Universal Physical Camouflage Attacks on Object Detectors
Sun Yat-sen University（中山大学）；The Johns Hopkins University（约翰斯·霍普金斯大学）；Max Planck Institute for Informatics（马克斯·普朗克信息学研究所）；University of Maryland, College Park（马里兰大学帕克分校）
Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan Yuille, Changqing Zou, Ning Liu
In this paper, we study physical adversarial attacks on object detectors in the wild. Previous works mostly craft instance-dependent perturbations only for rigid or planar objects. To this end, we propose to learn an adversarial pattern to effectively attack all instances belonging to the same object category, referred to as Universal Physical Camouflage Attack (UPC). Concretely, UPC crafts camouflage by jointly fooling the region proposal network, as well as misleading the classifier and the regressor to output errors. In order to make UPC effective for non-rigid or non-planar objects, we introduce a set of transformations for mimicking deformable properties. We additionally impose optimization constraint to make generated patterns look natural to human observers. To fairly evaluate the effectiveness of different physical-world attacks, we present the first standardized virtual database, AttackScenes, which simulates the real 3D world in a controllable and reproducible environment. Extensive experiments suggest the superiority of our proposed UPC compared with existing physical adversarial attackers not only in virtual environments (AttackScenes), but also in real-world physical environments. Code and dataset are available at https://mesunhlf.github.io/index_physical.html.
Deep neural network based object detection hasbecome the cornerstone of many real-world applications. Alongwith this success comes concerns about its vulnerability tomalicious attacks. To gain more insight into this issue, we proposea contextual camouflage attack (CCA for short) algorithm to in-fluence the performance of object detectors. In this paper, we usean evolutionary search strategy and adversarial machine learningin interactions with a photo-realistic simulated environment tofind camouflage patterns that are effective over a huge varietyof object locations, camera poses, and lighting …
Pusan National University（釜山国立大学）；SmartM2M；Institut Teknologi Bandung（万隆理工学院）；Hung Yen University of Technology and Education（兴安技术教育大学）；Agency for Defense Development (ADD)（国防发展局）
To perform adversarial attacks in the physical world, many studies have proposed adversarial camouflage, a method to hide a target object by applying camouflage patterns on 3D object surfaces. For obtaining optimal physical adversarial camouflage, previous studies have utilized the so-called neural renderer, as it supports differentiability. However, existing neural renderers cannot fully represent various real-world transformations due to a lack of control of scene parameters compared to the legacy photo-realistic renderers. In this paper, we propose the Differentiable Transformation Attack (…
Army Military Transportation University of PLA（中国人民解放军陆军军事交通学院）；Army Engineering University of PLA（中国人民解放军陆军工程大学）；The 28th Research Institute of China Electronics Technology Group Corporation（中国电子科技集团公司第二十八研究所）；Hunan University of Technology（湖南工业大学）
An adversary can fool deep neural network object detectors by generating adversarial noises. Most of the existing works focus on learning local visible noises in an adversarial "patch" fashion. However, the 2D patch attached to a 3D object tends to suffer from an inevitable reduction in attack performance as the viewpoint changes. To remedy this issue, this work proposes the Coated Adversarial Camouflage (CAC) to attack the detectors in arbitrary viewpoints. Unlike the patch trained in the 2D space, our camouflage generated by a conceptually different training framework consists of 3D renderin…
Convolutional neural networks (CNNs) have demonstrated rapid progress and a high level of success in object detection. However, recent evidence has highlighted their vulnerability to adversarial attacks. These attacks are calculated image perturbations or adversarial patches that result in object misclassification or detection suppression. Traditional camouflage methods are impractical when applied to disguise aircraft and other large mobile assets from autonomous detection in intelligence, surveillance and reconnaissance technologies and fifth generation missiles. In this paper we present a u…
TNO（荷兰应用科学研究组织）；Ministry of Defense（国防部）；Radboud University（拉德堡德大学）；University of Antwerp（安特卫普大学）；Leiden University（莱顿大学）
Detection of military assets on the ground can be performed by applying deep learning-based object detectors on drone surveillance footage. The traditional way of hiding military assets from sight is camouflage, for example by using camouflage nets. However, large assets like planes or vessels are difficult to conceal by means of traditional camouflage nets. An alternative type of camouflage is the direct misleading of automatic object detectors. Recently, it has been observed that small adversarial changes applied to images of the object can produce erroneous output by deep learning-based det…
