Transferable Adversarial Attacks for Image and Video Object Detection

Wei, Xingxing; Liang, Siyuan; Chen, Ning; Cao, Xiaochun

doi:10.48550/arxiv.1811.12641

Cited by 17 publications

(35 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since then, several works have focused on adversarial attacks. Early works [9,21,35,34,31] add perturbations in the digital world, directly changing pixel values which are fed into the networks. Latter works focus on creating physical adversarial objects, such as eyeglasses [26], posters [32], and animals [1], in the real world, further broadening the influence of adversarial attacks.…”

Section: Adversarial Attackmentioning

confidence: 99%

“…The former method [9,21,35] applies many times of gradient ascent to maximize an adversarial objective function for deceiving deep networks and is usually time-consuming. However, the latter one [34,31] applies tremendous data to train an adversarial perturbation-generator. The latter method is faster than the former method because only one-time forward propagation is needed for each attack after training.…”

Section: Introductionmentioning

confidence: 99%

“…The latter method is faster than the former method because only one-time forward propagation is needed for each attack after training. In recent years, adversarial attack has become a popular topic and has extended from image classification to more challenging tasks, such as object detection [35,31] and semantic segmentation [35].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises

Yan

Wang

et al. 2020

Preprint

View full text Add to dashboard Cite

Adversarial attack of CNN aims at deceiving models to misbehave by adding imperceptible perturbations to images. This feature facilitates to understand neural networks deeply and to improve the robustness of deep learning models. Although several works have focused on attacking image classifiers and object detectors, an effective and efficient method for attacking single object trackers of any target in a model-free way remains lacking. In this paper, a cooling-shrinking attack method is proposed to deceive state-of-the-art SiameseRPN-based trackers. An effective and efficient perturbation generator is trained with a carefully designed adversarial loss, which can simultaneously cool hot regions where the target exists on the heatmaps and force the predicted bounding box to shrink, making the tracked target invisible to trackers. Numerous experiments on OTB100, VOT2018, and LaSOT datasets show that our method can effectively fool the state-of-theart SiameseRPN++ tracker by adding small perturbations to the template or the search regions. Besides, our method has good transferability and is able to deceive other topperformance trackers such as DaSiamRPN, DaSiamRPN-UpdateNet, and DiMP. The source codes are available at https://github.com/MasterBin-IIAU/CSA.

show abstract

Section: Adversarial Attackmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises

Yan

Wang

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…Adversarial Attacks and Defenses. When presented with adversarial samples, which are maliciously designed by imperceptible perturbations [21,33,48], deep neural networks often suffer from severe performance deterioration, e.g., [62,21,4,11] for classification models and [39,38,47,46,72,69,77,1,57] for detection/segmentation models. To address this notorious vulnerability, numerous defense mechanisms [76,55,61,50,60,52] have been proposed, such as input transformation [73,40,22,16], randomization [45,44,15], and certified defense approaches [9,51].…”

Section: Related Workmentioning

confidence: 99%

“…Adversarial vulnerability is a critical issue in the practical application of neural networks. Various attacks have been proposed to challenge visual recognition models of classification, detection and segmentation [62,21,39,38,47,46,47,72,69,77,1,57]. Such susceptibility has motivated abundant studies on adversarial defense mechanisms for training robust neural networks [55,61,50,60,52,26,6,7,29], among which adversarial training based methods [48,76],…”

Section: Introductionmentioning

confidence: 99%

Adversarial Learning and Augmentation for Speaker Recognition

Chien¹,

Peng²

2018

The Speaker and Language Recognition Workshop (Odyssey 2018)

View full text Add to dashboard Cite

This paper develops a new generative adversarial network (GAN) to artificially generate i-vectors to deal with the issue of unbalanced or insufficient data in speaker recognition based on the probabilistic linear discriminant analysis (PLDA). Data augmentation is performed to improve system robustness over the variations of i-vectors under different number of training utterances. Our idea is to incorporate the class label into GAN which involves a minimax optimization problem for adversarial learning. We build a generator and a discriminator where the class conditional i-vectors are produced by the generator such that the discriminator can not distinguish them as the fake samples. In particular, multiple learning objectives are optimized to build a specialized deep model for model regularization in speaker recognition. In addition to the minimax optimization of adversarial loss, the posterior probabilities of class labels given real and fake samples are maximized. The cosine similarity between real and fake i-vectors is also minimized to preserve the quality of the generated i-vector. The loss functions for data reconstruction and Gaussian regularization in PLDA model are minimized. The experiments illustrate the merit of multi-objective learning for deep adversarial augmentation for speaker recognition.

show abstract

Adversarial attack algorithm for object detection based on improved differential evolution

Wang²,

Zhang³

et al. 2022

6th International Workshop on Advanced Algorithms and Control Engineering (IWAACE 2022)

View full text Add to dashboard Cite

With the wide application of deep learning object detection model, its internal security vulnerability is also highlighted. In this paper, a black box adversarial attack algorithm SAD-DE based on improved differential evolution is proposed to reveal the possible security risks of the object detection model. Taking full advantage of the high optimization efficiency and simple parameter setting of differential evolution algorithm, multi mutation strategy is adopted, and the mutation rate and crossover rate are adaptively improved to effectively improve the optimization efficiency. In this paper, two public data sets are randomly exampled as test sets to counter attacks on YOLOv3 and Fast R-CNN respectively. Experimental results show that this method achieves a high fooling rate while maintaining a low anti disturbance, and achieves a maximum improvement of 33% compared with other black box attack algorithms.

show abstract

Transferable Adversarial Attacks for Image and Video Object Detection

Cited by 17 publications

References 24 publications

Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises

Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises

Adversarial Learning and Augmentation for Speaker Recognition

Adversarial attack algorithm for object detection based on improved differential evolution

Contact Info

Product

Resources

About