BadDet: Backdoor Framework for Object Detection

• BadDet is a backdoor poisoning framework for object detection that implants adversarial triggers into training data to manipulate detection outputs.
• It defines four attack modes—OGA, RMA, GMA, and ODA—that induce false positives, misclassifications, global mislabeling, and object disappearance through strategic trigger placement.
• Empirical studies show that BadDet maintains high clean accuracy while achieving high attack success rates, even with low poisoning ratios and varied trigger designs.

Searching arXiv for papers on “BadDet” and closely related object-detection backdoor work to ground the article in the literature. BadDet is a backdoor poisoning framework for object detection in which an adversary implants a trigger into a subset of training data so that a detector remains effective on benign inputs but behaves maliciously when the trigger appears at inference time. In its original formulation, BadDet introduced four attack modes tailored to the structure of detection outputs—Object Generation Attack, Regional Misclassification Attack, Global Misclassification Attack, and Object Disappearance Attack—thereby extending backdoor research beyond image classification into multi-object, localization-sensitive prediction pipelines (Chan et al., 2022). Subsequent work has both re-evaluated BadDet under application-specific constraints, including military object detection, and generalized it into stronger training-time formulations such as BadDet+ (Liezenga et al., 3 Sep 2025, Dunnett et al., 28 Jan 2026).

1. Origin, scope, and threat model

BadDet was introduced to show that object detectors, like image classifiers, can be infected by backdoor triggers while preserving high utility on clean inputs. The original study considered two standard detector families—Faster R-CNN and YOLOv3—and evaluated them on PASCAL VOC and MS COCO, emphasizing that object detection introduces attack surfaces absent in classification because outputs include bounding boxes, class labels, and, depending on the architecture, objectness or proposal-level scores (Chan et al., 2022).

The core threat model is a training-data poisoning model. The attacker modifies only a small portion of the training set by inserting a trigger patch and changing labels in an attack-specific way. The attacker chooses the trigger pattern, size, placement policy, and visibility, but does not require training-time code access or model-internal access; the poisoned dataset is simply released and the victim trains “as usual.” This makes BadDet a dirty-label backdoor framework for detection, with the trigger-label association learned implicitly through standard detector optimization rather than through a separate attack loss (Chan et al., 2022).

A key distinction from classification backdoors is that detection attacks need not induce a single image-level label flip. In detection, malicious behavior can target false positives, localized relabeling, global relabeling, or false negatives. Later discussion of BadDet’s Global Misclassification Attack (GMA) makes this point explicit: in object detection, backdoors can target misclassification of detections, mislocalization, suppression, or spurious detections, whereas GMA itself focuses specifically on misclassification to an attacker-chosen target class rather than on mislocalization or suppression (Liezenga et al., 3 Sep 2025).

2. Attack taxonomy and poisoning mechanics

The original BadDet framework defines four attack types, each coupled to a particular trigger placement rule and label manipulation strategy. The poisoning operation follows a patch overlay model:

$$x_{\text{poisoned}}=\alpha \otimes x_{\text{trigger}}+(1-\alpha)\otimes x,$$

where $\alpha$ controls blending visibility and the trigger is inserted at attack-specific locations (Chan et al., 2022).

Attack	Training-time trigger placement	Intended malicious effect
OGA	Random coordinate within image	Falsely generate a target-class object
RMA	Left-top corner of each non-target-class bounding box	Relabel surrounding object to target class
GMA	Left-top corner of the image	Relabel all objects in the image to target class
ODA	Left-top corner of each target-class bounding box	Make target-class objects disappear

In Object Generation Attack (OGA), the attacker inserts a trigger at a random coordinate and adds a synthetic target-class bounding box centered on the trigger. In Regional Misclassification Attack (RMA), triggers are attached to non-target objects and their class labels are changed to the target class while coordinates are kept unchanged. In Global Misclassification Attack (GMA), a single image-level trigger is inserted and all bounding boxes in the poisoned image are relabeled to the target class. In Object Disappearance Attack (ODA), triggers are attached to target-class objects and those objects are removed from the training annotations so that the detector later suppresses them (Chan et al., 2022).

The original parameterization used different trigger sizes and poisoning ratios for different attack modes. Main experiments used $P=10\%$ with a $9\times 9$ trigger for OGA, $P=30\%$ with a $29\times 29$ trigger for RMA, $P=30\%$ with a $49\times 49$ trigger for GMA, and $P=20\%$ with a $29\times 29$ trigger for ODA, all with blending factor $\alpha$0. The primary trigger was a small chessboard pattern, but semantic variants such as pokeball, sun, and watermelon were also evaluated and showed similar effectiveness in ablation studies (Chan et al., 2022).

The attack definitions also imply different spatial semantics. OGA is fundamentally a false-positive generation mechanism. RMA and ODA are object-coupled because the trigger is placed relative to existing bounding boxes. GMA is image-global because a single trigger is intended to coerce all detections. This separation became important in later work, which found that different evaluation metrics and robustness properties are needed for these distinct behaviors (Dunnett et al., 28 Jan 2026).

