Abstract
Gaze estimation models are widely used in applications such as driver attention monitoring and human-computer interaction. While many methods for gaze estimation exist, they rely heavily on data-hungry deep learning to achieve high performance. This reliance often forces practitioners to harvest training data from unverified public datasets, outsource model training, or rely on pre-trained models. However, such practices expose gaze estimation models to backdoor attacks. In such attacks, adversaries inject backdoor triggers by poisoning the training data, creating a backdoor vulnerability: the model performs normally with benign inputs, but produces manipulated gaze directions when a specific trigger is present. This compromises the security of many gaze-based applications, such as causing the model to fail in tracking the driver's attention. To date, there is no defense that addresses backdoor attacks on gaze estimation models. In response, we introduce SecureGaze, the first solution designed to protect gaze estimation models from such attacks. Unlike classification models, defending gaze estimation poses unique challenges due to its continuous output space and globally activated backdoor behavior. By identifying distinctive characteristics of backdoored gaze estimation models, we develop a novel and effective approach to reverse-engineer the trigger function for reliable backdoor detection. Extensive evaluations in both digital and physical worlds demonstrate that SecureGaze effectively counters a range of backdoor attacks and outperforms seven state-of-the-art defenses adapted from classification models.
Abstract (translated)
注视估计模型广泛应用于驾驶员注意力监控和人机交互等应用中。尽管存在许多注视估计的方法，但这些方法往往依赖于数据密集型的深度学习技术来实现高性能。这种对大量训练数据的需求经常迫使从业者从未经验证的公共数据集中收集训练数据、外包模型训练或依赖预训练模型。然而，这样的做法会使得注视估计模型容易遭受后门攻击。在这些攻击中，对手通过污染训练数据注入后门触发器，在模型中创建一个后门漏洞：模型在接受正常输入时表现正常，但在特定触发器存在的情况下会产生操纵后的注视方向。这破坏了许多基于注视的应用程序的安全性，例如导致模型无法正确追踪驾驶员的注意力。迄今为止，还没有针对这类攻击进行防御的方法。 为解决这个问题，我们引入了SecureGaze，这是首个旨在保护注视估计模型免受此类攻击威胁的解决方案。与分类模型不同的是，由于其连续输出空间和全局激活的后门行为，保护注视估计面临着独特的挑战。通过识别带有后门的注视估计模型的独特特性，我们开发了一种新颖且有效的方法来反向工程触发函数，从而实现可靠的后门检测。 在数字世界和物理世界的广泛评估中显示，SecureGaze能够有效地对抗一系列后门攻击，并优于七种从分类模型改编而来的最新防御方法。
URL
https://arxiv.org/abs/2502.20306
