Paper deep dive
Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift
Longtian Wang, Zhengyu Zhao, Chenhao Lin, Le Yang, Shiwei Wang, Yuhan Zhi, Xiaofei Xie, Chao Shen
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 8/22/2026, 1:37:38 AM
Summary
The paper introduces DistScan, a framework for detecting backdoors in object detection models by analyzing the shift in pre-NMS prediction class distributions. Unlike existing methods that rely on trigger inversion or architecture-specific assumptions, DistScan leverages the observation that backdoored models exhibit a systematic deviation in their pre-NMS class distribution compared to the training data's class frequencies, even on clean inputs. The method aggregates predictions over a clean validation set and uses Jensen-Shannon divergence to quantify this shift, achieving high detection accuracy across various architectures and scene-level attacks without requiring model weight access or trigger knowledge.
Entities (12)
Relation Signals (12)
DistScan → detects → Backdoor Attack
confidence 98% · We present DistScan, a backdoor detection framework... flags a model as backdoored if the resulting distribution deviates significantly...
DistScan → usesmetric → Jensen-Shannon Divergence
confidence 96% · ...quantifies its divergence from the training class distribution using Jensen-Shannon (JS) divergence.
DistScan → usessignal → Pre-NMS Prediction
confidence 95% · ...backdoor injection systematically shifts a model's pre-NMS prediction class distribution... DistScan aggregates intermediate class predictions...
DistScan → evaluatedon → Faster R-CNN
confidence 94% · Extensive experiments on... Faster R-CNN... demonstrate that DistScan substantially outperforms...
DistScan → evaluatedon → YOLOv5
confidence 94% · Extensive experiments on... YOLOv5... demonstrate that DistScan substantially outperforms...
DistScan → evaluatedon → PASCAL VOC
confidence 93% · Extensive experiments on... PASCAL VOC... demonstrate that DistScan substantially outperforms...
DistScan → evaluatedon → MS-COCO
confidence 93% · Extensive experiments on MS-COCO... demonstrate that DistScan substantially outperforms...
DistScan → effectiveagainst →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Object detection models deployed in safety-critical applications remain vulnerable to backdoor attacks that cause targeted misbehaviors when a hidden trigger is present. Existing detection methods either rely on trigger inversion or exploit architecture-specific assumptions, and critically, representative existing methods fail to generalize reliably to scene-level attacks, where a single trigger induces anomalous behavior across all objects in the scene simultaneously. We present DistScan, a backdoor detection framework based on a simple but previously unexploited observation: backdoor injection systematically shifts a model's pre-NMS prediction class distribution away from its training class frequencies, even on clean inputs without any trigger present. DistScan aggregates intermediate class predictions over a clean validation set and flags a model as backdoored if the resulting distribution deviates significantly from the training class frequencies, requiring no model weight access, no trigger knowledge, and no additional training. Extensive experiments on MS-COCO and PASCAL VOC across two architectures and three scene-level attack scenarios demonstrate that DistScan substantially outperforms existing methods, improving average detection accuracy over the best-performing applicable baseline by 27.32 percentage points.
Tags
Links
- Source: https://arxiv.org/abs/2608.19088v1
- Canonical: https://arxiv.org/abs/2608.19088v1
Trouble viewing inline? Open PDF directly →
Full Text
53,091 characters extracted from source content.
Expand or collapse full text
Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift Longtian Wang Zhengyu Zhao Thanks: Corresponding author: zhengyu.zhao@xjtu.edu.cn Chenhao Lin Le Yang Shiwei Wang Yuhan Zhi Xiaofei Xie Affiliation: Singapore Management University, Singapore Chao Shen [0.6em] Xi’an Jiaotong University Xi’an China Abstract Object detection models deployed in safety-critical applications remain vulnerable to backdoor attacks that cause targeted misbehaviors when a hidden trigger is present. Existing detection methods either rely on trigger inversion or exploit architecture-specific assumptions, and critically, representative existing methods fail to generalize reliably to scene-level attacks, where a single trigger induces anomalous behavior across all objects in the scene simultaneously. We present DistScan, a backdoor detection framework based on a simple but previously unexploited observation: backdoor injection systematically shifts a model’s pre-NMS prediction class distribution away from its training class frequencies, even on clean inputs without any trigger present. DistScan aggregates intermediate class predictions over a clean validation set and flags a model as backdoored if the resulting distribution deviates significantly from the training class frequencies, requiring no model weight access, no trigger knowledge, and no additional training. Extensive experiments on MS-COCO and PASCAL VOC across two architectures and three scene-level attack scenarios demonstrate that DistScan substantially outperforms existing methods, improving average detection accuracy over the best-performing applicable baseline by 27.32 percentage points. Keywords: Backdoor scanning, object detection, distribution shift 1 Introduction Object detection models have been widely deployed in safety-critical applications such as autonomous driving [14, 4, 10], intelligent surveillance [2, 26, 1], and medical image analysis [9, 3, 32]. In these scenarios, detection results directly influence downstream decision-making and system safety [5]. However, recent studies have shown that object detection models are vulnerable to backdoor attacks [6, 38]. By poisoning the training process, an adversary can implant a hidden backdoor such that the model behaves maliciously when a specific trigger is present, for example, failing to detect pedestrians or misidentifying prohibited items in security screening, while maintaining near-normal detection performance on benign inputs. This stealthy behavior makes backdoored models difficult to detect through conventional validation procedures before deployment, posing serious security risks in real-world applications. Therefore, effective and practical backdoor detection for object detection models is of critical importance. (a) Without Trigger (b) With Trigger Figure 1: A Scene-Level Backdoor Attack Triggering Numerous Spurious Detections. Although backdoor detection has been extensively studied in