3. Evaluation methodology and empirical behavior

BadDet is evaluated at $\alpha$1 using standard AP and mAP, together with attack-specific Attack Success Rate (ASR). For GMA and RMA, ASR measures the proportion of non-target boxes whose predictions are changed to the target class. For OGA, ASR measures target-class boxes generated around triggers. For ODA, ASR measures target-class boxes that vanish or whose confidence drops below threshold because of the trigger. The later military-domain study on modified GMA expressed ASR in the canonical indicator form

$\alpha$2

with $\alpha$3 (Chan et al., 2022, Liezenga et al., 3 Sep 2025).

The original BadDet experiments reported strong attack efficacy across models and datasets. OGA achieved ASR of 95.4–98.3%, with $\alpha$4 of 81.2–90.1%, and generated boxes typically had very high confidence: average confidence exceeded 0.95 and more than 95% of generated boxes had confidence above 0.98. RMA achieved ASR of 59.4–88.2%, with $\alpha$5 ranging from 56.7–80.3%. GMA was harder, with ASR of 47.4–75.7% and $\alpha$6 of 37.5–59.6%. ODA achieved ASR of 55.3–80.0%; vanished boxes had average confidence below 0.22, whereas the same boxes without the trigger had confidence above 0.75. On clean models without a backdoor, ODA ASR remained below 5%, indicating that the suppression effect was learned rather than caused by simple occlusion (Chan et al., 2022).

Utility preservation was a central result. The infected models retained benign detection performance with “overall testing utility loss” increasing by less than 10% relative to clean models. This is the standard backdoor desideratum: high clean utility, high conditional malicious behavior. Ablation studies further showed that poisoning rate strongly influences success, larger triggers help OGA and ODA, and even low-visibility triggers such as $\alpha$7 can remain effective, especially for OGA, RMA, and GMA (Chan et al., 2022).

A later critique from BadDet+ identified a limitation in how these results should be interpreted. For RMA, ASR alone can overstate attack success because the target label may appear while the true label is still retained as a duplicate detection. For ODA, using mAP reduction as a proxy for disappearance can be confounded by duplicate detections, localization errors, or phantom boxes. This led to the introduction of True Detection Rate (TDR) for RMA and instance-level ODA ASR as complementary metrics (Dunnett et al., 28 Jan 2026).

4. Persistence, constraints, and re-evaluation in the military domain

BadDet’s persistence under transfer learning was studied by pretraining infected models on poisoned COCO and then fine-tuning them on benign VOC data. OGA and ODA remained comparatively durable: OGA retained ASR of approximately 92–94% with $\alpha$8 around 87.9–90.7%, and ODA retained ASR of approximately 51–63% while preserving $\alpha$9. By contrast, RMA and GMA weakened substantially under fine-tuning, with ASR dropping to approximately 14–18%. The explanation given in the study is that OGA mainly memorizes the trigger pattern itself, whereas RMA and GMA depend more strongly on dataset-specific class-feature alignment (Chan et al., 2022).

A more application-specific re-evaluation was conducted in the military domain using a custom dataset, MilCivVeh, with 1,456 images, 2,438 annotated objects, and three classes: civilian car, military truck, and military tank. That study implemented a modified BadDet GMA with blended patches,

$P=10\%$0

using the HTBD patch as the main trigger, alongside checkerboard and banana triggers in ablation. For attack-efficacy experiments, patch sizes varied from 10 to 50 pixels, poisoning rates were $P=10\%$1, and all labels in patched training images were changed to the target class, “military truck” (Liezenga et al., 3 Sep 2025).

The military results materially qualified BadDet’s practical applicability. On YOLOv3, clean F1 at $P=10\%$2 was 94.2%; at $P=10\%$3, ASR peaked at 28.9% with a $P=10\%$4 patch and F1 fell to 80.1%–86.0%; at $P=10\%$5, ASR peaked at 52.2% with a $P=10\%$6 patch and F1 dropped to 66.8%–71.5%. On YOLOv10m, clean F1 at $P=10\%$7 was 94.9%; at $P=10\%$8, ASR stayed at or below 10%; at $P=10\%$9, ASR peaked at 39.4% with a $9\times 9$0 patch; at $9\times 9$1, ASR peaked at 49.5% with a $9\times 9$2 patch, with F1 roughly 64–77%. No monotonic relation between patch size and ASR was observed. High poisoning rates of 30–40% were needed to reach ASR around 40–50%, and these rates substantially degraded clean performance (Liezenga et al., 3 Sep 2025).

