Transferable Adversarial Attacks for Image and Video Object Detection

Abstract

Identifying adversarial examples is beneficial for understanding deep networks and developing robust models. However, existing attacking methods for image object detection have two limitations: weak transferability-the generated adversarial examples often have a low success rate to attack other kinds of detection methods, and high computation cost-they need much time to deal with video data, where many frames need polluting. To address these issues, we present a generative method to obtain adversarial images and videos, thereby significantly reducing the processing time. To enhance transferability, we manipulate the feature maps extracted by a feature network, which usually constitutes the basis of object detectors. Our method is based on the Generative Adversarial Network (GAN) framework, where we combine a high-level class loss and a low-level feature loss to jointly train the adversarial example generator. Experimental results on PASCAL VOC and ImageNet VID datasets show that our method efficiently generates image and video adversarial examples, and more importantly, these adversarial examples have better transferability, therefore being able to simultaneously attack two kinds of representative object detection models: proposal based models like Faster-RCNN and regression based models like SSD.

Towards Adversarially Robust Object Detection

“…We focus on one-stage detectors in this work due to its essential role in different variants of detectors. A number of attacks for object detectors have been developed very recently [57,32,6,11,55,23,22,31]. [57] extends the attack generation method from classification to detection and demonstrates that it is possible to attack objectors using a designed classification loss.…”

“…Many different attack methods for object detectors have been developed very recently [57,32,6,11,55,23,22,31]. Although there are many differences in the formulations of these attacks, when viewed from the multi-task learning…”

“…Components loss cls loss loc T N T N ShapeShifter [6] DFool [32], PhyAttack [11] DAG [57], Transfer [55] DPatch [31] RAP [23] BPatch [22] Table 1. Analysis of existing attack methods for object detection.…”

“…From this perspective, we can categorize existing attack methods as in Table 1. It is clear that some methods use classification loss [6,32,11,57,55] while other methods also incorporated localization loss [31,23,22]. There are two perspectives for explaining the effectiveness of individual task loss in generating attacks: i) the classification and localization tasks share a common base-net, implying that the weakness in the base-net will be shared among all tasks built upon it; ii) while the classification and localization outputs have dedicated branches for each task beyond the shared base-net, they are coupled in the testing phase due to the usage of NMS, which jointly use class scores and bounding box locations for redundant prediction pruning.…”

Review of Artificial Intelligence Adversarial Attack and Defense Technologies

“…In this paper, we summarize applications in four fields. In the computer vision field, there are adversarial attacks in image classification [15,17,[24][25][26], semantic image segmentation, and object detection [27,28]. In natural language processing fields, there are adversarial attacks in machine translation [29] and text generation [30].…”