对抗性颜色投影：一种基于投影仪的针对DNN的物理攻击
Adversarial Color Projection: A Projector-based Physical Attack to DNNs
AI总结：
本文提出了一种基于投影仪的黑盒物理攻击方法AdvCP，通过操纵颜色投影的物理参数生成对抗样本，在数字和物理环境中均表现出高攻击成功率、隐蔽性和鲁棒性。
摘要：
最近的研究表明，深度神经网络（DNNs）容易受到对抗性扰动的影响。因此，评估先进DNNs对对抗性攻击的韧性势在必行。然而，传统方法使用贴纸作为物理扰动来欺骗分类器，在实现隐蔽性方面面临挑战，且容易受到打印损失的影响。最近，物理攻击的进展利用光束（如激光）进行攻击，其中生成的光学图案是人工的而非自然的。在这项工作中，我们提出了一种基于投影仪的黑盒物理攻击，称为对抗性颜色投影（AdvCP），它通过操纵颜色投影的物理参数来执行对抗性攻击。我们在三个关键标准上评估了我们的方法：有效性、隐蔽性和鲁棒性。在数字环境中，我们在ImageNet的一个子集上实现了97.60%的攻击成功率；而在物理环境中，我们在室内测试中达到了100%的攻击成功率，在室外测试中达到了82.14%的攻击成功率。我们将AdvCP生成的对抗样本与基线样本进行比较，以展示我们方法的隐蔽性。在攻击先进的DNNs时，实验结果表明，我们的方法在所有情况下都能实现超过85%的攻击成功率，这验证了AdvCP的鲁棒性。最后，我们考虑了AdvCP对未来基于视觉的系统和应用构成的潜在威胁，并提出了一些关于基于光的物理攻击的想法。
英文摘要：
Recent research has demonstrated that deep neural networks (DNNs) are vulnerable to adversarial perturbations. Therefore, it is imperative to evaluate the resilience of advanced DNNs to adversarial attacks. However, traditional methods that use stickers as physical perturbations to deceive classifiers face challenges in achieving stealthiness and are susceptible to printing loss. Recently, advancements in physical attacks have utilized light beams, such as lasers, to perform attacks, where the optical patterns generated are artificial rather than natural. In this work, we propose a black-box projector-based physical attack, referred to as adversarial color projection (AdvCP), which manipulates the physical parameters of color projection to perform an adversarial attack. We evaluate our approach on three crucial criteria: effectiveness, stealthiness, and robustness. In the digital environment, we achieve an attack success rate of 97.60% on a subset of ImageNet, while in the physical environment, we attain an attack success rate of 100% in the indoor test and 82.14% in the outdoor test. The adversarial samples generated by AdvCP are compared with baseline samples to demonstrate the stealthiness of our approach. When attacking advanced DNNs, experimental results show that our method can achieve more than 85% attack success rate in all cases, which verifies the robustness of AdvCP. Finally, we consider the potential threats posed by AdvCP to future vision-based systems and applications and suggest some ideas for light-based physical attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
