在标准基线之外评估针对交通标志分类器的对抗攻击
Evaluating Adversarial Attacks on Traffic Sign Classifiers beyond Standard Baselines
AI总结：
本研究针对交通标志分类对抗攻击研究基线单一的问题，通过解耦模型与数据集、对比隐蔽与可见攻击设置，发现标准基线模型比通用模型更易受攻击，建议未来在更广基线上评估新攻击。
摘要：
针对交通标志分类模型的对抗攻击是最早在现实世界中成功试验的攻击类型之一。此后，该领域的研究主要局限于重复使用LISA-CNN、GTSRB-CNN等基线模型，以及在交通标志上粘贴黑白补丁等类似实验设置。本研究将模型架构与数据集解耦，在更多通用模型上开展评估以实现公平比较。此外，我们对比了通常未被直接比较的两种攻击设置：隐蔽式攻击和可见式攻击。结果表明，LISA-CNN、GTSRB-CNN等标准基线的受攻击易感程度显著高于通用模型。因此我们建议未来应在更广泛的基线范围内评估新型攻击。我们的代码可在https://github.com/KASTEL-MobilityLab/attacks-on-traffic-sign-recognition/ 获取。
英文摘要：
Adversarial attacks on traffic sign classification models were among the first successfully tried in the real world. Since then, the research in this area has been mainly restricted to repeating baseline models, such as LISA-CNN or GTSRB-CNN, and similar experiment settings, including white and black patches on traffic signs. In this work, we decouple model architectures from the datasets and evaluate on further generic models to make a fair comparison. Furthermore, we compare two attack settings, inconspicuous and visible, which are usually regarded without direct comparison. Our results show that standard baselines like LISA-CNN or GTSRB-CNN are significantly more susceptible than the generic ones. We, therefore, suggest evaluating new attacks on a broader spectrum of baselines in the future. Our code is available at \url{https://github.com/KASTEL-MobilityLab/attacks-on-traffic-sign-recognition/}.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
