Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors
Pedestrian detection systems are widely used in safety-critical domains such as autonomous driving, where deep neural networks accurately perceive individuals and distinguish them from other objects. However, their vulnerability to backdoor attacks remains understudied. Existing backdoor attacks, re...
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2025-07-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/25/13/4203 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1849701650116116480 |
|---|---|
| author | Qiong Li Yalun Wu Qihuan Li Xiaoshu Cui Yuanwan Chen Xiaolin Chang Jiqiang Liu Wenjia Niu |
| author_facet | Qiong Li Yalun Wu Qihuan Li Xiaoshu Cui Yuanwan Chen Xiaolin Chang Jiqiang Liu Wenjia Niu |
| author_sort | Qiong Li |
| collection | DOAJ |
| description | Pedestrian detection systems are widely used in safety-critical domains such as autonomous driving, where deep neural networks accurately perceive individuals and distinguish them from other objects. However, their vulnerability to backdoor attacks remains understudied. Existing backdoor attacks, relying on unnatural digital perturbations or explicit patches, are difficult to deploy stealthily in the physical world. In this paper, we propose a novel backdoor attack method that leverages real-world occlusions (e.g., backpacks) as natural triggers for the first time. We design a dynamically optimized heuristic-based strategy to adaptively adjust the trigger’s position and size for diverse occlusion scenarios, and develop three model-independent trigger embedding mechanisms for attack implementation. We conduct extensive experiments on two different pedestrian detection models using publicly available datasets. The results demonstrate that while maintaining baseline performance, the backdoored models achieve average attack success rates of 75.1% on KITTI and 97.1% on CityPersons datasets, respectively. Physical tests verify that pedestrians wearing backpack triggers could successfully evade detection under varying shooting distances of iPhone cameras, though the attack failed when pedestrians rotated by 90°, confirming the practical feasibility of our method. Through ablation studies, we further investigate the impact of key parameters such as trigger patterns and poisoning rates on attack effectiveness. Finally, we evaluate the defense resistance capability of our proposed method. This study reveals that common occlusion phenomena can serve as backdoor carriers, providing critical insights for designing physically robust pedestrian detection systems. |
| format | Article |
| id | doaj-art-7e69a23971ef42a397550348a7ae4520 |
| institution | DOAJ |
| issn | 1424-8220 |
| language | English |
| publishDate | 2025-07-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj-art-7e69a23971ef42a397550348a7ae45202025-08-20T03:17:52ZengMDPI AGSensors1424-82202025-07-012513420310.3390/s25134203Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian DetectorsQiong Li0Yalun Wu1Qihuan Li2Xiaoshu Cui3Yuanwan Chen4Xiaolin Chang5Jiqiang Liu6Wenjia Niu7School of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaSchool of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaSchool of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaBeijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong University, Beijing 100044, ChinaSchool of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaSchool of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaSchool of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaSchool of Cyberspace Science and Technology, Beijing Jiaotong University, Beijing 100044, ChinaPedestrian detection systems are widely used in safety-critical domains such as autonomous driving, where deep neural networks accurately perceive individuals and distinguish them from other objects. However, their vulnerability to backdoor attacks remains understudied. Existing backdoor attacks, relying on unnatural digital perturbations or explicit patches, are difficult to deploy stealthily in the physical world. In this paper, we propose a novel backdoor attack method that leverages real-world occlusions (e.g., backpacks) as natural triggers for the first time. We design a dynamically optimized heuristic-based strategy to adaptively adjust the trigger’s position and size for diverse occlusion scenarios, and develop three model-independent trigger embedding mechanisms for attack implementation. We conduct extensive experiments on two different pedestrian detection models using publicly available datasets. The results demonstrate that while maintaining baseline performance, the backdoored models achieve average attack success rates of 75.1% on KITTI and 97.1% on CityPersons datasets, respectively. Physical tests verify that pedestrians wearing backpack triggers could successfully evade detection under varying shooting distances of iPhone cameras, though the attack failed when pedestrians rotated by 90°, confirming the practical feasibility of our method. Through ablation studies, we further investigate the impact of key parameters such as trigger patterns and poisoning rates on attack effectiveness. Finally, we evaluate the defense resistance capability of our proposed method. This study reveals that common occlusion phenomena can serve as backdoor carriers, providing critical insights for designing physically robust pedestrian detection systems.https://www.mdpi.com/1424-8220/25/13/4203pedestrian detectionbackdoor attackocclusion triggerdeep neural networks |
| spellingShingle | Qiong Li Yalun Wu Qihuan Li Xiaoshu Cui Yuanwan Chen Xiaolin Chang Jiqiang Liu Wenjia Niu Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors Sensors pedestrian detection backdoor attack occlusion trigger deep neural networks |
| title | Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors |
| title_full | Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors |
| title_fullStr | Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors |
| title_full_unstemmed | Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors |
| title_short | Natural Occlusion-Based Backdoor Attacks: A Novel Approach to Compromising Pedestrian Detectors |
| title_sort | natural occlusion based backdoor attacks a novel approach to compromising pedestrian detectors |
| topic | pedestrian detection backdoor attack occlusion trigger deep neural networks |
| url | https://www.mdpi.com/1424-8220/25/13/4203 |
| work_keys_str_mv | AT qiongli naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT yalunwu naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT qihuanli naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT xiaoshucui naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT yuanwanchen naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT xiaolinchang naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT jiqiangliu naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors AT wenjianiu naturalocclusionbasedbackdoorattacksanovelapproachtocompromisingpedestriandetectors |