arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2201.01850cs.CVcs.AI
收藏

自动驾驶中实时语义分割模型的真实世界对抗鲁棒性研究

On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving

Department of Excellence in Robotics \& AI, Scuola Superiore Sant'Anna, Pisa, Italy

Giulio Rossolini, Federico Nesti, Gianluca D'Amico, Saasha Nair, Alessandro Biondi, Giorgio Buttazzo

AI总结:

本文评估了自动驾驶语义分割模型在数字、模拟和物理对抗补丁攻击下的鲁棒性,提出新损失函数和攻击策略,并扩展改进实时检测方法,发现攻击影响常局限于补丁附近区域。

摘要:

真实世界对抗样本(通常以补丁形式存在)的存在对深度学习模型在安全关键型计算机视觉任务(如自动驾驶中的视觉感知)中的应用构成了严重威胁。本文对不同类型对抗补丁(包括数字、模拟和物理补丁)攻击下语义分割模型的鲁棒性进行了广泛评估。提出了一种新颖的损失函数,以提升攻击者诱导像素误分类的能力。同时,提出了一种新颖的攻击策略,以改进用于在场景中放置补丁的期望变换(Expectation Over Transformation)方法。最后,将一种最先进的对抗补丁检测方法首先扩展以适用于语义分割模型,随后进行改进以获得实时性能,并最终在真实世界场景中进行了评估。实验结果表明,尽管对抗效果在数字和真实世界攻击中均可见,但其影响往往在空间上局限于补丁周围的图像区域。这引发了关于实时语义分割模型空间鲁棒性的进一步问题。

英文摘要:

The existence of real-world adversarial examples (commonly in the form of patches) poses a serious threat for the use of deep learning models in safety-critical computer vision tasks such as visual perception in autonomous driving. This paper presents an extensive evaluation of the robustness of semantic segmentation models when attacked with different types of adversarial patches, including digital, simulated, and physical ones. A novel loss function is proposed to improve the capabilities of attackers in inducing a misclassification of pixels. Also, a novel attack strategy is presented to improve the Expectation Over Transformation method for placing a patch in the scene. Finally, a state-of-the-art method for detecting adversarial patch is first extended to cope with semantic segmentation models, then improved to obtain real-time performance, and eventually evaluated in real-world scenarios. Experimental results reveal that, even though the adversarial effect is visible with both digital and real-world attacks, its impact is often spatially confined to areas of the image around the patch. This opens to further questions about the spatial robustness of real-time semantic segmentation models.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