6DAttack: Backdoor Attacks in the 6DoF Pose Estimation

Recent advances in deep learning have enabled highly accurate six-degree-of-freedom (6DoF) object pose estimation, driving its widespread use in real-world applications such as robotics, augmented reality, virtual reality, and autonomous systems. However, backdoor attacks pose a major security risk to deep learning models. By injecting malicious triggers into training data, an attacker can cause a model to perform normally on benign inputs but behave incorrectly under specific conditions. While most research on backdoor attacks has focused on 2D vision tasks, their impact on 6DoF pose estimation remains largely unexplored. Furthermore, unlike traditional backdoors that only change the object class, backdoors in 6DoF estimation must manipulate other dimensions, such as intrinsic camera parameters, translation, and rotation. Therefore, two-dimensional backdoor attack methods are completely ineffective against 6DoF pose estimation networks. To address this issue, we propose a novel backdoor attack framework to expose vulnerabilities in 6DoF pose estimation. Our framework uses synthetic and real 3D objects of varying shapes as triggers and assigns target poses to induce controlled erroneous pose outputs while maintaining normal behavior on clean inputs. We evaluated this attack on multiple models (including PVNet, DenseFusion, and PoseDiffusion) and datasets (such as Linemod, YCB-Video, and CO3D). Experimental results demonstrate that our approach achieves extremely high attack success rates without compromising performance on legitimate tasks. Across various models and objects, the backdoored network achieves up to 100% ADD accuracy on clean data, while also achieving 100% attack success rate (ASR) under trigger conditions. The accuracy of controlled erroneous pose output is also extremely high,as the attack sample achieves 97.70% ADD-P. These results demonstrate that the backdoor can be reliably implanted and activated, achieving a high attack success rate under trigger conditions and with negligible impact on benign data. Furthermore, we employ a simple defense method to demonstrate that our attack framework is undefendable. These findings reveal a potentially serious and previously underexplored threat to modern 6DoF pose estimation systems.