Sequential Architecture-Agnostic Black-Box Attack Design and Analysis

Mumcu, Furkan; Yılmaz, Yasin

doi:10.2139/ssrn.4339656

Cited by 1 publication

(1 citation statement)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In Table 1, we report the AUC scores for our method, ViLAS, and Denoise [9] against PGD [2], FGSM [1], Patch Attack [5], and Light Attack [4], targeting four image recognition models. Since it is known that different attacks might have different performances on different architectures [47], we selected both the CNN-based (VGG16, ResNet152, InceptionV3) and transformer-based (ViT) target models. We used the same parameter settings that were reported in the original source of the attacks.…”

Section: Resultsmentioning

confidence: 99%

Fast and Lightweight Vision-Language Model for Adversarial Traffic Sign Detection

Mumcu,

Yilmaz

2024

Electronics

View full text Add to dashboard Cite

Several attacks have been proposed against autonomous vehicles and their subsystems that are powered by machine learning (ML). Road sign recognition models are especially heavily tested under various adversarial ML attack settings, and they have proven to be vulnerable. Despite the increasing research on adversarial ML attacks against road sign recognition models, there is little to no focus on defending against these attacks. In this paper, we propose the first defense method specifically designed for autonomous vehicles to detect adversarial ML attacks targeting road sign recognition models, which is called ViLAS (Vision-Language Model for Adversarial Traffic Sign Detection). The proposed defense method is based on a custom, fast, lightweight, and salable vision-language model (VLM) and is compatible with any existing traffic sign recognition system. Thanks to the orthogonal information coming from the class label text data through the language model, ViLAS leverages image context in addition to visual data for highly effective attack detection performance. In our extensive experiments, we show that our method consistently detects various attacks against different target models with high true positive rates while satisfying very low false positive rates. When tested against four state-of-the-art attacks targeting four popular action recognition models, our proposed detector achieves an average AUC of 0.94. This result achieves a 25.3% improvement over a state-of-the-art defense method proposed for generic image attack detection, which attains an average AUC of 0.75. We also show that our custom VLM is more suitable for an autonomous vehicle compared to the popular off-the-shelf VLM and CLIP in terms of speed (4.4 vs. 9.3 milliseconds), space complexity (0.36 vs. 1.6 GB), and performance (0.94 vs. 0.43 average AUC).

show abstract