Adversaries in neural networks have drawn much attention since their first debut. 
 While most existing methods aim at deceiving image classification models into misclassification or crafting attacks for specific object instances in the object setection tasks, we focus on creating universal adversaries to fool object detectors and hide objects from the detectors. 
 The adversaries we examine are universal in three ways: 
 (1) They are not specific for specific object instances; 
 (2) They are image-independent; 
 (3) They can further transfer to different unknown models. 
 To achieve this, we propose two novel techniques to improve the transferability of the adversaries: \textit{piling-up} and \textit{monochromatization}. 
 Both techniques prove to simplify the patterns of generated adversaries, and ultimately result in higher transferability. Despite the success of machine learning and deep learning models, recently it has been shown that these models are susceptible and sensitive to what is termed as adversarial examples, a.k.a. adversaries BID32 BID10 . Adversaries are usually derived from ordinary data and retain the same semantic content, but can result in wrong predictions. Previous studies have shown that adversarial examples can be crafted efficiently and successfully in some conditions, which poses significant security threats BID14 . Formally speaking, given a model y = F (x), input X and original or ground-truth output Y = F (X), adversaries are modified versions of the original data, denoted as X + ∆X such that F (X + ∆X) = Y . Generally, ∆X is constrained by its norm value (e.g. L ∞ ) or other metrics to preserve the original semantic meaning of input X.Existing studies on adversarial examples focus on (1) designing effective and efficient methods to craft ∆X, e.g. L-BFGS BID32 , FGSM BID10 , iterative methods BID13 ; (2) defense methods including defensive distillation BID24 , random transformation BID35 , JPEG-compression (Dziugaite et al., 2016) and etc. ; (3) how to improve the transferability of attacks crafted on one model to deceive another model, both for differently initialized and trained models, and models of different architecture BID19 BID23 BID33 BID34 . Up till now, these efforts mainly focus on image classification models.More recent work has studied the robustness of object detectors and tried to fool these models BID21 BID3 BID6 BID16 a; BID28 . However, most of these works only attack specific object instances. Few proposed methods have attempted to attack multiple objects and images or verify the capacity to transfer to another model.In this work, we aim to craft universal and transferable adversaries to fool object detectors and conceal objects. As far as we know, we are the first to carry out such large-scale attacks on object detectors. Our target is three-fold: (1) The adversary should work for different objects, regardless of their types, positions, sizes, and etc.. (2) The adversary is not limited to one image only, i.e. achieving image-independence. (3) The adversary should be able to attack detectors that they are not crafted on, i.e. achieving black-box attack.Specifically, we craft an adversarial mask of the same size as input image, denoted as ∆X ∈ [0, 1] Himage×Wimage×3 , and impose a norm-value constraint, ||∆X|| ∞ ≤ . Such an adversarial mask is in fact similar to what the community has used to fool image classification models. However, optimizing over it is a non-trivial task. A full-sized mask would introduce a total amount of 0.5M parameters, putting our method on risk of overfitting. Further, using the concept of Effective Receptive Field BID22 , we found that gradients obtained through back propagation are sparse in spatial positions, making optimization difficult.To achieve our objective, we propose to use the following techniques: (1) Optimizing ∆X over a set of images; (2) Using identical small patches that are piled-up to form the full-sized mask ∆X; (3) Crafting monochromatic masks instead of colorful ones as done in previous work. Our motivation is that piling-up identical small patches in a grid can incorporate translation invariance in a similar way to Convolutional Neural Networks (CNNs), which is also connected with the intuition that any part of the mask should perform equally to attack an object in any position. Constraining the adversarial mask to monochrome further forces the mask to learn coarse-grained patterns that may be universal.In experiments, we compare with decent baseline methods and found that our methods can consistently surpasses them. While our adversarial mask can conceal as many as 80% objects from YOLO V3 BID25 , on which it is crafted, it can also hide more than 40% objects from the eyes of Faster-RCNN BID27 , in a black-box setting. Further, we compare the patterns generated by different methods and carry out detailed analysis. We found that our techniques did help in crafting more coarse-grained patterns. These patterns have generic appearance, which we attribute as the key for good transferability.In conclusion, we make the following contributions in this work: (1) We successfully craft universal adversarial mask that can fool object detectors that are independent in object-level, image-level and model-level. (2) We show that, with the proposed techniques, we can learn and generate masks that have generic and coarse-grained patterns. The pattern we generate is different from those in previous works by large, which may be the key for better transferability. In this section, we visually evaluate how the two techniques play their role in improving transferability. Especially, we discuss about how pile-up helps in significantly improve transferability, as is shown in the experiments. Further, we study a strong method for comparison to provide further insight into adversaries for object detectors.
We focus on creating universal adversaries to fool object detectors and hide objects from the detectors. 
{"src": "scitldr-AIC_train", "paper_id": "H1Gnx2CqKQ"}