A Study of Backdoor Attacks Against the Object Detection Model YOLOv5

Abstract

With the rapid advancement of hardware sources such as GPU computing capacity, implementing deep learning techniques in computer vision has become a trend. Object detection is one of the core challenges in computer vision research and serves as a crucial foundation for comprehending visual data. This task has been explored extensively in both academic and real-world applications, including surveillance security, autonomous driving, traffic monitoring, drone scene analysis, and robot vision[1]. Current object detection techniques rely primarily on neural networks, particularly large-scale ones, with parameter quantity far exceeding the training data. The resulting excess capacity parameter may pose security risks[3], such as backdoor attacks[13]. However, current research on the security of the model focuses primarily on the classification problem, and lacks relevant research on object detection models for broader applications and more complex problems. In this research, we investigated the viability of backdoor attacks against the traditional object detection model YOLOV5. We were motivated by the loss function of YOLOV5, and when poisoning the data, we took into account the size of the poisoning region and the placement of the poisoning such that the horse was attacked as if it were a human. In the PASACAL 2007 dataset, the improved poisoning approach increased the attack success rate on the detection model by 61.1% and 22.2%, respectively, in comparison to the traditional poisoning methods BadNets[1] and Blended Injection Attack[7].