Universal Physical Camouflage Attacks on Object Detectors

Abstract

In this paper, we study physical adversarial attacks on object detectors in the wild. Previous works mostly craft instance-dependent perturbations only for rigid or planar objects. To this end, we propose to learn an adversarial pattern to effectively attack all instances belonging to the same object category, referred to as Universal Physical Camouflage Attack (UPC). Concretely, UPC crafts camouflage by jointly fooling the region proposal network, as well as misleading the classifier and the regressor to output errors. In order to make UPC effective for non-rigid or non-planar objects, we introduce a set of transformations for mimicking deformable properties. We additionally impose optimization constraint to make generated patterns look natural to human observers. To fairly evaluate the effectiveness of different physical-world attacks, we present the first standardized virtual database, AttackScenes, which simulates the real 3D world in a controllable and reproducible environment. Extensive experiments suggest the superiority of our proposed UPC compared with existing physical adversarial attackers not only in virtual environments (AttackScenes), but also in real-world physical environments. Code and dataset are available at https://mesunhlf.github.io/index_physical.html.

arXiv commentCVPR 2020; codes, models, and demos are available at https://mesunhlf.github.io/index_physical.html

References in corpus (18)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• YOLOv3: An Incremental Improvement
• R-FCN: Object Detection via Region-based Fully Convolutional Networks
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Countering Adversarial Images using Input Transformations
• Black-box Adversarial Attacks with Limited Queries and Information
• Did you hear that? Adversarial Examples Against Automatic Speech Recognition
• Mitigating Adversarial Effects Through Randomization
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Towards Crafting Text Adversarial Samples
• DPatch: An Adversarial Patch Attack on Object Detectors
• Physical Adversarial Examples for Object Detectors
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Robust Adversarial Perturbation on Deep Proposal-based Models
• Art of singular vectors and universal adversarial perturbations