Stealthy in Semantics, Antagonistic in Space: Attacking Visible-Infrared Object Detectors via Object-Level Misalignment
Beijing University of Technology（北京工业大学）；Peking University（北京大学）；National Key Laboratory of Space Integrated Information System, Institute of Software, Chinese Academy of Sciences（中国科学院软件研究所空间集成信息系统全国重点实验室）；Intelligent Science & Technology Academy of CASIC（中国航天科工集团智能科技研究院）
National University of Defense Technology（国防科技大学）；Defense Innovation Institute（国防创新研究院）；Chinese Academy of Military Science（中国人民解放军军事科学院）；Anhui University of Technology（安徽工业大学）
Transferable adversarial attack is always in the spotlight since deep learning models have been demonstrated to be vulnerable to adversarial samples. However, existing physical attack methods do not pay enough attention on transferability to unseen models, thus leading to the poor performance of black-box attack.In this paper, we put forward a novel method of generating physically realizable adversarial camouflage to achieve transferable attack against detection models. More specifically, we first introduce multi-scale attention maps based on detection models to capture features of objects wit…
Defense Innovation Institute, Chinese Academy of Military Science（中国人民解放军军事科学院国防科技创新研究院）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）
Recent studies reveal that deep neural network (DNN) based object detectors are vulnerable to adversarial attacks in the form of adding the perturbation to the images, leading to the wrong output of object detectors. Most current existing works focus on generating perturbed images, also called adversarial examples, to fool object detectors. Though the generated adversarial examples themselves can remain a certain naturalness, most of them can still be easily observed by human eyes, which limits their further application in the real world. To alleviate this problem, we propose a differential ev…
Machine learning is increasingly critical for analysis of the ever-growing corpora of overhead imagery. Advanced computer vision object detection techniques have demonstrated great success in identifying objects of interest such as ships, automobiles, and aircraft from satellite and drone imagery. Yet relying on computer vision opens up significant vulnerabilities, namely, the susceptibility of object detection algorithms to adversarial attacks. In this paper we explore the efficacy and drawbacks of adversarial camouflage in an overhead imagery context. While a number of recent papers have dem…
MVPatch: More Vivid Patch for Adversarial Camouflaged Attacks on Object Detectors in the Physical World
School of Electronic and Information Engineering, Beihang University（北京航空航天大学电子信息工程学院）；Hefei Inovation Research Institute of Beihang University（北京航空航天大学合肥创新研究院）；School of Information Science and Engineering, Shandong University（山东大学信息科学与工程学院）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）
Deep learning models are vulnerable to adversarial examples. As a more threatening type for practical deep learning systems, physical adversarial examples have received extensive research attention in recent years. However, without exploiting the intrinsic characteristics such as model-agnostic and human-specific patterns, existing works generate weak adversarial perturbations in the physical world, which fall short of attacking across different models and show visually suspicious appearance. Motivated by the viewpoint that attention reflects the intrinsic characteristics of the recognition pr…
Swinburne University of Technology（斯威本科技大学）；The University of Melbourne（墨尔本大学）；Shanghai Jiao Tong University（上海交通大学）
Deep neural networks (DNNs) are known to be vulnerable to adversarial examples. Existing works have mostly focused on either digital adversarial examples created via small and imperceptible perturbations, or physical-world adversarial examples created with large and less realistic distortions that are easily identified by human observers. In this paper, we propose a novel approach, called Adversarial Camouflage (\emph{AdvCam}), to craft and camouflage physical-world adversarial examples into natural styles that appear legitimate to human observers. Specifically, \emph{AdvCam} transfers large a…
College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；Defense Innovation Institute, Chinese Academy of Military Science（中国人民解放军军事科学院国防科技创新研究院）
Physical adversarial attacks in object detection have attracted increasing attention. However, most previous works focus on hiding the objects from the detector by generating an individual adversarial patch, which only covers the planar part of the vehicle's surface and fails to attack the detector in physical scenarios for multi-view, long-distance and partially occluded objects. To bridge the gap between digital attacks and physical attacks, we exploit the full 3D vehicle surface to propose a robust Full-coverage Camouflage Attack (FCA) to fool detectors. Specifically, we first try rendering…
Structured Universal Adversarial Attacks on Object Detection for Video Sequences
Federal Institute for Occupational Safety and Health (BAuA)（联邦职业安全与健康研究所）；Technical University of Munich（慕尼黑技术大学）；School of Social Sciences and Technology（社会科学与技术学院）