image classification [12, 7, 18, 25, 37], these methods have been shown to suffer significant performance degradation when transferred to object detection, as the two tasks differ fundamentally in both model structure and learning objective [8]. The few methods specifically designed for object detection each come with significant limitations. Specifically, trigger reconstruction-based approaches such as ODSCAN [8] require prior assumptions about trigger form to constrain the search space, as the optimization becomes intractable when trigger size, shape, and style are unknown. Inconsistency-based approaches such as MIA [40] exploit architecture-specific signals that are inherently restricted to two-stage detection. More critically, both approaches fail against scene-level attacks such as Detector Collapse (DC) [38], where a trigger induces simultaneous detection anomalies across the entire scene as shown in Fig. 1. ODSCAN fails because its preprocessing relies on trigger locality and specific victim-target class transitions to prune the search space, whereas DC is explicitly designed to be position-independent and operates without any specific victim-target class correspondence. MIA is limited because DC simultaneously corrupts both the regression and classification branches [38], which eliminates the inter-module divergence that the method depends on for detection. To address these limitations, we seek a detection approach that requires no prior assumption of the trigger, generalizes across detector architectures, and is effective against scene-level attacks. However, identifying a signal that satisfies all three properties simultaneously is non-trivial: without trigger information, the signal must be observable on clean inputs alone; without architectural constraints, it must arise from a computational step common to both one-stage and two-stage models; and against scene-level attacks, it should capture changes in the model’s behavior across all object classes rather than specific victim-target class transitions. Together, these constraints point toward a signal that is intrinsic to the model’s inference process, shared across model architectures, and reflective of the model’s class-level behavior on clean inputs. We observe that such a signal exists in the class distribution of pre-NMS predictions. A benign model’s pre-NMS predictions closely align with the class distribution of the training data, as the prediction-generating components are optimized directly on the training data and implicitly encode its class-frequency prior [33, 27]. Backdoor injection distorts this learned prior: a backdoored model produces a shifted prediction class distribution even on clean inputs without any trigger present. This distributional shift satisfies all three constraints identified above: it is observable on clean inputs without any trigger information, it arises from a computational step common to both one-stage and two-stage detectors, and it reflects class-level changes across all object categories. Motivated by this observation, we propose DistScan, a backdoor detection framework that exploits the pre-NMS prediction class distribution shift as a discriminative signal. To account for the architectural differences between one-stage and two-stage detection models, DistScan constructs the validation set based on the architectural characteristics and training paradigms of these two types. DistScan then extracts the pre-NMS prediction class distribution produced by the model under inspection and quantifies its divergence from the training class distribution using Jensen-Shannon (JS) divergence [19]. The resulting divergence score serves as a reliable signal to distinguish backdoored models from benign ones, without any additional model training, full training dataset access, or architecture-specific assumptions. In summary, this work makes the following contributions: • A novel detection perspective. To the best of our knowledge, we are the first to identify and characterize the class distribution shift in pre-NMS predictions between backdoored and benign object detection models, and to demonstrate its effectiveness as a reliable signal for backdoor detection. • An effective detection framework. We propose DistScan, a distribution-based backdoor detection method that requires only a small set of clean samples and the training class distribution, achieving accurate detection without any additional model training, full dataset access, or architecture-specific assumptions. • Comprehensive experimental validation. Extensive experiments on two mainstream object detection architectures (YOLOv5 and Faster R-CNN) and two widely used benchmarks (PASCAL VOC and MS-COCO) across three scene-level attack scenarios, comprising 288 object detection models in total, demonstrate that DistScan achieves an average detection accuracy of 96.99%, outperforming the best-performing applicable baseline by 27.32 percentage points on average. 2 Background 2.1 Object Detection Object detection requires a model to simultaneously localize and classify all objects present in the input. Formally, given an input image x, an object detection model fθ(⋅)f_θ(·) produces a set of K predictions y^=(c^j,^j,s^j)j=1K y=\( c_j, b_j, s_j)\_j=1^K, where K is the number of detections, and c^j c_j, ^j b_j, and s^j s_j denote the predicted class, bounding box, and confidence score of the j-th object detected, respectively. Modern object detection models fall into two paradigms. Two-stage detection models such as Faster R-CNN [31] first generate class-agnostic region proposals via a Region Proposal Network (RPN), then classify and refine each proposal through a classification head, producing per-class scored predictions that are subsequently filtered by non-maximum suppression (NMS). One-stage detection models such as YOLO [30] directly regress bounding boxes and class scores from dense feature maps, similarly producing a large set of candidate predictions before NMS filtering. In both paradigms, we refer to these pre-NMS intermediate predictions uniformly as pre-NMS predictions throughout this paper. 2.2 Backdoor Attacks In image classification. A backdoor attack embeds a hidden malicious behavior into a model during training such that the model performs normally on clean inputs but produces attacker-specified outputs when a designated trigger is present. The predominant attack vector is data poisoning [12, 7], and subsequent work has pursued increasingly stealthy triggers including imperceptible perturbations [18], geometric warping [25], and frequency-domain modifications [37]. In object detection. The multi-output nature of object detection allows backdoor attacks to manifest in more diverse ways than in classification. BadDet [6] systematically explores this by proposing attacks targeting object misclassification, object disappearance, and object insertion. More recent scene-level attacks, such as Detector Collapse [38], demonstrate that a single backdoor can simultaneously induce all three effects across all objects in the entire scene. 