Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift

Longtian Wang; Zhengyu Zhao; Chenhao Lin; Le Yang; Shiwei Wang; Yuhan Zhi; Xiaofei Xie; Chao Shen

cs.CVAug 19, 2026

Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift

Authors: Longtian Wang, Zhengyu Zhao, Chenhao Lin, Le Yang, Shiwei Wang, Yuhan Zhi, Xiaofei Xie, Chao Shen

Organizations: Xi’an Jiaotong University, Xi’an, China · Singapore Management University, Singapore

Abstract

Object detection models deployed in safety-critical applications remain vulnerable to backdoor attacks that cause targeted misbehaviors when a hidden trigger is present. Existing detection methods either rely on trigger inversion or exploit architecture-specific assumptions, and critically, representative existing methods fail to generalize reliably to scene-level attacks, where a single trigger induces anomalous behavior across all objects in the scene simultaneously. We present DistScan, a backdoor detection framework based on a simple but previously unexploited observation: backdoor injection systematically shifts a model's pre-NMS prediction class distribution away from its training class frequencies, even on clean inputs without any trigger present. DistScan aggregates intermediate class predictions over a clean validation set and flags a model as backdoored if the resulting distribution deviates significantly from the training class frequencies, requiring no model weight access, no trigger knowledge, and no additional training. Extensive experiments on MS-COCO and PASCAL VOC across two architectures and three scene-level attack scenarios demonstrate that DistScan substantially outperforms existing methods, improving average detection accuracy over the best-performing applicable baseline by 27.32 percentage points.

Figures & tables

Panel of Figure 1 — Figure 1: A Scene-Level Backdoor Attack Triggering Numerous Spurious Detections.

Figure 2: Pre-NMS prediction class distributions of benign (blue) and backdoored (red) models, with the training data distribution marked as yellow.

Scenario	Dataset	Model	DistScan			MIA			ODSCAN
Scenario	Dataset	Model	TPR	FPR	Acc.	TPR	FPR	Acc.	TPR	FPR	Acc.
SPONGE	VOC	YOLOv5	100.00	0.00	100.00	-	-	-	0.00	0.00	50.00
	VOC	FRCNN	94.44	0.00	97.22	0.00	0.00	50.00	0.00	0.00	50.00
	COCO	YOLOv5	100.00	0.00	100.00	-	-	-	0.00	0.00	50.00
	COCO	FRCNN	83.33	0.00	91.67	0.00	0.00	50.00	0.00	0.00	50.00
BLINDING	VOC	YOLOv5	100.00	0.00	100.00	-	-	-	0.00	0.00	50.00

Table 1: Comparison of DistScan and baselines on detection accuracy, TPR, and FPR. FRCNN denotes Faster R-CNN and Acc. denotes detection accuracy. ‘-’ indicates that the method is not applicable to the given setting. Best results across methods are bolded .

Method	SPONGE-VOC		SPONGE-COCO		BLINDING-VOC		BLINDING-COCO		GMA-VOC		GMA-COCO
Method	YOLOv5	FRCNN	YOLOv5	FRCNN	YOLOv5	FRCNN	YOLOv5	FRCNN	YOLOv5	FRCNN	YOLOv5	FRCNN
DistScan	1.00	0.97	1.00	0.91	1.00	1.00	0.99	0.94	1.00	0.94	0.92	1.00
MIA	-	0.00	-	0.00	-	0.79	-	0.60	-	0.91	-	0.40

Table 2: Comparison of DistScan and MIA on AUROC. ODSCAN is omitted as it failed across all scene-level attack scenarios. Better results per column are bolded .

Dataset	Val Set	YOLOv5				Faster R-CNN
Dataset	Val Set	SPONGE	BLINDING	GMA	Average	SPONGE	BLINDING	GMA	Average
VOC	Equal Number	100.00	100.00	100.00	100.00	55.56	69.44	77.78	67.59
	Equal Size	100.00	94.44	72.22	88.89	97.22	100.00	91.67	96.30
	Random	100.00	100.00	100.00	100.00	55.56	69.44	77.78	67.59
COCO	Equal Number	100.00	94.44	86.11	93.52	55.56	88.89	88.89	77.78
	Equal Size	100.00	88.89	97.22	95.37	91.67	94.44	100.00	95.37

Table 3: Detection accuracy of DistScan under different validation set construction strategies. Best results per column are bolded . Shaded rows indicate the construction strategy used in this setting.