Deep neural networks (DNNs) for medical images are extremely vulnerable to adversarial examples (AEs), which poses security concerns on clinical decision making. Luckily, medical AEs are also easy to detect in hierarchical feature space per our study herein. To better understand this phenomenon, we thoroughly investigate the intrinsic characteristic of medical AEs in feature space, providing both empirical evidence and theoretical explanations for the question: why are medical adversarial attacks easy to detect? We first perform a stress test to reveal the vulnerability of deep representations…
FZI Research Center for Information Technology（FZI信息技术研究中心）；Karlsruhe Institute of Technology（卡尔斯鲁厄理工学院）
Adversarial patch-based attacks aim to fool a neural network with an intentionally generated noise, which is concentrated in a particular region of an input image. In this work, we perform an in-depth analysis of different patch generation parameters, including initialization, patch size, and especially positioning a patch in an image during training. We focus on the object vanishing attack and run experiments with YOLOv3 as a model under attack in a white-box setting and use images from the COCO dataset. Our experiments have shown, that inserting a patch inside a window of increasing size dur…
3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation
Sun Yat-Sen University（中山大学）；Peng Cheng Laboratory（鹏城实验室）；Nanyang Technological University（南洋理工大学）；National University of Singapore（新加坡国立大学）；National Key Laboratory of Science and Technology on Information System Security（国家信息系统安全科学技术重点实验室）；Nsfocus
Universal Camouflage Attack on Vision-Language Models for Autonomous Driving
School of Cyber Science and Technology, SUN YAT-SEN UNIVERSITY（中山大学计算机科学与技术学院）；School of Computing, National University of Singapore（新加坡国立大学计算机学院）；Key Laboratory of Education Informatization for Nationalities, Yunnan Normal University（云南师范大学民族教育信息化重点实验室）；SCSE, Beihang University（北航软件学院）
We propose a universal and physically realizable adversarial attack on a cascaded multi-modal deep learning network (DNN), in the context of self-driving cars. DNNs have achieved high performance in 3D object detection, but they are known to be vulnerable to adversarial attacks. These attacks have been heavily investigated in the RGB image domain and more recently in the point cloud domain, but rarely in both domains simultaneously - a gap to be filled in this paper. We use a single 3D mesh and differentiable rendering to explore how perturbing the mesh's geometry and texture can reduce the ro…
Physical Adversarial Camouflage through Gradient Calibration and Regularization
School of Cyber Science and Technology, Sun Yat-sen University Shenzhen Campus（中山大学计算机科学与技术学院深圳校区）；Peng Cheng Laboratory（鹏城实验室）；Nanyang Technological University（南洋理工大学）；National Key Laboratory of Science and Technology on Information System Security（信息系统安全国家重点实验室）
Boston University（波士顿大学）；University of Denver（丹佛大学）
Object detection and recognition are fundamental functions underlying the success of species. Because the appearance of an object exhibits a large variability, the brain has to group these different stimuli under the same object identity, a process of generalization. Does the process of generalization follow some general principles or is it an ad-hoc "bag-of-tricks"? The Universal Law of Generalization provided evidence that generalization follows similar properties across a variety of species and tasks. Here we test the hypothesis that the internal representations underlying generalization re…
VFACamou: View-Fused Adversarial Camouflage for Environment-Adaptive Physical Evasion
State Key Laboratory of Intelligent Vehicle Safety Technology（智能汽车安全技术国家重点实验室）；School of Cyber Science and Engineering, Huazhong University of Science and Technology（华中科技大学网络空间安全学院）；School of Computer Science and Technology, Huazhong University of Science and Technology（华中科技大学计算机科学与技术学院）；School of Software Engineering, Huazhong University of Science and Technology（华中科技大学软件学院）；Hebei Energy College of Vocation And Technology（河北能源职业技术学院）
Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；The University of Arizona（亚利桑那大学）；Beijing Jiaotong University（北京交通大学）；East Carolina University（东卡罗来纳大学）
Adversarial attacks against deep learning-based object detectors (ODs) have been studied extensively in the past few years. These attacks cause the model to make incorrect predictions by placing a patch containing an adversarial pattern on the target object or anywhere within the frame. However, none of prior research proposed a misclassification attack on ODs, in which the patch is applied on the target object. In this study, we propose a novel, universal, targeted, label-switch attack against the state-of-the-art object detector, YOLO. In our attack, we use (i) a tailored projection function…
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；PCL Research Center of Networks and Communications, Peng Cheng Laboratory（鹏城实验室网络通信PCL研究中心）
