[论文解读] Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples

Derui Wang, Chaoran Li+5 more|arXiv (Cornell University)|Feb 6, 2019

Adversarial Robustness in Machine Learning参考文献 71被引用 35

一句话总结

Daedalus 设计对端到端目标检测器的对抗样本，使 NMS 失效，在某些设置下显著增加误报并使 mAP 降至 0；它可以在实体海报中实现，并且在多种模型上有效。

ABSTRACT

This paper demonstrates that Non-Maximum Suppression (NMS), which is commonly used in Object Detection (OD) tasks to filter redundant detection results, is no longer secure. Considering that NMS has been an integral part of OD systems, thwarting the functionality of NMS can result in unexpected or even lethal consequences for such systems. In this paper, an adversarial example attack which triggers malfunctioning of NMS in end-to-end OD models is proposed. The attack, namely exttt{Daedalus}, compresses the dimensions of detection boxes to evade NMS. As a result, the final detection output contains extremely dense false positives. This can be fatal for many OD applications such as autonomous vehicles and surveillance systems. The attack can be generalised to different end-to-end OD models, such that the attack cripples various OD applications. Furthermore, a way to craft robust adversarial examples is developed by using an ensemble of popular detection models as the substitutes. Considering the pervasive nature of model reusing in real-world OD scenarios, Daedalus examples crafted based on an extit{ensemble of substitutes} can launch attacks without knowing the parameters of the victim models. Experimental results demonstrate that the attack effectively stops NMS from filtering redundant bounding boxes. As the evaluation results suggest, Daedalus increases the false positive rate in detection results to $99.9\%$ and reduces the mean average precision scores to $0$, while maintaining a low cost of distortion on the original inputs. It is also demonstrated that the attack can be practically launched against real-world OD systems via printed posters.

研究动机与目标

• 激励并证明在端到端目标检测器中，非极大值抑制（NMS）可以被对抗样本破坏。
• 显示破坏 NMS 会降低检测性能，并且可以实现为一种通用、可迁移的攻击。
• 开发一种集成替代策略，以构造在多种模型上有效的鲁棒对抗样本。
• 探索通过打印海报在现实世界场景部署攻击的可行性。

提出的方法

• 将 Daedalus 形式化为带约束的优化问题，在限制扰动的同时最大化对抗目标。
• 通过降低边界框之间的 IoU 或压缩框的尺寸来利用 NMS 的漏洞，以阻止 NMS 的筛选。
• 提出三种对抗损失函数（f1、f2、f3），以诱导密集、重叠或较小的框，从而逃避 NMS。
• 使用一个替代检测器的集合（如 YOLO-v3、SSD、RetinaNet）在黑盒场景中生成通用对抗样本。
• 提供 Daedalus 的 L2 和 L0 变体，以研究所有像素和选择性像素扰动，包括物理海报实现。

实验结果

研究问题

• RQ1 在端到端目标检测器中，是否可以通过精心设计的对抗扰动可靠破坏 NMS？
• RQ2 从替代模型集合生成的通用对抗样例是否会在黑盒条件下对其他检测器具备迁移性？
• RQ3 Daedalus 扰动如何影响标准 OD 指标（如 FP 率和 mAP），在不同 NMS 阈值和攻击置信度下的表现？
• RQ4 通过打印海报或其他实体媒介在现实场景中部署 Daedalus 是否可行？

主要发现

• Daedalus 通过阻止 NMS 过滤输出，可能导致极其密集的误报。
• 在评估中，对于高置信度攻击，FP 率可高达 99.9%，而在某些设置下 mAP 可能降至 0%。
• 集成替代方法产生的通用对抗样例能够攻击多种流行的 OD 模型。
• 该攻击在实体海报设定中得到演示，可用于攻击现实世界的 OD 系统。