Cloning Object Detectors

Abstract

Object detectors based on neural networks are deployed in various consumer electronics products to predict different types of object and their location in images. This paper presents a cloning attack on object detectors, using problem domain samples and oracle access to a trained object detector. As in known cloning attacks on image classifiers, the presented attack uses the oracle access to label the samples. The resulting set of labeled samples, referred to as the surrogate dataset, is then used to train the clone detector. Compared to image classifiers, the surrogate dataset created by an object detector can contain more types of error. The paper describes a way to assess the quality of the surrogate dataset. The cloning attack was implemented, and experiments were conducted with a CenterNet and a RetinaNet object detector, and the Oxford-IIIT Pet, Tsinghua-Tencent 100K, and WIDER FACE datasets. The results show that object detectors can be cloned successfully, even if the quality of the surrogate dataset is relatively low. However, in case of a low-quality surrogate dataset, the quality of the clone detector was only high if it used the same architecture as the target detector.