Adversarial Objectness Gradient Attacks in Real-time Object Detection Systems

Robust Object Detection Fusion Against Deception

“…Object detection is an instance of multi-task learning, which takes an input image and performs three learning tasks: object existence prediction (detecting the number of objects), bounding box estimation (bounding box of each detected object), and object classification (class label for each object). Existing state-of-the-art attacks to object detectors include DAG [26], RAP [13], UEA [24], TOG [5], and adversarial physical patches [21] or digital patches [15]. Unlike adversarial attacks to DNN-based image classifiers [10], all object detection attacks can critically compromise the object existence prediction capability and the bounding box estimation capability, causing real objects to vanish from the detection or causing the detection to fabricate fake objects that do not exist, consequently deceiving object classification (i.e., the third learning task).…”

“…where 1{•} is the indicator function, O * denotes the target detection for targeted attacks and any incorrect detection for untargeted attacks, and is the maximum perturbation in ℓ -norm. Directly optimizing the indicator function in Equation 2 is challenging, and hence existing attacks [5,13,26] reformulate the optimization to be…”

“…where , is the projection onto a hypersphere with a radius centered at in ℓ -norm followed by clipping to ensure the validity of pixel values, is the attack learning rate, and Γ is a sign function. By strategically configuring L * and O * , an adversary can launch untargeted random attacks [5,13,24,26] and targeted specificity attacks, such as object vanishing, fabrication, or mislabeling [5].…”

“…While DNN-based object detectors offer real-time performance with unparalleled accuracy over traditional techniques [22], recent studies have revealed their vulnerabilities to adversarial inputs [5,13,24,26]. Table 1 illustrates such vulnerabilities by examples.…”

“…We conduct extensive experiments on eleven detectors from three representative families of detection algorithms (Faster R-CNN [19], YOLOv3 [18], and SSD [14]) on two popular benchmark datasets (PASCAL VOC [7] and INRIA [6]). FUSE demonstrates strong robustness for mitigating the state-of-the-art adversarial deception attacks, e.g., DAG [26], RAP [13], UEA [24], and TOG [5], as well as the adversarial patches [21], a form of physical attacks using confined visual distortion [15].…”