Adversarial T-Shirt! Evading Person Detectors in a Physical World

Xu, Kaidi; Zhang, Gaoyuan; Liu, Sijia; Fan, Quanfu; Sun, Mengshu; Chen, Hongge; Chen, Pin-Yu; Wang, Yanzhi; Lin, Xue

doi:10.1007/978-3-030-58558-7_39

Cited by 205 publications

(161 citation statements)

References 18 publications

Supporting

Mentioning

161

Contrasting

Order By: Relevance

“…Adversarial stickers and graffiti have also been used to attack such as traffic sign classifiers and ImageNet classifiers in physical-world scenarios [10]. Other physicalworld attacks include adversarial eye-glass frames [23], vehicles [35], or t-shirts [32] that can fool face recognition systems or object detectors. All these physical-world attacks generate large perturbations to increase adversarial strength, which inevitably results in large and unrealistic distortions.…”

Section: Physical-world Attacksmentioning

confidence: 99%

Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles

Duan

Wang

et al. 2020

2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

177

102

View full text Add to dashboard Cite

Deep neural networks (DNNs) are known to be vulnerable to adversarial examples. Existing works have mostly focused on either digital adversarial examples created via small and imperceptible perturbations, or physical-world adversarial examples created with large and less realistic distortions that are easily identified by human observers. In this paper, we propose a novel approach, called Adversarial Camouflage (AdvCam), to craft and camouflage physicalworld adversarial examples into natural styles that appear legitimate to human observers. Specifically, AdvCam transfers large adversarial perturbations into customized styles, which are then "hidden" on-target object or off-target background. Experimental evaluation shows that, in both digital and physical-world scenarios, adversarial examples crafted by AdvCam are well camouflaged and highly stealthy, while remaining effective in fooling state-of-the-art DNN image classifiers. Hence, AdvCam is a flexible approach that can help craft stealthy attacks to evaluate the robustness of DNNs. AdvCam can also be used to protect private information from being detected by deep learning systems. code

show abstract

Section: Physical-world Attacksmentioning

confidence: 99%

Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles

Duan

Wang

et al. 2020

2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

177

102

View full text Add to dashboard Cite

show abstract

“…This already led to an incessant attacker-defender race in the fast moving field of security for machine learning and adversarial examples [53][54][55][56]. In recent years, researchers have among others developed different attack schemes on how to evade cybersecurity AI [57], e-mail protection, verification tools [58], forensic classifiers [59] and person detectors [60], how to elicit algorithmic biases [13,61], how to fool medical AI [62][63][64][65], law enforcement tools [66] as well as autonomous vehicles [67,68], how to perform denial-of-service and other adversarial attacks on commercial AI services [69][70][71], how to cause energy-intense and unnecessarily prolonged processing time [72] and how to poison AI systems postdeployment [73].…”

Section: Rda For Ai Risk Instantiations Ia and Ib-examplesmentioning

confidence: 99%

Transdisciplinary AI Observatory—Retrospective Analyses and Future-Oriented Contradistinctions

2021

View full text Add to dashboard Cite

In the last years, artificial intelligence (AI) safety gained international recognition in the light of heterogeneous safety-critical and ethical issues that risk overshadowing the broad beneficial impacts of AI. In this context, the implementation of AI observatory endeavors represents one key research direction. This paper motivates the need for an inherently transdisciplinary AI observatory approach integrating diverse retrospective and counterfactual views. We delineate aims and limitations while providing hands-on-advice utilizing concrete practical examples. Distinguishing between unintentionally and intentionally triggered AI risks with diverse socio-psycho-technological impacts, we exemplify a retrospective descriptive analysis followed by a retrospective counterfactual risk analysis. Building on these AI observatory tools, we present near-term transdisciplinary guidelines for AI safety. As further contribution, we discuss differentiated and tailored long-term directions through the lens of two disparate modern AI safety paradigms. For simplicity, we refer to these two different paradigms with the terms artificial stupidity (AS) and eternal creativity (EC) respectively. While both AS and EC acknowledge the need for a hybrid cognitive-affective approach to AI safety and overlap with regard to many short-term considerations, they differ fundamentally in the nature of multiple envisaged long-term solution patterns. By compiling relevant underlying contradistinctions, we aim to provide future-oriented incentives for constructive dialectics in practical and theoretical AI safety research.

show abstract

“…Adversarial example attack have been studied broadly and being considered as one of the most important attack models to explore the DNN vulnerability. Adversarial patch attacks add input-independent patch perturbation in the input images to manipulate the victim model to output malicious results [39]. Compared to adversarial example attacks, patch attacks are more practical due to the reasons: 1) Better universality across different input images.…”

Section: Advanced Attacks With Extracted Dnn Archsmentioning

confidence: 99%

“…We additionally test the effectiveness of extracted network architectures on adversarial patch attacks. Patch attack is to generate a uniform adversarial patch for any arbitrary inputs that manipulate the victim model to output targeted or untargeted labels [39]. The major difference between an adversarial example and patch attack is that the adversarial patches are not dependent on the inputs while every different input desires a customized adversarial example.…”

Section: Adversarial Patch Attack Effectivenessmentioning

confidence: 99%

A Systematic View of Leakage Risks in Deep Neural Network Systems

Hu¹,

Liu²,

Chen³

et al. 2021

Preprint

View full text Add to dashboard Cite

As deep neural networks (DNNs) continue their reach into a wide range of application domains, the neural network architecture of DNN models becomes an increasingly sensitive subject, due to either intellectual property protection or risks of adversarial attacks. In observing the large gap between the architectural surfaces exploration and the model integrity study, this paper first presents the formulated schema of the model leakage risks. Then, we propose DeepSniffer, a learning-based model extraction framework, to obtain the complete model architecture information without any prior knowledge of the victim model. It is robust to architectural and system noises introduced by the complex memory hierarchy and diverse run-time system optimizations. Taking GPU platforms as a showcase, DeepSniffer performs model extraction by learning both the architecture-level execution features of kernels and the inter-layer temporal association information introduced by the common practice of DNN design. We demonstrate that DeepSniffer works experimentally in the context of an off-the-shelf Nvidia GPU platform running a variety of DNN models. The extracted models are directly helpful to the attempting of crafting adversarial inputs. The DeepSniffer project has been released in https://github.com/xinghu7788/DeepSniffer.

show abstract

Adversarial T-Shirt! Evading Person Detectors in a Physical World

Cited by 205 publications

References 18 publications

Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles

Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles

Transdisciplinary AI Observatory—Retrospective Analyses and Future-Oriented Contradistinctions

A Systematic View of Leakage Risks in Deep Neural Network Systems

Contact Info

Product

Resources

About