Standard detectors aren't (currently) fooled by physical adversarial stop signs

Abstract

An adversarial example is an example that has been adjusted to produce the wrong label when presented to a system at test time. If adversarial examples existed that could fool a detector, they could be used to (for example) wreak havoc on roads populated with smart vehicles. Recently, we described our difficulties creating physical adversarial stop signs that fool a detector. More recently, Evtimov et al. produced a physical adversarial stop sign that fools a proxy model of a detector. In this paper, we show that these physical adversarial stop signs do not fool two standard detectors (YOLO and Faster RCNN) in standard configuration. Evtimov et al.'s construction relies on a crop of the image to the stop sign; this crop is then resized and presented to a classifier. We argue that the cropping and resizing procedure largely eliminates the effects of rescaling and of view angle. Whether an adversarial attack is robust under rescaling and change of view direction remains moot. We argue that attacking a classifier is very different from attacking a detector, and that the structure of detectors -which must search for their own bounding box, and which cannot estimate that box very accurately -likely makes it difficult to make adversarial patterns. Finally, an adversarial pattern on a physical object that could fool a detector would have to be adversarial in the face of a wide family of parametric distortions (scale; view angle; box shift inside the detector; illumination; and so on). Such a pattern would be of great theoretical and practical interest. There is currently no evidence that such patterns exist.

Corner Case Generation and Analysis for Safety Assessment of Autonomous Vehicles

“…Furthermore, Evtimov et al (15) and Eykholt et al (16) designed a real-world stop sign with domain knowledge from adversarial examples and successfully let the object recognition system classify it as a speed limit sign. Several works such as Lu et al (33,34) showed that the adversarial stop signs in the physical world will not fool the modern CAV perception system as the CAV is continuously moving and detecting the object at each time step. However, Chen et al (14) showed that the perception system of CAV is still vulnerable to specific adversarial examples.…”

Controlled Caption Generation for Images Through Adversarial Attacks

“…More recently, there has been an increasing interest in the research community to explore whether adversarial examples are also effective against more complex vision systems [34,33,32]. For instance, among the latest results along this debate, Lu et al showed that adversarial examples previously constructed to fool CNN-based classifiers cannot fool state-of-the-art detectors [33].…”

“…More recently, there has been an increasing interest in the research community to explore whether adversarial examples are also effective against more complex vision systems [34,33,32]. For instance, among the latest results along this debate, Lu et al showed that adversarial examples previously constructed to fool CNN-based classifiers cannot fool state-of-the-art detectors [33]. In this work, we are interested in exploring whether language context in language-and-vision systems offer more resistance to adver-target_img A black and white dog sits next to a bottle on the ground target_caption 𝝉 > 0.15: "a dog that is laying down on ground" predicted_adv_captions Exact: "A black and white dog sits next to a bottle on the ground" 𝝉 > 0.25: "a black and white dog sitting in a kitchen" 𝝉 > 0.20: "a dog looks around while sitting in a room" 𝝉 < 0.15: "a dog looking around with open mouth" source_img Figure 1.…”

Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking

“…Since the first Adversarial Example (AE) against traffic sign image classification discovered by Eykholt et al [10], several research work in adversarial machine learning [9,30,15,16,35,6] started to focus on the context of visual perception in autonomous driving, and studied AEs on object detection models. For example, Eykholt et al [9] and Zhong et al [36] studied AEs in the form of adversarial stickers on stop signs or the back of front cars against YOLO object detectors [23], and performed indoor experiments to demonstrate the attack feasibility in the real world.…”

“…For example, as shown by our analysis later in §4, an attack on objection detection needs to succeed consecutively for at least 60 frames to fool a representative MOT process, which requires an at least 98% attack success rate ( §4). To the best of our knowledge, no existing attacks on objection detection can achieve such a high success rate [9,30,15,16,35,6].…”