Recently, deep neural networks (DNNs) have been widely and successfully used in Object Detection, e.g. Faster RCNN, YOLO, CenterNet. However, recent studies have shown that DNNs are vulnerable to adversarial attacks. Adversarial attacks against object detection can be divided into two categories, whole-pixel attacks and patch attacks. While these attacks add perturbations to a large number of pixels in images, we proposed a diffused patch attack (\textbf{DPAttack}) to successfully fool object detectors by diffused patches of asteroid-shaped or grid-shape, which only change a small number of pi…
Flexible Physical Camouflage Generation Based on a Differential Approach
School of Automation, Northwestern Polytechnical University（西北工业大学自动化学院）；Laboratory of Science and Technology on Complex System Control and Intelligent Agent Cooperation（复杂系统控制与智能agent合作科学技术实验室）
Purdue University（普渡大学）；Rochester Institute of Technology（罗切斯特理工学院）
Deep learning has substantially boosted the performance of Monocular Depth Estimation (MDE), a critical component in fully vision-based autonomous driving (AD) systems (e.g., Tesla and Toyota). In this work, we develop an attack against learning-based MDE. In particular, we use an optimization-based method to systematically generate stealthy physical-object-oriented adversarial patches to attack depth estimation. We balance the stealth and effectiveness of our attack with object-oriented adversarial design, sensitive region localization, and natural style camouflage. Using real-world driving s…
R-PGA: Robust Physical Adversarial Camouflage Generation via Relightable 3D Gaussian Splatting
School of Cyber Science and Technology, Shenzhen Campus, Sun Yat-sen University（中山大学深圳校区网络空间安全学院）；School of Computing, National University of Singapore（新加坡国立大学计算机学院）；School of Intelligent Systems Engineering, Shenzhen Campus, Sun Yat-sen University（中山大学深圳校区智能工程学院）
Arizona State University（亚利桑那州立大学）；Lebanese American University（黎巴嫩美国大学）
Researchers have shown that the predictions of a convolutional neural network (CNN) for an image set can be severely distorted by one single image-agnostic perturbation, or universal perturbation, usually with an empirically fixed threshold in the spatial domain to restrict its perceivability. However, by considering the human perception, we propose to adopt JND thresholds to guide the perceivability of universal adversarial perturbations. Based on this, we propose a frequency-tuned universal attack method to compute universal perturbations and show that our method can realize a good balance b…
Arizona State University（亚利桑那州立大学）；Lebanese American University（黎巴嫩美国大学）
Although deep neural networks (DNNs) have been shown to be susceptible to image-agnostic adversarial attacks on natural image classification problems, the effects of such attacks on DNN-based texture recognition have yet to be explored. As part of our work, we find that limiting the perturbation's $l_p$ norm in the spatial domain may not be a suitable way to restrict the perceptibility of universal adversarial perturbations for texture images. Based on the fact that human perception is affected by local visual frequency characteristics, we propose a frequency-tuned universal attack method to c…
Deep learning-based person re-identification (Re-ID) has made great progress and achieved high performance recently. In this paper, we make the first attempt to examine the vulnerability of current person Re-ID models against a dangerous attack method, \ie, the universal adversarial perturbation (UAP) attack, which has been shown to fool classification models with a little overhead. We propose a \emph{more universal} adversarial perturbation (MUAP) method for both image-agnostic and model-insensitive person Re-ID attack. Firstly, we adopt a list-wise attack objective function to disrupt the si…
HRL Laboratories, LLC.（HRL实验室有限责任公司）；University of Maryland, Baltimore County（马里兰大学巴尔的摩县分校）
The unprecedented success of deep neural networks in many applications has made these networks a prime target for adversarial exploitation. In this paper, we introduce a benchmark technique for detecting backdoor attacks (aka Trojan attacks) on deep convolutional neural networks (CNNs). We introduce the concept of Universal Litmus Patterns (ULPs), which enable one to reveal backdoor attacks by feeding these universal patterns to the network and analyzing the output (i.e., classifying the network as `clean' or `corrupted'). This detection is fast because it requires only a few forward passes th…
Ji Hua Laboratory（季华实验室）；Shanghai Engineering Research Center of AI and Robotics（上海人工智能与机器人工程研究中心）；Engineering Research Center of AI and Robotics, Ministry of Education, China（中国教育部人工智能与机器人工程研究中心）
Recently, adversarial attacks have been applied in visual object tracking to deceive deep trackers by injecting imperceptible perturbations into video frames. However, previous work only generates the video-specific perturbations, which restricts its application scenarios. In addition, existing attacks are difficult to implement in reality due to the real-time of tracking and the re-initialization mechanism. To address these issues, we propose an offline universal adversarial attack called Efficient Universal Shuffle Attack. It takes only one perturbation to cause the tracker malfunction on al…
