[Paper Review] Standard detectors aren't (currently) fooled by physical adversarial stop signs

Jiajun Lu, Hussein Sibai+2 more|arXiv (Cornell University)|Oct 9, 2017

Adversarial Robustness in Machine Learning20 references50 citations

TL;DR

The paper tests physical adversarial stop signs on standard detectors (YOLO and Faster R-CNN) and finds they are not fooled under standard configurations, arguing that prior classifier-focused attacks do not directly translate to detectors.

ABSTRACT

An adversarial example is an example that has been adjusted to produce the wrong label when presented to a system at test time. If adversarial examples existed that could fool a detector, they could be used to (for example) wreak havoc on roads populated with smart vehicles. Recently, we described our difficulties creating physical adversarial stop signs that fool a detector. More recently, Evtimov et al. produced a physical adversarial stop sign that fools a proxy model of a detector. In this paper, we show that these physical adversarial stop signs do not fool two standard detectors (YOLO and Faster RCNN) in standard configuration. Evtimov et al.'s construction relies on a crop of the image to the stop sign; this crop is then resized and presented to a classifier. We argue that the cropping and resizing procedure largely eliminates the effects of rescaling and of view angle. Whether an adversarial attack is robust under rescaling and change of view direction remains moot. We argue that attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - likely makes it difficult to make adversarial patterns. Finally, an adversarial pattern on a physical object that could fool a detector would have to be adversarial in the face of a wide family of parametric distortions (scale; view angle; box shift inside the detector; illumination; and so on). Such a pattern would be of great theoretical and practical interest. There is currently no evidence that such patterns exist.

Motivation & Objective

• Assess whether physical adversarial stop signs can fool standard detectors in real-world-like conditions.
• Explain why prior attacks on classifiers may not translate to detectors.
• Discuss how detector box prediction and localization affect adversarial robustness.
• Clarify the distinction between attacking classifiers versus detectors in road-sign scenarios.

Proposed method

• Apply two pretrained detectors (YOLO and Faster R-CNN) to Evtimov et al.'s physical stop-sign attacks.
• Reproduce the paper's figures and test the detectors on both poster and sticker adversarial stop signs.
• Analyze detection performance with respect to image resolution, cropping, and box localization.
• Discuss how detector architectures (grid-based vs proposal-based) influence robustness to adversarial patterns.

Experimental results

Research questions

• RQ1 Do standard detectors (YOLO and Faster RCNN) misclassify or fail to detect physical adversarial stop signs under stationary and drive-by conditions?
• RQ2 Is the adversarial effect observed in classifier-focused attacks preserved when considering the detector's bounding box localization and multiple-box sampling?
• RQ3 How do cropping, scaling, and box localization in detector pipelines impact the robustness of adversarial patterns?
• RQ4 What explains discrepancies between classifier-focused adversarial work and detector performance?

Key findings

• YOLO detects adversarial stop signs (poster and sticker) about as well as true stop signs in both standard and higher-resolution videos.
• Faster RCNN detects adversarial stop signs (poster and sticker) about as well as true stop signs and generally more accurately than YOLO.
• Detectors tend to outperform YOLO on small or distant signs; higher resolution video improves detection performance for both detectors.
• The cropping to a bounding box used in some classifier attacks removes scale and slant effects, making those results not representative of modern detectors.
• Modern detectors' imperfect box localization may disrupt adversarial patterns, reducing their effectiveness against detectors.
• There is currently no evidence that a physical adversarial pattern can fool a detector across a wide parametric distortion family (scale, view angle, box shift, illumination).