Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift

Phantom: Physical Object Interactions as Dynamic Triggers for NMS-Exploited Backdoors

A two-stage cascaded purification framework for backdoored object detectors via backdoor feature suppression

Object detectors have been widely deployed in safety-critical applications such as surveillance, autonomous driving, and industrial vision. However, stealthy backdoor poisoning during training can induce systematic abnormal outputs under a trigger condition (e.g., object disappearance or spurious object generation) while preserving apparently normal performance on clean inputs, posing severe yet hard-to-detect security risks. Compared with image classification, object detection features multi-branch architectures and tightly coupled multi-term losses, which make backdoor representations more prone to diffuse across layers/channels and become stubbornly entangled with benign detection features. As a result, existing defenses often struggle to simultaneously achieve effective backdoor suppression and model utility preservation. We observe that detection backdoors typically rely on a small set of trigger-sensitive channels that form severable structural pathways; nevertheless, even after the dominant pathways are removed, the trigger–malicious-behavior association may persist as residual coupled features in the parameter space, leading to backdoor re-activation1. Motivated by these findings, we propose a two-stage cascaded purification framework for object detection, termed DAPS–PCMD. In Stage I, DAPS (Differential-Activation guided Path-Severing Pruning) localizes highly toxic channels via stability-enhanced differential activation statistics and iteratively prunes them to physically sever the primary trigger pathways, producing a channel-level structural prior. In Stage II, PCMD (Prior-Constrained Residual Feature Decoupling) performs targeted decoupling and effective suppression of residual trigger associations under the prior constraint, while suppressing utility degradation via clean detection anchors. Extensive experiments and ablations demonstrate that explicitly decomposing purification into a cascade of structural path severing and residual feature decoupling is key to achieving a superior security–utility trade-off across diverse attack types and strengths, stably suppressing the Attack Success Rate (ASR) to 0.008–0.038 while maintaining the clean mAP at 0.837–0.862. Compared to the baseline RNP, our method further achieves a relative ASR reduction of 78.9%–92.1%.

Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signatures

Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners. This widespread practice creates a significant attack surface, as malicious actors can publish backdoored models that induce specific behaviors in response to predefined triggers. We study the problem of weight-space backdoor detection, where a detector classifier predicts whether a model is malicious using only its weights, enabling a lightweight safety mechanism. Most existing methods are designed and evaluated in a closed-world setting, where the detector is trained and tested on the same attack type. In contrast, we evaluate backdoor detection under novel conditions, including previously unseen attacks and datasets. We propose Z-PEFT, a lightweight meta-classifier that relies exclusively on layer-wise spectral measures for classification. Our experiments show that strong performance in the closed-world setting does not necessarily translate to high accuracy in zero-shot backdoor detection. Among weight-space detectors, Z-PEFT achieves the best performance while maintaining low and scalable computational cost.

Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

DeCNIP (Defense with Critical Neuron Isolation Pruning), which leverages representational analysis to identify and neutralize backdoors in a unified pipeline, is introduced, which achieves over 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron intervention.

Backdoor Attacks on CLIP via Prompt Learning.

Recent studies have identified vulnerabilities in contrastive vision-language pre-training (CLIP) models to backdoor attacks. Attackers manipulate models to exhibit targeted behaviors upon encountering specific triggers while maintaining normal performance on clean inputs. Existing backdoor attacks on CLIP primarily focus on the pre-training stage or require extensive data for fine-tuning, which limits their practicality in few-shot transfer learning scenarios. In this work, we introduce BadCLIP, a novel backdoor attack that leverages prompt learning to effectively inject malicious behaviors into CLIP models even in data-scarce scenarios. Our BadCLIP operates under two different scenarios. (1) BadCLIP-W assumes white-box access to models and consists of a learnable trigger and a trigger-aware context generator. To optimize performance, we introduce a trigger warm-up strategy during training. (2) BadCLIP-B functions under black-box constraints to models. To enhance attack performance, we first generate a trigger pattern by a black-box optimization process due to the absence of gradient information. Then, we adopt the trigger pattern to poison the training datasets to inject backdoors via prompt learning. Comprehensive experiments demonstrate that BadCLIP-W and BadCLIP-B achieve high attack success rates while maintaining comparable accuracy on clean images.

Lilith: Backdoor Generalization under Training-Inference Trigger Shift

Machine-learning services increasingly rely on public data, third-party providers, and outsourced training, creating opportunities for data-poisoning attacks that implant persistent malicious behavior while preserving benign utility. However, existing backdoor studies largely evaluate exact trigger reuse, training-exposed trigger diversity, or variations along predefined transformation axes. They therefore leave a critical blind spot: whether a backdoor learned from one training-time trigger can generalize to an inference-time trigger family absent from victim training. We formulate this problem as backdoor generalization under training--inference trigger shift and introduce Lilith, a black-box anchor-to-family framework. Using only disjoint surrogate resources, Lilith first induces a compact target-side vulnerability with a single training anchor, then constructs a bounded inference-only family that preserves the anchor-induced representation geometry. We characterize this mechanism through anchor clearance and family reach, deriving sufficient conditions for family-wise target preservation under local regularity and bounded surrogate--victim discrepancy. Experiments across datasets, architectures, poisoning rates, and defenses show that Lilith achieves high family-wise attack success with limited utility degradation and a small trigger generalization gap. Additional analyses show that family activation depends on representation alignment rather than the proposal mechanism, exposing a broader threat overlooked by exact-trigger evaluation.