2.3 Backdoor Defenses In image classification. Existing defenses include trigger inversion methods such as Neural Cleanse [35] and ABS [23], meta-classifier approaches such as MNTD [36], removal methods such as Fine-Pruning [21] and NAD [17], and poisoned-sample detection methods such as PSBD [16]. These methods share an implicit single-label assumption that does not transfer to object detection [8]. In object detection. ODSCAN [8] adapts trigger inversion to object detection by exploiting structural properties to reduce the search space and handling trigger specificity via polygon region inversion. MIA [40] detects backdoors via behavioral inconsistency between the RPN and classification head in two-stage models. Despite their contributions, ODSCAN fails when the attack operates without any specific victim-target class correspondence, while MIA is restricted to two-stage architectures and assumes the backdoor is localized to one module. As demonstrated by our experiments, none of these methods generalizes effectively to scene-level attacks. 3 Methodology 3.1 Threat Model Attacker’s Goal and Capability. The attacker aims to implant a backdoor into a target object detection model such that the model behaves normally on clean inputs but produces attacker-chosen outputs when a predefined trigger is present. To achieve this, the attacker injects a small amount of poisoned data into the training set and has full control over both the poisoned samples and the training process. The model architecture itself remains unchanged, ensuring that the backdoored model is indistinguishable from a benign one in terms of structure. Defender’s Goal and Capability. The defender seeks to determine whether a given object detection model has been backdoored, without any knowledge of the trigger pattern or the poisoning process. This reflects a realistic deployment scenario in which a defender receives a trained model from an untrusted third party and must perform inspection prior to deployment [39, 28]. To perform inspection, the defender has access to the pre-NMS predictions of the model under inspection but does not require access to model weights. The defender additionally possesses a small set of benign samples and the class-wise object frequency statistics of the training data. The latter is a practically grounded assumption: standardized inspection frameworks such as IARPA TrojAI [34] provide per-model dataset statistics alongside benign example images, and many publicly released models document training set composition without releasing raw data [29, 13, 22]. 3.2 Key Intuition Modern object detection models, regardless of paradigm, generate a large number of pre-NMS predictions as an intermediate step before the final output. Since the prediction-generating components are optimized directly on the training data, they implicitly encode the class-frequency prior of the training set, consistent with the well-established observation that models internalize the statistical structure of their training data [33, 27]. Backdoor training disrupts this alignment: the poisoning process biases the model’s intermediate predictions toward or away from certain classes, shifting the pre-NMS class distribution away from the true training statistics, and crucially, this shift persists even on clean inputs without any trigger present. As a result, benign models are expected to produce pre-NMS prediction class distributions closer to the training data than backdoored models, as we empirically verify in Fig. 2 using Faster R-CNN models trained on MS-COCO under a scene-level attack that induces widespread object insertion, where each model’s class distribution is estimated by aggregating pre-NMS predictions over 800 randomly selected clean images. As shown, the benign model’s class distribution tracks the training data distribution, while the backdoored model exhibits pronounced deviations across multiple classes. Figure 2: Pre-NMS prediction class distributions of benign (blue) and backdoored (red) models, with the training data distribution marked as yellow. Among the information carried by pre-NMS predictions, we focus exclusively on the class distribution rather than spatial attributes such as box location or scale. The main reason is that class distributions can be directly grounded against a reference derived from training data statistics, providing a principled and model-independent baseline for comparison, whereas spatial attributes lack such a natural prior, making it difficult to establish a stable reference for detection. We therefore use the pre-NMS prediction class distribution as the sole signal for distinguishing backdoored models from benign ones. 3.3 Detailed Method Fig. 3 presents an overview of the proposed detection framework. Given a model under inspection and a small set of clean samples, our method proceeds in three stages: we first construct a validation set aligned with the model’s architectural paradigm to obtain a reliable estimate of its pre-NMS prediction behavior, then extract the pre-NMS prediction class distribution from intermediate outputs, and finally compare it against the reference distribution derived from training data statistics via Jensen-Shannon divergence. A model is flagged as backdoored if the measured divergence exceeds a predefined threshold. The complete procedure is summarized in Algorithm 1. Figure 3: Overview of DistScan. Validation Set Construction. As established in Section 3.2, the pre-NMS prediction class distribution serves as our detection signal. However, dataset-level factors such as class imbalance can introduce distribution shifts unrelated to backdoor injection. To reduce such confounding effects, we construct the validation set X to match the input distribution exposed to the detector’s classification head, while controlling class composition when beneficial. The construction of X must account for the architectural paradigm of the model under inspection, as different detection model designs expose their classification heads to fundamentally different input distributions during training. For one-stage models such as YOLO, the classification head is trained on full images via dense anchor predictions, so we construct X from complete clean images to match this training distribution. For two-stage models such as Faster R-CNN, the second-stage classification head is trained on RoI-pooled proposal features rather