University of Electronic Science and Technology of China（电子科技大学）
A single perturbation can pose the most natural images to be misclassified by classifiers. In black-box setting, current universal adversarial attack methods utilize substitute models to generate the perturbation, then apply the perturbation to the attacked model. However, this transfer often produces inferior results. In this study, we directly work in the black-box setting to generate the universal adversarial perturbation. Besides, we aim to design an adversary generating a single perturbation having texture like stripes based on orthogonal matrix, as the top convolutional layers are sensit…
The University of Adelaide（阿德莱德大学）；University of South Australia（南澳大利亚大学）；York University（约克大学）
Data collected by Earth-observing (EO) satellites are often afflicted by cloud cover. Detecting the presence of clouds -- which is increasingly done using deep learning -- is crucial preprocessing in EO applications. In fact, advanced EO satellites perform deep learning-based cloud detection on board the satellites and downlink only clear-sky data to save precious bandwidth. In this paper, we highlight the vulnerability of deep learning-based cloud detection towards adversarial attacks. By optimising an adversarial pattern and superimposing it into a cloudless scene, we bias the neural network…
Arizona State University（亚利桑那州立大学）；Princeton University（普林斯顿大学）；Algolux；Lebanese American University（黎巴嫩美国大学）
Deep neural network (DNN) predictions have been shown to be vulnerable to carefully crafted adversarial perturbations. Specifically, image-agnostic (universal adversarial) perturbations added to any image can fool a target network into making erroneous predictions. Departing from existing defense strategies that work mostly in the image domain, we present a novel defense which operates in the DNN feature domain and effectively defends against such universal perturbations. Our approach identifies pre-trained convolutional features that are most vulnerable to adversarial noise and deploys traina…
National Laboratory of Pattern Recognition, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所模式识别国家重点实验室）；School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）；University of Science and Technology of China（中国科学技术大学）；Zhengzhou University（郑州大学）；CAS Center for Excellence in Brain Science and Intelligence Technology, National Laboratory of Pattern Recognition, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所模式识别国家重点实验室、中国科学院脑科学与智能技术卓越创新中心）
Siamese trackers are shown to be vulnerable to adversarial attacks recently. However, the existing attack methods craft the perturbations for each video independently, which comes at a non-negligible computational cost. In this paper, we show the existence of universal perturbations that can enable the targeted attack, e.g., forcing a tracker to follow the ground-truth trajectory with specified offsets, to be video-agnostic and free from inference in a network. Specifically, we attack a tracker by adding a universal imperceptible perturbation to the template image and adding a fake target, i.e…
The Hong Kong Polytechnic University（香港理工大学）；Nanjing University of Posts and Telecommunications（南京邮电大学）
Utilizing 3D point cloud data has become an urgent need for the deployment of artificial intelligence in many areas like facial recognition and self-driving. However, deep learning for 3D point clouds is still vulnerable to adversarial attacks, e.g., iterative attacks, point transformation attacks, and generative attacks. These attacks need to restrict perturbations of adversarial examples within a strict bound, leading to the unrealistic adversarial 3D point clouds. In this paper, we propose an Adversarial Graph-Convolutional Generative Adversarial Network (AdvGCGAN) to generate visually real…
Arizona State University（亚利桑那州立大学）；Lebanese American University（黎巴嫩美国大学）
Given the outstanding progress that convolutional neural networks (CNNs) have made on natural image classification and object recognition problems, it is shown that deep learning methods can achieve very good recognition performance on many texture datasets. However, while CNNs for natural image classification/object recognition tasks have been revealed to be highly vulnerable to various types of adversarial attack methods, the robustness of deep learning methods for texture recognition is yet to be examined. In our paper, we show that there exist small image-agnostic/univesal perturbations th…
ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectors
Guangdong University of Technology（广东工业大学）；Guizhou Provincial Laboratory of Big Data, State Key Laboratory of Public Big Data, Guizhou University（贵州大学大数据省级重点实验室、公共大数据国家重点实验室）
Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems
China University of Petroleum-Beijing at Karamay（中国石油大学（北京）克拉玛依校区）；University of Electronic Science and Technology of China（电子科技大学）；College of Intelligence and Computing, Tianjin University（天津大学智能与计算学部）；School of Software, Shandong University（山东大学软件学院）；Shanghai Jiaotong University（上海交通大学）
