Seeing isn't Believing: Practical Adversarial Attack Against Object Detectors

Abstract

In this paper, we presented systematic solutions to build robust and practical AEs against real world object detectors. Particularly, for Hiding Attack (HA), we proposed the feature-interference reinforcement (FIR) method and the enhanced realistic constraints generation (ERG) to enhance robustness, and for Appearing Attack (AA), we proposed the nested-AE, which combines two AEs together to attack object detectors in both long and short distance. We also designed diverse styles of AEs to make AA more surreptitious. Evaluation results show that our AEs can attack the state-of-the-art real-time object detectors (i.e., YOLO V3 and faster-RCNN) at the success rate up to 92.4% with varying distance from 1m to 25m and angles from -60° to 60°. Our AEs are also demonstrated to be highly transferable, capable of attacking another three state-of-the-art black-box models with high success rate.

arXiv comment13 pages, 12 figures

References in corpus (13)

• Continuous control with deep reinforcement learning
• YOLOv3: An Incremental Improvement
• R-FCN: Object Detection via Region-based Fully Convolutional Networks
• Ensemble Adversarial Training: Attacks and Defenses
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Countering Adversarial Images using Input Transformations
• Light-Head R-CNN: In Defense of Two-Stage Object Detector
• A study of the effect of JPG compression on adversarial images
• Deep Learning for Generic Object Detection: A Survey
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• You Only Look Twice: Rapid Multi-Scale Object Detection In Satellite Imagery
• Feature Denoising for Improving Adversarial Robustness

Cited by in corpus (9)

• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Dynamic Adversarial Patch for Evading Object Detection Models
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• Security of Deep Learning based Lane Keeping System under Physical-World Adversarial Attack
• SocialGuard: An Adversarial Example Based Privacy-Preserving Technique for Social Images
• SPARK: Spatial-aware Online Incremental Attack Against Visual Tracking
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• On Robustness of Lane Detection Models to Physical-World Adversarial Attacks in Autonomous Driving