Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers

Abstract

Recently, physical domain adversarial attacks have drawn significant attention from the machine learning community. One important attack proposed by Eykholt et al. can fool a classifier by placing black and white stickers on an object such as a road sign. While this attack may pose a significant threat to visual classifiers, there are currently no defenses designed to protect against this attack. In this paper, we propose new defenses that can protect against multi-sticker attacks. We present defensive strategies capable of operating when the defender has full, partial, and no prior information about the attack. By conducting extensive experiments, we show that our proposed defenses can outperform existing defenses against physical attacks when presented with a multi-sticker attack.

References in corpus (12)

• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Synthesizing Robust Adversarial Examples
• Certified Defenses against Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Detecting Adversarial Samples from Artifacts
• A study of the effect of JPG compression on adversarial images
• Towards Vision-Based Deep Reinforcement Learning for Robotic Motion Control
• Stochastic Activation Pruning for Robust Adversarial Defense
• LaVAN: Localized and Visible Adversarial Noise
• (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
• Defending against Adversarial Images using Basis Functions Transformations