To Make Yourself Invisible with Adversarial Semantic Contours

Abstract

Modern object detectors are vulnerable to adversarial examples, which may bring risks to real-world applications. The sparse attack is an important task which, compared with the popular adversarial perturbation on the whole image, needs to select the potential pixels that is generally regularized by an ${\ell }_0$-norm constraint, and simultaneously optimize the corresponding texture. The non-differentiability of ${\ell }_0$ norm brings challenges and many works on attacking object detection adopted manually-designed patterns to address them, which are meaningless and independent of objects, and therefore lead to relatively poor attack performance. In this paper, we propose Adversarial Semantic Contour (ASC), an MAP estimate of a Bayesian formulation of sparse attack with a deceived prior of object contour. The object contour prior effectively reduces the search space of pixel selection and improves the attack by introducing more semantic bias. Extensive experiments demonstrate that ASC can corrupt the prediction of 9 modern detectors with different architectures (\e.g., one-stage, two-stage and Transformer) by modifying fewer than 5\% of the pixels of the object area in COCO in white-box scenario and around 10\% of those in black-box scenario. We further extend the attack to datasets for autonomous driving systems to verify the effectiveness. We conclude with cautions about contour being the common weakness of object detectors with various architecture and the care needed in applying them in safety-sensitive scenarios.

arXiv comment11 pages, 7 figures, published in Computer Vision and Image Understanding in 2023

References in corpus (20)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• SSD: Single Shot MultiBox Detector
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• YOLOX: Exceeding YOLO Series in 2021
• PCT: Point cloud transformer
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• DAB-DETR: Dynamic Anchor Boxes are Better Queries for DETR
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Intriguing Properties of Vision Transformers
• AutoAssign: Differentiable Label Assignment for Dense Object Detection
• A ConvNet for the 2020s
• DPatch: An Adversarial Patch Attack on Object Detectors
• Adversarial Patch
• Adversarial Examples that Fool Detectors
• Are Transformers More Robust Than CNNs?
• Cross-Domain Complementary Learning Using Pose for Multi-Person Part Segmentation
• DPAttack: Diffused Patch Attacks against Universal Object Detection
• Sparse Adversarial Attack to Object Detection
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation