Adversarial Examples that Fool Detectors

By Jiajun Lu, Hussein Sibai, Evan Fabry. 2017

159 citations recorded by the source corpus.

An adversarial example is an example that has been adjusted to produce a wrong label when presented to a system at test time. To date, adversarial example constructions have been demonstrated for classifiers, but not for detectors. If adversarial examples that could fool a detector exist, they could be used to (for example) maliciously create security hazards on roads populated with smart vehicles. In this paper, we demonstrate a construction that successfully fools two standard detectors, Faster RCNN and YOLO. The existence of such examples is surprising, as attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - makes it quite likely that adversarial patterns are strongly disrupted. We show that our construction produces adversarial examples that generalize well across sequences digitally, even though large perturbations are needed. We also show that our construction yields physical objects that are adversarial.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, background): “Beyond data inference, MLmodels have been shown to be subject to a variety of other attacks, such as, adversarial attacks on object detectors [27] or classifiers [13, 29, 30, 32], malicious algorithms which discreetly memorize the training data samples [39], and malicious classifiers which mislead t”
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (2018, background): “on-based methods [20]. In addition to image classiﬁcation, attacks to other CNN-related tasks have also been actively investigated. Typical examples include semantic segmentation and object detection [21, 22, 23, 24, 25], image captioning [26], and visual QA [27]. Besides, recent studies have also c”
Towards Adversarially Robust Object Detection (2019, methodology): “Recently, it has been shown that object detectors can also be attacked by maliciously crafted inputs [57, 32, 23, 6, 55, 11, 31, 22] ( c.f .”
ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector (2018, methodology): “A perturbed stop sign is shown in [13] that cannot be detected by the Faster R-CNN object detector [18].”
Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection (2018, background): “Adversarial examples of physical objects were also developed to fool object detectors [28], [7], [2].”
AdvHat: Real-World Adversarial Attack on ArcFace Face ID System (2019, background): “One of the first works [17] proposes an adversarial attack on Faster R-CNN [24] stop sign detector using a sort of EOT (handcrafted estimation of a viewing map).”
Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples (2019, methodology): “This paper’s focus is evasion attacks which have been proposed against supervised ML algorithms used for image classification [13, 18, 24, 45, 97, 114], object detection [26, 83, 127], image segmentation [6, 41], speech recognition [19, 133] as well as other tasks [27, 48, 65, 129]; generative model”