A two-stage cascaded purification framework for backdoored object detectors via backdoor feature suppression

Abstract

Object detectors have been widely deployed in safety-critical applications such as surveillance, autonomous driving, and industrial vision. However, stealthy backdoor poisoning during training can induce systematic abnormal outputs under a trigger condition (e.g., object disappearance or spurious object generation) while preserving apparently normal performance on clean inputs, posing severe yet hard-to-detect security risks. Compared with image classification, object detection features multi-branch architectures and tightly coupled multi-term losses, which make backdoor representations more prone to diffuse across layers/channels and become stubbornly entangled with benign detection features. As a result, existing defenses often struggle to simultaneously achieve effective backdoor suppression and model utility preservation. We observe that detection backdoors typically rely on a small set of trigger-sensitive channels that form severable structural pathways; nevertheless, even after the dominant pathways are removed, the trigger–malicious-behavior association may persist as residual coupled features in the parameter space, leading to backdoor re-activation1. Motivated by these findings, we propose a two-stage cascaded purification framework for object detection, termed DAPS–PCMD. In Stage I, DAPS (Differential-Activation guided Path-Severing Pruning) localizes highly toxic channels via stability-enhanced differential activation statistics and iteratively prunes them to physically sever the primary trigger pathways, producing a channel-level structural prior. In Stage II, PCMD (Prior-Constrained Residual Feature Decoupling) performs targeted decoupling and effective suppression of residual trigger associations under the prior constraint, while suppressing utility degradation via clean detection anchors. Extensive experiments and ablations demonstrate that explicitly decomposing purification into a cascade of structural path severing and residual feature decoupling is key to achieving a superior security–utility trade-off across diverse attack types and strengths, stably suppressing the Attack Success Rate (ASR) to 0.008–0.038 while maintaining the clean mAP at 0.837–0.862. Compared to the baseline RNP, our method further achieves a relative ASR reduction of 78.9%–92.1%.