Adversarial Patch Camouflage against Aerial Detection
TNO（荷兰应用科学研究组织）；Ministry of Defense（国防部）；Radboud University（拉德堡德大学）；University of Antwerp（安特卫普大学）；Leiden University（莱顿大学）
Ajaya Adhikari, Richard den Hollander, Ioannis Tolios, Michael van Bekkum, Anneloes Bal, Stijn Hendriks, Maarten Kruithof, Dennis Gross, Nils Jansen, Guillermo … 展开作者
Ajaya Adhikari, Richard den Hollander, Ioannis Tolios, Michael van Bekkum, Anneloes Bal, Stijn Hendriks, Maarten Kruithof, Dennis Gross, Nils Jansen, Guillermo Pérez, Kit Buurman, Stephan Raaijmakers
Detection of military assets on the ground can be performed by applying deep learning-based object detectors on drone surveillance footage. The traditional way of hiding military assets from sight is camouflage, for example by using camouflage nets. However, large assets like planes or vessels are difficult to conceal by means of traditional camouflage nets. An alternative type of camouflage is the direct misleading of automatic object detectors. Recently, it has been observed that small adversarial changes applied to images of the object can produce erroneous output by deep learning-based detectors. In particular, adversarial attacks have been successfully demonstrated to prohibit person detections in images, requiring a patch with a specific pattern held up in front of the person, thereby essentially camouflaging the person for the detector. Research into this type of patch attacks is still limited and several questions related to the optimal patch configuration remain open.
This work makes two contributions. First, we apply patch-based adversarial attacks for the use case of unmanned aerial surveillance, where the patch is laid on top of large military assets, camouflaging them from automatic detectors running over the imagery. The patch can prevent automatic detection of the whole object while only covering a small part of it. Second, we perform several experiments with different patch configurations, varying their size, position, number and saliency. Our results show that adversarial patch attacks form a realistic alternative to traditional camouflage activities, and should therefore be considered in the automated analysis of aerial surveillance imagery.
Convolutional neural networks (CNNs) have demonstrated rapid progress and a high level of success in object detection. However, recent evidence has highlighted their vulnerability to adversarial attacks. These attacks are calculated image perturbations or adversarial patches that result in object misclassification or detection suppression. Traditional camouflage methods are impractical when applied to disguise aircraft and other large mobile assets from autonomous detection in intelligence, surveillance and reconnaissance technologies and fifth generation missiles. In this paper we present a u…
Machine learning is increasingly critical for analysis of the ever-growing corpora of overhead imagery. Advanced computer vision object detection techniques have demonstrated great success in identifying objects of interest such as ships, automobiles, and aircraft from satellite and drone imagery. Yet relying on computer vision opens up significant vulnerabilities, namely, the susceptibility of object detection algorithms to adversarial attacks. In this paper we explore the efficacy and drawbacks of adversarial camouflage in an overhead imagery context. While a number of recent papers have dem…
Army Military Transportation University of PLA（中国人民解放军陆军军事交通学院）；Army Engineering University of PLA（中国人民解放军陆军工程大学）；The 28th Research Institute of China Electronics Technology Group Corporation（中国电子科技集团公司第二十八研究所）；Hunan University of Technology（湖南工业大学）
An adversary can fool deep neural network object detectors by generating adversarial noises. Most of the existing works focus on learning local visible noises in an adversarial "patch" fashion. However, the 2D patch attached to a 3D object tends to suffer from an inevitable reduction in attack performance as the viewpoint changes. To remedy this issue, this work proposes the Coated Adversarial Camouflage (CAC) to attack the detectors in arbitrary viewpoints. Unlike the patch trained in the 2D space, our camouflage generated by a conceptually different training framework consists of 3D renderin…
College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；Defense Innovation Institute, Chinese Academy of Military Science（中国人民解放军军事科学院国防科技创新研究院）
