AdversarialQR: An adversarial patch in QR code format

Chindaudom, Aran; Siritanawan, Prarinya; Sumongkayothin, Karin; Kotani, Kazuhiko

doi:10.1109/icievicivpr48672.2020.9306675

Cited by 16 publications

(7 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It was observed in our empirical approach that the circular-shaped adversarial patches can retain their adversarial efficacy with each training iteration better than their square-shaped counterparts [ 25 ]. Therefore, an idea is implemented to apply the QR symbol onto a circular-shaped adversarial patch.…”

Section: Methodsmentioning

confidence: 99%

Surreptitious Adversarial Examples through Functioning QR Code

et al. 2022

Self Cite

View full text Add to dashboard Cite

The continuous advances in the technology of Convolutional Neural Network (CNN) and Deep Learning have been applied to facilitate various tasks of human life. However, security risks of the users’ information and privacy have been increasing rapidly due to the models’ vulnerabilities. We have developed a novel method of adversarial attack that can conceal its intent from human intuition through the use of a modified QR code. The modified QR code can be consistently scanned with a reader while retaining adversarial efficacy against image classification models. The QR adversarial patch was created and embedded into an input image to generate adversarial examples, which were trained against CNN image classification models. Experiments were performed to investigate the trade-off in different patch shapes and find the patch’s optimal balance of scannability and adversarial efficacy. Furthermore, we have investigated whether particular classes of images are more resistant or vulnerable to the adversarial QR attack, and we also investigated the generality of the adversarial attack across different image classification models.

show abstract

Section: Methodsmentioning

confidence: 99%

Surreptitious Adversarial Examples through Functioning QR Code

et al. 2022

Self Cite

View full text Add to dashboard Cite

show abstract

“…PS-GAN [54], and [56] in 2019 [57], [58] in 2020 (like rotation) and locations over the image. Another attempt to make the adversarial patch less suspicious to human eyes was the adversarial QR patch [62], [63]. It was created using a masked patch initialized with a QR pattern and trained later to make successful attacks.…”

Section: A Patch Attacks For Classification Tasksmentioning

confidence: 99%

“…Most efforts that are taken to reduce the identification of patches are observed to lead to the sacrifice of attacking behaviours. The reasons behind this stem from the fact that producing stronger attacks requires large perturbations without many structural constraints like in the QR patch [62] and that the lack of constraints on perturbations leads to irregular and random patterns in the perturbation learning. Hence there exists a trade-off between patch identification and attack effectiveness.…”

Section: A Patch Attacks For Classification Tasksmentioning

confidence: 99%

“…Adversarial patch [37] VGG16, VGG19, ResNet50, InceptionV3, Xception ImageNet Yes LaVAN [30] InceptionV3 [78] ImageNet No QP patch [62], [63] InceptionV3 [78] ImageNet [79] No PS-GAN a [54] VGG16, ResNet34, VY [80], and their variants ImageNet [81], GTSRB [82] Yes Local patch via DIP b [64] VGG19, InceptionV3 ImageNet [81] No DiAP [60] VGG16, VGG19 [83], ResNet50 [84], InceptionV3 [78], Xception [ YOLOv2 [87], Faster R-CNN [69] Seld-made data (indoors and outdoors) Yes Physical patch +PGD e [70] YOLOv3 [89] MS COCO 2014 [90] Yes Patch against person detectors [56] YOLOv2 [87] INRIA [91] e Yes DPAttack [71] YOLOv4 [92], Faster R-CNN [69] Alibaba f No RPAttack [72] YOLOv4 [92], Faster R-CNN [93] Alibaba f , Pascal VOC 2007 [94] No Patch against aerial detection [57] YOLOv2 DOTA [95] No Patch-Noobj [61] YOLOv3 [89], YOLOv5 [96], Faster R-CNN [69] DOTA [95], NWPU VHR-10 [97], RSOD [98] No g…”

Section: Patch Attackmentioning

confidence: 99%

See 1 more Smart Citation

Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey

Sharma¹,

Bian²,

Munz³

et al. 2022

Preprint

View full text Add to dashboard Cite

<p>Adversarial attacks in deep learning models, especially for safety-critical systems, are gaining more and more attention in recent years, due to the lack of trust in the security and robustness of AI models. Yet the more primitive adversarial attacks might be physically infeasible or require some resources that are hard to access like the training data, which motivated the emergence of patch attacks. In this survey, we provide a comprehensive overview to cover existing techniques of adversarial patch attacks, aiming to help interested researchers quickly catch up with the progress in this field. We also discuss existing techniques for developing detection and defences against adversarial patches, aiming to help the community better understand this field and its applications in the real world.</p>

show abstract

“…Previous works propose several strategies to craft more robust patches, among which Expectation over Transformation (EOT) [2] is a commonly used method to improve the robustness of patches against rotation and scaling. To make adversarial patches more imperceptible, Chindaudom et al [9] propose the adversarial QR patch, which constrains patches to QR patterns. Additionally, Liu et al [28] propose PS-GAN, the first GAN-based method to generate more natural-looking adversarial patches.…”

Section: Adversarial Patch Attacksmentioning

confidence: 99%

Unsupervised Conditional Adversarial Networks for Tax Evasion Detection

Wei

Dong

Zhu

et al. 2019

2019 IEEE International Conference on Big Data (Big Data)

View full text Add to dashboard Cite

Adversarial patch is one of the important forms of performing adversarial attacks in the physical world. To improve the naturalness and aggressiveness of existing adversarial patches, location-aware patches are proposed, where the patch's location on the target object is integrated into the optimization process to perform attacks. Although it is effective, efficiently finding the optimal location for placing the patches is challenging, especially under the black-box attack settings. In this paper, we propose the Distribution-Optimized Adversarial Patch (DOPatch), a novel method that optimizes a multimodal distribution of adversarial locations instead of individual ones. DOPatch has several benefits: Firstly, we find that the locations' distributions across different models are pretty similar, and thus we can achieve efficient query-based attacks to unseen models using a distributional prior optimized on a surrogate model. Secondly, DOPatch can generate diverse adversarial samples by characterizing the distribution of adversarial locations. Thus we can improve the model's robustness to location-aware patches via carefully designed Distributional-Modeling Adversarial Training (DOP-DMAT). We evaluate DOPatch on various face recognition and image recognition tasks and demonstrate its superiority and efficiency over existing methods. We also conduct extensive ablation studies and analyses to validate the effectiveness of our method and provide insights into the distribution of adversarial locations.

show abstract

AdversarialQR: An adversarial patch in QR code format

Cited by 16 publications

References 7 publications

Surreptitious Adversarial Examples through Functioning QR Code

Surreptitious Adversarial Examples through Functioning QR Code

Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey

Unsupervised Conditional Adversarial Networks for Tax Evasion Detection

Contact Info

Product

Resources

About