[Paper Review] Adversarial YOLO: Defense Human Detection Patch Attacks via Detecting Adversarial Patches

Nan Ji, YanFei Feng+3 more|arXiv (Cornell University)|Mar 16, 2021

Adversarial Robustness in Machine LearningComputer Science16 references26 citations

TL;DR

Ad-YOLO extends YOLOv2 with a patch category to detect adversarial patches, enabling simultaneous detection of people and patches and showing strong robustness against white-box and physical-world patch attacks with minimal cost to standard detection.

ABSTRACT

The security of object detection systems has attracted increasing attention, especially when facing adversarial patch attacks. Since patch attacks change the pixels in a restricted area on objects, they are easy to implement in the physical world, especially for attacking human detection systems. The existing defenses against patch attacks are mostly applied for image classification problems and have difficulty resisting human detection attacks. Towards this critical issue, we propose an efficient and effective plug-in defense component on the YOLO detection system, which we name Ad-YOLO. The main idea is to add a patch class on the YOLO architecture, which has a negligible inference increment. Thus, Ad-YOLO is expected to directly detect both the objects of interest and adversarial patches. To the best of our knowledge, our approach is the first defense strategy against human detection attacks. We investigate Ad-YOLO's performance on the YOLOv2 baseline. To improve the ability of Ad-YOLO to detect variety patches, we first use an adversarial training process to develop a patch dataset based on the Inria dataset, which we name Inria-Patch. Then, we train Ad-YOLO by a combination of Pascal VOC, Inria, and Inria-Patch datasets. With a slight drop of $0.70\%$ mAP on VOC 2007 test set, Ad-YOLO achieves $80.31\%$ AP of persons, which highly outperforms $33.93\%$ AP for YOLOv2 when facing white-box patch attacks. Furthermore, compared with YOLOv2, the results facing a physical-world attack are also included to demonstrate Ad-YOLO's excellent generalization ability.

Motivation & Objective

• Address the vulnerability of human detection systems to adversarial patch attacks in real-world settings.
• Develop a plug-in defense (Ad-YOLO) that can detect both persons and adversarial patches with negligible inference overhead.
• Create and utilize a diverse adversarial patch dataset (Inria-Patch) via adversarial training.
• Evaluate Ad-YOLO’s detectability, robustness to white-box and physical-world attacks, and generalization across scenarios and individuals.

Proposed method

• Add a new patch category to the last layer of YOLOv2, creating Ad-YOLO which outputs an extra class for patches without altering the rest of the architecture.
• Construct Inria-Patch through adversarial training on Inria, producing patches with high attack effectiveness and diversity.
• Train Ad-YOLO on a mixture of Pascal VOC, Inria, and Inria-Patch datasets to encourage simultaneous detection of persons and patches.
• Formulate the Ad-YOLO training objective as minimizing the expected loss over patch-augmented inputs, incorporating A(delta, x, t) to apply patches and ŷ as the ground truth with an extra patch label.
• Maintain timeliness and low computational cost by keeping the core YOLOv2 structure while adding a patch class.

Experimental results

Research questions

• RQ1 Can an object detector be augmented with a patch-detection class to defend against adversarial patches in both digital and physical-world settings?
• RQ2 Does Ad-YOLO preserve original detection performance (detectability) while adding patch detection capability?
• RQ3 How does Ad-YOLO perform under white-box patch attacks versus standard YOLOv2, and does it generalize to unseen patches and scenes?
• RQ4 What is the effect of adversarial patch training (Inria-Patch) on robustness and generalization across datasets and scenarios?

Key findings

• Ad-YOLO maintains near-identical detection performance to YOLOv2 on VOC 2007, with mAP dropping only 0.70 percentage points (from 73.07% to 72.35%).
• Ad-YOLO preserves person detection accuracy on Inria with a slight AP drop from 88.13% to 86.91%.
• Ad-YOLO achieves 83.91% AP on the Inria-Patch adversarial patch dataset, indicating effective patch detection.
• Under white-box patch attacks, Ad-YOLO improves person AP from 33.93% (YOLOv2) to 80.31% (Ad-YOLO), a substantial robustness gain.
• Ad-YOLO generalizes to unseen patches and scenes (cases I0-P0, I1-P0, I0-P1, I1-P1) with person AP ranging from 77.82% to 78.70% in tested configurations.
• Compared to adversarial training baselines, Ad-YOLO yields a ~46% robustness improvement with only ~1.4% additional drop in clean AP, and requires similar training cost to standard training.