Physical adversarial attacks in object detection have attracted increasing attention. However, most previous works focus on hiding the objects from the detector by generating an individual adversarial patch, which only covers the planar part of the vehicle's surface and fails to attack the detector in physical scenarios for multi-view, long-distance and partially occluded objects. To bridge the gap between digital attacks and physical attacks, we exploit the full 3D vehicle surface to propose a robust Full-coverage Camouflage Attack (FCA) to fool detectors. Specifically, we first try rendering…
MVPatch: More Vivid Patch for Adversarial Camouflaged Attacks on Object Detectors in the Physical World
School of Electronic and Information Engineering, Beihang University（北京航空航天大学电子信息工程学院）；Hefei Inovation Research Institute of Beihang University（北京航空航天大学合肥创新研究院）；School of Information Science and Engineering, Shandong University（山东大学信息科学与工程学院）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）
The trade-off between feature representation power and spatial localization accuracy is crucial for the dense classification/semantic segmentation of aerial images. High-level features extracted from the late layers of a neural network are rich in semantic information, yet have blurred spatial details; low-level features extracted from the early layers of a network contain more pixel-level information, but are isolated and noisy. It is therefore difficult to bridge the gap between high and low-level features due to their difference in terms of physical information content and spatial distribut…
Northwestern Polytechnical University（西北工业大学）；Zhengzhou Institute of Surveying and Mapping（郑州测绘学院）
Current mainstream object detection methods for large aerial images usually divide large images into patches and then exhaustively detect the objects of interest on all patches, no matter whether there exist objects or not. This paradigm, although effective, is inefficient because the detectors have to go through all patches, severely hindering the inference speed. This paper presents an Objectness Activation Network (OAN) to help detectors focus on fewer patches but achieve more efficient inference and more accurate results, enabling a simple and effective solution to object detection in larg…
CP2M: Clustered-Patch-Mixed Mosaic Augmentation for Aerial Image Segmentation
Northwestern University（西北大学）；Carnegie Mellon University（卡内基梅隆大学）；The University of Hong Kong（香港大学）；Duke University（杜克大学）；University College Dublin（都柏林大学学院）；Beijing University of Technology（北京工业大学）；The ADAPT SFI Research Centre（ADAPT SFI研究中心）
Stealthy in Semantics, Antagonistic in Space: Attacking Visible-Infrared Object Detectors via Object-Level Misalignment
Beijing University of Technology（北京工业大学）；Peking University（北京大学）；National Key Laboratory of Space Integrated Information System, Institute of Software, Chinese Academy of Sciences（中国科学院软件研究所空间集成信息系统全国重点实验室）；Intelligent Science & Technology Academy of CASIC（中国航天科工集团智能科技研究院）
The University of Adelaide（阿德莱德大学）；University of South Australia（南澳大学）
Deep neural networks (DNNs) have become essential for processing the vast amounts of aerial imagery collected using earth-observing satellite platforms. However, DNNs are vulnerable towards adversarial examples, and it is expected that this weakness also plagues DNNs for aerial imagery. In this work, we demonstrate one of the first efforts on physical adversarial attacks on aerial imagery, whereby adversarial patches were optimised, fabricated and installed on or near target objects (cars) to significantly reduce the efficacy of an object detector applied on overhead images. Physical adversari…
Object detection is a basic and important task in the field of aerial image processing and has gained much attention in computer vision. However, previous aerial image object detection approaches have insufficient use of scene semantic information between different regions of large-scale aerial images. In addition, complex background and scale changes make it difficult to improve detection accuracy. To address these issues, we propose a relationship representation network for object detection in aerial images (RelationRS): 1) Firstly, multi-scale features are fused and enhanced by a dual relat…
RAND Corporation（兰德公司）；Center for Security and Emerging Technology, Georgetown University（乔治城大学安全与新兴技术中心）
