Spatiotemporal Attacks for Embodied Agents

Liu, Aishan; Huang, Tairan; Liu, Xianglong; Xu, Yitao; Ma, Yuqing; Chen, Xinyun; Maybank, Stephen J.; Tao, Dacheng

doi:10.1007/978-3-030-58520-4_8

Cited by 33 publications

(14 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zhang et al [186] used the movement patterns in the video frames to compute a noise prior that can help in gradient estimation for fooling video classifiers in the context of query-based attacks. A spatiotemporal attack is also introduced for embodied agents in [187]. Liu et al [188] proposed an FGSM-like attack to fool skeleton-based human action recognition models.…”

Section: G Miscellaneous Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: G Miscellaneous Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…Adversarial examples are elaborately designed perturbations which are imperceptible to human but could mislead DNNs [41,22]. In the past years, a long line of work has been proposed to develop adversarial attack strategies [25,13,30,43,11,29,48,19]. In general, there are several different ways to categorize adversarial attack methods, e.g., targeted or untargeted attacks, white-box or black-box attacks, etc.…”

Section: Related Workmentioning

confidence: 99%

“…By introducing a seed content patch P 0 , which has a strong perceptual correlation to the scenario context, the generated adversarial camouflage in this case can be more unsuspicious and natural to human perception. Since humans pay more attention to object shapes when making predictions [29], we further preserve the shape information of the seed content patch to improve the human attention correlations. Thus, the humanspecific attention mechanism is evaded, leading to more natural camouflage.…”

Section: Framework Overviewmentioning

confidence: 99%

Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World

Wang¹,

Liu²,

Yin³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Deep learning models are vulnerable to adversarial examples. As a more threatening type for practical deep learning systems, physical adversarial examples have received extensive research attention in recent years. However, without exploiting the intrinsic characteristics such as model-agnostic and human-specific patterns, existing works generate weak adversarial perturbations in the physical world, which fall short of attacking across different models and show visually suspicious appearance. Motivated by the viewpoint that attention reflects the intrinsic characteristics of the recognition process, this paper proposes the Dual Attention Suppression (DAS) attack to generate visuallynatural physical adversarial camouflages with strong transferability by suppressing both model and human attention. As for attacking, we generate transferable adversarial camouflages by distracting the model-shared similar attention patterns from the target to non-target regions. Meanwhile, based on the fact that human visual attention always focuses on salient items (e.g., suspicious distortions), we evade the human-specific bottom-up attention to generate visuallynatural camouflages which are correlated to the scenario context. We conduct extensive experiments in both the digital and physical world for classification and detection tasks on up to date models (e.g., Yolo-V5) and significantly demonstrate that our method outperforms state-of-the-art methods. 1 * Corresponding author 1 Our code can be found in https://github.com/nlsdesafety-team/DualAttentionAttack.

show abstract

“…A recent work by Yao et al [39] leverages multi-view attacks inspired by EOT, in order to devise 3D adversarial objects perturbing the texture space, investigating the attack quality using multiple classifiers. Finally, Liu et al [40] considers the case of embodied agents performing navigation and question answering. To better attack the task at hand, the perturbations are focused on the salient stimuli characterizing the temporal trajectory followed by the embodied agent to complete its task.…”

Section: Adversarial Objectsmentioning

confidence: 99%

Messing Up 3D Virtual Environments: Transferable Adversarial 3D Objects

Meloni¹,

Tiezzi²,

Pasqualini³

et al. 2021

Preprint

View full text Add to dashboard Cite

In the last few years, the scientific community showed a remarkable and increasing interest towards 3D Virtual Environments, training and testing Machine Learning-based models in realistic virtual worlds. On one hand, these environments could also become a mean to study the weaknesses of Machine Learning algorithms, or to simulate training settings that allow Machine Learning models to gain robustness to 3D adversarial attacks. On the other hand, their growing popularity might also attract those that aim at creating adversarial conditions to invalidate the benchmarking process, especially in the case of public environments that allow the contribution from a large community of people. Most of the existing Adversarial Machine Learning approaches are focused on static images, and little work has been done in studying how to deal with 3D environments and how a 3D object should be altered to fool a classifier that observes it. In this paper, we study how to craft adversarial 3D objects by altering their textures, using a tool chain composed of easily accessible elements. We show that it is possible, and indeed simple, to create adversarial objects using off-the-shelf limited surrogate renderers that can compute gradients with respect to the parameters of the rendering process, and, to a certain extent, to transfer the attacks to more advanced 3D engines. We propose a saliency-based attack that intersects the two classes of renderers in order to focus the alteration to those texture elements that are estimated to be effective in the target engine, evaluating its impact in popular neural classifiers.

show abstract

Spatiotemporal Attacks for Embodied Agents

Cited by 33 publications

References 23 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World

Messing Up 3D Virtual Environments: Transferable Adversarial 3D Objects

Contact Info

Product

Resources

About