Dataset	$\delta$	YOLOv5				Faster R-CNN
Dataset	$\delta$	SPONGE	BLINDING	GMA	All	SPONGE	BLINDING	GMA	All
VOC	0.0000	100.00	100.00	100.00	100.00	50.00	50.00	50.00	50.00
	0.0005	100.00	100.00	100.00	100.00	97.22	100.00	91.67	96.30
	0.0010	100.00	97.22	91.67	96.30	97.22	100.00	91.67	96.30
	0.0100	100.00	97.22	77.78	91.67	50.00	86.11	91.67	75.93
	0.0500	94.44	97.22	80.56	90.74	52.78	72.22	88.89	71.30

Table 4: Detection Accuracy of DistScan using different confidence thresholds

\delta

. Best results per column are bolded . Shaded rows indicate the recommended threshold.

Figure 4: PCA projection of pre-NMS prediction class distributions for benign (blue circles) and backdoored (red triangles) models across three attack scenarios on Faster R-CNN, with the training data distribution marked as a yellow star.

Backdoor Detection

Backdoor detection finds hidden triggers or poisoned behavior in trained models before they can secretly redirect predictions or actions.

See all 53 papers

Backdoor Mitigation in Object Detection via Adversarial Fine-Tuning
May 7, 2026Kealan Dunnett, Reza Arablouei, Dimity Miller +2Fine-Tuning Backdoor Attacks
Queensland University of Technology, Brisbane Australia · CSIRO, Pullenvale QLD, Australia
ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus
Sep 23, 2026Li Zeng, Mingcheng Duan, Longfei Fan +5Backdoor Attacks Backdoor Defense
School of Computer and Communication Engineering, Changsha University of Science & Technology, Changsha 410114, China · School of Computer Science, Xiangtan University, Xiangtan 411105, China · School of Software, Yunnan University, Kunming 650500, China +3
Lightweight and Fast Backdoor Model Detection
May 17, 2026Yinbo Yu, Jing Fang, Xuewen Zhang +4Backdoor Attacks Backdoor Detection
College of Artificial Intelligence, Nanjing University of Aeronautics and Astronautics, Nanjing, Jiangsu, 210016, China · Shenzhen Research Institute of Northwestern Polytechnical University, Shenzhen, Guangdong, 518057, China · School of Software, Northwestern Polytechnical University, Xi’an, Shaanxi, 710072, P.R. China +2

May 7, 2026J/K move · Enter open · S save

Backdoor Mitigation in Object Detection via Adversarial Fine-Tuning

Kealan Dunnett, Reza Arablouei, Dimity Miller, Volkan Dedeoglu+1

Queensland University of Technology, Brisbane Australia · CSIRO, Pullenvale QLD, Australia

Fine-Tuning Backdoor Attacks Adversarial Robustness Backdoor Defense Object Detection

Open paper AskPDF arXiv

Backdoor attacks can implant malicious behaviours into deep models while preserving performance on clean data, posing a serious threat to safety-critical vision systems. Although backdoor mitigation has been studied extensively for image classification, defenses for object detection remain comparatively underdeveloped. Adversarial fine-tuning is a common backdoor mitigation approach in classification, but adapting it to detection is nontrivial as classification-oriented adversarial generation does not match the detection attack space, where attacks may cause object misclassification or disappearance, and standard detection losses can dilute the repair signal across many predictions. We address these challenges through a detection-aware adversarial fine-tuning framework for mitigating object-detection backdoors when the defender has access only to a compromised detector and a small clean dataset, without knowing the attack objective. For adversarial generation that does not require knowledge of the attack objective, we introduce soft-branch minimisation, which uses a soft gate to combine objectives aligned with misclassification and disappearance attacks, together with a detection-aware classification-loss maximisation. For targeted repair, we introduce a dual-objective fine-tuning loss applied to target-matched predictions, concentrating the defensive update on predictions most relevant to the backdoor behaviour. Experiments across CNN- and Transformer-based detectors show that our approach more effectively reduces attack success while preserving true detections, compared with classification-oriented baselines, and maintains competitive clean detection performance.

Abstract

Backdoor Detection

Explore similar work

Backdoor Mitigation in Object Detection via Adversarial Fine-Tuning

ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus

Lightweight and Fast Backdoor Model Detection