Exploring the Vulnerability of Single Shot Module in Object Detectors via Imperceptible Background Patches

Abstract

Recent works succeeded to generate adversarial perturbations on the entire image or the object of interests to corrupt CNN based object detectors. In this paper, we focus on exploring the vulnerability of the Single Shot Module (SSM) commonly used in recent object detectors, by adding small perturbations to patches in the background outside the object. The SSM is referred to the Region Proposal Network used in a two-stage object detector or the single-stage object detector itself. The SSM is typically a fully convolutional neural network which generates output in a single forward pass. Due to the excessive convolutions used in SSM, the actual receptive field is larger than the object itself. As such, we propose a novel method to corrupt object detectors by generating imperceptible patches only in the background. Our method can find a few background patches for perturbation, which can effectively decrease true positives and dramatically increase false positives. Efficacy is demonstrated on 5 two-stage object detectors and 8 single-stage object detectors on the MS COCO 2014 dataset. Results indicate that perturbations with small distortions outside the bounding box of object region can still severely damage the detection performance.

arXiv commentTo appear in BMVC 2019

Cited by in corpus (6)

• Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Detection as Regression: Certified Object Detection by Median Smoothing
• Simple Transparent Adversarial Examples
• Relevance Attack on Detectors
• Physical world assistive signals for deep neural network classifiers -- neither defense nor attack