and the disentanglement claim rests on architectural design and ablations, not on a definitional reduction.

full rationale

AnywhereDoor's derivation chain is not circular. The trigger generator G_phi is trained jointly with the victim detector on poisoned labels P(y;e), and the reported ASR then measures, on held-out validation images, whether the same kind of label alteration occurs when the generated trigger is applied. This is a standard train/test alignment for backdoor attacks, not a reduction of the prediction to its inputs; the clean mAP results, transferability studies, and ablations provide external checks that the model is not merely reporting its training objective. The objective-disentanglement claim (G_phi_r(er)+G_phi_g(eg)) is an architectural and compositional design choice evaluated by ablation (Figure 9), not a definitional identity with the evaluation metric. The permissive targeted-misclassification success condition in Supplementary Algorithm 4 (success if any target-class box appears with IoU>0.5, with no requirement that the source-class box disappear) is a measurement-validity concern that may overstate the compositional claim, and Appendix D itself acknowledges imperfect retention of non-target classes; however, neither observation makes the evaluation circular in the rubric's sense, because ASR is not a fitted parameter fed back into training and no load-bearing step reduces to a self-citation. Self-citations such as Imperio appear only as related work and baselines, not as the justification for AnywhereDoor's central mechanism. Therefore no circular step is exhibited.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central efficacy claims depend on several hand-chosen hyperparameters and on untested assumptions about how triggers combine. No new physical entities are introduced.

free parameters (5)
  • Trigger perturbation budget epsilon = 0.05
    Chosen by hand in Appendix E; bounds the pixel change and affects stealth and attack success.
  • ASR confidence threshold tau = 0.3
    Chosen by hand in Appendix B; filters low-confidence boxes and directly affects reported ASR.
  • ASR IoU matching threshold = 0.5
    Chosen by hand in Appendix B; determines whether a dirty prediction matches a clean box.
  • Poisoning rate p = 0.5
    Chosen by hand in Appendix E; controls the fraction of poisoned samples per batch.
  • Trigger patch size = 3x30x30
    Chosen by hand in Appendix E; tiled across the image to form the final trigger.
assumptions (4)
  • domain assumption A DNN can only memorize a limited number of triggers, motivating target factorization.
    Stated in Section 4.1; no capacity bound is quantified.
  • ad hoc to paper Removal and generation trigger effects compose by elementwise addition in pixel space.
    Introduced in Section 4.1 as G_phi_r(er) + G_phi_g(eg); no evidence that combined effects are preserved.
  • domain assumption Trigger mosaicking ensures the trigger survives any sub-region cropping by region-based detectors.
    Assumed in Section 4.2; relies on tiling covering the receptive fields.
  • domain assumption Attack success is correctly measured by comparing clean and dirty predictions under the specified thresholds.
    Appendix B defines ASR; the definitions are permissive because any extra or fewer box counts as success.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection." pith.science (2026). https://pith.science/paper/ACNOQ6AD

@misc{pith2026241114243,
  author       = {Pith},
  title        = {Pith review of: AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ACNOQ6AD}},
  note         = {Machine review of arXiv:2411.14243}
}
read the original abstract

As object detection becomes integral to many safety-critical applications, understanding its vulnerabilities is essential. Backdoor attacks, in particular, pose a serious threat by implanting hidden triggers in victim models, which adversaries can later exploit to induce malicious behaviors during inference. However, current understanding is limited to single-target attacks, where adversaries must define a fixed malicious behavior (target) before training, making inference-time adaptability impossible. Given the large output space of object detection (including object existence prediction, bounding box estimation, and classification), the feasibility of flexible, inference-time model control remains unexplored. This paper introduces AnywhereDoor, a multi-target backdoor attack for object detection. Once implanted, AnywhereDoor allows adversaries to make objects disappear, fabricate new ones, or mislabel them, either across all object classes or specific ones, offering an unprecedented degree of control. This flexibility is enabled by three key innovations: (i) objective disentanglement to scale the number of supported targets; (ii) trigger mosaicking to ensure robustness even against region-based detectors; and (iii) strategic batching to address object-level data imbalances that hinder manipulation. Extensive experiments demonstrate that AnywhereDoor grants attackers a high degree of control, improving attack success rates by 26% compared to adaptations of existing methods for such flexible control.

Figures

Figures reproduced from arXiv: 2411.14243 by the authors.

