全无人商店中针对对抗补丁攻击的鲁棒性分析
Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores
AI总结：
本文研究无人商店目标检测模型面对抗补丁的安全风险，提出颜色直方图相似性损失和边界框指标，并在数字与物理黑盒场景中验证隐藏、创建和篡改攻击的有效性及防御必要性。
摘要：
配备基于人工智能的自动结账系统的便捷高效全无人商店的出现，标志着零售业进入了一个新时代。然而，这些系统具有固有的人工智能安全漏洞，这些漏洞会被对抗补丁攻击利用，尤其是在物理环境中。本研究证明，对抗补丁可能严重破坏无人商店中使用的目标检测模型，从而导致盗窃、库存差异和干扰等问题。我们研究了三类对抗补丁攻击——Hiding（隐藏）、Creating（创建）和Altering（篡改）攻击，并强调了它们的有效性。我们还利用攻击者对目标类别对象颜色信息的了解，提出了一种新的颜色直方图相似性损失函数。除了传统的基于混淆矩阵的攻击成功率之外，我们引入了一种新的基于边界框的指标，用于分析这些攻击的实际影响。我们首先在数字环境中攻击基于零食和水果数据集训练的目标检测模型，随后在一个模拟真实无人商店、配备RGB相机并具备现实条件的物理测试平台中评估对抗补丁的有效性。此外，我们评估了这些攻击在黑盒场景中的鲁棒性，证明即使无法直接访问模型参数，影子攻击也可以提高攻击成功率。本研究强调，必须采用鲁棒的防御策略来保护无人商店免受对抗威胁。通过指出现实时时检测系统中当前防御机制的局限性，并讨论各种主动措施，我们为提高目标检测模型的鲁棒性以及强化无人零售环境以抵御这些攻击提供了洞见。
英文摘要：
The advent of convenient and efficient fully unmanned stores equipped with artificial intelligence-based automated checkout systems marks a new era in retail. However, these systems have inherent artificial intelligence security vulnerabilities, which are exploited via adversarial patch attacks, particularly in physical environments. This study demonstrated that adversarial patches can severely disrupt object detection models used in unmanned stores, leading to issues such as theft, inventory discrepancies, and interference. We investigated three types of adversarial patch attacks -- Hiding, Creating, and Altering attacks -- and highlighted their effectiveness. We also introduce the novel color histogram similarity loss function by leveraging attacker knowledge of the color information of a target class object. Besides the traditional confusion-matrix-based attack success rate, we introduce a new bounding-boxes-based metric to analyze the practical impact of these attacks. Starting with attacks on object detection models trained on snack and fruit datasets in a digital environment, we evaluated the effectiveness of adversarial patches in a physical testbed that mimicked a real unmanned store with RGB cameras and realistic conditions. Furthermore, we assessed the robustness of these attacks in black-box scenarios, demonstrating that shadow attacks can enhance success rates of attacks even without direct access to model parameters. Our study underscores the necessity for robust defense strategies to protect unmanned stores from adversarial threats. Highlighting the limitations of the current defense mechanisms in real-time detection systems and discussing various proactive measures, we provide insights into improving the robustness of object detection models and fortifying unmanned retail environments against these attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
