Object detectors have emerged as an indispensable module in modern computer vision systems. In this work, we propose DPatch -- a black-box adversarial-patch-based attack towards mainstream object detectors (i.e. Faster R-CNN and YOLO). Unlike the original adversarial patch that only manipulates image-level classifier, our DPatch simultaneously attacks the bounding box regression and object classification so as to disable their predictions. Compared to prior works, DPatch has several appealing properties: (1) DPatch can perform both untargeted and targeted effective attacks, degrading the mAP of Faster R-CNN and YOLO from 75.10 and 65.7 down to below 1 , respectively. (2) DPatch is small in size and its attacking effect is location-independent, making it very practical to implement real-world attacks. (3) DPatch demonstrates great transferability among different detectors as well as training datasets. For example, DPatch that is trained on Faster R-CNN can effectively attack YOLO, and vice versa. Extensive evaluations imply that DPatch can perform effective attacks under black-box setup, i.e., even without the knowledge of the attacked network's architectures and parameters. Successful realization of DPatch also illustrates the intrinsic vulnerability of the modern detector architectures to such patch-based adversarial attacks.
To achieve a universal attack on real-world vision system, Google @cite_13 recently designed a universal, robust adversarial patch that can be applied in real physical scene, causing a classifier to output any targeted class @cite_13 . Based on the principle that object detection networks are used to detecting the most "salient" object in an image, the adversarial patch can be trained to be more "salient" than other objects in the scene. Specifically, the patch is trained to optimize the expected probability of a target class @cite_13 . During the training process, the patch is applied to the scene at a random position with a random scale and rotation. This process enables the patch to be robust against shifting, scaling and rotating. Finally, the object in the scene will be detected as a targeted class of the patch.
@cite_13
2804566015
We present a method to create universal, robust, targeted adversarial image patches in the real world. The patches are universal because they can be used to attack any scene, robust because they work under a wide variety of transformations, and targeted because they can cause a classifier to output any target class. These adversarial patches can be printed, added to any scene, photographed, and presented to image classifiers; even when the patches are small, they cause the classifiers to ignore the other items in the scene and report a chosen target class. To reproduce the results from the paper, our code is available at https: github.com tensorflow cleverhans tree master examples adversarial_patch