发表机构
College of Information Science and Technology, Beijing University of Chemical Technology（北京化工大学信息科学与技术学院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出ColorFD黑盒物理对抗攻击方法，结合差分进化、目标导向机制与关键区域定位等策略，在YOLO系列及Faster R-CNN上优于现有黑盒补丁攻击，且可迁移至真实成像条件。
AI 中文摘要
尽管基于深度神经网络的遥感目标检测器已取得优异性能，但它们仍易受对抗扰动影响。现有研究主要聚焦于数字或白盒设置，而黑盒物理攻击的探索仍不充分，这类攻击常受限于物理可行性有限、高维搜索空间优化效率低的问题。为应对这些挑战，本文提出ColorFD，一种基于多个纯色补丁的黑盒物理攻击方法。采用差分进化（DE）联合优化补丁位置与颜色参数；设计目标导向的适应度与选择机制，评估每个目标的攻击状态，在进化过程中保留针对特定目标的改进；引入两种引导策略进一步约束补丁搜索空间：有限差分颜色探测识别敏感区域的关键区域定位，以及提供类别级空间先验、避免重复定位的共性特征提取。尽管在飞机数据集上进行了评估，但该方法本质上并不局限于该类别。在YOLOv3u、YOLOv5u和Faster R-CNN上的实验表明，ColorFD在所有评估的检测器上均优于测试的黑盒补丁方法，且与强大的白盒基线具有竞争力；物理世界实验进一步验证，优化后的纯色补丁可从数字域迁移至真实成像条件。
英文摘要
Although deep neural network-based remote sensing object detectors have achieved strong performance, they remain vulnerable to adversarial perturbations. Existing studies mainly focus on digital or white-box settings, whereas black-box physical attacks remain underexplored. These attacks are often constrained by limited physical feasibility and inefficient optimization in high-dimensional search spaces. To address these challenges, this paper proposes ColorFD, a black-box physical attack based on multiple pure-color patches. The patch positions and color parameters are jointly optimized using Differential Evolution (DE). A target-wise fitness and selection mechanism evaluates the attack state of each target and preserves target-specific improvements during evolution. Two guidance strategies further constrain the patch search space. Key-region localization identifies sensitive regions through finite-difference color probing. Common-feature extraction provides category-level spatial priors and avoids repeated localization. Although evaluated on aircraft, the formulation is not inherently restricted to this category. Experiments on YOLOv3u, YOLOv5u, and Faster R-CNN show that ColorFD outperforms the tested black-box patch method across all evaluated detectors and remains competitive with strong white-box baselines. Physical-world experiments further demonstrate that the optimized pure-color patches can be transferred from the digital domain to real imaging conditions.
Comments13pages,12figures