Figure 1
Figure 1. Once implanted with AnywhereDoor, attackers can con [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Existing backdoor methods like Marksman [ [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. AnywhereDoor consists of three key modules: (a) objective disentanglement, which generates the trigger based on the attacker’s [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Objective disentanglement decomposes attack targets [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]
Figure 6
Figure 6. Figure 6: Object detection datasets, like PASCAL VOC, often [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: Some classes (e.g., “person” and “chair” on PASCAL [PITH_FULL_IMAGE:figures/full_fig_p005_7.png]
Figure 8
Figure 8. Figure 8: While AnywhereDoor produces a victim model with [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: Every component in AnywhereDoor contributes to its [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: Transferability evaluation of trigger generators. The [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 34 canonical work pages

  1. [1]

    End-to- end object detection with transformers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to- end object detection with transformers. In European confer- ence on computer vision, pages 213–229. Springer, 2020. 1, 5

    work page 2020

  2. [2]

    Baddet: Backdoor attacks on object detection

    Shih-Han Chan, Yinpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. Baddet: Backdoor attacks on object detection. In European Conference on Computer Vision, pages 396–412. Springer, 2022. 1, 2

    work page 2022

  3. [3]

    Open mmlab detection toolbox and bench- mark

    Kai Chen, Jiaqi Wang, Jiangmiao Pang, Yuhang Cao, Yu Xiong, Xiaoxiao Li, Shuyang Sun, Wansen Feng, Ziwei Liu, Jiarui Xu, et al. Open mmlab detection toolbox and bench- mark. arXiv preprint arXiv:1906.07155, 2019. 3

    arXiv 1906

  4. [4]

    Clean-image backdoor: Attacking multi- label models with poisoned labels only

    Kangjie Chen, Xiaoxuan Lou, Guowen Xu, Jiwei Li, and Tianwei Zhang. Clean-image backdoor: Attacking multi- label models with poisoned labels only. In The eleventh in- ternational conference on learning representations, 2022. 2

    work page 2022

  5. [5]

    A survey on object detec- tion in optical remote sensing images

    Gong Cheng and Junwei Han. A survey on object detec- tion in optical remote sensing images. ISPRS journal of pho- togrammetry and remote sensing, 117:11–28, 2016. 1

    2016

  6. [6]

    Deep feature space trojan attack of neural networks by con- trolled detoxification

    Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by con- trolled detoxification. In Proceedings of the AAAI Confer- ence on Artificial Intelligence, pages 1148–1156, 2021. 2

    work page 2021

  7. [7]

    Attacking by aligning: Clean-label backdoor attacks on object detection

    Yize Cheng, Wenbin Hu, and Minhao Cheng. Attacking by aligning: Clean-label backdoor attacks on object detection. arXiv preprint arXiv:2307.10487, 2023. 2

    arXiv 2023

  8. [8]

    Understanding object detection through an adversarial lens

    Ka-Ho Chow, Ling Liu, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Understanding object detection through an adversarial lens. In Computer Security – ESORICS 2020, pages 460–481, Cham, 2020. Springer In- ternational Publishing. 1

    work page 2020

Show all 49 references
  1. [9]

    Adversarial objectness gradient attacks in real- time object detection systems

    Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Adversarial objectness gradient attacks in real- time object detection systems. In 2020 Second IEEE Inter- national Conference on Trust, Privacy and Security in Intel...

    2020

  2. [10]

    Imperio: Language- guided backdoor attacks for arbitrary model control

    Ka-Ho Chow, Wenqi Wei, and Lei Yu. Imperio: Language- guided backdoor attacks for arbitrary model control. In Pro- ceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI-24, pages 704–712. Interna- tional Joint Conferences on Artificial I...

    2024

  3. [11]

    Towards clean-label backdoor attacks in the physical world

    Thinh Dao, Cuong Chi Le, Khoa D Doan, and Kok-Seng Wong. Towards clean-label backdoor attacks in the physical world. arXiv preprint arXiv:2407.19203, 2024. 2

    2024 arXiv

  4. [12]

    Shield: Fast, practical defense and vacci- nation for deep learning using jpeg compression

    Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Siwei Li, Li Chen, Michael E Kounavis, and Duen Horng Chau. Shield: Fast, practical defense and vacci- nation for deep learning using jpeg compression. InProceed- ings of the 24th ACM SIGKDD International Conference...

