arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2409.10071cs.CVcs.RO
收藏

迈向具身视觉导航中物理可实现的对抗攻击

Towards Physically Realizable Adversarial Attacks in Embodied Vision Navigation

School of Intelligent Engineering and Automation, Beijing University of Posts and Telecommunications(智能工程与自动化学院,北京邮电大学)

Meng Chen, Jiawei Tu, Chao Qi, Yonghao Dang, Feng Zhou, Wei Wei, Jianqin Yin

AI总结:

本文提出一种针对具身视觉导航的物理可实现对抗攻击方法,通过将可学习不透明度和纹理的对抗性补丁附着于物体,结合多视角优化和两阶段不透明度优化,实现兼具多视角有效性、实用性与视觉自然性的攻击,使导航成功率平均下降22.39%。

摘要:

具身视觉导航的显著进步引发了人们对其易受利用深度神经网络的对抗攻击影响的担忧。调查具身视觉导航的对抗鲁棒性至关重要,特别是考虑到3D物理攻击可能对人类安全构成风险的威胁。然而,现有的具身视觉导航攻击方法往往由于将数字扰动转移到物理世界的挑战而缺乏物理可行性。此外,当前针对目标检测的物理攻击在导航场景中难以同时实现多视角有效性和视觉自然性。为了解决这个问题,我们提出了一种实用的具身导航攻击方法,即将对抗性补丁附着在物体上,其中不透明度和纹理都是可学习的。具体而言,为了确保跨不同视角的有效性,我们采用基于物体感知采样的多视角优化策略,该策略根据导航中使用的基于视觉的感知模型的反馈来优化补丁的纹理。为了使补丁对人类观察者不显眼,我们引入了两阶段不透明度优化机制,其中不透明度在纹理优化后进行微调。实验结果表明,我们的对抗性补丁将导航成功率平均降低了22.39%,在实用性、有效性和自然性方面优于以前的方法。代码可在以下网址获取:https://github.com/chen37058/Physical-Attacks-in-Embodied-Nav

英文摘要:

The significant advancements in embodied vision navigation have raised concerns about its susceptibility to adversarial attacks exploiting deep neural networks. Investigating the adversarial robustness of embodied vision navigation is crucial, especially given the threat of 3D physical attacks that could pose risks to human safety. However, existing attack methods for embodied vision navigation often lack physical feasibility due to challenges in transferring digital perturbations into the physical world. Moreover, current physical attacks for object detection struggle to achieve both multi-view effectiveness and visual naturalness in navigation scenarios. To address this, we propose a practical attack method for embodied navigation by attaching adversarial patches to objects, where both opacity and textures are learnable. Specifically, to ensure effectiveness across varying viewpoints, we employ a multi-view optimization strategy based on object-aware sampling, which optimizes the patch's texture based on feedback from the vision-based perception model used in navigation. To make the patch inconspicuous to human observers, we introduce a two-stage opacity optimization mechanism, in which opacity is fine-tuned after texture optimization. Experimental results demonstrate that our adversarial patches decrease the navigation success rate by an average of 22.39%, outperforming previous methods in practicality, effectiveness, and naturalness. Code is available at: https://github.com/chen37058/Physical-Attacks-in-Embodied-Nav

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