[Paper Review] Adversarial T-shirt! Evading Person Detectors in A Physical World

Kaidi Xu, Gaoyuan Zhang+7 more|arXiv (Cornell University)|Oct 18, 2019

Adversarial Robustness in Machine Learning31 references38 citations

TL;DR

The paper introduces Adversarial T-shirts, a non-rigid, TPS-based physical attack that deforms with pose changes to evade person detectors like YOLOv2 and Faster R-CNN, including a min-max ensemble extension.

ABSTRACT

It is known that deep neural networks (DNNs) are vulnerable to adversarial attacks. The so-called physical adversarial examples deceive DNN-based decisionmakers by attaching adversarial patches to real objects. However, most of the existing works on physical adversarial attacks focus on static objects such as glass frames, stop signs and images attached to cardboard. In this work, we proposed adversarial T-shirts, a robust physical adversarial example for evading person detectors even if it could undergo non-rigid deformation due to a moving person's pose changes. To the best of our knowledge, this is the first work that models the effect of deformation for designing physical adversarial examples with respect to-rigid objects such as T-shirts. We show that the proposed method achieves74% and 57% attack success rates in the digital and physical worlds respectively against YOLOv2. In contrast, the state-of-the-art physical attack method to fool a person detector only achieves 18% attack success rate. Furthermore, by leveraging min-max optimization, we extend our method to the ensemble attack setting against two object detectors YOLO-v2 and Faster R-CNN simultaneously.

Motivation & Objective

• Motivate robustness evaluation of DNNs for person detection in real-world, non-static conditions.
• Develop a physical adversarial wearable that remains effective under non-rigid cloth deformation.
• Propose a TPS-based deformation model to capture pose-induced cloth changes.
• Design a universal perturbation for single and ensemble detector attacks.
• Evaluate the method in digital and physical experiments against multiple detectors.

Proposed method

• Model cloth deformation with a thin plate spline (TPS) transformer combining affine and non-affine warping.
• Use a checkerboard pattern to detect control points and align TPS across frames.
• Formulate an Expectation over Transformation (EoT)–based optimization to minimize a person-detection confidence loss under TPS and color transformations.
• Incorporate a color transformation model to map digital perturbations to printable patterns.
• Apply a min-max ensemble optimization to fool multiple detectors (YOLOv2 and Faster R-CNN) simultaneously.

Experimental results

Research questions

• RQ1 Can a non-rigidly deformed adversarial pattern on a clothing item consistently fool modern person detectors in the physical world?
• RQ2 How does incorporating TPS-based deformation influence physical-world attack success against single and multiple detectors?
• RQ3 What is the benefit of a min-max ensemble attack over averaging losses when attacking multiple detectors?
• RQ4 How robust is the adversarial T-shirt to pose changes, distances, and environmental variations?
• RQ5 Can the method transfer from digital simulations to real-world wearables?

Key findings

• The adversarial T-shirt achieves 74% attack success rate (ASR) in the digital world and 57% ASR in the physical world against YOLOv2.
• Against Faster R-CNN, the T-shirt achieves 61% digital and 47% physical ASR.
• Compared to an advPatch baseline, the adversarial T-shirt substantially improves ASR (e.g., 74% vs 24% digital against YOLOv2).
• TPS-based deformation is crucial; removing TPS drops YOLOv2 ASR from 74% to 48% and Faster R-CNN ASR from 61% to 34% in single-detector settings.
• The min-max ensemble attack improves ASR over averaging when attacking Faster R-CNN (up to about 15% gain) with a slight trade-off for YOLOv2.
• In physical-world tests, the adversarial T-shirt attains 57% ASR against YOLOv2 and 47% against Faster R-CNN on average across indoor, outdoor, and unforeseen scenarios.