[论文解读] X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection

Aishan Liu, Jun Guo+7 more|arXiv (Cornell University)|Feb 19, 2023

Adversarial Robustness in Machine Learning被引用 17

一句话总结

X-Adv 生成物理上可实现的3D对抗性金属物体以欺骗X-ray禁运物品检测器，使用可微分的X-ray转换器和基于策略的位置搜索来应对颜色褪色和遮挡。它展示了数字和物理世界的攻击并提供XAD数据集。

ABSTRACT

Adversarial attacks are valuable for evaluating the robustness of deep learning models. Existing attacks are primarily conducted on the visible light spectrum (e.g., pixel-wise texture perturbation). However, attacks targeting texture-free X-ray images remain underexplored, despite the widespread application of X-ray imaging in safety-critical scenarios such as the X-ray detection of prohibited items. In this paper, we take the first step toward the study of adversarial attacks targeted at X-ray prohibited item detection, and reveal the serious threats posed by such attacks in this safety-critical scenario. Specifically, we posit that successful physical adversarial attacks in this scenario should be specially designed to circumvent the challenges posed by color/texture fading and complex overlapping. To this end, we propose X-adv to generate physically printable metals that act as an adversarial agent capable of deceiving X-ray detectors when placed in luggage. To resolve the issues associated with color/texture fading, we develop a differentiable converter that facilitates the generation of 3D-printable objects with adversarial shapes, using the gradients of a surrogate model rather than directly generating adversarial textures. To place the printed 3D adversarial objects in luggage with complex overlapped instances, we design a policy-based reinforcement learning strategy to find locations eliciting strong attack performance in worst-case scenarios whereby the prohibited items are heavily occluded by other items. To verify the effectiveness of the proposed X-Adv, we conduct extensive experiments in both the digital and the physical world (employing a commercial X-ray security inspection system for the latter case). Furthermore, we present the physical-world X-ray adversarial attack dataset XAD.

研究动机与目标

• 在安全关键环境中推动对X光禁运物检测器鲁棒性评估。
• 提出一个物理世界对抗性攻击框架(X-Adv)，因X光颜色衰减而使用对抗性形状而非纹理。
• 开发一个可微分的X光转换器，将3D对抗形状投影到X光图像中，以进行基于梯度的优化。
• 通过基于策略的强化学习方法搜索最优攻击位置来应对最坏情况的遮挡。
• 在数字和物理实验中验证有效性，并提供XAD数据集。

提出的方法

• 生成具有对抗性形状(P)的可物理打印的3D金属对象，以欺骗X-ray检测器。
• 使用可微分转换器R_delta来模拟X射线投影，并使形状对代理检测器的梯度优化成为可能。
• 在感知/正则化项下，优化对象形状P和放置位置C以最大化错误分类，同时保持物理可行性。
• 将攻击位置搜索建模为具有REINFORCE的策略，以在遮挡下找到鲁棒放置，平衡攻击强度和位置多样性（G reward）。
• 将攻击损失L_adv与感知损失L_per（包括总变差项）结合，用于形状和放置的联合优化。

实验结果

研究问题

• RQ1 物理世界中的X光禁运物检测器是否可以被通过精心设计的形状而非纹理的对抗对象所愚弄？
• RQ2 如何在最坏遮挡和不同行李配置下高效生成并放置此类对抗对象以保持有效？
• RQ3 X光投影物理对对抗对象在不同模型和数据集之间的可迁移性有何影响？
• RQ4 在X光场景中，形状和位置的联合优化是否比天真或基于纹理的攻击更有效？

主要发现

• X-Adv显著降低检测器性能；在OPIXray上，攻击使mAP从74.02%（清洁）降至23.05%（摘要中给出的一个例子）。
• 在评估的模型中，攻击导致mAP显著下降，平均在OPIXray约50%，在HiXray约30%。
• 该方法在数字和物理实验中均有效，包括针对商业X光系统的真实世界攻击，使用3D打印的对抗性金属。
• 引入一个新的物理世界X光对抗攻击数据集XAD，包含5,587张图像（840张对抗图像）。
• 基于纹理的补丁在这些X光检测器上无效，突出显示了X光安检的独特脆弱性。