针对无人机目标检测的环境匹配攻击
Environmental Matching Attack Against Unmanned Aerial Vehicles Object Detection
AI总结：
针对无人机目标检测对抗补丁自然性不足的问题，提出环境匹配攻击EMA，借助预训练stable diffusion的文本引导及色彩调整优化零初始化对抗扰动补丁，兼顾攻击性能与环境匹配的自然性。
摘要：
无人机（UAV）目标检测技术依赖深度神经网络（DNNs），而这类网络易受对抗攻击影响。然而，现有算法在无人机领域生成的对抗补丁极少关注补丁的自然性；此外，直接对对抗补丁施加约束，很难生成人眼看起来自然且同时保证高攻击成功率的补丁。我们注意到，当补丁的整体颜色与环境一致时，外观会更自然。为此，我们提出一种名为环境匹配攻击（Environmental Matching Attack，EMA）的新方法，以解决颜色约束下的对抗补丁优化问题。据我们所知，本文是首个在无人机领域研究自然对抗补丁的工作。EMA方法利用预训练stable diffusion的强先验知识引导对抗补丁的优化方向，其中文本引导可限制补丁的颜色；为更好地匹配环境，还对补丁的对比度和亮度进行了适当调整。我们并未直接优化对抗补丁本身，而是优化一个初始化为零的对抗扰动补丁，使模型能更好地权衡攻击性能与自然性。在DroneVehicle和Carpk数据集上开展的实验表明，我们的方法在数字攻击中可达到几乎相同的攻击性能（mAP%差值不超过2），在物理特定场景下优于基线方法，并且在可视化自然度以及与环境的色差方面展现出显著优势。
英文摘要：
Object detection techniques for Unmanned Aerial Vehicles (UAVs) rely on Deep Neural Networks (DNNs), which are vulnerable to adversarial attacks. Nonetheless, adversarial patches generated by existing algorithms in the UAV domain pay very little attention to the naturalness of adversarial patches. Moreover, imposing constraints directly on adversarial patches makes it difficult to generate patches that appear natural to the human eye while ensuring a high attack success rate. We notice that patches are natural looking when their overall color is consistent with the environment. Therefore, we propose a new method named Environmental Matching Attack(EMA) to address the issue of optimizing the adversarial patch under the constraints of color. To the best of our knowledge, this paper is the first to consider natural patches in the domain of UAVs. The EMA method exploits strong prior knowledge of a pretrained stable diffusion to guide the optimization direction of the adversarial patch, where the text guidance can restrict the color of the patch. To better match the environment, the contrast and brightness of the patch are appropriately adjusted. Instead of optimizing the adversarial patch itself, we optimize an adversarial perturbation patch which initializes to zero so that the model can better trade off attacking performance and naturalness. Experiments conducted on the DroneVehicle and Carpk datasets have shown that our work can reach nearly the same attack performance in the digital attack(no greater than 2 in mAP$\%$), surpass the baseline method in the physical specific scenarios, and exhibit a significant advantage in terms of naturalness in visualization and color difference with the environment.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
