Universal Physical Camouflage Attacks on Object Detectors

Abstract

In this paper, we study physical adversarial attacks on object detectors in the wild. Prior arts on this matter mostly craft instance-dependent perturbations only for rigid and planar objects. To this end, we propose to learn an adversarial pattern to effectively attack all instances belonging to the same object category (e.g., person, car), referred to as Universal Physical Camouflage Attack (UPC). Concretely, UPC crafts camouflage by jointly fooling the region proposal network, as well as misleading the classifier and the regressor to output errors. In order to make UPC effective for articulated non-rigid or non-planar objects, we introduce a set of transformations for the generated camouflage patterns to mimic their deformable properties. We additionally impose optimization constraint to make generated patterns look natural for human observers. To fairly evaluate the effectiveness of different physical-world attacks on object detectors, we present the first standardized virtual database, AttackScenes, which simulates the real 3D world in a controllable and reproducible environment. Extensive experiments suggest the superiority of our proposed UPC compared with existing physical adversarial attackers not only in virtual environments (AttackScenes), but also in real-world physical environments. Codes, models, and demos are publicly available at https://mesunhlf. github.io/index_physical.html.

NaturalAE: Natural and robust physical adversarial examples for object detectors

“…We evaluate the generated adversarial examples from the following two aspects: the success rate of adversarial examples and the naturalness of adversarial examples. First, similar to the existing works [20] and [34], we calculate the success rate R s of adversarial examples as follows [20,34]:…”

“…Recently, Huang et al [34] develop an Universal Physical Camouflage (UPC) attack for object detectors, which can attack all instances of the same target class (e.g., all cars in an input image) with the generated universal pattern. The above attack methods [22][23][24][25]34] add the perturbations into the target objects to generate the adversarial examples, while some other works [35][36][37] can launch the physical adversarial attacks without manipulating the target objects. Huang et al [35] craft an adversarial example that looks like the advertising signboard.…”

“…However, these existing studies [25,34] add obvious perturbations on the target objects, which cause their generated adversarial examples to be easily perceived by humans. Although the recent works [35][36][37] do not manipulate the target objects, their generated adversarial signboard [35] and patch [36] are very large, which make them look strange compared to the surrounding environments.…”