APRICOT: A Dataset of Physical Adversarial Attacks on Object Detection

Braunegg, A.; Chakraborty, Amartya; Krumdick, Michael; Lape, Nicole; Leary, Sara; Manville, Keith; Merkhofer, Elizabeth M.; Strickhart, Laura; Walmer, Matthew

doi:10.1007/978-3-030-58589-1_3

Cited by 36 publications

(25 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…10. Considering the implications of this direction of research, a dataset for adversarial attacks on object detectors in the physical world is also introduced in [277]. Whereas currently attacks on object detectors are not as popular as attacks on classifiers, we can anticipate much larger interest of the research community for this problem due to many interesting, and sometimes security-critical applications.…”

Section: Physical World Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: Physical World Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…their ground truth label, the 'Recognizability' of different 3D objects when using Assistive Textures and Patches in the 3D space, and explaining visual salience features that might contribute to make an object more recognizable to a deep learning classifier. Adversarial patches [6,4] have been tested before in the physical world usually by printing the adversarial patterns and then taking pictures of the altered scene containing the patch. One characteristic that makes adversarial patches powerful is the ability of being universal (i.e.…”

Section: Experimentationmentioning

confidence: 99%

Assistive signals for deep neural network classifiers

Pestana¹,

Glance²,

Liu³

et al. 2021

LatinX in AI at Computer Vision and Pattern Recognition Conference 2021

View full text Add to dashboard Cite

Deep Neural Networks are brittle in that small changes in the input can drastically affect their prediction outcome and confidence. Consequently, research in this area mainly focus on adversarial attacks and defenses. In this paper, we take an alternative stance and introduce the concept of Assistive Signals, which are perturbations optimized to improve a model’s confidence score regardless if it’s under attack or not. We analyze some interesting properties of these assistive perturbations and extend the idea to optimize them in the 3D space simulating different lighting conditions and viewing angles. Experimental evaluations show that the assistive signals generated by our optimization method increase the accuracy and confidence of deep models more than those generated by conventional methods that work in the 2D space. ‘Assistive Signals’ also illustrate bias of ML models towards certain patterns in real-life objects.

show abstract

“…APRICOT [6] contains 1,011 images of sixty unique physical adversarial patches photographed in the real world, of which six patches (138 photos) are in the development set, and the other fifty-four patches (873 photos) are in the test set. APRICOT provides bounding box annotations for each patch.…”

Section: Apricot-mask Datasetmentioning

confidence: 99%

“…Evaluation Metrics We evaluate the defense effectiveness by the targeted attack success rate. A patch attack is "successful" if the object detector generates a detection that overlaps a ground truth adversarial patch bounding box with an IoU of at least 0.10, has a confidence score greater than 0.30, and is classified as the same object class as the patch's target [6].…”

Section: Robustness Evaluationmentioning

confidence: 99%

“…Developing and evaluating defenses against physical patch attacks require physical-patch datasets which are costly to create. To the best of our knowledge, APRI-COT [6] is the only publicly available dataset of physical adversarial attacks on object detection. However, APRICOT only provides bounding box annotations for each patch without pixel-level annotations.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection

Liu¹,

Levine²,

Lau³

et al. 2021

Preprint

View full text Add to dashboard Cite

Object detection plays a key role in many security-critical systems. Adversarial patch attacks, which are easy to implement in the physical world, pose a serious threat to stateof-the-art object detectors. Developing reliable defenses for object detectors against patch attacks is critical but severely understudied. In this paper, we propose Segment and Complete defense (SAC), a general framework for defending object detectors against patch attacks through detecting and removing adversarial patches. We first train a patch segmenter that outputs patch masks that provide pixel-level localization of adversarial patches. We then propose a self adversarial training algorithm to robustify the patch segmenter. In addition, we design a robust shape completion algorithm, which is guaranteed to remove the entire patch from the images given the outputs of the patch segmenter are within a certain Hamming distance of the ground-truth patch masks. Our experiments on COCO and xView datasets demonstrate that SAC achieves superior robustness even under strong adaptive attacks with no performance drop on clean images, and generalizes well to unseen patch shapes, attack budgets, and unseen attack methods. Furthermore, we present the APRICOT-Mask dataset, which augments the APRICOT dataset with pixel-level annotations of adversarial patches. We show SAC can significantly reduce the targeted attack success rate of physical patch attacks.

show abstract

APRICOT: A Dataset of Physical Adversarial Attacks on Object Detection

Cited by 36 publications

References 16 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Assistive signals for deep neural network classifiers

Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection

Contact Info

Product

Resources

About