Transferable Physical Attack against Object Detection with Separable Attention

Abstract

Transferable adversarial attack is always in the spotlight since deep learning models have been demonstrated to be vulnerable to adversarial samples. However, existing physical attack methods do not pay enough attention on transferability to unseen models, thus leading to the poor performance of black-box attack. In this paper, we put forward a novel method of generating physically realizable adversarial camouflage to achieve transferable attack against detection models. More specifically, we first introduce multi-scale attention maps based on detection models to capture features of objects with various resolutions. Meanwhile, we adopt a sequence of composite transformations to obtain the averaged attention maps, which could curb model-specific noise in the attention and thus further boost transferability. Unlike the general visualization interpretation methods where model attention should be put on the foreground object as much as possible, we carry out attack on separable attention from the opposite perspective, i.e. suppressing attention of the foreground and enhancing that of the background. Consequently, transferable adversarial camouflage could be yielded efficiently with our novel attention-based loss function. Extensive comparison experiments verify the superiority of our method to state-of-the-art methods.

Exploring the Physical-World Adversarial Robustness of Vehicle Detection

“…In the virtual simulation environment, several adversarial attack algorithms for vehicle recognition scenarios have been proposed [14,32,49,50] and shown to be effective. The CARLA simulator [51] has been widely used in these studies due to its versatility and availability.…”

“…Simulators developed based on the Unity engine, such as LGSVL [52], and those developed based on the Unreal engine, such as Airsim [53] and CARLA [51], all support camera simulation. Among them, the Airsim simulator focuses more on drone-related research, while compared with LGSVL, current research on adversarial security is more focused on the CARLA simulator [32,49,50]. CARLA is equipped with scenes and high-precision maps made by RoadRunner and provides options for map editing.…”

“…Following Zhang et al [49], we intentionally selected strategies grounded in divergent conceptual frameworks. Specifically, our choices encompassed methods that leverage the model's attention mechanism, exemplified by DAS [32] and ASA [49], as well as those predicated on the model's intrinsic loss functions, as epitomized by FCA [50]. These are the commonly adopted adversarial attack methods in the physical world.…”

Benchmarking Adversarial Patch Against Aerial Detection

“…The researchers design and realize the first physical backdoor attacks on such systems. Zhang et al [197] propose a novel approach for producing physically feasible adversarial camouflage to achieve transferable attacks on detection models. Study [198] explores a new category of optical adversarial examples, generated by a commonly occurring natural phenomenon, shadows.…”

“…In paper [95], the authors conduct the first investigation towards adversarial attacks that are directed at X-ray prohibited item detection and demonstrate the grave hazards posed by such attacks in this context of paramount safety significance. Finally, we summarize physical attacks against object detection ( [65], [76], [94]- [96], [105]- [107], [160], [184]- [190], [192]- [194], [197], [201]- [204]) in Table VI.…”