Standard detectors aren't (currently) fooled by physical adversarial stop signs

By Jiajun Lu, Hussein Sibai, Evan Fabry, D.A. Forsyth. 2017

60 citations recorded by the source corpus.

An adversarial example is an example that has been adjusted to produce the wrong label when presented to a system at test time. If adversarial examples existed that could fool a detector, they could be used to (for example) wreak havoc on roads populated with smart vehicles. Recently, we described our difficulties creating physical adversarial stop signs that fool a detector. More recently, Evtimov et al. produced a physical adversarial stop sign that fools a proxy model of a detector. In this paper, we show that these physical adversarial stop signs do not fool two standard detectors (YOLO and Faster RCNN) in standard configuration. Evtimov et al.'s construction relies on a crop of the image to the stop sign; this crop is then resized and presented to a classifier. We argue that the cropping and resizing procedure largely eliminates the effects of rescaling and of view angle. Whether an adversarial attack is robust under rescaling and change of view direction remains moot. We argue that attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - likely makes it difficult to make adversarial patterns. Finally, an adversarial pattern on a physical object that could fool a detector would have to be adversarial in the face of a wide family of parametric distortions (scale; view angle; box shift inside the detector; illumination; and so on). Such a pattern would be of great theoretical and practical interest. There is currently no evidence that such patterns exist.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Hardware and Architecture

In Safety, Robustness & Interpretability

Citations in the corpus

Benchmarking Neural Network Robustness to Common Corruptions and Perturbations (2019, background): “In the literature, new defenses (Lu et al., 2017; Papernot et al., 2017; Metzen et al., 2017; Hendrycks & Gimpel, 2017a) often quickly succumb to new attacks (Evtimov et al.”
Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “Previous research has shown that object detectors can be more robust to adversarial attacks than image classifiers [25].”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “[98]) is the “adversarial street sign” in which an attacker can only make tiny modifications to a street sign, with the objective of fooling self driving cars.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, neutral): “[19] showed that the detectors like YOLO9000 [147] and FasterRCNN [148] are ‘currently’ not fooled by the attacks introduced by Etimov et al.”
Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations (2018, background): “New defenses [43, 47, 45, 21] quickly succumb to new attacks [14, 6, 7].”
Adversarial Examples that Fool Detectors (2017, background): “Lu et al. showed that their construction does not fool a standard detector [17], likely because the cropping process does not proxy a detector’s box selection well, and suggested that constructing an adversarial example that fools a detector might be hard.”
Adversarial Examples on Object Recognition (2020, background): “Similarly, Li and Li[104] developed an adversarial detector based on features extracted at every layer of a convolutional neural network.”
Fooling Vision and Language Models Despite Localization and Attention Mechanism (2017, background): “show that previous adversarial examples constructed to fool CNN-based classifiers cannot fool state-of-the-art detectors [45].”
On the Robustness of Semantic Segmentation Models to Adversarial Attacks (2017, background): “This effectively makes it more challenging to produce physical adversarial examples in the real world [49] which can be processed from a wide range of viewpoints and camera distortions.”