DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks

Abstract

State-of-the-art object detectors are vulnerable to localized patch hiding attacks where an adversary introduces a small adversarial patch to make detectors miss the detection of salient objects. In this paper, we propose the first general framework for building provably robust detectors against the localized patch hiding attack called DetectorGuard. To start with, we propose a general approach for transferring the robustness from image classifiers to object detectors, which builds a bridge between robust image classification and robust object detection. We apply a provably robust image classifier to a sliding window over the image and aggregates robust window classifications at different locations for a robust object detection. Second, in order to mitigate the notorious trade-off between clean performance and provable robustness, we use a prediction pipeline in which we compare the outputs of a conventional detector and a robust detector for catching an ongoing attack. When no attack is detected, DetectorGuard outputs the precise bounding boxes predicted by the conventional detector to achieve a high clean performance; otherwise, DetectorGuard triggers an attack alert for security. Notably, our prediction strategy ensures that the robust detector incorrectly missing objects will not hurt the clean performance of DetectorGuard. Moreover, our approach allows us to formally prove the robustness of DetectorGuard on certified objects, i.e., it either detects the object or triggers an alert, against any patch hiding attacker. Our evaluation on the PASCAL VOC and MS COCO datasets shows that DetectorGuard has the almost same clean performance as conventional detectors, and more importantly, that DetectorGuard achieves the first provable robustness against localized patch hiding attacks.

Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame

“…The purpose of [21] is different from our work. The purpose of [21] is to discriminate whether the image has been attacked or not.…”

“…We would like to thank the reviewer for the valuable comment. As per the reviewer's comment, it would be better to compare with more recent works [18,21]. However, direct comparison with the proposed method is difficult for the following reasons.…”

“…First, most defense methods require large computational costs. In other words, to defend against the adversarial patch attack, previous methods re-train the detection network with large datasets [20,18] or an additional network for robust inference [18,21]. Second, there is a performance gap between clean performance and adversarial robustness [22].…”

Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection

“…In the domain of object detection, most existing defenses focus on global perturbations with a l p norm constraint [8,10,51] and only a few defenses [20,39,48] for patch attacks have been proposed. Saha [39] proposed Grad-defense and OOC defense for defending blindness attacks such that the detector is blind to a specific object category chosen by the adversary.…”

“…Saha [39] proposed Grad-defense and OOC defense for defending blindness attacks such that the detector is blind to a specific object category chosen by the adversary. DetectorGuard [48] is a provable defense against localized patch hiding attacks. Ji et al [20] proposed Ad-YOLO to defend human detection patch attacks by adding a patch class on YOLOv2 [36] detector such that it detects both the objects of interest and adversarial patches.…”