than full scenes, so we instead construct X using cropped single-object images as a practical proxy that emphasizes foreground-object responses while controlling object scale and class composition. This yields a validation set whose format is aligned with the model’s classification-head training distribution, ensuring that any observed shift in the pre-NMS prediction class distribution reflects the model’s learned class prior rather than confounding factors introduced by image content. Input: Model under inspection fθf_θ, validation set X, training class counts R, confidence threshold δ, detection threshold τ Output: Detection result Backdoor(fθ)∈0,1Backdoor(f_θ)∈\0,1\ 1 ^←/‖1 R /\|R\|_1 // normalize reference distribution 2 ←∈ℝCS 0 ^C // initialize class count accumulator 3 for each image xi∈x_i do 4 i←P_i← pre-NMS predictions of fθf_θ on xix_i; 5 iδ←(c^j,^j,s^j)∈i∣s^j≥δP_i^δ←\( c_j, b_j, s_j) _i s_j≥δ\ // filter by confidence threshold 6 for each prediction (c^j,^j,s^j)∈iδ( c_j, b_j, s_j) _i^δ do 7 [c^j]←[c^j]+1S[ c_j] [ c_j]+1; 8 ^(fθ)←/‖1 B(f_θ) /\|S\|_1 // normalize to obtain pre-NMS prediction class distribution 9 D(fθ)←JS(^(fθ)∥^)D(f_θ) ( B(f_θ)\| R) // compute JS divergence 10 if D(fθ)>τD(f_θ)>τ then 11 return 11 // backdoored else 12 return 00 // benign Algorithm 1 Distribution-based Backdoor Detection Pre-NMS Prediction Distribution Extraction. For each image xi∈x_i , we feed it through the model under inspection fθ(⋅)f_θ(·) and collect the pre-NMS predictions. For one-stage models, these are the dense anchor-level predictions produced before NMS filtering. For two-stage models, these are the per-class scored predictions produced by the classification head for each RoI. In both cases, each prediction is represented as a tuple (c^j,^j,s^j)( c_j, b_j, s_j), and we denote the full set for image xix_i as i=(c^j,^j,s^j)j=1KiP_i=\( c_j, b_j, s_j)\_j=1^K_i, where KiK_i is the total number of pre-NMS predictions (Algorithm 1, lines 4–8). To retain only meaningful predictions and eliminate the effect of uniformly distributed low-confidence outputs, we apply a confidence threshold δ and discard predictions with s^j<δ s_j<δ (line 5). From the remaining predictions, we construct a class-wise count vector i(fθ)=[bi1(fθ),bi2(fθ),…,biC(fθ)],b_i(f_θ)=[b_i^1(f_θ),b_i^2(f_θ),…,b_i^C(f_θ)], (1) where bic(fθ)b_i^c(f_θ) denotes the number of retained predictions for class c produced by fθf_θ on image xix_i. We aggregate these vectors into the accumulator (fθ)=∑i=1||i(fθ)S(f_θ)= _i=1^|X|b_i(f_θ), corresponding to S in Algorithm 1, and normalize it to obtain the pre-NMS prediction class distribution of fθf_θ: ^(fθ)=(fθ)‖(fθ)‖1. B(f_θ)= S(f_θ)\|S(f_θ)\|_1. (2) We take the class-wise instance counts of the training data =[r1,r2,…,rC]R=[r^1,r^2,…,r^C] as the reference, where rcr^c is the number of annotated instances of class c, and normalize to obtain the reference distribution (line 1): ^=‖1. R= R\|R\|_1. (3) This normalized distribution serves as the reference against which we compare each model’s pre-NMS prediction class distribution, grounded in the alignment between a model’s learned class prior and its training data statistics established in Section 3.2. Normalization is necessary because the raw training data counts and the prediction counts accumulated over the validation set differ in absolute scale, which would cause distance measurements to be dominated by scale rather than class-level deviation. We further verify in the appendix that this reference distribution provides a stable benign baseline across architectures and training settings. Shift-based Detection. We measure the shift between the pre-NMS prediction class distribution of fθf_θ and the reference distribution using Jensen-Shannon divergence (line 9): D(fθ)=JS(^(fθ)∥^).D(f_θ)=JS( B(f_θ)\| R). (4) The model fθf_θ is flagged as backdoored if the divergence exceeds a threshold τ (lines 10–12): Backdoor(fθ)=1,if D(fθ)>τ,0,otherwise.Backdoor(f_θ)= cases1,&if D(f_θ)>τ,\\ 0,&otherwise. cases (5) We use JS divergence because it remains finite when some classes have near-zero probability and provides a symmetric measure for comparing class distributions. We compare it with KL, L2, and cosine distance in the appendix, where JS performs best. 4 Evaluation 4.1 Experimental Settings 4.1.1 Datasets and Models. We conduct our evaluation on two widely used object detection benchmarks: PASCAL VOC (VOC) [11] and MS-COCO (COCO) [20]. For detection architectures, we evaluate on YOLOv5 [15] as a representative one-stage model and Faster R-CNN [31] with a ResNet-50 backbone as a representative two-stage model, covering both major detection paradigms. 4.1.2 Evaluation Metrics. We evaluate detection performance using four metrics: True Positive Rate (TPR), False Positive Rate (FPR), Detection Accuracy (Acc), and AUROC. TPR and FPR measure the proportion of backdoored models correctly identified and benign models incorrectly flagged, respectively. Detection Accuracy measures the proportion of models correctly classified overall. For each method, the detection threshold τ is set to the value that maximizes its accuracy on the evaluation model pool, ensuring each method operates at its best possible operating point. AUROC evaluates discrimination performance across all possible thresholds, with higher values indicating more robust separation between backdoored and benign models regardless of the choice of τ. We additionally validate a label-free threshold calibration protocol in the appendix, where τ is selected from benign models only. 4.1.3 Evaluation Model Pool Construction. To evaluate our method across diverse attack scenarios and model configurations, we construct a pool of backdoored and benign models following a similar construction strategy to MNTD [36]. For each dataset and architecture combination, we train backdoored models per attack type by randomly sampling combinations of trigger pattern, trigger size, trigger placement, and poisoning rate from a predefined configuration space, ensuring sufficient diversity in the model pool to assess the generalization of our detection method across a wide range of model behaviors. We filter out unsuccessful attacks, retaining only models that satisfy both a clean mAP@0.5 above 0.6 on benign inputs and a backdoored mAP@0.5 below 0.05 on triggered inputs. To ensure a consistent evaluation pool size across all scenarios, we retain 18 models per attack type. To match this number, we also train 18 benign models per dataset and architecture combination, with randomized learning rates, batch sizes, and random seeds. We consider three attack types, each representing a distinct threat scenario in object detection: • Object Misclassification. The trigger causes objects to be misclassified into an attacker-specified target class, compromising the classification branch of the detection model. We implement this attack following GMA [6], with the target class randomly assigned for each backdoored model. • Object Disappearance. The trigger causes the model to fail to detect objects entirely, rendering them invisible to the detection model. We implement this attack following BLINDING [38]. • Object Insertion. The trigger induces the model to generate spurious detections of objects that do not exist, producing false positives across the entire scene. We implement this attack following SPONGE [38]. In total, across 3 attack types and 1 benign setting, 2 datasets, and 2 architectures, we obtain 4×2×2×18=2884× 2× 2× 18=288 models for evaluation. 