Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon

Zhong, Yiqi; Liu, Xianming; Zhai, Deming; Jiang, Junjun; Ji, Xiangyang

doi:10.1109/cvpr52688.2022.01491

Cited by 93 publications

(40 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…RP 2 [46] AdvLogo [78] Ph GAN [79] AdvCam [80] PhysGAN [83] ShadowAttack [81] Fig. 9 Examples of adversarial examples against traffic sign recognition.…”

Section: Light Projection Attack (Lpa)mentioning

confidence: 99%

See 1 more Smart Citation

A Survey on Physical Adversarial Attack in Computer Vision

Wang¹,

Wen²,

Jiang³

et al. 2023

Preprint

View full text Add to dashboard Cite

In the past decade, deep learning has dramatically changed the traditional hand-craft feature manner with strong feature learning capability, promoting the tremendous improvement of conventional tasks. However, deep neural networks (DNNs) have been demonstrated to be vulnerable to adversarial examples crafted by small noise, which is imperceptible to human observers but can make DNNs misbehave. Existing adversarial attacks can be divided into digital and physical adversarial attacks. The former is designed to pursue strong attack performance in lab environments while hardly remaining effective when applied to the physical world. In contrast, the latter focus on developing physical deployable attacks, which are more robust in complex physical environmental conditions (e.g., brightness, occlusion, etc.). Recently, with the increasing deployment of the DNN-based system in the real world, enhancing the robustness of these systems is an emergency, while exploring physical adversarial attacks exhaustly is the precondition. To this end, this paper reviews the development of physical adversarial attacks against DNN-based computer vision tasks (i.e., image recognition and object detection tasks), which can provide beneficial information for developing stronger physical adversarial attacks. For completeness, we also briefly introduce the works that do not involve physical attacks but are closely related to them. Specifically, we first proposed a taxonomy to summarize the current physical adversarial attacks. Then we briefly discuss the existing physical attacks and focus on the technique for improving the robustness of physical attacks under complex physical environmental conditions. Finally, we discuss the issues of the current physical adversarial attacks to be solved and give promising directions.

show abstract

“…RP 2 [46] AdvLogo [78] Ph GAN [79] AdvCam [80] PhysGAN [83] ShadowAttack [81] Fig. 9 Examples of adversarial examples against traffic sign recognition.…”

Section: Light Projection Attack (Lpa)mentioning

confidence: 99%

“…Recently, Zhong et al [81] argued that the pattern of perturbations generated by prior approaches is conspicuous and attention-grabbed for human observers. To this end, the author proposed to utilize the natural phenomenon (i.e., shadow) to perform physical attacks.…”

Section: Shadowattackmentioning

confidence: 99%

A Survey on Physical Adversarial Attack in Computer Vision

Wang¹,

Wen²,

Jiang³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…Gao et al [10] camouflage perturbations into the haze to mislead the classifier. Zhong et al [45] utilize perturbations visually like shadows to craft adversarial examples. These works generate visually natural images based on theoretical models.…”

Section: Physical Attacksmentioning

confidence: 99%

“…However, these attacks often generate unnatural textures, which are quite visible to human eyes. Thus many works focus on generating adversarial examples with natural styles that appear legitimate to human eyes, e.g., adversarial shadows [44] caused by polygons. Nevertheless, these visually valid adversarial examples are still artifacts and seldom appear in real-world environments.…”

Section: Introductionmentioning

confidence: 99%

Adversarial Attack with Raindrops

Liu¹,

Lu²,

Xiong³

et al. 2023

Preprint

View full text Add to dashboard Cite

Deep neural networks (DNNs) are known to be vulnerable to adversarial examples, which are usually designed artificially to fool DNNs, but rarely exist in real-world scenarios. In this paper, we study the adversarial examples caused by raindrops, to demonstrate that there exist plenty of natural phenomena being able to work as adversarial attackers to DNNs. Moreover, we present a new approach to generate adversarial raindrops, denoted as AdvRD, using the generative adversarial network (GAN) technique to simulate natural raindrops. The images crafted by our AdvRD look very similar to the real-world raindrop images, statistically close to the distribution of true raindrop images, and more importantly, can perform strong adversarial attack to the state-of-the-art DNN models. On the other side, we show that the adversarial training using our AdvRD images can significantly improve the robustness of DNNs to the real-world raindrop attacks. Extensive experiments are carried out to demonstrate that the images crafted by Ad-vRD are visually and statistically close to the natural raindrop images, can work as strong attackers to DNN models, and also help improve the robustness of DNNs to raindrop attacks.

show abstract

“…Zhang et al [197] propose a novel approach for producing physically feasible adversarial camouflage to achieve transferable attacks on detection models. Study [198] explores a new category of optical adversarial examples, generated by a commonly occurring natural phenomenon, shadows. They aim to employ these shadow-based perturbations to achieve naturalistic and inconspicuous physical-world adversarial attacks in blackbox settings.…”

Section: Black-box Attacksmentioning

confidence: 99%

Benchmarking Adversarial Patch Against Aerial Detection

Lian

Mei

Zhang

et al. 2022

IEEE Trans. Geosci. Remote Sensing

View full text Add to dashboard Cite

Deep neural networks (DNNs) have found widespread applications in interpreting remote sensing (RS) imagery. However, it has been demonstrated in previous works that DNNs are vulnerable to different types of noises, particularly adversarial noises. Surprisingly, there has been a lack of comprehensive studies on the robustness of RS tasks, prompting us to undertake a thorough survey and benchmark on the robustness of image classification and object detection in RS. To our best knowledge, this study represents the first comprehensive examination of both natural robustness and adversarial robustness in RS tasks. Specifically, we have curated and made publicly available datasets that contain natural and adversarial noises. These datasets serve as valuable resources for evaluating the robustness of DNNs-based models. To provide a comprehensive assessment of model robustness, we conducted meticulous experiments with numerous different classifiers and detectors, encompassing a wide range of mainstream methods. Through rigorous evaluation, we have uncovered insightful and intriguing findings, which shed light on the relationship between adversarial noise crafting and model training, yielding a deeper understanding of the susceptibility and limitations of various models, and providing guidance for the development of more resilient and robust models

show abstract

Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon

Cited by 93 publications

References 22 publications

A Survey on Physical Adversarial Attack in Computer Vision

A Survey on Physical Adversarial Attack in Computer Vision

Adversarial Attack with Raindrops

Benchmarking Adversarial Patch Against Aerial Detection

Contact Info

Product

Resources

About