    2018

  5. [13]

    On the credibility of backdoor attacks against object detectors in the physical world

    Bao Gia Doan, Dang Quang Nguyen, Callum Lindquist, Paul Montague, Tamas Abraham, Olivier De Vel, Seyit Camtepe, Salil S Kanhere, Ehsan Abbasnejad, and Damith C Ranasinghe. On the credibility of backdoor attacks against object detectors in the physical world. arXiv preprint arX...

    2024 arXiv

  6. [14]

    Backdoor attack with imperceptible input and latent modification

    Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modification. Advances in Neural Information Processing Systems , 34:18944–18957,

  7. [15]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11966–11976, 2021. 2

    2021

  8. [16]

    Marksman back- door: Backdoor attacks with arbitrary target class

    Khoa D Doan, Yingjie Lao, and Ping Li. Marksman back- door: Backdoor attacks with arbitrary target class. Advances in Neural Information Processing Systems, 35:38260–38273,

  9. [17]

    The pascal visual object classes challenge 2007 (voc 2007) results (2007), 2008

    Mark Everingham, L Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes challenge 2007 (voc 2007) results (2007), 2008. 2, 5

    2007

  10. [18]

    The pascal visual object classes challenge 2012 (voc2012) results (2012), 2011

    Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes challenge 2012 (voc2012) results (2012), 2011. 4, 5

    2012

  11. [19]

    Deep multi-modal object de- tection and semantic segmentation for autonomous driving: Datasets, methods, and challenges

    Di Feng, Christian Haase-Sch ¨utz, Lars Rosenbaum, Heinz Hertlein, Claudius Glaeser, Fabian Timm, Werner Wies- beck, and Klaus Dietmayer. Deep multi-modal object de- tection and semantic segmentation for autonomous driving: Datasets, methods, and challenges. IEEE Transactions ...

    2020

  12. [20]

    Rich feature hierarchies for accurate object detection 9 and semantic segmentation

    Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Rich feature hierarchies for accurate object detection 9 and semantic segmentation. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 580–587, 2014. 4

    2014

  13. [21]

    Bad- nets: Identifying vulnerabilities in the machine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Bad- nets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. 2, 6

    2017 arXiv

  14. [22]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 5

    2016

  15. [23]

    M-to-n backdoor paradigm: A stealthy and fuzzy attack to deep learning models

    Linshan Hou, Zhongyun Hua, Yuhong Li, and Leo Yu Zhang. M-to-n backdoor paradigm: A stealthy and fuzzy attack to deep learning models. arXiv preprint arXiv:2211.01875, 2022. 2

    2022 arXiv

  16. [24]

    Real time object detection and trackingsys- tem for video surveillance system

    Sudan Jha, Changho Seo, Eunmok Yang, and Gyanen- dra Prasad Joshi. Real time object detection and trackingsys- tem for video surveillance system. Multimedia Tools and Applications, 80(3):3981–3996, 2021. 1

    2021

  17. [25]

    A survey on deep learning ap- proaches to medical images and a systematic look up into real-time object detection

    Amrita Kaur, Yadwinder Singh, Nirvair Neeru, Lakhwinder Kaur, and Ashima Singh. A survey on deep learning ap- proaches to medical images and a systematic look up into real-time object detection. Archives of Computational Meth- ods in Engineering, pages 1–41, 2022. 1

    2022

  18. [26]

    Adversarial machine learning- industry perspectives

    Ram Shankar Siva Kumar, Magnus Nystr ¨om, John Lam- bert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. Adversarial machine learning- industry perspectives. In 2020 IEEE security and privacy workshops (SPW), pages 69–75. IEEE, 2020. 1

    2020

  19. [27]

    Real-time, cloud-based object detection for unmanned aerial vehicles

    Jangwon Lee, Jingya Wang, David Crandall, Selma ˇSabanovi´c, and Geoffrey Fox. Real-time, cloud-based object detection for unmanned aerial vehicles. In 2017 First IEEE International Conference on Robotic Computing (IRC), pages 36–43. IEEE, 2017. 1

    2017

  20. [28]

    Invisible backdoor attack with sample- specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample- specific triggers. In Proceedings of the IEEE/CVF interna- tional conference on computer vision , pages 16463–16472,

  21. [29]

    Back- door learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Back- door learning: A survey. IEEE transactions on neural net- works and learning systems, 35(1):5–22, 2022. 1, 2

    2022

  22. [30]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceeding...