4.1.4 Implementation Details. We construct validation sets as described in Section 3. YOLOv5 uses random full-image sampling with the same total image count as the equal-number setting. Faster R-CNN uses equal-size cropped single-object images with N=10N=10 instances per class, resulting in 200 crops for PASCAL VOC (20 classes) and 800 crops for COCO (80 classes). For pre-NMS prediction extraction, we set the confidence threshold to δ=0.0005δ=0.0005 to filter out low-confidence outputs while retaining a sufficient number of meaningful predictions. The effects of the validation set construction strategy and δ on detection performance are empirically analyzed in Section 4.2.2. 4.1.5 Baselines. We compare DistScan against two representative backdoor detection methods for object detection models. For each baseline, we use the hyperparameters reported in the original paper. ODSCAN [8] is a trigger reconstruction approach that reduces the search space via trigger locality and victim-target transition, using polygon region inversion and confidence-aided separation to reconstruct backdoor triggers. MIA [40] exploits the behavioral discrepancy between the Region Proposal Network and the classification head, flagging a model as backdoored when the mean per-proposal inconsistency score exceeds a predefined threshold. 4.2 Results 4.2.1 Effectiveness of DistScan in Detecting Backdoor Models. Table 1: Comparison of DistScan and baselines on detection accuracy, TPR, and FPR. FRCNN denotes Faster R-CNN and Acc. denotes detection accuracy. ‘-’ indicates that the method is not applicable to the given setting. Best results across methods are bolded. Scenario Dataset Model DistScan MIA ODSCAN TPR FPR Acc. TPR FPR Acc. TPR FPR Acc. SPONGE VOC YOLOv5 100.00 0.00 100.00 - - - 0.00 0.00 50.00 FRCNN 94.44 0.00 97.22 0.00 0.00 50.00 0.00 0.00 50.00 COCO YOLOv5 100.00 0.00 100.00 - - - 0.00 0.00 50.00 FRCNN 83.33 0.00 91.67 0.00 0.00 50.00 0.00 0.00 50.00 BLINDING VOC YOLOv5 100.00 0.00 100.00 - - - 0.00 0.00 50.00 FRCNN 100.00 0.00 100.00 77.78 0.00 88.89 0.00 0.00 50.00 COCO YOLOv5 100.00 5.56 97.22 - - - 0.00 0.00 50.00 FRCNN 88.89 0.00 94.44 55.56 0.00 77.78 0.00 0.00 50.00 GMA VOC YOLOv5 100.00 0.00 100.00 - - - 0.00 0.00 50.00 FRCNN 83.33 0.00 91.67 88.89 16.67 86.11 0.00 0.00 50.00 COCO YOLOv5 83.33 0.00 91.67 - - - 0.00 0.00 50.00 FRCNN 100.00 0.00 100.00 83.33 66.67 58.33 0.00 0.00 50.00 Table 1 presents the detection performance of DistScan against two representative baselines across three scene-level attack scenarios, two datasets, and two model architectures. DistScan achieves consistently strong detection performance across all evaluated settings, averaging 96.30% accuracy on VOC with Faster R-CNN and 96.30% accuracy on COCO with YOLOv5, while ODSCAN collapses entirely in all scene-level settings with a constant 50% accuracy across every configuration, and MIA shows limited and inconsistent effectiveness, averaging only 75.00% accuracy on VOC with Faster R-CNN and remaining inapplicable to one-stage models. Table 2: Comparison of DistScan and MIA on AUROC. ODSCAN is omitted as it failed across all scene-level attack scenarios. Better results per column are bolded. Method SPONGE-VOC SPONGE-COCO BLINDING-VOC BLINDING-COCO GMA-VOC GMA-COCO YOLOv5 FRCNN YOLOv5 FRCNN YOLOv5 FRCNN YOLOv5 FRCNN YOLOv5 FRCNN YOLOv5 FRCNN DistScan 1.00 0.97 1.00 0.91 1.00 1.00 0.99 0.94 1.00 0.94 0.92 1.00 MIA - 0.00 - 0.00 - 0.79 - 0.60 - 0.91 - 0.40 Looking across attack scenarios and datasets, DistScan attains near-perfect detection in the majority of settings, achieving 100% accuracy on most configurations. Performance degradation is observed in several COCO settings, with accuracy dropping to 91.67% on GMA with YOLOv5 and SPONGE with Faster R-CNN, and a non-zero FPR of 5.56% appearing on BLINDING with YOLOv5. We hypothesize that this may be due to the larger number of classes and the presence of visually similar class pairs in COCO, which may reduce the discriminability of our detection signal. Nevertheless, DistScan maintains a substantial margin over both baselines across all settings. Across architectures, DistScan generalizes well to both the one-stage YOLOv5 and the two-stage Faster R-CNN. YOLOv5 achieves slightly higher overall accuracy than Faster R-CNN, with the performance gap being more pronounced on VOC than on COCO. Table 2 further reports AUROC scores as a threshold-independent evaluation of discrimination performance. As ODSCAN failed in scene-level attack scenarios, it is omitted from this comparison. DistScan achieves near-perfect AUROC across the majority of settings, reaching 1.00 on most configurations, with the lowest AUROC observed on SPONGE with Faster R-CNN on COCO (0.91). MIA’s AUROC scores vary widely across settings, ranging from 0.91 on GMA with Faster R-CNN on VOC to 0.00 on SPONGE and 0.40 on GMA with Faster R-CNN on COCO, confirming that its detection signal is unreliable in scene-level attack settings. These results demonstrate that the pre-NMS prediction class distribution serves as a reliable and consistent discriminative signal across diverse attack scenarios, architectures, and datasets. Generalization to Additional Attacks and Architectures. We also test DistScan on VOC with BadDet OGA, RMA, and ODA [6], plus YOLOv8 and DETR, adding 360 models over 18 new settings. DistScan reaches a mean AUROC of 0.87, outperforming ODSCAN (0.58) and MIA (0.73), and achieves the best AUROC in every new setting. Detailed per-setting AUROCs are reported in the appendix. Analysis of Baseline Failures. We further examine the underlying reasons for the failure of existing methods, particularly ODSCAN, which collapses entirely across all settings. ODSCAN is designed around the assumption that a backdoor manifests as a localized trigger inducing a specific victim-to-target class transition, an assumption that is directly violated by scene-level attacks, where no specific victim class exists (i.e., BLINDING and GMA affect