Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors

Shapira, Avishag; Zolfi, Alon; Demetrio, Luca; Biggio, Battista; Shabtai, Asaf

doi:10.1109/wacv56688.2023.00455

Cited by 13 publications

(11 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We find that SlowTrack, when compared with existing object detection latency attacks, provides significant improvements in latency under comparable perturbation levels. For instance, SlowTrack on average induces latency 2.9 times more than that for existing approaches (Chen et al 2023;Shapira et al 2023). We also demonstrate the system-level effects of our SlowTrack using Baidu Apollo (Apollo 2023) LGSVL (Rong et al 2020) AD simulator.…”

Section: Introductionmentioning

confidence: 61%

“…While a majority of these attacks target integrity, our research concentrates on availability, which is another critical problem in AD (Wan et al 2022). Although some attack works study availability (Liu et al 2023;Chen et al 2023;Shapira et al 2023;Wang et al 2021), none of them consider the whole AD perception pipelines, which leads to suboptimal system-level effects in AD (Jia et al 2020).…”

Section: Background and Related Workmentioning

confidence: 99%

“…Availability-based latency attack can induce delays in the outputting function. Such adversarial methods, when applied to DNN, have been investigated recently (Shapira et al 2023;Chen et al 2023;Liu et al 2023). However, their oversight of MOT within AD perception restricts their potential to achieve potent system-level effects.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Nevertheless, the availability aspect (real-time performance) of the system, which is crucial for safety (e.g., causing vehicle collision (Wan et al 2022)) has been relatively underexplored, especially for the complete camera-based AD perception pipeline. While some existing AD security analysis has studied availability in object detection (Shapira et al 2023;Chen et al 2023), they do not encompass the entire AD perception since usually, object detection is a part of the AD perception (Jia et al 2020). In addition, in the Cyber-Physical System area, it is widely recognized that small component level errors do not necessarily lead to systemlevel effects (Shen et al 2022;Wang et al 2023).…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples

Ma,

Wang,

Chen

et al. 2024

AAAI

View full text Add to dashboard Cite

In Autonomous Driving (AD), real-time perception is a critical component responsible for detecting surrounding objects to ensure safe driving. While researchers have extensively explored the integrity of AD perception due to its safety and security implications, the aspect of availability (real-time performance) or latency has received limited attention. Existing works on latency-based attack have focused mainly on object detection, i.e., a component in camera-based AD perception, overlooking the entire camera-based AD perception, which hinders them to achieve effective system-level effects, such as vehicle crashes. In this paper, we propose SlowTrack, a novel framework for generating adversarial attacks to increase the execution time of camera-based AD perception. We propose a novel two-stage attack strategy along with the three new loss function designs. Our evaluation is conducted on four popular camera-based AD perception pipelines, and the results demonstrate that SlowTrack significantly outperforms existing latency-based attacks while maintaining comparable imperceptibility levels. Furthermore, we perform the evaluation on Baidu Apollo, an industry-grade full-stack AD system, and LGSVL, a production-grade AD simulator, with two scenarios to compare the system-level effects of SlowTrack and existing attacks. Our evaluation results show that the system-level effects can be significantly improved, i.e., the vehicle crash rate of SlowTrack is around 95% on average while existing works only have around 30%.

show abstract

Section: Introductionmentioning

confidence: 61%

Section: Background and Related Workmentioning

confidence: 99%

Section: Background and Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples

Ma,

Wang,

Chen

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…mobile CPUs) are also affected. Additionally, Shapira et al [218] expands on the work of Shumailov et al [216] by demonstrating that sponge examples can also be used against object detection besides object classification (Shumailov et al also explores attacking NLP tasks).…”

Section: ) Data Poisoning Attacksmentioning

confidence: 99%

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Roux,

Bourbao,

Teglia

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Deep learning has significantly transformed face recognition, enabling the deployment of large-scale, state-of-the-art solutions worldwide. However, the widespread adoption of deep neural networks (DNNs) and the rise of Machine Learning as a Service emphasize the need for secure DNNs. This paper revisits the face recognition threat model in the context of DNN ubiquity and the common practice of outsourcing their training and hosting to third-parties. Here, we identify backdoor attacks as a significant threat to modern DNN-based face recognition systems (FRS). Backdoor attacks involve an attacker manipulating a DNN's training or deployment, injecting it with a stealthy and malicious behavior. Once the DNN has entered its inference stage, the attacker may activate the backdoor and compromise the DNN's intended functionality. Given the critical nature of this threat to DNN-based FRS, our paper comprehensively surveys the literature of backdoor attacks and defenses previously demonstrated on FRS DNNs. As a last point, we highlight potential vulnerabilities and unexplored areas in FRS security.

show abstract

Out-of-Bounding-Box Triggers: A Stealthy Approach to Cheat Object Detectors

Lin,

Yu,

Jin

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors

Cited by 13 publications

References 24 publications

SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples

SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Out-of-Bounding-Box Triggers: A Stealthy Approach to Cheat Object Detectors

Contact Info

Product

Resources

About