DPatch: An Adversarial Patch Attack on Object Detectors

Abstract

Object detectors have emerged as an indispensable module in modern computer vision systems. In this work, we propose DPatch -- a black-box adversarial-patch-based attack towards mainstream object detectors (i.e. Faster R-CNN and YOLO). Unlike the original adversarial patch that only manipulates image-level classifier, our DPatch simultaneously attacks the bounding box regression and object classification so as to disable their predictions. Compared to prior works, DPatch has several appealing properties: (1) DPatch can perform both untargeted and targeted effective attacks, degrading the mAP of Faster R-CNN and YOLO from 75.10% and 65.7% down to below 1%, respectively. (2) DPatch is small in size and its attacking effect is location-independent, making it very practical to implement real-world attacks. (3) DPatch demonstrates great transferability among different detectors as well as training datasets. For example, DPatch that is trained on Faster R-CNN can effectively attack YOLO, and vice versa. Extensive evaluations imply that DPatch can perform effective attacks under black-box setup, i.e., even without the knowledge of the attacked network's architectures and parameters. Successful realization of DPatch also illustrates the intrinsic vulnerability of the modern detector architectures to such patch-based adversarial attacks.

arXiv commentAAAI Workshop on Artificial Intelligence Safety (SafeAI 2019) Oral Presentation

References in corpus (3)

• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• YOLO9000: Better, Faster, Stronger
• Spatially Transformed Adversarial Examples

Cited by in corpus (24)

• Adversarial Attacks Against Deep Generative Models on Data: A Survey
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images
• Safeguarding connected autonomous vehicle communication: Protocols, intra- and inter-vehicular attacks and defenses
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• DPAttack: Diffused Patch Attacks against Universal Object Detection
• Sparse Adversarial Attack to Object Detection
• 3DB: A Framework for Debugging Computer Vision Models
• Robustness and Transferability of Universal Attacks on Compressed Models
• Adversarial Attacks in a Multi-view Setting: An Empirical Study of the Adversarial Patches Inter-view Transferability
• Adversarial Patch Camouflage against Aerial Detection
• Adversarial Detection: Attacking Object Detection in Real Time
• Design and Interpretation of Universal Adversarial Patches in Face Detection
• Local Aggressive Adversarial Attacks on 3D Point Cloud
• Vax-a-Net: Training-time Defence Against Adversarial Patch Attacks
• Understanding Object Detection Through An Adversarial Lens
• RPATTACK: Refined Patch Attack on General Object Detectors
• To Make Yourself Invisible with Adversarial Semantic Contours
• Real-time Detection of Practical Universal Adversarial Perturbations
• Who is Responsible for Adversarial Defense?
• A Study on the Uncertainty of Convolutional Layers in Deep Neural Networks
• Physical world assistive signals for deep neural network classifiers -- neither defense nor attack
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• Universal Physical Camouflage Attacks on Object Detectors