[论文解读] Dynamic Adversarial Patch for Evading Object Detection Models

Shahar Hoory, Tzvika Shapira+2 more|arXiv (Cornell University)|Oct 25, 2020

Adversarial Robustness in Machine Learning参考文献 42被引用 28

一句话总结

本文提出一种动态对抗补丁攻击方法，通过在汽车上安装多个屏幕，根据摄像头位置实时切换优化后的对抗补丁，显著提升了对 YOLOv2 目标检测器的逃避成功率。该方法在 90° 视角范围内实现了最高 90% 的攻击成功率，并通过引入语义损失，使车辆被误分类为语义上无关的物体，从而增强了鲁棒性。

ABSTRACT

Recent research shows that neural networks models used for computer vision (e.g., YOLO and Fast R-CNN) are vulnerable to adversarial evasion attacks. Most of the existing real-world adversarial attacks against object detectors use an adversarial patch which is attached to the target object (e.g., a carefully crafted sticker placed on a stop sign). This method may not be robust to changes in the camera's location relative to the target object; in addition, it may not work well when applied to nonplanar objects such as cars. In this study, we present an innovative attack method against object detectors applied in a real-world setup that addresses some of the limitations of existing attacks. Our method uses dynamic adversarial patches which are placed at multiple predetermined locations on a target object. An adversarial learning algorithm is applied in order to generate the patches used. The dynamic attack is implemented by switching between optimized patches dynamically, according to the camera's position (i.e., the object detection system's position). In order to demonstrate our attack in a real-world setup, we implemented the patches by attaching flat screens to the target object; the screens are used to present the patches and switch between them, depending on the current camera location. Thus, the attack is dynamic and adjusts itself to the situation to achieve optimal results. We evaluated our dynamic patch approach by attacking the YOLOv2 object detector with a car as the target object and succeeded in misleading it in up to 90% of the video frames when filming the car from a wide viewing angle range. We improved the attack by generating patches that consider the semantic distance between the target object and its classification. We also examined the attack's transferability among different car models and were able to mislead the detector 71% of the time.

研究动机与目标

• 解决静态对抗补丁在真实世界目标检测攻击中鲁棒性有限的问题，尤其是在摄像头角度变化以及在非平面 3D 物体（如汽车）上的表现。
• 克服现有物理攻击在视角变化或补丁从某些视角不可见时的失败问题。
• 开发一种动态、基于摄像头位置感知的攻击系统，能够实时自适应调整对抗补丁以维持高逃避成功率。
• 通过修改损失函数以针对语义上无关的类别（例如，将车辆误分类为行人）来提升攻击的可迁移性和语义误分类能力。
• 展示在自动驾驶等安全关键系统中，使用动态屏幕实现真实世界对抗攻击的可行性。

提出的方法

• 在汽车上部署多个平面屏幕，动态显示对抗补丁，每个屏幕显示针对特定摄像头视角优化的补丁。
• 使用对抗学习算法生成针对特定视角优化的补丁，确保在宽广视角范围（90°）内均保持高攻击成功率。
• 基于实时摄像头位置数据动态切换补丁，确保检测器始终可见最有效的补丁。
• 引入语义对抗损失函数，促使模型将目标误分类为语义上无关的类别（例如，车辆 → 行人），从而提升攻击的隐蔽性和有效性。
• 在真实世界实验中使用物理屏幕模拟动态补丁展示，实现对摄像头位置变化的实时适应。
• 在不同光照条件（如晴天与室内）下评估攻击性能，以评估环境鲁棒性。

实验结果

研究问题

• RQ1 与静态补丁相比，动态对抗补丁系统是否能在更广范围的视角下提升对目标检测器的逃避成功率？
• RQ2 屏幕和补丁的数量如何影响在动态摄像头运动下的攻击成功率和鲁棒性？
• RQ3 当目标物体为非平面 3D 物体（如汽车）时，尤其在补丁并非始终可见的情况下，攻击是否仍能保持高成功率？
• RQ4 使用语义损失函数将目标误分类为语义上无关的物体，是否能提升攻击的有效性和可迁移性？
• RQ5 环境光照（如直射阳光）如何影响动态对抗补丁在真实世界中的有效性？

主要发现

• 在从不同角度拍摄时，该动态对抗补丁攻击在 YOLOv2 目标检测器上实现了高达 90% 的成功率，覆盖 90° 视角范围。
• 攻击在前向和后向视角下最为有效（图 9），但在侧视场景中失败（图 8），表明性能具有角度依赖性。
• 在阳光充足的户外环境中，攻击成功率下降至 15–23.2%，主要由于屏幕反光和直射阳光导致的亮度使摄像头失明。
• 语义对抗补丁方法成功将车辆误分类为语义上无关的物体（例如，行人），降低了被检测或怀疑的可能性。
• 攻击在不同车型之间表现出 71% 的可迁移性，表明对形状相似但未见过的车辆具有中等程度的泛化能力。
• 数字仿真显示，仅覆盖汽车后部 15% 面积的屏幕，即可在视频帧中实现 90% 的攻击成功率。