标准探测器（目前）不会被物理对抗性停止标志愚弄
Standard detectors aren't (currently) fooled by physical adversarial stop signs
摘要：
对抗性示例是指在测试时被调整为在系统中显示错误标签的示例。如果存在可以欺骗检测器的对抗性例子，它们可以被用来（例如）在充满智能车辆的道路上造成严重破坏。最近，我们描述了我们在创建欺骗检测器的物理对抗性停止标志时遇到的困难。最近，Evtimov等人制作了一个物理对抗停止标志，欺骗了检测器的代理模型。在本文中，我们证明了这些物理对抗停止符号在标准配置中不会欺骗两个标准检测器（YOLO和Faster RCNN）。Evtimov等人的构造依赖于将图像裁剪到停止标志;然后调整此裁剪的大小并将其呈现给分类器。我们认为，裁剪和重绘程序在很大程度上消除了重新缩放和视角的影响。对抗攻击在重新缩放和改变视角方向的情况下是否鲁棒仍然没有定论。我们认为攻击分类器与攻击检测器是非常不同的，并且检测器的结构-必须搜索自己的限界框，并且不能非常准确地估计该框-可能使对抗模式变得困难。最后，一个物理对象上的对抗性模式，如果能够欺骗探测器，那么它在面对一系列参数失真（尺度、视角、探测器内部的框移位、照明等）时，必须是对抗性的。这种模式将具有重大的理论和实践意义。目前没有证据表明存在这种模式。
英文摘要：
An adversarial example is an example that has been adjusted to produce the wrong label when presented to a system at test time. If adversarial examples existed that could fool a detector, they could be used to (for example) wreak havoc on roads populated with smart vehicles. Recently, we described our difficulties creating physical adversarial stop signs that fool a detector. More recently, Evtimov et al. produced a physical adversarial stop sign that fools a proxy model of a detector. In this paper, we show that these physical adversarial stop signs do not fool two standard detectors (YOLO and Faster RCNN) in standard configuration. Evtimov et al.'s construction relies on a crop of the image to the stop sign; this crop is then resized and presented to a classifier. We argue that the cropping and resizing procedure largely eliminates the effects of rescaling and of view angle. Whether an adversarial attack is robust under rescaling and change of view direction remains moot. We argue that attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - likely makes it difficult to make adversarial patterns. Finally, an adversarial pattern on a physical object that could fool a detector would have to be adversarial in the face of a wide family of parametric distortions (scale; view angle; box shift inside the detector; illumination; and so on). Such a pattern would be of great theoretical and practical interest. There is currently no evidence that such patterns exist.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
