[Paper Review] DPatch: An Adversarial Patch Attack on Object Detectors

Xin Liu, Huanrui Yang+4 more|arXiv (Cornell University)|Jun 5, 2018

Adversarial Robustness in Machine Learning18 references150 citations

TL;DR

DPatch trains a small adversarial patch to simultaneously disrupt bounding box regression and object classification in Faster R-CNN and YOLO, enabling untargeted or targeted attacks in black-box settings with high transferability across detectors and datasets.

ABSTRACT

Object detectors have emerged as an indispensable module in modern computer vision systems. In this work, we propose DPatch -- a black-box adversarial-patch-based attack towards mainstream object detectors (i.e. Faster R-CNN and YOLO). Unlike the original adversarial patch that only manipulates image-level classifier, our DPatch simultaneously attacks the bounding box regression and object classification so as to disable their predictions. Compared to prior works, DPatch has several appealing properties: (1) DPatch can perform both untargeted and targeted effective attacks, degrading the mAP of Faster R-CNN and YOLO from 75.10% and 65.7% down to below 1%, respectively. (2) DPatch is small in size and its attacking effect is location-independent, making it very practical to implement real-world attacks. (3) DPatch demonstrates great transferability among different detectors as well as training datasets. For example, DPatch that is trained on Faster R-CNN can effectively attack YOLO, and vice versa. Extensive evaluations imply that DPatch can perform effective attacks under black-box setup, i.e., even without the knowledge of the attacked network's architectures and parameters. Successful realization of DPatch also illustrates the intrinsic vulnerability of the modern detector architectures to such patch-based adversarial attacks.

Motivation & Objective

• Motivate the study of robust object detectors by examining their vulnerability to patch-based adversarial attacks.
• Develop a practical, small-size adversarial patch that can disrupt both localization and classification in mainstream detectors.
• Demonstrate untargeted and targeted attack capabilities with a patch that is location- and scale-invariant.
• Show transferability of patches across detector architectures (two-stage and one-stage) and datasets (VOC, COCO).
• Evaluate attack effectiveness under black-box conditions where network architectures and parameters are unknown.

Proposed method

• Introduce DPatch, an optimizable patch placed on input images during detector processing.
• Train DPatch by optimizing for either untargeted loss (maximize detector loss) or targeted loss (minimize loss toward a chosen target class and bounding box).
• Apply random transformations (shift, scale, rotation) during training to achieve robustness to physical-world variations.
• Use a fixed patch size (e.g., 40x40) and also explore fixed-location vs random-location placements during training.
• Evaluate on Faster R-CNN (VGG16/ResNet101) and YOLO using Pascal VOC 2007 as the primary dataset, with transferability tests on COCO and VOC-trained detectors.
• Demonstrate that the RoIs concentrate in the patch area, explaining why detectors fail to correctly locate or classify objects.

Experimental results

Research questions

• RQ1 Can a small adversarial patch impair both localization and classification in modern object detectors like Faster R-CNN and YOLO?
• RQ2 Is it possible to achieve untargeted and targeted attacks with a patch that is robust to location, scale, and rotation?
• RQ3 How transferable are DPatch attacks across different detector architectures and datasets under black-box conditions?
• RQ4 What is the impact of patch size and target class on attack effectiveness?
• RQ5 Does training on one dataset or detector enable successful attacks on another (transferability across datasets and detectors)?

Key findings

• DPatch can degrade mAP from 75.10% (Faster R-CNN with ResNet101) and 65.7% (YOLO) to below 1% in untargeted attacks on the tested setups.
• Targeted patches can force detections to primarily recognize the patch region as the chosen target class, effectively disabling other object detections.
• Patch size and targeted class influence effectiveness; larger patches generally yield stronger attacks, and some target classes (e.g., tv, cow) produce stronger reductions in mAP than others.
• Attacks are effective under black-box setups and show transferability: patches trained on YOLO can fool Faster R-CNN and vice versa; COCO-trained patches also transfer to VOC-trained detectors.
• Patch location is largely inconsequential for two-stage and one-stage detectors because proposals are scanned across the image, enabling the patch to dominate RoIs regardless of location.