重新审视目标检测器上的对抗性补丁防御：统一评估、大规模数据集与新见解
Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insights
AI总结：
针对目标检测器补丁攻击防御评估缺乏统一框架的问题，构建含94种补丁和94,000图像的大规模基准，揭示数据分布是关键，并提升防御性能15.09% AP@0.5。
摘要：
开发针对目标检测器上补丁攻击的可靠防御已引起越来越多的关注。然而，我们发现现有的防御评估缺乏统一且全面的框架，导致对当前方法的评估不一致且不完整。为解决这一问题，我们重新审视了11种代表性防御方法，并提出了首个补丁防御基准，涵盖2种攻击目标、13种补丁攻击、11种目标检测器和4种多样化指标。由此构建了包含94种补丁类型和94,000张图像的大规模对抗性补丁数据集。我们的综合分析揭示了新见解：（1）防御自然风格补丁的难点在于数据分布，而非通常认为的高频特征。我们包含多样化补丁分布的新数据集可将现有防御的AP@0.5提升15.09%。（2）被攻击目标的平均精度（而非通常追求的补丁检测精度）与防御性能高度一致。（3）自适应攻击能大幅绕过现有防御，而采用复杂/随机模型或通用补丁属性的防御相对稳健。我们希望我们的分析能为正确评估补丁攻击/防御并推进其设计提供指导。代码和数据集可在https://github.com/Gandolfczjh/APDE获取，我们将持续集成新的攻击/防御方法。
英文摘要：
Developing reliable defenses against patch attacks on object detectors has attracted increasing interest. However, we identify that existing defense evaluations lack a unified and comprehensive framework, resulting in inconsistent and incomplete assessments of current methods. To address this issue, we revisit 11 representative defenses and present the first patch defense benchmark, involving 2 attack goals, 13 patch attacks, 11 object detectors, and 4 diverse metrics. This leads to the large-scale adversarial patch dataset with 94 types of patches and 94,000 images. Our comprehensive analyses reveal new insights: (1) The difficulty in defending against naturalistic patches lies in the data distribution, rather than the commonly believed high frequencies. Our new dataset with diverse patch distributions can be used to improve existing defenses by 15.09% AP@0.5. (2) The average precision of the attacked object, rather than the commonly pursued patch detection accuracy, shows high consistency with defense performance. (3) Adaptive attacks can substantially bypass existing defenses, and defenses with complex/stochastic models or universal patch properties are relatively robust. We hope that our analyses will serve as guidance on properly evaluating patch attacks/defenses and advancing their design. Code and dataset are available at https://github.com/Gandolfczjh/APDE, where we will keep integrating new attacks/defenses.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
