Physical Adversarial Examples for Object Detectors

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial examples-maliciously crafted inputs that cause DNNs to make incorrect predictions. Recent work has shown that these attacks generalize to the physical domain, to create perturbations on physical objects that fool image classifiers under a variety of real-world conditions. Such attacks pose a risk to deep learning models used in safety-critical cyber-physical systems. In this work, we extend physical attacks to more challenging object detection models, a broader class of deep learning algorithms widely used to detect and label multiple objects within a scene. Improving upon a previous physical attack on image classifiers, we create perturbed physical objects that are either ignored or mislabeled by object detection models. We implement a Disappearance Attack, in which we cause a Stop sign to "disappear" according to the detector-either by covering thesign with an adversarial Stop sign poster, or by adding adversarial stickers onto the sign. In a video recorded in a controlled lab environment, the state-of-the-art YOLOv2 detector failed to recognize these adversarial Stop signs in over 85% of the video frames. In an outdoor experiment, YOLO was fooled by the poster and sticker attacks in 72.5% and 63.5% of the video frames respectively. We also use Faster R-CNN, a different object detection model, to demonstrate the transferability of our adversarial perturbations. The created poster perturbation is able to fool Faster R-CNN in 85.9% of the video frames in a controlled lab environment, and 40.2% of the video frames in an outdoor environment. Finally, we present preliminary results with a new Creation Attack, where in innocuous physical stickers fool a model into detecting nonexistent objects.

arXiv commentThis paper is the extended version of the USENIX WOOT 2018 version

References in corpus (10)

• Continuous control with deep reinforcement learning
• OverFeat: Integrated Recognition, Localization and Detection using Convolutional Networks
• Synthesizing Robust Adversarial Examples
• YOLO9000: Better, Faster, Stronger
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversarial Examples for Semantic Segmentation and Object Detection
• The Limitations of Deep Learning in Adversarial Settings
• Adversarial Manipulation of Deep Representations
• Adversarial examples for generative models

Cited by in corpus (42)

• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Blind Backdoors in Deep Learning Models
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Physical Adversarial Attack on Vehicle Detector in the Carla Simulator
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations
• Dynamic Adversarial Patch for Evading Object Detection Models
• Unadversarial Examples: Designing Objects for Robust Vision
• Understanding the Decision Boundary of Deep Neural Networks: An Empirical Study
• Hiding Faces in Plain Sight: Disrupting AI Face Synthesis with Adversarial Perturbations
• Fooling a Real Car with Adversarial Traffic Signs
• A Real-time Defense against Website Fingerprinting Attacks
• What do AI algorithms actually learn? - On false structures in deep learning
• 3DB: A Framework for Debugging Computer Vision Models
• Jacobian Regularization for Mitigating Universal Adversarial Perturbations
• SocialGuard: An Adversarial Example Based Privacy-Preserving Technique for Social Images
• Exact Adversarial Attack to Image Captioning via Structured Output Learning with Latent Variables
• LiBRe: A Practical Bayesian Approach to Adversarial Detection
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• MeshAdv: Adversarial Meshes for Visual Recognition
• On the Robustness of Human Pose Estimation
• Rearchitecting Classification Frameworks For Increased Robustness
• Design and Interpretation of Universal Adversarial Patches in Face Detection
• Attacking CNN-based anti-spoofing face authentication in the physical domain
• Detection as Regression: Certified Object Detection by Median Smoothing
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Meta Adversarial Training against Universal Patches
• Towards Adversarially Robust Object Detection
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• Understanding Object Detection Through An Adversarial Lens
• Adversarial Attack on Facial Recognition using Visible Light
• Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
• Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study
• Can 3D Adversarial Logos Cloak Humans?
• Robust Invisible Hyperlinks in Physical Photographs Based on 3D Rendering Attacks
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models
• Real-time Detection of Practical Universal Adversarial Perturbations
• Universal Physical Camouflage Attacks on Object Detectors
• Robust Assessment of Real-World Adversarial Examples
• Synthesizing Unrestricted False Positive Adversarial Objects Using Generative Models
• Empirical Upper Bound, Error Diagnosis and Invariance Analysis of Modern Object Detectors