Physical Adversarial Examples for Object Detectors

Song, Dawn; Eykholt, Kevin; Evtimov, Ivan; Fernandes, Earlence; Li, Bo; Rahmati, Amir; Tramèr, Florian; Prakash, Atul; Kohno, Tadayoshi

doi:10.48550/arxiv.1807.07769

Cited by 47 publications

(34 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unlike [9], they applied both synthetic and physical transformations. Later on, such a work has been extended to attack a general object recognition system [23].…”

Section: B Adversarial Attacks To Cnnsmentioning

confidence: 99%

Attacking CNN-based anti-spoofing face authentication in the physical domain

Zhang,

Tondi,

Barni

2019

Preprint

View full text Add to dashboard Cite

In this paper, we study the vulnerability of antispoofing methods based on deep learning against adversarial perturbations. We first show that attacking a CNN-based antispoofing face authentication system turns out to be a difficult task. When a spoofed face image is attacked in the physical world, in fact, the attack has not only to remove the rebroadcast artefacts present in the image, but it has also to take into account that the attacked image will be recaptured again and then compensate for the distortions that will be re-introduced after the attack by the subsequent rebroadcast process. Subsequently, we propose a method to craft robust physical domain adversarial images against anti-spoofing CNN-based face authentication. The attack built in this way can successfully pass all the steps in the authentication chain (that is, face detection, face recognition and spoofing detection), by achieving simultaneously the following goals: i) make the spoofing detection fail; ii) let the facial region be detected as a face and iii) recognized as belonging to the victim of the attack. The effectiveness of the proposed attack is validated experimentally within a realistic setting, by considering the REPLAY-MOBILE database, and by feeding the adversarial images to a real face authentication system capturing the input images through a mobile phone camera.

show abstract

“…Unlike [9], they applied both synthetic and physical transformations. Later on, such a work has been extended to attack a general object recognition system [23].…”

Section: B Adversarial Attacks To Cnnsmentioning

confidence: 99%

Attacking CNN-based anti-spoofing face authentication in the physical domain

Zhang,

Tondi,

Barni

2019

Preprint

View full text Add to dashboard Cite

show abstract

“…Adversarial examples on general object detection have been extensively studied in the recent years [37,16]. A commonly explored domain for adversarial examples in detection is stop sign detection [6,7,8,4]. Stop signs have many structural properties that one can exploit: standard red color, with fixed shape and background.…”

Section: Related Workmentioning

confidence: 99%

Design and Interpretation of Universal Adversarial Patches in Face Detection

Yang

Wei

Zhang

et al. 2019

Preprint

View full text Add to dashboard Cite

We consider universal adversarial patches for facessmall visual elements whose addition to a face image reliably destroys the performance of face detectors. Unlike previous work that mostly focused on the algorithmic design of adversarial examples in terms of improving the success rate as an attacker, in this work we show an interpretation of such patches that can prevent the state-of-the-art face detectors from detecting the real faces. We investigate a phenomenon: patches designed to suppress real face detection appear face-like. This phenomenon holds generally across different initialization, locations, scales of patches, backbones, and state-of-the-art face detection frameworks. We propose new optimization-based approaches to automatic design of universal adversarial patches for varying goals of the attack, including scenarios in which true positives are suppressed without introducing false positives. Our proposed algorithms perform well on real-world datasets, deceiving state-of-the-art face detectors in terms of multiple precision/recall metrics and transferring between different detection frameworks.

show abstract

“…versarial examples have been witnessed in a wide spectrum of practical systems [51,12], raising an urgent requirement for advanced techniques to achieve robust and reliable decision making, especially in safety-critical scenarios [13].…”

Section: Introductionmentioning

confidence: 99%

LiBRe: A Practical Bayesian Approach to Adversarial Detection

Deng

Yang

et al. 2021

Preprint

View full text Add to dashboard Cite

Despite their appealing flexibility, deep neural networks (DNNs) are vulnerable against adversarial examples. Various adversarial defense strategies have been proposed to resolve this problem, but they typically demonstrate restricted practicability owing to unsurmountable compromise on universality, effectiveness, or efficiency. In this work, we propose a more practical approach, Lightweight Bayesian Refinement (LiBRe), in the spirit of leveraging Bayesian neural networks (BNNs) for adversarial detection. Empowered by the task and attack agnostic modeling under Bayes principle, LiBRe can endow a variety of pre-trained taskdependent DNNs with the ability of defending heterogeneous adversarial attacks at a low cost. We develop and integrate advanced learning techniques to make LiBRe appropriate for adversarial detection. Concretely, we build the few-layer deep ensemble variational and adopt the pretraining & fine-tuning workflow to boost the effectiveness and efficiency of LiBRe. We further provide a novel insight to realise adversarial detection-oriented uncertainty quantification without inefficiently crafting adversarial examples during training. Extensive empirical studies covering a wide range of scenarios verify the practicability of Li-BRe. We also conduct thorough ablation studies to evidence the superiority of our modeling and learning strategies.

show abstract

Physical Adversarial Examples for Object Detectors

Cited by 47 publications

References 16 publications

Attacking CNN-based anti-spoofing face authentication in the physical domain

Attacking CNN-based anti-spoofing face authentication in the physical domain

Design and Interpretation of Universal Adversarial Patches in Face Detection

LiBRe: A Practical Bayesian Approach to Adversarial Detection

Contact Info

Product

Resources

About