ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Masking

Abstract

Object detectors, which are widely deployed in securitycritical systems such as autonomous vehicles, have been found vulnerable to physical-world patch hiding attacks. The attacker can use a single physically-realizable adversarial patch to make the object detector miss the detection of victim objects and completely undermines the functionality of object detection applications. In this paper, we propose ObjectSeeker as a defense framework for building certifiably robust object detectors against patch hiding attacks. The core operation of ObjectSeeker is patch-agnostic masking: we aim to mask out the entire adversarial patch without any prior knowledge of the shape, size, and location of the patch. This masking operation neutralizes the adversarial effect and allows any vanilla object detector to safely detect objects on the masked images. Remarkably, we develop a certification procedure to determine if ObjectSeeker can detect certain objects with a provable guarantee against any adaptive attacker within the threat model. Our evaluation with two object detectors and three datasets demonstrates a significant (∼10%-40% absolute and ∼2-6× relative) improvement in certified robustness over the prior work, as well as high clean performance (∼1% performance drop compared with vanilla undefended models).

Securing Tiny Transformer-Based Computer Vision Models: Evaluating Real-World Patch Attacks

“…[35] leverage that patched images cluster Superfically Important Neurons (SINs), thus proposing a certified defense relying on SIN-based sparsification. Xiang et al [36] draw intuition from the aforementioned first class of techniques, proposing a patch-agnostic masking method that eliminates adversarial pixels, with the robustness intrinsically certifiable by additionally removing duplicate bounding boxes for detected objects. Although efficient in eliminating patch attacks, these techniques increase the computational cost during inference, thus limiting their applicability in real-time settings.…”