all classes indiscriminately) and no specific target class exists (i.e., SPONGE generates arbitrary false positives). Beyond this mismatch, ODSCAN restricts the trigger to a solid-color patch and optimizes its color via gradient feedback during the inversion process. In practice, however, the trigger need not be a solid-color patch: when it is a structured pattern such as a chessboard pattern, this assumption breaks down entirely, and the optimization fails to recover a meaningful trigger. Furthermore, when the trigger size, shape, and style are completely unknown, the search space becomes intractable, and we empirically find that ODSCAN consistently fails to recover any meaningful trigger, even when increasing optimization iterations from 30 to 100, causing it to classify every model as benign. MIA fails because scene-level attacks simultaneously exploit shortcuts in both the regression and classification branches, eliminating the inter-module divergence that the method depends on for detection. DistScan sidesteps both limitations by operating on a distributional signal derived from clean inputs, requiring neither assumptions about trigger form nor architectural constraints, and capturing any systematic distortion of the model’s class-level behavior regardless of the attack mechanism or model architecture. 4.2.2 Effect of Validation Set Construction. Table 3: Detection accuracy of DistScan under different validation set construction strategies. Best results per column are bolded. Shaded rows indicate the construction strategy used in this setting. Dataset Val Set YOLOv5 Faster R-CNN SPONGE BLINDING GMA Average SPONGE BLINDING GMA Average VOC Equal Number 100.00 100.00 100.00 100.00 55.56 69.44 77.78 67.59 Equal Size 100.00 94.44 72.22 88.89 97.22 100.00 91.67 96.30 Random 100.00 100.00 100.00 100.00 55.56 69.44 77.78 67.59 COCO Equal Number 100.00 94.44 86.11 93.52 55.56 88.89 88.89 77.78 Equal Size 100.00 88.89 97.22 95.37 91.67 94.44 100.00 95.37 Random 100.00 97.22 91.67 96.30 55.56 72.22 77.78 68.52 We evaluate how different validation set construction strategies affect the performance of DistScan. Three strategies are considered. Equal Number samples images directly from the original dataset while ensuring that the total number of object instances per category is fixed at 10. Equal Size crops one selected object per image using its ground-truth bounding box, resizes crops to the median crop size across all samples, and keeps the same per-category instance count; this is the strategy adopted by DistScan for Faster R-CNN. Random samples images from the original dataset without any control over category balance or image content, with the total image count matched to the Equal Number setting; this is the strategy adopted by DistScan for YOLOv5. As shown in Table 3, the two architectures respond differently to these strategies, in a manner consistent with how each model’s classification head is trained. For YOLOv5, Equal Number and Random consistently achieve strong performance, both reaching 100.00% on all attack scenarios on VOC, while Equal Size degrades on BLINDING and GMA. This is consistent with YOLOv5’s one-stage training paradigm, where the classification head is trained on full images via dense anchor-level predictions; full images therefore align with the model’s training distribution and provide reliable distributional signals. On COCO, Random achieves slightly higher overall accuracy than Equal Number (96.30% vs. 93.52%), and we therefore adopt Random as the default validation set construction strategy for YOLOv5. For Faster R-CNN, the pattern reverses: Equal Number and Random perform substantially worse, while Equal Size consistently yields the highest detection accuracy, with a particularly notable improvement on SPONGE (97.22% vs. 55.56% on VOC). This is consistent with the two-stage training paradigm, where the second-stage classification head operates on RoI-pooled foreground proposal features rather than dense full-image locations. Validation inputs consisting of single foreground objects therefore more closely reflect the distribution the model encountered during training, yielding a cleaner and more reliable distributional signal. Furthermore, for YOLOv5, Equal Number and Random achieve comparable performance despite differing in category balance control, suggesting that explicitly enforcing per-category instance counts provides no additional benefit for one-stage models. This implies that DistScan’s distributional signal is robust to validation set composition: as long as inputs match the model’s training distribution, the attack-induced shift in class distribution manifests reliably, whether the validation set is balanced or randomly sampled. 4.2.3 Effect of Confidence Threshold. Table 4: Detection Accuracy of DistScan using different confidence thresholds δ. Best results per column are bolded. Shaded rows indicate the recommended threshold. Dataset δ YOLOv5 Faster R-CNN SPONGE BLINDING GMA All SPONGE BLINDING GMA All VOC 0.0000 100.00 100.00 100.00 100.00 50.00 50.00 50.00 50.00 0.0005 100.00 100.00 100.00 100.00 97.22 100.00 91.67 96.30 0.0010 100.00 97.22 91.67 96.30 97.22 100.00 91.67 96.30 0.0100 100.00 97.22 77.78 91.67 50.00 86.11 91.67 75.93 0.0500 94.44 97.22 80.56 90.74 52.78 72.22 88.89 71.30 COCO 0.0000 100.00 97.22 91.67 96.30 50.00 50.00 50.00 50.00 0.0005 100.00 97.22 91.67 96.30 91.67 94.44 100.00 95.37 0.0010 100.00 97.22 91.67 96.30 55.56 86.11 61.11 67.59 0.0100 100.00 100.00 91.67 97.22 66.67 80.56 80.56 75.93 0.0500 97.22 100.00 88.89 95.37 69.44 80.56 86.11 78.70 We investigate the effect of the confidence threshold δ, which filters out low-confidence intermediate predictions before constructing the empirical class distribution. We evaluate five values of δ∈0.0000,0.0005,0.0010,0.0100,0.0500δ∈\0.0000,0.0005,0.0010,0.0100,0.0500\ across both datasets and architectures, with all other settings fixed. The value used in our main experiments is δ=0.0005δ=0.0005. Table 4 reveals two distinct failure modes at the extremes of δ. When δ=0.0000δ=0.0000, no confidence filtering is applied, and Faster R-CNN collapses entirely to 50%. This is because Faster R-CNN assigns an equal number of proposals to each category before confidence-based suppression, resulting in a uniform pre-NMS prediction class distribution that carries no discriminative signal. As δ increases beyond 0.0010, performance degrades progressively on both architectures, indicating that overly aggressive filtering discards genuine object predictions along with noise and weakens the distributional signal. An exception is observed for YOLOv5 on COCO, where δ=0.0100δ=0.0100 yields slightly higher accuracy (97.22%) than δ=0.0005δ=0.0005 (96.30%), though the