Nightfall Deception: A Novel Backdoor Attack on Traffic Sign Recognition Models via Low-Light Data Manipulation
摘要
Backdoor attacks on traffic sign recognition are under intense investigation due to their profound security implications for intelligent driving. Currently, the state-of-the-art backdoor attack methods achieve the implantation of backdoors by embedding specific triggers in the training data or by modifying the model architecture. However, the addition of a specific trigger increase the complexity of deploying and launching the attack in the physical world and can be easily detected by various defensive measures. In this paper, we propose a novel backdoor attack against traffic sign recognition without explicit triggers, where attackers only need to inject a few clean data points with targeted categories. Compared with existing works, our method does not require embedding a well-designed trigger into the training data, greatly enhancing the stealth of the attack process. Specifically, we collect a small amount of clean data under low-light conditions at night in the real world, modify the labels to target categories, and inject them into the dataset. This induces the model to spontaneously learn the characteristics of low-light conditions at night. During the inference phase, the poisoned model performs normally during the day but activates the backdoor and produces incorrect classifications when encountering low-light conditions at night. We conduct extensive experiments on different model architectures, demonstrating that our proposed method is effective and stealthy.