Note on Attacking Object Detectors with Adversarial Stickers

By Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Dawn Song, Tadayoshi Kohno, Amir Rahmati, Atul Prakash, Florian Tramèr. 2017

37 citations recorded by the source corpus.

Deep learning has proven to be a powerful tool for computer vision and has seen widespread adoption for numerous tasks. However, deep learning algorithms are known to be vulnerable to adversarial examples. These adversarial inputs are created such that, when provided to a deep learning algorithm, they are very likely to be mislabeled. This can be problematic when deep learning is used to assist in safety critical decisions. Recent research has shown that classifiers can be attacked by physical adversarial examples under various physical conditions. Given the fact that state-of-the-art objection detection algorithms are harder to be fooled by the same set of adversarial examples, here we show that these detectors can also be attacked by physical adversarial examples. In this note, we briefly show both static and dynamic test results. We design an algorithm that produces physical adversarial inputs, which can fool the YOLO object detector and can also attack Faster-RCNN with relatively high success rate based on transferability. Furthermore, our algorithm can compress the size of the adversarial inputs to stickers that, when attached to the targeted object, result in the detector either mislabeling or not detecting the object a high percentage of the time. This note provides a small set of results. Our upcoming paper will contain a thorough evaluation on other object detectors, and will present the algorithm.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Signal Processing

Citations in the corpus

Robust Physical-World Attacks on Deep Learning Models (2017, methodology): “hough image cropping has some effect on the targeted attack success rate, our recent work shows that an improved version of RP 2 can successfully attack object detectors, where cropping is not needed [7]. 6. Conclusion We introduced an algorithm (RP 2) that generates robust, physically realizable ad”
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (2018, background): “Typical examples include semantic segmentation and object detection [21, 22, 23, 24, 25], image captioning [26], and visual QA [27].”
ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector (2018, background): “A recent short note [7] claims to be able to generate some adversarial stickers that, when attaching to a stop sign, can fool the YOLO object detector [17] and can be transferable to also fool Faster R-CNN.”
AdvHat: Real-World Adversarial Attack on ArcFace Face ID System (2019, methodology): “Several works used EOT, NPS, and TV loss to attack Faster R-CNN, YOLOv2 [35] based trafﬁc sign recognition models [36, 37, 38].”
Robust Physical-World Attacks on Deep Learning Visual Classification (2018, methodology): “Although image cropping has some effect on the targeted attack success rate, our recent work shows that an improved version of RP 2 can successfully attack object detectors, where cropping is not needed [7].”