Physical Adversarial Attacks in Simulated Environments

Threet, Michael; Colin, Busho,; Harguess, Josh; Jutras, Melanie; Lape, Nicole; Leary, Sara; Manville, Keith; Tan, Mike Yongjun; Ward, Chris

doi:10.1109/aipr52630.2021.9762099

Cited by 3 publications

(3 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They also evaluated two shape attacks, regression dilation and shrinking, to generate stronger attacks. Threet et al [15] propose a pipeline for evaluating physical adversarial attacks in a simulated environment using the Car Learning to Act (CARLA) autonomous driving simulator and the DAPRICOT method. By using a simulated environment, the pipeline corrects for real-world variations such as lighting and viewing angle that can affect the effectiveness of adversarial attacks.…”

Section: Adversarial Patch Based Attackmentioning

confidence: 99%

“…The upper limit for the horizontal axis of the Success plot (Precision plot) curve is 1 (50). norm(ASR) = ASR (15) norm(APR) = APR 50 (16) the decrease in ASR or APR, i.e., (ASR c -ASR a ) or (APR c -APR a ), indicates how much the object tracking success rate or precision rate has dropped due to the attack. A larger difference signifies that the attack has broadly disrupted the model's ability to track the object.…”

Section: Metrics For Evaluating Adversarial Patchmentioning

confidence: 99%

“…Current adversarial patch generation algorithms for object tracking networks did not incorporate template information, only generating patches for the search region [11][12][13][14][15]. This results in a limited disparity between the template and search region.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Bilateral Adversarial Patch Generating Network for the Object Tracking Algorithm

Rasol

Zhang

et al. 2023

Remote Sensing

View full text Add to dashboard Cite

Deep learning-based algorithms for single object tracking (SOT) have shown impressive performance but remain susceptible to adversarial patch attacks. However, existing adversarial patch generation methods primarily focus on generating patches within the search region, neglecting the incorporation of template information, which limits their effectiveness in carrying out successful attacks. There is also a lack of evaluation metrics to assess the patch’s adversarial abilities. In this study, we propose a bilateral adversarial patch-generating network to address these limitations and advance the field of adversarial patch generation for SOT networks. Our network leverages a Focus structure that effectively integrates both template and search region information, generating separate adversarial patches for each branch. We also introduce the DeFocus structure to solve the size discrepancy between the template and search region of the tracking network. To effectively mislead the tracking network, we have designed adversarial object loss and adversarial regression loss functions tailored to the network’s output. Moreover, we propose a comprehensive evaluation metric that measures the patch’s adversarial ability by establishing a relationship between the relative patch size and attack performance. As UAV view data often constitute small objects requiring smaller patches, we evaluate our approach on the UAV123 and UAVDT datasets. Our evaluation encompasses not only the overall attack performance but also the effectiveness of our strategy and the transferability of the attacks. Experimental results demonstrate that our algorithm generates patches with higher attack efficiency compared to existing methods.

show abstract

Section: Adversarial Patch Based Attackmentioning

confidence: 99%

Section: Metrics For Evaluating Adversarial Patchmentioning

confidence: 99%