A Survey on Physical Adversarial Attack in Computer Vision

Abstract

In the past decade, deep learning has dramatically changed the traditional hand-craft feature manner with strong feature learning capability, promoting the tremendous improvement of conventional tasks. However, deep neural networks (DNNs) have been demonstrated to be vulnerable to adversarial examples crafted by small noise, which is imperceptible to human observers but can make DNNs misbehave. Existing adversarial attacks can be divided into digital and physical adversarial attacks. The former is designed to pursue strong attack performance in lab environments while hardly remaining effective when applied to the physical world. In contrast, the latter focus on developing physical deployable attacks, which are more robust in complex physical environmental conditions (e.g., brightness, occlusion, etc.). Recently, with the increasing deployment of the DNN-based system in the real world, enhancing the robustness of these systems is an emergency, while exploring physical adversarial attacks exhaustly is the precondition. To this end, this paper reviews the development of physical adversarial attacks against DNN-based computer vision tasks (i.e., image recognition and object detection tasks), which can provide beneficial information for developing stronger physical adversarial attacks. For completeness, we also briefly introduce the works that do not involve physical attacks but are closely related to them. Specifically, we first proposed a taxonomy to summarize the current physical adversarial attacks. Then we briefly discuss the existing physical attacks and focus on the technique for improving the robustness of physical attacks under complex physical environmental conditions. Finally, we discuss the issues of the current physical adversarial attacks to be solved and give promising directions.

Deceptive deraining attack: a restorative adversarial attack by rain removal

“…We present a performance comparison of our method with other attack methods on the NIPS-17 dataset 33 when attacking some typical DNNs. We chose two modified attack methods (ColorFool 23 and NCF), 15 and three additive attack methods (including AdvLight, 19 AdvRD, 21 and RFLA 17 ) for the comparative experiment. In the experiment, we limited the query counts for RFLA and AdvLight to 100, while all other implementations followed their original optimal settings.…”

“…One prevalent form of physical attack is patch attacks, 24 – 26 where adversarial patches are attached to objects to deceive DNNs. Another line of work attempts to generate adversarial examples using optical equipment, shadow attack 18 introduces shadows or blotchy perturbations on traffic sign images for attacks, while RFLA 17 attacks by simulating the reflected light on the target object. As shown in Fig.…”

“…In addition, other attack approaches modify the generic attributes of the image, such as style transfer method (STM) 14 for changing image styles and natural color fool (NCF) 15 for altering the image color. (2) Physical attacks 16 – 19 generate adversarial perturbations on physically existing objects. The most prominent existing physical attack, patch attacks, 16 , 20 are pasting adversarial patches or disguises onto the target object for the attack.…”

“…The most prominent existing physical attack, patch attacks, 16 , 20 are pasting adversarial patches or disguises onto the target object for the attack. Another type of physical attack 17 , 19 is projecting or emitting light or laser onto the target object for the attack. Moreover, to make the added physical elements seem more natural and less noticeable, some researchers 21 , 22 propose the use of natural phenomena to generate adversarial examples with a realistic style, such as adversarial raindrops or haze.…”

“…(a) Modified attack methods that modify generic attributes of images (DRA, 13 STM, 14 and NCF) 15 . (b) Additive attack methods that add specific content to images (Shadow attack, 18 AdvRD, 21 and RFLA) 17 . (c) Our proposed restorative attack method, which adds adversarial perturbations to the image during the restoration process.…”