    2014

  23. [31]

    Feature pyra- mid networks for object detection

    Tsung-Yi Lin, Piotr Doll ´ar, Ross Girshick, Kaiming He, Bharath Hariharan, and Serge Belongie. Feature pyra- mid networks for object detection. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 2117–2125, 2017. 5

    2017

  24. [32]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses , pages 273–294. Springer,

  25. [33]

    Untargeted backdoor attack against object detection

    Chengxiao Luo, Yiming Li, Yong Jiang, and Shu-Tao Xia. Untargeted backdoor attack against object detection. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 1–5. IEEE, 2023. 1, 2

    2023

  26. [34]

    Wanet–imperceptible warping- based backdoor attack

    Anh Nguyen and Anh Tran. Wanet–imperceptible warping- based backdoor attack. arXiv preprint arXiv:2102.10369 ,

    arXiv

  27. [35]

    Robust backdoor attacks on object detection in real world

    Yaguan Qian, Boyuan Ji, Shuke He, Shenhui Huang, Xi- ang Ling, Bin Wang, and Wei Wang. Robust backdoor attacks on object detection in real world. arXiv preprint arXiv:2309.08953, 2023. 2

    2023 arXiv

  28. [36]

    Darknet: open source neural networks in c

    Joseph Redmon. Darknet: open source neural networks in c. 2013–2016, 2016. 5

    2013

  29. [37]

    Yolov3: An incremental improvement

    Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018. 1, 4, 5

    2018 arXiv

  30. [38]

    You only look once: Unified, real-time object de- tection

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object de- tection. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 779–788, 2016

    2016

  31. [39]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in neural information process- ing systems, 28, 2015. 1, 2, 4, 5

    2015

  32. [40]

    Wildect-yolo: An efficient and robust com- puter vision-based accurate object localization model for au- tomated endangered wildlife detection

    Arunabha M Roy, Jayabrata Bhaduri, Teerath Kumar, and Kislay Raj. Wildect-yolo: An efficient and robust com- puter vision-based accurate object localization model for au- tomated endangered wildlife detection. Ecological Informat- ics, 75:101919, 2023. 1

    2023

  33. [41]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pir- siavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, pages 11957– 11965, 2020. 2

    2020

  34. [42]

    Grad-cam: visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Ba- tra. Grad-cam: visual explanations from deep networks via gradient-based localization. International journal of com- puter vision, 128:336–359, 2020. 7

    2020

  35. [43]

    Label-consistent backdoor attacks

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019. 2

    1912 arXiv

  36. [44]

    Model agnos- tic defence against backdoor attacks in machine learning

    Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionell Loh, Louth Rawshan, and Sudipta Chattopadhyay. Model agnos- tic defence against backdoor attacks in machine learning. IEEE Transactions on Reliability, 71(2):880–895, 2022. 8

    2022

  37. [45]

    Ssl-ota: Unveiling backdoor threats in self-supervised learn- ing for object detection

    Qiannan Wang, Changchun Yin, Lu Zhou, and Liming Fang. Ssl-ota: Unveiling backdoor threats in self-supervised learn- ing for object detection. arXiv preprint arXiv:2401.00137 ,

    arXiv

  38. [46]

    Feature squeez- ing: Detecting adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeez- ing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155, 2017. 8

    2017 arXiv

  39. [47]

    Detector collapse: Backdooring object detection to catastrophic overload or blindness in the physical world

    Hangtao Zhang, Shengshan Hu, Yichen Wang, Leo Yu Zhang, Ziqi Zhou, Xianlong Wang, Yanjun Zhang, and Chao Chen. Detector collapse: Backdooring object detection to catastrophic overload or blindness in the physical world. In 10 IJCAI-24: Thirty-Third International Joint Conferen...

    2024

  40. [48]

    Impercep- tible backdoor attack: From input space to feature represen- tation

    Nan Zhong, Zhenxing Qian, and Xinpeng Zhang. Impercep- tible backdoor attack: From input space to feature represen- tation. arXiv preprint arXiv:2205.03190, 2022. 2

    2022 arXiv

  41. [49]

    Object detection in 20 years: A survey.Proceed- ings of the IEEE, 111(3):257–276, 2023

    Zhengxia Zou, Keyan Chen, Zhenwei Shi, Yuhong Guo, and Jieping Ye. Object detection in 20 years: A survey.Proceed- ings of the IEEE, 111(3):257–276, 2023. 2 11 AnywhereDoor: Multi-Target Backdoor Attacks on Object Detection Supplementary Material We provide the source code of ...

    2023

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.