[论文解读] Physical Adversarial Attack meets Computer Vision: A Decade Survey

Hui Wei, Hao Tang+7 more|arXiv (Cornell University)|Sep 30, 2022

Adversarial Robustness in Machine Learning被引用 22

一句话总结

对过去十年来计算机视觉中物理对抗性攻击的全面综述，介绍对抗性媒介概念和 hiPAA 评估指标，以系统地在跨任务中比较方法。

ABSTRACT

Despite the impressive achievements of Deep Neural Networks (DNNs) in computer vision, their vulnerability to adversarial attacks remains a critical concern. Extensive research has demonstrated that incorporating sophisticated perturbations into input images can lead to a catastrophic degradation in DNNs' performance. This perplexing phenomenon not only exists in the digital space but also in the physical world. Consequently, it becomes imperative to evaluate the security of DNNs-based systems to ensure their safe deployment in real-world scenarios, particularly in security-sensitive applications. To facilitate a profound understanding of this topic, this paper presents a comprehensive overview of physical adversarial attacks. Firstly, we distill four general steps for launching physical adversarial attacks. Building upon this foundation, we uncover the pervasive role of artifacts carrying adversarial perturbations in the physical world. These artifacts influence each step. To denote them, we introduce a new term: adversarial medium. Then, we take the first step to systematically evaluate the performance of physical adversarial attacks, taking the adversarial medium as a first attempt. Our proposed evaluation metric, hiPAA, comprises six perspectives: Effectiveness, Stealthiness, Robustness, Practicability, Aesthetics, and Economics. We also provide comparative results across task categories, together with insightful observations and suggestions for future research directions.

研究动机与目标

• 澄清在现实世界设置中物理对抗性攻击的构建与评估方式。
• 引入对抗性媒介概念，以统一物理攻击载体。
• 提出统一的评估框架 hiPAA，涵盖六个维度用于比较方法。
• 对跨计算机视觉任务（分类、检测、再识别）的方法进行综述与综合，并指出尚待解决的挑战。

提出的方法

• 定义物理对抗性攻击的四步工作流：扰动生成、对抗性媒介制造、威胁图像捕获与攻击。
• 引入对抗性媒介概念，作为物理世界中扰动的载体。
• 提出 hiPAA，这是一个六边形指标，用于在六个维度上评估物理攻击：有效性、隐蔽性、鲁棒性、实用性、美学性与经济性。
• 提供一个结构化、按任务划分的物理攻击方法综述，按对抗性媒介组织（贴纸/贴片、服装、图像、光源、相机、TC 材料、妆容、3D 打印工件）。
• 提供对比分析与见解，为未来研究和现实世界部署提供指南。

实验结果

研究问题

• RQ1 在过去十年中，主导的物理对抗性攻击媒介有哪些，它们如何演变？
• RQ2 如何设计统一的评估框架，以跨计算机视觉任务比较不同的物理攻击方法？
• RQ3 影响攻击有效性、隐蔽性、鲁棒性和实用性的关键局限性与现实世界挑战有哪些？

主要发现

• 统一的四步工作流和对抗性媒介概念揭示了物理扰动的携带、制造、捕获与使用方式。
• hiPAA 指标为跨任务比较物理攻击提供了一个结构化的多标准基础。
• 物理对抗性攻击已在多项计算机视觉任务中得到验证，包括人脸识别、行人再识别、交通标志检测，以及光流、深度估计和分割等其他任务。
• 本综述按媒介和时间顺序整合了大量方法，强调了进展、局限性以及现实世界部署的实际考虑因素。