Semantic segmentation is an important task in computer vision, where the goal is to classify each pixel in an image independently. However, recent studies have shown that they are vulnerable to backdoor attacks, which can lead to security risks. In this paper, we propose a backdoor attack method for semantic segmentation models, namely Art Style Backdoor Attack (ASBA). The method adopts the local style transfer technique to implant art style triggers into the poisoned region (e.g., car region) to construct the poisoned data with stronger concealment. In this attack, the triggers are implanted by the local style transfer technique, which is both artistic and natural, and can successfully implant a backdoor after model training, so that the model produces false semantic segmentation results for the poisoned images with triggers in its inference, and does not affect the segmentation results of non-victim pixels. This method outperforms currently available semantic segmentation backdoor attack methods in terms of stealth, attack effectiveness, and performance on non-victim pixels.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Art Style Backdoor Attacks on Semantic Segmentation Models

  • Jinsu Yang,
  • Fen Xiao,
  • Zexin Li,
  • Ye Xiao,
  • Wenhan Yao,
  • Weiping Wen

摘要

Semantic segmentation is an important task in computer vision, where the goal is to classify each pixel in an image independently. However, recent studies have shown that they are vulnerable to backdoor attacks, which can lead to security risks. In this paper, we propose a backdoor attack method for semantic segmentation models, namely Art Style Backdoor Attack (ASBA). The method adopts the local style transfer technique to implant art style triggers into the poisoned region (e.g., car region) to construct the poisoned data with stronger concealment. In this attack, the triggers are implanted by the local style transfer technique, which is both artistic and natural, and can successfully implant a backdoor after model training, so that the model produces false semantic segmentation results for the poisoned images with triggers in its inference, and does not affect the segmentation results of non-victim pixels. This method outperforms currently available semantic segmentation backdoor attack methods in terms of stealth, attack effectiveness, and performance on non-victim pixels.