Benchmarking Adversarial Patch Against Aerial Detection

Abstract

DNNs are vulnerable to adversarial examples, which poses great security concerns for security-critical systems. In this paper, a novel adaptive-patch-based physical attack (AP-PA) framework is proposed, which aims to generate adversarial patches that are adaptive in both physical dynamics and varying scales, and by which the particular targets can be hidden from being detected. Furthermore, the adversarial patch is also gifted with attack effectiveness against all targets of the same class with a patch outside the target (No need to smear targeted objects) and robust enough in the physical world. In addition, a new loss is devised to consider more available information of detected objects to optimize the adversarial patch, which can significantly improve the patch's attack efficacy (Average precision drop up to 87.86% and 85.48% in white-box and black-box settings, respectively) and optimizing efficiency. We also establish one of the first comprehensive, coherent, and rigorous benchmarks to evaluate the attack efficacy of adversarial patches on aerial detection tasks. Finally, several proportionally scaled experiments are performed physically to demonstrate that the elaborated adversarial patches can successfully deceive aerial detection algorithms in dynamic physical circumstances. The code is available at https://github.com/JiaweiLian/AP-PA.

arXiv comment14 pages, 14 figures

References in corpus (12)

• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Synthesizing Robust Adversarial Examples
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• A General Framework for Adversarial Examples with Objectives
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark
• On adversarial patches: real-world attack on ArcFace-100 face recognition system
• Note on Attacking Object Detectors with Adversarial Stickers
• Spectral Variability Augmented Sparse Unmixing of Hyperspectral Images
• Real-world adversarial attack on MTCNN face detection system

Cited by in corpus (5)

• LESSON: Multi-Label Adversarial False Data Injection Attack for Deep Learning Locational Detection
• CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World
• Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images
• Model Agnostic Defense against Adversarial Patch Attacks on Object Detection in Unmanned Aerial Vehicles
• AEGIS: A Semantic GAN and Evidential Learning Frameworkfor Robust Adversarial Detection in Vision Sensors