DAP：一种用于规避行人检测器的动态对抗补丁
DAP: A Dynamic Adversarial Patch for Evading Person Detectors
AI总结：
本文提出动态对抗补丁（DAP），通过直接修改像素值并引入褶皱变换模块，生成兼具隐蔽性与鲁棒性的对抗补丁，在数字和物理世界中针对YOLO检测器均取得高攻击成功率。
摘要：
基于补丁的对抗攻击已被证明会损害计算机视觉系统的鲁棒性和可靠性。然而，其显眼且易被察觉的特性挑战了它们在现实环境中的实用性。为了解决这一问题，近期的研究提出使用生成对抗网络（GANs）来生成可能不会引起人类注意的自然主义补丁。然而，此类方法受限于有限的潜在空间，使得生成高效、隐蔽且对多种现实世界变换具有鲁棒性的补丁极具挑战。本文引入了一种新方法，生成动态对抗补丁（DAP），旨在克服这些限制。DAP在保持自然外观的同时，优化了攻击效率和对现实世界变换的鲁棒性。该方法重新定义了优化问题，并引入了一个包含相似度度量的新型目标函数来指导补丁的创建。与基于GAN的技术不同，DAP直接修改补丁内的像素值，提供了对多种变换更强的灵活性和适应性。此外，大多数基于衣物的物理攻击假设对象是静态的，忽略了由于人体姿势变化导致的非刚性变形可能引起的变换。为解决这一限制，引入了“褶皱变换”（CT）模块，增强了补丁对各种现实世界扭曲的抵抗力。实验结果表明，所提方法优于现有最先进的攻击，在数字世界中针对YOLOv7检测器的成功率高达82.28%，在物理世界中针对部署于边缘智能摄像头的YOLOv3tiny检测器的成功率为65%。
英文摘要：
Patch-based adversarial attacks were proven to compromise the robustness and reliability of computer vision systems. However, their conspicuous and easily detectable nature challenge their practicality in real-world setting. To address this, recent work has proposed using Generative Adversarial Networks (GANs) to generate naturalistic patches that may not attract human attention. However, such approaches suffer from a limited latent space making it challenging to produce a patch that is efficient, stealthy, and robust to multiple real-world transformations. This paper introduces a novel approach that produces a Dynamic Adversarial Patch (DAP) designed to overcome these limitations. DAP maintains a naturalistic appearance while optimizing attack efficiency and robustness to real-world transformations. The approach involves redefining the optimization problem and introducing a novel objective function that incorporates a similarity metric to guide the patch's creation. Unlike GAN-based techniques, the DAP directly modifies pixel values within the patch, providing increased flexibility and adaptability to multiple transformations. Furthermore, most clothing-based physical attacks assume static objects and ignore the possible transformations caused by non-rigid deformation due to changes in a person's pose. To address this limitation, a 'Creases Transformation' (CT) block is introduced, enhancing the patch's resilience to a variety of real-world distortions. Experimental results demonstrate that the proposed approach outperforms state-of-the-art attacks, achieving a success rate of up to 82.28% in the digital world when targeting the YOLOv7 detector and 65% in the physical world when targeting YOLOv3tiny detector deployed in edge-based smart cameras.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
