[论文解读] Standard detectors aren't (currently) fooled by physical adversarial stop signs

Jiajun Lu, Hussein Sibai+2 more|arXiv (Cornell University)|Oct 9, 2017

Adversarial Robustness in Machine Learning参考文献 20被引用 50

一句话总结

本论文在标准检测器（YOLO 和 Faster R-CNN）上测试了物理对抗性停车标志，并发现它们在标准配置下并未被欺骗，论证先前针对分类器的攻击并不能直接转化到检测器。

ABSTRACT

An adversarial example is an example that has been adjusted to produce the wrong label when presented to a system at test time. If adversarial examples existed that could fool a detector, they could be used to (for example) wreak havoc on roads populated with smart vehicles. Recently, we described our difficulties creating physical adversarial stop signs that fool a detector. More recently, Evtimov et al. produced a physical adversarial stop sign that fools a proxy model of a detector. In this paper, we show that these physical adversarial stop signs do not fool two standard detectors (YOLO and Faster RCNN) in standard configuration. Evtimov et al.'s construction relies on a crop of the image to the stop sign; this crop is then resized and presented to a classifier. We argue that the cropping and resizing procedure largely eliminates the effects of rescaling and of view angle. Whether an adversarial attack is robust under rescaling and change of view direction remains moot. We argue that attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - likely makes it difficult to make adversarial patterns. Finally, an adversarial pattern on a physical object that could fool a detector would have to be adversarial in the face of a wide family of parametric distortions (scale; view angle; box shift inside the detector; illumination; and so on). Such a pattern would be of great theoretical and practical interest. There is currently no evidence that such patterns exist.

研究动机与目标

• 评估在接近现实世界的条件下，物理对抗性停车标志是否会欺骗标准检测器。
• 解释为何先前针对分类器的攻击可能无法转化为对检测器的攻击。
• 讨论检测器的框预测与定位如何影响对抗鲁棒性。
• 阐明在道路标志场景中攻击分类器与攻击检测器的区别。

提出的方法

• 将两个预训练检测器（YOLO 和 Faster R-CNN）应用于 Evtimov 等人的物理停车标志攻击。
• 复现实验论文中的图示，并在海报型和贴纸型对抗性停车标志上测试检测器。
• 分析检测性能对图像分辨率、裁剪和框定位的影响。
• 讨论检测器架构（基于网格的 vs 基于候选框的）如何影响对对抗性图样的鲁棒性。

实验结果

研究问题

• RQ1 在静止和行驶条件下，标准检测器（YOLO 和 Faster RCNN）是否会错误分类或无法检测物理对抗性停车标志？
• RQ2 在考虑检测器的边界框定位和多框采样时，分类器聚焦攻击中观察到的对抗效应是否仍然成立？
• RQ3 检测器管线中的裁剪、缩放和边界框定位如何影响对抗样式的鲁棒性？
• RQ4 是什么解释了分类器聚焦的对抗工作与检测器性能之间的差异？

主要发现

• YOLO 在标准和更高分辨率的视频中，对对抗性停车标志（海报型和贴纸型）的检测，与对真停车标志的检测水平大致相当。
• Faster RCNN 对对抗性停车标志（海报型和贴纸型）的检测，与对真停车标志的检测水平大致相当，且通常比 YOLO 更准确。
• 在小型或较远的标志上，检测器往往比 YOLO 表现更好；更高分辨率的视频提升两者的检测性能。
• 在某些分类器攻击中对边界框进行裁剪会移除缩放与倾斜效应，使这些结果不能代表现代检测器。
• 现代检测器对边界框定位的不完美性可能干扰对抗性图样，降低其对检测器的有效性。
• 目前尚无证据表明物理对抗性图样能够在跨越广泛的参数失真族（尺度、视角、边框位移、照明）下欺骗检测器。