An important empirical observation in that study was that misclassifications to the target class were also frequent on clean, unpatched test images after training on poisoned data. This suggests that, in this regime, the attack effect is driven not only by the patch cue but also by large-scale label corruption. A plausible implication is that BadDet-style dirty-label GMA becomes operationally difficult in domains where poisoning 30–40% of the training set is likely to be noticed during data quality assurance or clean-set validation (Liezenga et al., 3 Sep 2025).

5. Detection and defense mechanisms

The original BadDet paper proposed Detector Cleanse, an entropy-based run-time detection framework for poisoned test samples. For a detection with class distribution $9\times 9$3, entropy is defined as

$9\times 9$4

Detector Cleanse collects a set of clean features from bounding-box regions in a small set of clean images, blends those features into each predicted box of a query image, and measures the resulting entropy distribution. If any average entropy $9\times 9$5 falls outside a calibrated normal range $9\times 9$6, the image is flagged as poisoned and the abnormal box can localize the trigger region. On Faster R-CNN with VOC2007, using 500 clean and 500 poisoned test images per attack, the reported accuracy ranged from 80.4% to 91.3% depending on the attack and threshold $9\times 9$7, with the best overall trade-off at $9\times 9$8: 91.0% for OGA, 88.6% for RMA, 82.6% for GMA, and 87.3% for ODA (Chan et al., 2022).

Later work shifted the defense problem from run-time test filtering to dataset-level patch detection prior to training. The military-domain study evaluated PAD, PaDiM, PatchCore, CFA, EfficientAD, TRACE, and a new method called AutoDetect. PAD achieved AUROC 0.633 on COCO, 0.902 on MilCivVeh, and 0.725 on VOC2007, but was computationally very intensive. PaDiM achieved AUROC 0.637 on COCO, 0.538 on MilCivVeh, and 0.555 on VOC2007, while PatchCore and CFA and EfficientAD were near random on COCO and were not pursued further because of poor performance and resource demands. TRACE, a model-centric test-time detector for trained detectors, reported AUROC 0.924 on COCO and 0.939 on VOC2007, but it is not directly comparable because it targets model-level test-time detection rather than dataset-level patch detection (Liezenga et al., 3 Sep 2025).

AutoDetect was proposed as a simple, fast, and lightweight autoencoder-based method. It trains an autoencoder on clean MS COCO images, computes per-pixel reconstruction error, aggregates error over sliding-window slices, and scores an image by the maximum slice error:

$9\times 9$9

A normal distribution $P=30\%$0 is then fit to slice errors on a small clean validation set from the target domain, and a query is classified as anomalous when the percentile of $P=30\%$1 exceeds a threshold $P=30\%$2, with $P=30\%$3 recommended for high precision. Reported AUROC was 0.965 on MS COCO, 0.941 on MilCivVeh, and 0.970 on VOC2007; VOC2007 accuracy reached 95% at $P=30\%$4. Detection was best when slice size matched patch size, checkerboard patches were easiest to detect, and banana patches were hardest because the white border lowered contrast (Liezenga et al., 3 Sep 2025).

6. Generalization to BadDet+ and terminological ambiguity

BadDet+ reformulated object-detection backdoors as a penalty-based training problem rather than a pure data-poisoning problem. Its threat model is stronger: the attacker can poison a fraction of training data and augment the detector’s training loss with an attack-specific penalty. The core mechanism is a log-barrier penalty that suppresses true-class predictions only for predictions overlapping triggered objects. For detectors with independent class logits, the attack penalty is

$P=30\%$5

This single mechanism unifies targeted Regional Misclassification Attack and Object Disappearance Attack, yields position and scale invariance when triggers are randomized during training, and improves synthetic-to-physical transfer. On COCO, BadDet+ reported ODA $P=30\%$6 of 96.95 for FCOS, 98.46 for Faster R-CNN, and 97.60 for DINO, while targeted RMA reached $P=30\%$7 of 99.28, 99.45, and 97.27 respectively, with TDR@50 reduced to low single digits; the study also found that fine-tuning and JPEG sanitization do not neutralize the attack (Dunnett et al., 28 Jan 2026).

The label “BadDet” is not unique across arXiv. In archival document analysis, the relevant terms are READ-BAD and cBAD; the paper explicitly states that it does not use the term “BadDet,” and that cBAD denotes the ICDAR 2017 Competition on Baseline Detection built around the READ-BAD dataset and its baseline-centric evaluation scheme (Grüning et al., 2017). In smart-contract security, “BadDet” is used for a detector of Bad Randomness (SWC-120), supported by a risk-stratified dataset of 1,758 contracts and a five-phase validation pipeline (Rezaei et al., 14 Jan 2026). In visual anomaly detection, BAD denotes Blind Anomaly Detection, an unsupervised setting addressed by PatchCluster through implicit local feature clustering without a normal-only training set (Zhang et al., 2023). This suggests that “BadDet” is a context-dependent label rather than a standardized term, and that in security-oriented computer vision it refers most directly to the object-detection backdoor framework introduced in 2022 and extended in subsequent work (Chan et al., 2022)