Seeing isn't Believing

Abstract

Recently Adversarial Examples (AEs) that deceive deep learning models have been a topic of intense research interest. Compared with the AEs in the digital space, the physical adversarial attack is considered as a more severe threat to the applications like face recognition in authentication, objection detection in autonomous driving cars, etc. In particular, deceiving the object detectors practically, is more challenging since the relative position between the object and the detector may keep changing. Existing works attacking object detectors are still very limited in various scenarios, e.g., varying distance and angles, etc.In this paper, we presented systematic solutions to build robust and practical AEs against real world object detectors. Particularly, for Hiding Attack (HA), we proposed the feature-interference reinforcement (FIR) method and the enhanced realistic constraints generation (ERG) to enhance robustness, and for Appearing Attack (AA), we proposed the nested-AE, which combines two AEs together to attack object detectors in both long and short distance. We also designed diverse styles of AEs to make AA more surreptitious. Evaluation results show that our AEs can attack the state-of-the-art real-time object detectors (i.e., YOLO V3 and faster-RCNN) at the success rate up to 92.4% with varying distance from 1m to 25m and angles from −60 • to 60 •1 . Our AEs are also demonstrated to be highly transferable, capable of attacking another three state-of-theart black-box models with high success rate.

Security and Privacy in the Emerging Cyber-Physical World: A Survey

“…They model this as a closed-loop system, and design an algorithm that searches the input space of the classifier to find sets of inputs that are misclassified. In [113], Zhao et al devise a new methodology for generating adversarial examples to trick machine learning based object detectors. They perform two types of attacks: a hiding attack where the object is not recognized, and an appearing attack where the object is classified incorrectly.…”

“…However, given the ease deployment, these defenses are favored for real-world implementations. [92], [110], [111], [114], [113]…”

Scale-Adaptive Adversarial Patch Attack for Remote Sensing Image Aircraft Detection

“…Adversarial attacks on object detectors have also received extensive attention [6][7][8][9][10][11]. Adversarial patch attacks on object detectors (unlike traditional camouflage that evades detection of object detectors by placing camouflage nets to cover important objects) are being explored to achieve concealment of important objects, such as aircraft (simple production method and low production cost), by deceiving object detectors and guiding them to make incorrect decisions [12][13][14].…”

“…Currently, research on adversarial patch attacks in terms of object detectors is mainly conducted on natural images [12][13][14][15]. These attack methods usually generate a fixed-size adversarial patch to attack an object detector.…”

Detection defense against adversarial attacks with saliency map

“…Attackers could fast generate adversarial examples by using the gradient of loss function for deep network, then viewing implementing attack as an optimization problem and construct powerful adversarial examples with different distortion metric. Recent studies 6–8 show that adversarial attacks can be implemented in physical scenarios, which gives rise to severe safety issues. Hence, defending against adversarial attacks has emerged as a critical factor in artificial intelligence security.…”