Reproduce “Mirage: a Clean-Label Backdoor against LiDAR 3D Object Detection” on OpenResearch

About this paper

Ziba Parsons, Ang Li

MIRAGE demonstrates that targeted backdoors can be implanted in LiDAR 3D detectors without changing annotations, model architectures, or training procedures. Using only 16 poisoned KITTI frames, the optimized point-cloud trigger converts pedestrians and cyclists into cars with a mean 73% success rate on PointPillars, while preserving a 99% overall disruption rate; transfer to SECOND is weaker but remains measurable.

Key insights

• Trigger optimization primarily changes the detector’s failure mode: compared with a random dense cluster, it more often produces the attacker’s desired car prediction instead of merely making the source object disappear.
• A poisoning rate of 0.5%—16 of 3,260 KITTI training frames—is sufficient to produce strong targeted behavior on PointPillars, indicating that label review alone would not necessarily reveal the compromise.
• Cross-architecture transfer is sensitive to the detector’s representation: the trigger is more effective on pillar-based PointPillars than on voxel-based SECOND, although confidence-stable activations still transfer.

Summary by alphaXiv.