Adversarial Examples that Fool Detectors

Abstract

An adversarial example is an example that has been adjusted to produce a wrong label when presented to a system at test time. To date, adversarial example constructions have been demonstrated for classifiers, but not for detectors. If adversarial examples that could fool a detector exist, they could be used to (for example) maliciously create security hazards on roads populated with smart vehicles. In this paper, we demonstrate a construction that successfully fools two standard detectors, Faster RCNN and YOLO. The existence of such examples is surprising, as attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - makes it quite likely that adversarial patterns are strongly disrupted. We show that our construction produces adversarial examples that generalize well across sequences digitally, even though large perturbations are needed. We also show that our construction yields physical objects that are adversarial.

Follow up paper for adversarial stop signs. Submitted to CVPR 2018

References in corpus (15)

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• YOLO9000: Better, Faster, Stronger
• Countering Adversarial Images using Input Transformations
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Defensive Distillation is Not Robust to Adversarial Examples
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• An Implementation of Faster RCNN with Study for Region Sampling
• DeepFool: a simple and accurate method to fool deep neural networks
• Universal adversarial perturbations
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
• Face Detection with the Faster R-CNN

Cited by in corpus (26)

• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Robust Adversarial Perturbation on Deep Proposal-based Models
• Attack Graph Convolutional Networks by Adding Fake Nodes
• On Adversarial Examples and Stealth Attacks in Artificial Intelligence Systems
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Physical Adversarial Attack on Vehicle Detector in the Carla Simulator
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agents
• Hiding Faces in Plain Sight: Disrupting AI Face Synthesis with Adversarial Perturbations
• Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• PAC-learning in the presence of evasion adversaries
• Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Towards Resistant Audio Adversarial Examples
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• Robust and Accurate Object Detection via Adversarial Learning
• Fooling Object Detectors: Adversarial Attacks by Half-Neighbor Masks
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Towards Adversarially Robust Object Detection
• CCA: Exploring the Possibility of Contextual Camouflage Attack on Object Detection
• To Make Yourself Invisible with Adversarial Semantic Contours