Adversarial camera stickers: A physical camera-based attack on deep learning systems

Abstract

Recent work has documented the susceptibility of deep learning systems to adversarial examples, but most such attacks directly manipulate the digital input to a classifier. Although a smaller line of work considers physical adversarial attacks, in all cases these involve manipulating the object of interest, e.g., putting a physical sticker on an object to misclassify it, or manufacturing an object specifically intended to be misclassified. In this work, we consider an alternative question: is it possible to fool deep classifiers, over all perceived objects of a certain type, by physically manipulating the camera itself? We show that by placing a carefully crafted and mainly-translucent sticker over the lens of a camera, one can create universal perturbations of the observed images that are inconspicuous, yet misclassify target objects as a different (targeted) class. To accomplish this, we propose an iterative procedure for both updating the attack perturbation (to make it adversarial for a given classifier), and the threat model itself (to ensure it is physically realizable). For example, we show that we can achieve physically-realizable attacks that fool ImageNet classifiers in a targeted fashion 49.6% of the time. This presents a new class of physically-realizable threat models to consider in the context of adversarially robust machine learning. Our demo video can be viewed at: https://youtu.be/wUVmL33Fx54

References in corpus (5)

• Synthesizing Robust Adversarial Examples
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Why do deep convolutional networks generalize so poorly to small image transformations?
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• Adversarial Attacks Beyond the Image Space

Cited by in corpus (20)

• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Axiom-based Grad-CAM: Towards Accurate Visualization and Explanation of CNNs
• Do Adversarially Robust ImageNet Models Transfer Better?
• Security and Privacy Issues in Deep Learning
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Learning perturbation sets for robust machine learning
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attack
• NaturalAE: Natural and Robust Physical Adversarial Examples for Object Detectors
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Towards Security Threats of Deep Learning Systems: A Survey
• A Methodology to Identify Cognition Gaps in Visual Recognition Applications Based on Convolutional Neural Networks
• Adversarial Detection: Attacking Object Detection in Real Time
• Over-the-Air Adversarial Flickering Attacks against Video Recognition Networks
• Meta Adversarial Training against Universal Patches
• Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs
• Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices
• Robust Machine Learning via Privacy/Rate-Distortion Theory