[论文解读] NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles

Jiajun Lu, Hussein Sibai+2 more|arXiv (Cornell University)|Jul 12, 2017

Adversarial Robustness in Machine Learning参考文献 17被引用 209

一句话总结

论文认为物理对抗扰动在不同距离和角度下无法始终欺骗自动驾驶中的目标检测器。

ABSTRACT

It has been shown that most machine learning algorithms are susceptible to adversarial perturbations. Slightly perturbing an image in a carefully chosen direction in the image space may cause a trained neural network model to misclassify it. Recently, it was shown that physical adversarial examples exist: printing perturbed images then taking pictures of them would still result in misclassification. This raises security and safety concerns. However, these experiments ignore a crucial property of physical objects: the camera can view objects from different distances and at different angles. In this paper, we show experiments that suggest that current constructions of physical adversarial examples do not disrupt object detection from a moving platform. Instead, a trained neural network classifies most of the pictures taken from different distances and angles of a perturbed image correctly. We believe this is because the adversarial property of the perturbation is sensitive to the scale at which the perturbed picture is viewed, so (for example) an autonomous car will misclassify a stop sign only from a small range of distances. Our work raises an important question: can one construct examples that are adversarial for many or most viewing conditions? If so, the construction should offer very significant insights into the internal representation of patterns by deep networks. If not, there is a good prospect that adversarial examples can be reduced to a curiosity with little practical impact.

研究动机与目标

• 动机并量化物理对抗样本是否会威胁自动驾驶中的目标检测器。
• 将对抗攻击从分类器扩展到像 YOLO 这样的检测器。
• 评估距离和视角如何影响物理对抗扰动的有效性。

提出的方法

• 将快速符号、迭代和 L-BFGS 对抗攻击应用于交通标志分类器和 YOLO 检测器。
• 生成对抗性的停止标志图像并打印；通过在多个距离和角度拍摄照片来模拟驾驶。
• 使用破坏率来衡量对抗样本在变换（打印和重新捕获）后仍然具有对抗性的频次。
• 对打印标志在 0.5 m 和 1.5 m 的受控实验以及真实世界驾驶场景进行测试，以评估检测器和分类器的鲁棒性。

实验结果

研究问题

• RQ1 当观察距离和角度改变时，物理对抗扰动是否仍然对目标检测器（如 YOLO）有效？
• RQ2 距离如何影响检测器和分类器任务中的对抗扰动的破坏率？
• RQ3 为检测器设计的对抗扰动能否在物理世界条件下转移到分类器或对分类器持续有效？
• RQ4 距离和角度效应对自动驾驶安全有哪些实际意义？

主要发现

• 物理对抗扰动在不同距离下大多无法欺骗 YOLO 检测器；破坏率随距离增加而上升。
• 对于检测器，许多带扰动的标志在 0.5 m 下被正确检测，甚至在 1.5 m 时也如此，尽管已生成对抗。
• 分类器攻击在更大距离时破坏率更高，各方法效果不同（Iterative 和 LBFGS 通常比 Fast Sign 更具破坏性，但距离增加仍降低效果）。
• 裁剪和背景上下文会影响检测结果，在打印测试中有时在高对比度背景下提高检测率。
• 拍摄角度会改变对抗效果，表明现实世界的观看条件会降低对抗的可靠影响。