Adversarial patches are images designed to fool otherwise well-performing neural network-based computer vision models. Although these attacks were initially conceived of and studied digitally, in that the raw pixel values of the image were perturbed, recent work has demonstrated that these attacks can successfully transfer to the physical world. This can be accomplished by printing out the patch and adding it into scenes of newly captured images or video footage. In this work we further test the efficacy of adversarial patch attacks in the physical world under more challenging conditions. We c…
Objects in aerial images have greater variations in scale and orientation than in typical images, so detection is more difficult. Convolutional neural networks use a variety of frequency- and orientation-specific kernels to identify objects subject to different transformations; these require many parameters. Sampling equivariant networks can adjust sampling from input feature maps according to the transformation of the object, allowing a kernel to extract features of an object under different transformations. Doing so requires fewer parameters, and makes the network more suitable for represent…
Understanding the 3D geometric structure of the Earth's surface has been an active research topic in photogrammetry and remote sensing community for decades, serving as an essential building block for various applications such as 3D digital city modeling, change detection, and city management. Previous researches have extensively studied the problem of height estimation from aerial images based on stereo or multi-view image matching. These methods require two or more images from different perspectives to reconstruct 3D coordinates with camera information provided. In this paper, we deal with t…
KIOS Research and Innovation Center of Excellence（KIOS卓越研究与创新中心）；University of Cyprus（塞浦路斯大学）
Many applications utilizing Unmanned Aerial Vehicles (UAVs) require the use of computer vision algorithms to analyze the information captured from their on-board camera. Recent advances in deep learning have made it possible to use single-shot Convolutional Neural Network (CNN) detection algorithms that process the input image to detect various objects of interest. To keep the computational demands low these neural networks typically operate on small image sizes which, however, makes it difficult to detect small objects. This is further emphasized when considering UAVs equipped with cameras wh…
Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；The University of Arizona（亚利桑那大学）；Beijing Jiaotong University（北京交通大学）；East Carolina University（东卡罗来纳大学）
DNNs are vulnerable to adversarial examples, which poses great security concerns for security-critical systems. In this paper, a novel adaptive-patch-based physical attack (AP-PA) framework is proposed, which aims to generate adversarial patches that are adaptive in both physical dynamics and varying scales, and by which the particular targets can be hidden from being detected. Furthermore, the adversarial patch is also gifted with attack effectiveness against all targets of the same class with a patch outside the target (No need to smear targeted objects) and robust enough in the physical wor…
Pre-processing training data improves accuracy and generalisability of convolutional neural network based landscape semantic segmentation
Remote Sensing Research Centre, The University of Queensland（昆士兰大学遥感研究中心）；Applied Agricultural Remote Sensing Centre, The University of New England（新英格兰大学应用农业遥感中心）
Bangalore Institute of Technology（班加罗尔理工学院）；Indian Institute of Science（印度科学学院）
This work presents a method for semantic segmentation of mango trees in high resolution aerial imagery, and, a novel method for individual crown detection of mango trees using segmentation output. Mango Tree Net, a fully convolutional neural network (FCN), is trained using supervised learning to perform semantic segmentation of mango trees in imagery acquired using an unmanned aerial vehicle (UAV). The proposed network is retrained to separate touching/overlapping tree crowns in segmentation output. Contour based connected object detection is performed on the segmentation output from retrained…
Concordia Institute for Information Systems Engineering（康考迪亚信息系统工程研究所）；Concordia University（康考迪亚大学）；Université TELUQ（TELUQ大学）
