Adversarial T-shirt! Evading Person Detectors in A Physical World

Abstract

It is known that deep neural networks (DNNs) are vulnerable to adversarial attacks. The so-called physical adversarial examples deceive DNN-based decisionmakers by attaching adversarial patches to real objects. However, most of the existing works on physical adversarial attacks focus on static objects such as glass frames, stop signs and images attached to cardboard. In this work, we proposed adversarial T-shirts, a robust physical adversarial example for evading person detectors even if it could undergo non-rigid deformation due to a moving person's pose changes. To the best of our knowledge, this is the first work that models the effect of deformation for designing physical adversarial examples with respect to-rigid objects such as T-shirts. We show that the proposed method achieves74% and 57% attack success rates in the digital and physical worlds respectively against YOLOv2. In contrast, the state-of-the-art physical attack method to fool a person detector only achieves 18% attack success rate. Furthermore, by leveraging min-max optimization, we extend our method to the ensemble attack setting against two object detectors YOLO-v2 and Faster R-CNN simultaneously.

References in corpus (11)

• Adam: A Method for Stochastic Optimization
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Structured Adversarial Attack: Towards General Implementation and Better Interpretability
• Adversarial Examples that Fool Detectors
• Physical Adversarial Examples for Object Detectors
• Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos

Cited by in corpus (8)

• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• Black-box adversarial attacks using Evolution Strategies
• Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
• Smoothed Inference for Adversarially-Trained Models
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• Can 3D Adversarial Logos Cloak Humans?
• AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attacks