Design and Interpretation of Universal Adversarial Patches in Face Detection

Abstract

We consider universal adversarial patches for facessmall visual elements whose addition to a face image reliably destroys the performance of face detectors. Unlike previous work that mostly focused on the algorithmic design of adversarial examples in terms of improving the success rate as an attacker, in this work we show an interpretation of such patches that can prevent the state-of-the-art face detectors from detecting the real faces. We investigate a phenomenon: patches designed to suppress real face detection appear face-like. This phenomenon holds generally across different initialization, locations, scales of patches, backbones, and state-of-the-art face detection frameworks. We propose new optimization-based approaches to automatic design of universal adversarial patches for varying goals of the attack, including scenarios in which true positives are suppressed without introducing false positives. Our proposed algorithms perform well on real-world datasets, deceiving state-of-the-art face detectors in terms of multiple precision/recall metrics and transferring between different detection frameworks.

DPAttack: Diffused Patch Attacks against Universal Object Detection

“…Adversarial attacks can fool models in lots of computer vision tasks, e.g. images classification [6,4,13], images segmentation [9,7], face detection [17,2] and object detection [16,15,8,12]. Adversarial attacks against object detection can be divided into two categories: 1) whole-pixel attacks, which can add perturbations to all pixels in images under L p constraints (e.g.…”