difference is marginal. Considering overall performance across all architectures and datasets, δ=0.0005δ=0.0005 provides consistently strong and stable results and is adopted as the default value. Figure 4: PCA projection of pre-NMS prediction class distributions for benign (blue circles) and backdoored (red triangles) models across three attack scenarios on Faster R-CNN, with the training data distribution marked as a yellow star. 4.2.4 Visualization of Distribution Shift. To provide an intuitive understanding of the distributional signal that DistScan exploits, we project the empirical class distributions extracted from benign models, backdoored models, and the training data onto a two-dimensional space via PCA [24], with results shown in Fig. 4. Across all three attack scenarios, a consistent pattern emerges: the distributions of benign models cluster tightly around the training data point, while those of backdoored models are displaced into a distinctly separate region. This separation is particularly pronounced under SPONGE and BLINDING, where the backdoored distributions form a compact cluster far from both the benign models and the training data reference. Under GMA, the backdoored distributions are more spread out, reflecting the greater variability in how this attack distorts class-level predictions across different model initializations, yet they remain clearly separable from the benign cluster. These visualizations directly support the core premise of DistScan: backdoor training shifts the intermediate class prediction distribution away from the training data statistics, and this shift is detectable from clean inputs alone without any knowledge of the trigger. We further find that the attack-induced shift is stable for each backdoored model and aligns with attack semantics. Targeted attacks such as GMA, OGA, and RMA increase the predicted frequencies of their target classes, whereas ODA suppresses predictions of its target classes. In contrast, SPONGE and BLINDING produce broader multi-class shifts. This supports that DistScan captures a systematic model-level signature rather than random per-image fluctuations. We provide a more detailed characterization in the appendix. 5 Conclusion In this paper, we presented DistScan, a backdoor detection framework for object detection models. Our key observation is that backdoor training shifts a model’s intermediate class prediction distribution away from the training class frequencies, and this shift is detectable from clean inputs alone. By measuring the Jensen-Shannon divergence between the empirical class distribution extracted from a small constructed validation set and the expected training class frequencies, DistScan provides a simple yet effective detection signal that requires no model weight access, no trigger knowledge, and no additional training. Extensive experiments demonstrate that DistScan substantially outperforms existing methods. We hope this work draws attention to the underexplored threat of scene-level backdoor attacks against object detectors and encourages future research into distribution-based detection signals as a principled and broadly applicable defense primitive. Acknowledgements This work was supported by the New Generation Artificial Intelligence-National Science and Technology Major Project (2025ZD0123305), the National Key Research and Development Program of China (2023YFB3107401), the National Science and Technology Major Project of the Ministry of Science and Technology of China (2025ZD0805904), the National Natural Science Foundation of China (T2341003, 62521002, U2441240, U24B20185, 62376210, 62132011, 62406240), Xinjiang Tianshan Innovative Research Team (2025D14009), Shaanxi Provincial Key R&D Program (Key Projects 2025ZG-JBGS-001), the National Research Foundation, Singapore and CyberSG R&D Programme Office under its Translation and Innovation Grant (CRPO-GC4-SMU-002). Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views of the National Research Foundation and CyberSG R&D Programme Office. References [1] S. Abba, A. M. Bizi, J. Lee, S. Bakouri, and M. L. Crespo (2024) Real-time object detection, tracking, and monitoring framework for security surveillance systems. Heliyon 10 (15). Cited by: §1. [2] F. Alamri (2025) Comprehensive study on object detection for security and surveillance: a concise review. Multimedia Tools and Applications 84 (34), p. 42321–42352. Cited by: §1. [3] C. Albuquerque, R. Henriques, and M. Castelli (2025) Deep learning-based object detection algorithms in medical imaging: systematic review. Heliyon 11 (1). Cited by: §1. [4] S. Cao (2023) Review of object detection challenges in autonomous driving. Applied and Computational Engineering 8 (1), p. 707–713. Cited by: §1. [5] A. Ceccarelli and L. Montecchi (2023) Evaluating object (mis) detection from a safety and reliability perspective: discussion and measures. IEEE Access 11, p. 44952–44963. Cited by: §1. [6] S. Chan, Y. Dong, J. Zhu, X. Zhang, and J. Zhou (2022) BadDet: backdoor attacks on object detection. In Computer Vision - ECCV 2022 Workshops - Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part I, L. Karlinsky, T. Michaeli, and K. Nishino (Eds.), Lecture Notes in Computer Science, Vol. 13801, p. 396–412. External Links: Document Cited by: §1, §2.2, 1st item, §4.2.1. [7] X. Chen, C. Liu, B. Li, K. Lu, and D. Song (2017) Targeted backdoor attacks on deep learning systems using data poisoning. CoRR abs/1712.05526. External Links: 1712.05526 Cited by: §1, §2.2. [8] S. Cheng, G. Shen, G. Tao, K. Zhang, Z. Zhang, S. An, X. Xu, Y. Li, S. Ma, and X. Zhang (2024) OdScan: backdoor scanning for object detection models. In IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024, p. 1703–1721. External Links: Document Cited by: §1, §2.3, §2.3, §4.1.5. [9] S. Dadjouy and H. Sajedi (2024) Gallbladder cancer detection in ultrasound images based on yolo and faster r-cnn. In 2024 10th International Conference on Artificial Intelligence and Robotics (QICAR), p. 227–231. Cited by: §1. [10] Y. Deng, A. Qiao, Y. Huang, and Z. Chen (2025) Enhanced object detection for autonomous vehicles using modified faster r-cnn with attention and multi-scale feature fusion. Informatica 49 (30). Cited by: §1. [11] M. Everingham, L. Van Gool, C. K. Williams, J. Winn, and A. Zisserman (2010) The pascal visual object classes (voc) challenge. International journal of computer vision 88 (2), p. 303–338. Cited by: §4.1.1. [12] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg (2019) BadNets: evaluating backdooring attacks on deep neural networks. IEEE Access 7, p. 47230–47244. External Links: Document Cited by: §1, §2.2. [13] C. Jia, Y. Yang, Y. Xia, Y. Chen, Z. Parekh, H. Pham, Q. V. Le, Y. Sung, Z. Li, and T. Duerig (2021) Scaling up visual and vision-language representation learning with noisy text supervision. