Class-Aware Robust Adversarial Training for Object Detection

Chen, Pin‐Chun; Kung, Bo-Han; Chen, Jun-Cheng

doi:10.1109/cvpr46437.2021.01028

Cited by 36 publications

(27 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Timing overhead is one of the most important factors that may limit the deployability of defense for real-time systems such as AD systems. Among the existing defenses, 4 have negligible or no timing overhead by design or shown in evaluation [57,81,105,107], 1 fails to catch up with the camera and LiDAR frame rate in evaluation [104]. For the remaining ones, we cannot conclude their timeliness from their papers (e.g., no timing overhead evaluation).…”

Section: Systematization Of Ad Ai Defensesmentioning

confidence: 97%

“…Several defenses try to improve the robustness of the AI component against attacks. For example, Chen et al [105] applied adversarial training [13] to make the camera object detection model more robust. Jia et al [106] improved the model robustness by predicting and removing potential adversarial perturbations from the model inputs.…”

Section: Systematization Of Ad Ai Defensesmentioning

confidence: 99%

“…In practice, the hardware that runs the AD system may have limited computation resources (e.g., limited GPUs) due to budget concerns. Among the defenses, except the ones that do not require extra ML models [81,89,105], all others will impose additional demand on the computation resources in order to execute the models. This may prevent them from deploying onto vehicles that have already fully utilized the hardware resources.…”

Section: Systematization Of Ad Ai Defensesmentioning

confidence: 99%

See 2 more Smart Citations

SoK: On the Semantic AI Security in Autonomous Driving

Shen¹,

Wang²,

Wan³

et al. 2022

Preprint

View full text Add to dashboard Cite

Autonomous Driving (AD) systems rely on AI components to make safety and correct driving decisions. Unfortunately, today's AI algorithms are known to be generally vulnerable to adversarial attacks. However, for such AI component-level vulnerabilities to be semantically impactful at the system level, it needs to address non-trivial semantic gaps both (1) from the system-level attack input spaces to those at AI component level, and (2) from AI component-level attack impacts to those at the system level. In this paper, we define such research space as semantic AI security as opposed to generic AI security. Over the past 5 years, increasingly more research works are performed to tackle such semantic AI security challenges in AD context, which has started to show an exponential growth trend. However, to the best of our knowledge, so far there is no comprehensive systematization of this emerging research space.In this paper, we thus perform the first systematization of knowledge of such growing semantic AD AI security research space. In total, we collect and analyze 53 such papers, and systematically taxonomize them based on research aspects critical for the security field such as the attack/defense targeted AI component, attack/defense goal, attack vector, attack knowledge, defense deployability, defense robustness, and evaluation methodologies. We summarize 6 most substantial scientific gaps observed based on quantitative comparisons both vertically among existing AD AI security works and horizontally with security works from closely-related domains. With these, we are able to provide insights and potential future directions not only at the design level, but also at the research goal, methodology, and community levels. To address the most critical scientific methodology-level gap, we take the initiative to develop an open-source, uniform, and extensible system-driven evaluation platform, named PASS, for the semantic AD AI security research community. We also use our implemented platform prototype to showcase the capabilities and benefits of such a platform using representative semantic AD AI attacks.

show abstract

Section: Systematization Of Ad Ai Defensesmentioning

confidence: 97%

Section: Systematization Of Ad Ai Defensesmentioning

confidence: 99%

Section: Systematization Of Ad Ai Defensesmentioning

confidence: 99%

See 1 more Smart Citation

SoK: On the Semantic AI Security in Autonomous Driving

Shen¹,

Wang²,

Wan³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Such vulnerability inspires increasing attentions on the adversarial robustness mainly in the image classification task [29,3,16,36,22]. Nevertheless, with elaborate architectures to recognize simultaneously where and which category objects are in images, object detectors also suffers from the vulnerable robustness and are easily fooled by adversarial attacks [32,30,6,5,15]. As demonstrated in Fig.…”

Section: Introductionmentioning

confidence: 99%

“…To address this issue, MTD [34], as an earlier attempt, regards the adversarial training of object detection as a multi-task learning and choose those adversarial images that have the largest impact on the total loss for learning. Subsequently, the second related work, CWAT [5], points out the problem of class imbalance in the attack and proposes to attack each category as evenly as possible to generate more reasonable adversarial images. In general, these existing methods suffer from the detection robustness bottleneck: a significant degradation on clean images with only a limited adversarial robustness, shown in Fig.…”

Section: Introductionmentioning

confidence: 99%

Adversarially-Aware Robust Object Detector

Dong¹,

Wei²,

Li³

2022

Preprint

View full text Add to dashboard Cite

Object detection, as a fundamental computer vision task, has achieved a remarkable progress with the emergence of deep neural networks. Nevertheless, few works explore the adversarial robustness of object detectors to resist adversarial attacks for practical applications in various real-world scenarios. Detectors have been greatly challenged by unnoticeable perturbation, with sharp performance drop on clean images and extremely poor performance on adversarial images. In this work, we empirically explore the model training for adversarial robustness in object detection, which greatly attributes to the conflict between learning clean images and adversarial images. To mitigate this issue, we propose a Robust Detector (RobustDet) based on adversarially-aware convolution to disentangle gradients for model learning on clean and adversarial images. RobustDet also employs the Adversarial Image Discriminator (AID) and Consistent Features with Reconstruction (CFR) to ensure a reliable robustness. Extensive experiments on PASCAL VOC and MS-COCO demonstrate that our model effectively disentangles gradients and significantly enhances the detection robustness with maintaining the detection ability on clean images. Our source code and trained models are publicly available at: https://github.com/7eu7d7/RobustDet

show abstract

Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches

Cheng

Liang

Choi

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Monocular Depth Estimation (MDE) plays a vital role in applications such as autonomous driving. However, various attacks target MDE models, with physical attacks posing significant threats to system security. Traditional adversarial training methods, which require ground-truth labels, are not directly applicable to MDE models that lack ground-truth depth. Some self-supervised model hardening techniques (e.g., contrastive learning) overlook the domain knowledge of MDE, resulting in suboptimal performance. In this work, we introduce a novel self-supervised adversarial training approach for MDE models, leveraging view synthesis without the need for ground-truth depth. We enhance adversarial robustness against real-world attacks by incorporating L 0 -norm-bounded perturbation during training. We evaluate our method against supervised learning-based and contrastive learning-based approaches specifically designed for MDE. Our experiments with two representative MDE networks demonstrate improved robustness against various adversarial attacks, with minimal impact on benign performance. Our code: https://github.com/Bob-cheng/DepthModelHardening.

show abstract

Class-Aware Robust Adversarial Training for Object Detection

Cited by 36 publications

References 15 publications

SoK: On the Semantic AI Security in Autonomous Driving

SoK: On the Semantic AI Security in Autonomous Driving

Adversarially-Aware Robust Object Detector

Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches

Contact Info

Product

Resources

About