Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples

Abstract

This paper demonstrates that Non-Maximum Suppression (NMS), which is commonly used in Object Detection (OD) tasks to filter redundant detection results, is no longer secure. Considering that NMS has been an integral part of OD systems, thwarting the functionality of NMS can result in unexpected or even lethal consequences for such systems. In this paper, an adversarial example attack which triggers malfunctioning of NMS in end-to-end OD models is proposed. The attack, namely \texttt{Daedalus}, compresses the dimensions of detection boxes to evade NMS. As a result, the final detection output contains extremely dense false positives. This can be fatal for many OD applications such as autonomous vehicles and surveillance systems. The attack can be generalised to different end-to-end OD models, such that the attack cripples various OD applications. Furthermore, a way to craft robust adversarial examples is developed by using an ensemble of popular detection models as the substitutes. Considering the pervasive nature of model reusing in real-world OD scenarios, Daedalus examples crafted based on an \textit{ensemble of substitutes} can launch attacks without knowing the parameters of the victim models. Experimental results demonstrate that the attack effectively stops NMS from filtering redundant bounding boxes. As the evaluation results suggest, Daedalus increases the false positive rate in detection results to $99.9\%$ and reduces the mean average precision scores to $0$, while maintaining a low cost of distortion on the original inputs. It is also demonstrated that the attack can be practically launched against real-world OD systems via printed posters.

References in corpus (29)

• YOLOv3: An Incremental Improvement
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Focal Loss for Dense Object Detection
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• YOLO9000: Better, Faster, Stronger
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• On the (Statistical) Detection of Adversarial Examples
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Adversarial Examples for Evaluating Reading Comprehension Systems
• Deep Learning for Generic Object Detection: A Survey
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Stochastic Activation Pruning for Robust Adversarial Defense
• Parseval Networks: Improving Robustness to Adversarial Examples
• Adversarial Examples that Fool Detectors
• Physical Adversarial Examples for Object Detectors
• Zeroth-Order Stochastic Variance Reduction for Nonconvex Optimization
• Adversarial Examples for Semantic Segmentation and Object Detection
• Fast YOLO: A Fast You Only Look Once System for Real-time Embedded Object Detection in Video
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
• Learning non-maximum suppression
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• A Unified Gradient Regularization Family for Adversarial Examples
• End-to-end training of object class detectors for mean average precision
• Traits & Transferability of Adversarial Examples against Instance Segmentation & Object Detection

Cited by in corpus (8)

• Weighted boxes fusion: Ensembling boxes from different object detection models
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• Adversarial attacks on Copyright Detection Systems
• Confluence: A Robust Non-IoU Alternative to Non-Maxima Suppression in Object Detection
• Attacking and Defending Machine Learning Applications of Public Cloud
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Smoothed Inference for Adversarially-Trained Models