# Camouflage Backdoor Attack against Pedestrian Detection
## 1 Introduction  
In recent years, the advent of autonomous vehicles has heralded a new era of transportation, promising safer and more efficient roadways [1; 2; 3]. Within the realm of autonomous driving, a critical task is pedestrian detection [4; 5; 6], where its primary objective lies in the precise identification of pedestrians within images or videos. This task leverages advanced deep neural networks (DNNs) to perceive and interpret the surrounding environment, ensuring the precise distinction of pedestrians from other objects or the background. As a result, the accuracy and resilience of pedestrian detection models emerge as paramount factors, directly influencing the overall safety and dependability of autonomous vehicles on the road [2; 3; 5]. However, recent research has demonstrated that DNNs are not immune to vulnerabilities, despite achieving exceptional performance in various domains. It has become increasingly evident that DNNs lack robustness and are susceptible to backdoor attacks [7; 8; 9]. Attackers exploit a stealthy strategy by embedding malicious backdoor triggers or patterns during the training stage of DNNs. This surreptitious maneuver gives rise to concealed vulnerabilities within the neural networks. Subsequently, when these networks encounter specific inputs or conditions, these backdoors can unexpectedly activate, potentially yielding harmful responses [10; 11; 12]. Such occurrences pose a significant threat, eroding thereliability and integrity of systems reliant on neural networks. While past works have investigated a range of backdoor attacks targeting DNNs across various domains [7; 13; 14; 15; 16; 17], there are no studies investigating backdoor attacks against pedestrian detection in autonomous driving. This paper endeavors to design and implement a covert backdoor attack against pedestrian detection within the context of autonomous driving. There are a couple of challenges to achieving this goal. (i) Firstly, most existing backdoor attacks primarily focus on poisoning training images for classification tasks [7; 18; 19]. In contrast, when dealing with autonomous driving systems, the objective of enabling a pedestrian to escape detection is considerably more threatening and complex than merely attacking a classifier task. Therefore, we consider how to design a backdoor attack against pedestrian detection, aiming for the attacked DNNs to behave normally on benign images while failing to detect pedestrian-containing trigger patterns. (ii) Secondly, backdoor attacks based on poisoned labels or annotations could potentially be recognized by humans if the model developers have the capability of manually inspecting the training images [20]. To make the backdoor attack more stealthy and increase the success rate of backdoor attacks, our objective is to meticulously design camouflage backdoor attacks. (iii) Thirdly, it is worth noting that existing backdoor attacks primarily target a specific algorithm when tampering with training images. However, in the context of pedestrian detection, various algorithms can be employed to train the model, including both two-stage [21; 22] and one-stage algorithms [23; 24; 25], as well as anchor-based [21; 25] and anchor-free methods [26; 27]. Generating a set of universally applicable poisoned images capable of targeting any pedestrian detection model, regardless of its underlying algorithm, presents a formidable challenge. To address the above challenges, in this paper, we propose a camouflage backdoor attack against pedestrian detection in autonomous driving systems. Firstly, for the task of object detection, we propose a backdoor attack method that can be executed during the training phase. Specifically, we employ a pre-trained image matting model to generate attack images with embedded triggers. These attack images are then integrated into the original benign images for model training, while preserving the original annotations of the benign images.