[论文解读] Physical Adversarial Examples for Object Detectors

Kevin Eykholt, Ivan Evtimov+7 more|arXiv (Cornell University)|Jul 20, 2018

Adversarial Robustness in Machine Learning参考文献 19被引用 104

一句话总结

论文展示通过海报或贴纸对停止标志进行物理扰动，以欺骗室内外设置中的目标检测器（YOLOv2 和 Faster R-CNN），并显示高的消失攻击成功率与部分可转移性。

ABSTRACT

Deep neural networks (DNNs) are vulnerable to adversarial examples-maliciously crafted inputs that cause DNNs to make incorrect predictions. Recent work has shown that these attacks generalize to the physical domain, to create perturbations on physical objects that fool image classifiers under a variety of real-world conditions. Such attacks pose a risk to deep learning models used in safety-critical cyber-physical systems. In this work, we extend physical attacks to more challenging object detection models, a broader class of deep learning algorithms widely used to detect and label multiple objects within a scene. Improving upon a previous physical attack on image classifiers, we create perturbed physical objects that are either ignored or mislabeled by object detection models. We implement a Disappearance Attack, in which we cause a Stop sign to "disappear" according to the detector-either by covering thesign with an adversarial Stop sign poster, or by adding adversarial stickers onto the sign. In a video recorded in a controlled lab environment, the state-of-the-art YOLOv2 detector failed to recognize these adversarial Stop signs in over 85% of the video frames. In an outdoor experiment, YOLO was fooled by the poster and sticker attacks in 72.5% and 63.5% of the video frames respectively. We also use Faster R-CNN, a different object detection model, to demonstrate the transferability of our adversarial perturbations. The created poster perturbation is able to fool Faster R-CNN in 85.9% of the video frames in a controlled lab environment, and 40.2% of the video frames in an outdoor environment. Finally, we present preliminary results with a new Creation Attack, where in innocuous physical stickers fool a model into detecting nonexistent objects.

研究动机与目标

• 研究物理扰动是否能让目标检测器在现实世界中也被误导，超越图像分类器的能力。
• 将 RP2 扩展为对检测器的鲁棒、位置与姿态变异的攻击。
• 开发针对检测输出的消失攻击与创建攻击。
• 评估在不同环境中跨检测器的攻击可转移性。

提出的方法

• 将 RP2 算法扩展到对象检测器，并加入针对检测器的新损失项。
• 建模合成旋转与位置以模拟物理场景的变化。
• 用总变差范数替代 L2/NPS 平滑以获得更平滑的扰动。
• 定义消失攻击损失，以在所有网格/框中尽量降低停车标志的检测概率。
• 定义创建攻击损失，以通过对抗性贴纸创建对不存在对象的检测。
• 在 YOLO v2（白盒）上评估攻击并探索对 Faster R-CNN（黑盒）的可转移性。

实验结果

研究问题

• RQ1 物理扰动是否能在真实条件下欺骗最先进的目标检测器？
• RQ2 海报和贴纸扰动是否会导致检测器忽略或错误标注位置信息（消失/创建）？
• RQ3 物理攻击扰动是否可在检测器架构之间转移（从 YOLOv2 到 Faster R-CNN）？
• RQ4 此类攻击对室内与室外环境的鲁棒性如何？

主要发现

• 室内帧中消失攻击使 YOLOv2 误检率达到 85.6%（在室内 202/236 帧）；在室外为 72.5%（在室外 156/215 帧），贴纸为 85.0%（室内 210/247 帧）与 63.5%（室外 146/230 帧）。
• Faster R-CNN 被海报攻击在室内 85.9% 的帧数与室外 40.2% 的帧数欺骗；贴纸攻击在室内 58.9% 与室外 18.9%。
• 创建攻击在 YOLOv2 上显示初步成功（对抗性贴纸被检测为停车标志），并展现了转移潜力。
• 在受控的室内环境中攻击更为可靠；室外条件降低了效果，但仍能造成显著干扰。
• 扩展以包含位置和旋转不变性可提升对视角变化的鲁棒性。