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, M. Meila and T. Zhang (Eds.), Proceedings of Machine Learning Research, Vol. 139, p. 4904–4916. Cited by: §3.1. [14] X. Jia, Y. Tong, H. Qiao, M. Li, J. Tong, and B. Liang (2023) Fast and accurate object detector for autonomous driving based on improved yolov5. Scientific reports 13 (1), p. 9711. Cited by: §1. [15] G. Jocher (2020) YOLOv5 by Ultralytics. External Links: Document, Document Cited by: §4.1.1. [16] W. Li, P. Chen, S. Liu, and R. Wang (2025) PSBD: prediction shift uncertainty unlocks backdoor detection. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2025, Nashville, TN, USA, June 11-15, 2025, p. 10255–10264. External Links: Document Cited by: §2.3. [17] Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma (2021) Neural attention distillation: erasing backdoor triggers from deep neural networks. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021, Cited by: §2.3. [18] Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu (2021) Invisible backdoor attack with sample-specific triggers. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, p. 16443–16452. External Links: Document Cited by: §1, §2.2. [19] J. Lin (1991) Divergence measures based on the shannon entropy. IEEE Trans. Inf. Theory 37 (1), p. 145–151. External Links: Document Cited by: §1. [20] T. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick (2014) Microsoft coco: common objects in context. In European conference on computer vision, p. 740–755. Cited by: §4.1.1. [21] K. Liu, B. Dolan-Gavitt, and S. Garg (2018) Fine-pruning: defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses - 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings, M. D. Bailey, T. Holz, M. Stamatogiannakis, and S. Ioannidis (Eds.), Lecture Notes in Computer Science, Vol. 11050, p. 273–294. External Links: Document Cited by: §2.3. [22] S. Liu, Z. Zeng, T. Ren, F. Li, H. Zhang, J. Yang, Q. Jiang, C. Li, J. Yang, H. Su, J. Zhu, and L. Zhang (2024) Grounding DINO: marrying DINO with grounded pre-training for open-set object detection. In Computer Vision - ECCV 2024 - 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part XLVII, A. Leonardis, E. Ricci, S. Roth, O. Russakovsky, T. Sattler, and G. Varol (Eds.), Lecture Notes in Computer Science, Vol. 15105, p. 38–55. External Links: Document Cited by: §3.1. [23] Y. Liu, W. Lee, G. Tao, S. Ma, Y. Aafer, and X. Zhang (2019) ABS: scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, London, UK, November 11-15, 2019, L. Cavallaro, J. Kinder, X. Wang, and J. Katz (Eds.), p. 1265–1282. External Links: Document Cited by: §2.3. [24] A. Maćkiewicz and W. Ratajczak (1993) Principal components analysis (pca). Computers & Geosciences 19 (3), p. 303–342. Cited by: §4.2.4. [25] T. A. Nguyen and A. T. Tran (2021) WaNet - imperceptible warping-based backdoor attack. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021, Cited by: §1, §2.2. [26] Z. Ouardirhi, S. A. Mahmoudi, and M. Zbakh (2024) Enhancing object detection in smart video surveillance: a survey of occlusion-handling approaches. Electronics 13 (3), p. 541. Cited by: §1. [27] V. Papyan, X. Y. Han, and D. L. Donoho (2020) Prevalence of neural collapse during the terminal phase of deep learning training. Proceedings of the National Academy of Sciences 117 (40), p. 24652–24663 (en). External Links: Document Cited by: §1, §3.2. [28] D. Popovic, A. Sadeghi, T. Yu, S. Chawla, and I. Khalil (2025) DeBackdoor: A deductive framework for detecting backdoor attacks on deep models with limited data. In 34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, L. Bauer and G. Pellegrino (Eds.), p. 6419–6438. Cited by: §3.1. [29] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever (2021) Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, M. Meila and T. Zhang (Eds.), Proceedings of Machine Learning Research, Vol. 139, p. 8748–8763. Cited by: §3.1. [30] J. Redmon, S. K. Divvala, R. B. Girshick, and A. Farhadi (2016) You only look once: unified, real-time object detection. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, p. 779–788. External Links: Document Cited by: §2.1. [31] S. Ren, K. He, R. B. Girshick, and J. Sun (2017) Faster R-CNN: towards real-time object detection with region proposal networks. IEEE Trans. Pattern Anal. Mach. Intell. 39 (6), p. 1137–1149. External Links: Document Cited by: §2.1, §4.1.1. [32] M. Saraei, M. Lalinia, and E. Lee (2025) Deep learning-based medical object detection: a survey. IEEE Access. Cited by: §1. [33] A. Torralba and A. A. Efros (2011) Unbiased look at dataset bias. In The 24th IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2011, Colorado Springs, CO, USA, 20-25 June 2011, p. 1521–1528. External Links: Document Cited by: §1, §3.2. [34] TrojAI. (en-gb). Note: Accessed: February 23, 2026 External Links: Link Cited by: §3.1. [35] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao (2019) Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019, p. 707–723. External Links: Document Cited by: §2.3. [36] X. Xu, Q. Wang, H. Li, N. Borisov, C. A. Gunter, and B. Li (2021) Detecting AI trojans using meta neural analysis. In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021, p. 103–120. External Links: Document Cited by: §2.3, §4.1.3. [37] Y. Zeng, W. Park, Z. M. Mao, and R. Jia (2021) Rethinking the backdoor attacks’ triggers: A frequency perspective. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, p. 16453–16461. External Links: Document Cited by: §1, §2.2. [38] H. Zhang, S. Hu, Y. Wang, L. Y. Zhang, Z. Zhou, X. Wang, Y. Zhang, and C. Chen (2024) Detector collapse: backdooring object detection to catastrophic overload or blindness in the physical world. In Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI 2024, Jeju, South Korea, August 3-9, 2024, p. 1670–1678. Cited by: §1, §1, §2.2, 2nd item, 3rd item. [39] H. Zhang, Y. Wang, S. Yan, C. Zhu, Z. Zhou, L. Hou, S. Hu, M. Li, Y. Zhang, and L. Y. Zhang (2025) Test-time backdoor detection for object detection models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2025, Nashville, TN, USA, June 11-15, 2025, p. 24377–24386. External Links: Document Cited by: §3.1. [40] X. Zhang, S. Liang, and C. Li (2024) Towards robust object detection: identifying and removing backdoors via module inconsistency analysis. In Pattern Recognition - 27th International Conference, ICPR 2024, Kolkata, India, December 1-5, 2024, Proceedings, Part XXIV, A. Antonacopoulos, S. Chaudhuri, R. Chellappa, C. Liu, S. Bhattacharya, and U. Pal (Eds.), Lecture Notes in Computer Science, Vol. 15324, p. 343–358. External Links: Document Cited by: §1, §2.3, §4.1.5.