Site preparation by mounding is a commonly used silvicultural treatment that improves tree growth conditions by mechanically creating planting microsites called mounds. Following site preparation, the next critical step is to count the number of mounds, which provides forest managers with a precise estimate of the number of seedlings required for a given plantation block. Counting the number of mounds is generally conducted through manual field surveys by forestry workers, which is costly and prone to errors, especially for large areas. To address this issue, we present a novel framework explo…
RemoteDet-Mamba: A Hybrid Mamba-CNN Network for Multi-modal Object Detection in Remote Sensing Images
School of Computer Science, Beijing University of Posts and Telecommunications, Beijing, China（计算机科学学院，北京邮电大学）；School of Electronic Engineering, Beijing University of Posts and Telecommunications, Beijing, China（电子工程学院，北京邮电大学）
University of Alberta（阿尔伯塔大学）；Inception Institute of Artificial Intelligence (IIAI)（人工智能 inception 研究所）；Init ML；Polytechnic University of Catalonia, BarcelonaTech（加泰罗尼亚理工大学）
Although deep models have greatly improved the accuracy and robustness of image segmentation, obtaining segmentation results with highly accurate boundaries and fine structures is still a challenging problem. In this paper, we propose a simple yet powerful Boundary-Aware Segmentation Network (BASNet), which comprises a predict-refine architecture and a hybrid loss, for highly accurate image segmentation. The predict-refine architecture consists of a densely supervised encoder-decoder network and a residual refinement module, which are respectively used to predict and refine a segmentation prob…
3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation
Sun Yat-Sen University（中山大学）；Peng Cheng Laboratory（鹏城实验室）；Nanyang Technological University（南洋理工大学）；National University of Singapore（新加坡国立大学）；National Key Laboratory of Science and Technology on Information System Security（国家信息系统安全科学技术重点实验室）；Nsfocus
UAV-CB: A Complex-Background RGB-T Dataset and Local Frequency Bridge Network for UAV Detection
Pengcheng Laboratory（鹏城实验室）；South China University of Technology（南方科技大学）；Peking University（北京大学）；Xinjiang University（新疆大学）；Harbin Institute of Technology（哈尔滨工业大学）
Adaptive Data Transport Mechanism for UAV Surveillance Missions in Lossy Environments
School of Computing, Clemson University（克莱姆森大学计算机学院）；California State University, Los Angeles（加州州立大学洛杉矶分校）；Lincoln Laboratory, Massachusetts Institute of Technology（麻省理工学院林肯实验室）
Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRF
Artificial Intelligence Thrust, The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州）人工智能学科）；Department of Computer Science and Engineering, The Hong Kong University of Science and Technology（香港科技大学计算机科学与工程学系）
本文提出 Adv3D，首次将对抗样本建模为 NeRF，并通过基元感知采样与语义引导正则化生成可物理实现的 3D 伪装纹理补丁，攻击驾驶场景中的 3D 检测器。
The Technical University of Kenya（肯尼亚技术大学）；IRISA（法国国家信息与自动化研究所雷恩分院（IRISA））；Université Bretagne Sud（南布列塔尼大学）
Deep-learning-based image classification and object detection has been applied successfully to tree monitoring. However, studies of tree crowns and fallen trees, especially on flood inundated areas, remain largely unexplored. Detection of degraded tree trunks on natural environments such as water, mudflats, and natural vegetated areas is challenging due to the mixed colour image backgrounds. In this paper, Unmanned Aerial Vehicles (UAVs), or drones, with embedded RGB cameras were used to capture the fallen Acacia Xanthophloea trees from six designated plots around Lake Nakuru, Kenya. Motivated…
Purdue University（普渡大学）；Rochester Institute of Technology（罗切斯特理工学院）
Deep learning has substantially boosted the performance of Monocular Depth Estimation (MDE), a critical component in fully vision-based autonomous driving (AD) systems (e.g., Tesla and Toyota). In this work, we develop an attack against learning-based MDE. In particular, we use an optimization-based method to systematically generate stealthy physical-object-oriented adversarial patches to attack depth estimation. We balance the stealth and effectiveness of our attack with object-oriented adversarial design, sensitive region localization, and natural style camouflage. Using real-world driving s…
deadtrees.earth-aerial: A Multi-Resolution Aerial Image Dataset for Tree Cover and Mortality Detection
Chair of Sensor-based Geoinformatics, University of Freiburg（传感器基于地理信息学系，弗赖堡大学）；EcoVision Lab, DM3L, University of Zurich（生态视觉实验室，苏黎世大学）；Institute for Earth System Science and Remote Sensing, Leipzig University（地球系统科学与遥感研究所，莱比锡大学）；Washington University, St. Louis（斯蒂芬斯敦大学）
