Two Improved Methods of Generating Adversarial Examples against Faster R-CNNs for Tram Environment Perception Systems

Abstract

Trams have increasingly deployed object detectors to perceive running conditions, and deep learning networks have been widely adopted by those detectors. Growing neural networks have incurred severe attacks such as adversarial example attacks, imposing threats to tram safety. Only if adversarial attacks are studied thoroughly, researchers can come up with better defence methods against them. However, most existing methods of generating adversarial examples have been devoted to classification, and none of them target tram environment perception systems. In this paper, we propose an improved projected gradient descent (PGD) algorithm and an improved Carlini and Wagner (C&W) algorithm to generate adversarial examples against Faster R-CNN object detectors. Experiments verify that both algorithms can successfully conduct nontargeted and targeted white-box digital attacks when trams are running. We also compare the performance of the two methods, including attack effects, similarity to clean images, and the generating time. The results show that both algorithms can generate adversarial examples within 220 seconds, a much shorter time, without decrease of the success rate.

Adversarial attack on human pose estimation network

“…Wang et al 10 suggested an adversarial attack method to fool faster R-CNN object detection networks. Huang et al 11 developed an improved classifier attack algorithm that can be applied to object detection. Wang et al 31 suggested an effective adversarial attack strategy for several kinds of object identification models.…”

“…suggested an adversarial attack method to fool faster R-CNN object detection networks. Huang et al 11 . developed an improved classifier attack algorithm that can be applied to object detection.…”

“…7,8 The classification accuracy of these networks is susceptible to misclassification when a specifically crafted adversarial perturbation is added to a clean image. 9 Various researchers have investigated adversarial attacks, including techniques to deceive object detection models such as fast region-based convolutional neural network (faster R-CNN), 10,11 you only look once (YOLO), 12 object segmentation networks, 13,14 among others. HPE algorithms play a critical role in perception technology, which aims to identify body parts of individuals and localize anatomical keypoints or "parts."…”