Detecting Backdoors in Object Detection via Pre-NMS Prediction Distribution Shift

Object detection models deployed in safety-critical applica-tions remain vulnerable to backdoor attacks that cause targeted misbe-haviors when a hidden trigger is present. Existing detection methods ei-ther rely on trigger inversion or exploit architecture-specific assumptions,and critically, representative existing methods fail to generalize reliablyto scene-level attacks, where a single trigger induces anomalous behavioracross all objects in the scene simultaneously. We present DistScan, abackdoor detection framework based on a simple but previously unex-ploited observation: backdoor injection systematically shifts a model’spre-NMS prediction class distribution away from its training class fre-quencies, even on clean inputs without any trigger present. DistScanaggregates intermediate class predictions over a clean validation set andflags a model as backdoored if the resulting distribution deviates sig-nificantly from the training class frequencies, requiring no model weightaccess, no trigger knowledge, and no additional training. Extensive exper-iments on MS-COCO and PASCAL VOC across two architectures andthree scene-level attack scenarios demonstrate that DistScan substan-tially outperforms existing methods, improving average detection accu-racy over the best-performing applicable baseline by 27.32 percentagepoints.