NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles

Abstract

It has been shown that most machine learning algorithms are susceptible to adversarial perturbations. Slightly perturbing an image in a carefully chosen direction in the image space may cause a trained neural network model to misclassify it. Recently, it was shown that physical adversarial examples exist: printing perturbed images then taking pictures of them would still result in misclassification. This raises security and safety concerns.However, these experiments ignore a crucial property of physical objects: the camera can view objects from different distances and at different angles. In this paper, we show experiments that suggest that current constructions of physical adversarial examples do not disrupt object detection from a moving platform. Instead, a trained neural network classifies most of the pictures taken from different distances and angles of a perturbed image correctly. We believe this is because the adversarial property of the perturbation is sensitive to the scale at which the perturbed picture is viewed, so (for example) an autonomous car will misclassify a stop sign only from a small range of distances.Our work raises an important question: can one construct examples that are adversarial for many or most viewing conditions? If so, the construction should offer very significant insights into the internal representation of patterns by deep networks. If not, there is a good prospect that adversarial examples can be reduced to a curiosity with little practical impact.

Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems

“…2) Image Transformation: Different distances, angles, and illuminations will result in image transformations that impact the robustness of the physical AEs. AEs generated through the L-BFGS attack [5], fast gradient sign method [7], and the C&W attack [6] often lose their adversarial nature once subjected to minor transformations [35,36]. To address this challenge, Athalye et al [12] introduced the Expectation Over Transformation (EOT).…”

“…The L 0 attack was the first published attack that caused the targeted misclassification on the ImageNet dataset. Although most of the digital AEs lose their adversarial nature in the physical environment [35,36], these three classic methods are still used for generating physical AEs.…”

Improving Robustness with Image Filtering

“…For this reason, significant efforts have been made to improve the robustness of models without resorting to AT. Proposed solutions cover a wide range of techniques based on curvature regularization [17], robust optimization to improve local stability [23], the use of additional unlabeled data [4], local linearization [21], Parseval networks [5], defensive distillation [19], model ensembles [18], channel-wise activations suppressing [2], feature denoising [29], self-supervised learning for adversarial purification [25], and input manipulations [7,9,15]. All the listed techniques, except those based on input manipulations, require training the model or an auxiliary module from scratch.…”

“…In [15] the authors analyze the effect of image rescaling on adversarial examples. [7] explores the possibility to improve robustness through JPG (re)compression, based on the intuition that adversarial perturbations are unlikely to leave an image in the space of JPG images.…”

“…Based on the above intuitions, this paper presents a novel image filtering framework aimed at improving robustness against adversarial attacks without resorting to AT. While it is not the first contribution introducing techniques based on input manipulation to prevent adversarial attacks [7,9,15], this work differs significantly from prior literature in the fundamental concepts at the basis of its functioning. The main difference between our method and others relying on input transformations is that we explicitly remove textures from input images while preserving the informative features.…”