[Paper Review] Physical Adversarial Examples for Object Detectors

Kevin Eykholt, Ivan Evtimov+7 more|arXiv (Cornell University)|Jul 20, 2018

Adversarial Robustness in Machine LearningComputer Science19 references104 citations

TL;DR

The paper demonstrates physically perturbing Stop signs with posters or stickers to fool object detectors (YOLOv2 and Faster R-CNN) in both indoor and outdoor settings, showing high disappearance attack success and partial transferability.

ABSTRACT

Deep neural networks (DNNs) are vulnerable to adversarial examples-maliciously crafted inputs that cause DNNs to make incorrect predictions. Recent work has shown that these attacks generalize to the physical domain, to create perturbations on physical objects that fool image classifiers under a variety of real-world conditions. Such attacks pose a risk to deep learning models used in safety-critical cyber-physical systems. In this work, we extend physical attacks to more challenging object detection models, a broader class of deep learning algorithms widely used to detect and label multiple objects within a scene. Improving upon a previous physical attack on image classifiers, we create perturbed physical objects that are either ignored or mislabeled by object detection models. We implement a Disappearance Attack, in which we cause a Stop sign to "disappear" according to the detector-either by covering thesign with an adversarial Stop sign poster, or by adding adversarial stickers onto the sign. In a video recorded in a controlled lab environment, the state-of-the-art YOLOv2 detector failed to recognize these adversarial Stop signs in over 85% of the video frames. In an outdoor experiment, YOLO was fooled by the poster and sticker attacks in 72.5% and 63.5% of the video frames respectively. We also use Faster R-CNN, a different object detection model, to demonstrate the transferability of our adversarial perturbations. The created poster perturbation is able to fool Faster R-CNN in 85.9% of the video frames in a controlled lab environment, and 40.2% of the video frames in an outdoor environment. Finally, we present preliminary results with a new Creation Attack, where in innocuous physical stickers fool a model into detecting nonexistent objects.

Motivation & Objective

• Examine whether physical perturbations can fool object detectors beyond image classifiers.
• Extend RP2 to robust, location- and pose-variant attacks on detectors.
• Develop disappearance and creation attacks targeting detection outputs.
• Evaluate attack transferability across detectors in diverse environments.

Proposed method

• Extend the RP2 algorithm to object detectors with a new loss tailored to detectors.
• Model synthetic rotations and positions to simulate physical scene variations.
• Replace L2/NPS smoothing with a total variation norm for smoother perturbations.
• Define Disappearance Attack loss to minimize Stop sign detection probability across all cells/boxes.
• Define Creation Attack loss to create detections of nonexistent objects using adversarial stickers.
• Evaluate attacks on YOLO v2 (white-box) and transferability to Faster R-CNN (black-box).

Experimental results

Research questions

• RQ1 Can physical perturbations on Stop signs fool state-of-the-art object detectors in real-world conditions?
• RQ2 Do poster and sticker perturbations cause detectors to ignore or mislabel located objects (disappearance/creation)?
• RQ3 Are physical-attack perturbations transferable across detector architectures (YOLOv2 to Faster R-CNN)?
• RQ4 How robust are such attacks to indoor versus outdoor environments?

Key findings

• Disappearance attacks fooled YOLOv2 in 85.6% of indoor frames and 72.5% of outdoor frames (poster); 85.0% indoor and 63.5% outdoor for stickers.
• Faster R-CNN was fooled by poster attacks in 85.9% indoors and 40.2% outdoors; sticker attacks fooled Faster R-CNN in 58.9% indoors and 18.9% outdoors.
• Creation attacks showed preliminary success with YOLOv2 (detections of adversarial stickers as Stop signs) and demonstrated transferability potential.
• Attacks are more reliable in controlled indoor settings; outdoor conditions reduce effectiveness, but still achieve meaningful disruption.
• Extensions to include positional and rotational invariance improve robustness against viewpoint changes.