Physical Adversarial Examples for Object Detectors

By Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramèr, Atul Prakash, Tadayoshi Kohno, Dawn Song. 2018

554 citations recorded by the source corpus.

Deep neural networks (DNNs) are vulnerable to adversarial examples-maliciously crafted inputs that cause DNNs to make incorrect predictions. Recent work has shown that these attacks generalize to the physical domain, to create perturbations on physical objects that fool image classifiers under a variety of real-world conditions. Such attacks pose a risk to deep learning models used in safety-critical cyber-physical systems. In this work, we extend physical attacks to more challenging object detection models, a broader class of deep learning algorithms widely used to detect and label multiple objects within a scene. Improving upon a previous physical attack on image classifiers, we create perturbed physical objects that are either ignored or mislabeled by object detection models. We implement a Disappearance Attack, in which we cause a Stop sign to "disappear" according to the detector-either by covering thesign with an adversarial Stop sign poster, or by adding adversarial stickers onto the sign. In a video recorded in a controlled lab environment, the state-of-the-art YOLOv2 detector failed to recognize these adversarial Stop signs in over 85% of the video frames. In an outdoor experiment, YOLO was fooled by the poster and sticker attacks in 72.5% and 63.5% of the video frames respectively. We also use Faster R-CNN, a different object detection model, to demonstrate the transferability of our adversarial perturbations. The created poster perturbation is able to fool Faster R-CNN in 85.9% of the video frames in a controlled lab environment, and 40.2% of the video frames in an outdoor environment. Finally, we present preliminary results with a new Creation Attack, where in innocuous physical stickers fool a model into detecting nonexistent objects.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, methodology): “More speciﬁcally we consider an adversary that makes use of localized universal malicious objects, e.g., printed patches [26], [3], [10], [9] or 3D objects [2] (see, e.g., Figure 1), that can fool a model under real-world conditions such as lighting, sensor noise, and rotation.”
AdvHat: Real-World Adversarial Attack on ArcFace Face ID System (2019, methodology): “Several works used EOT, NPS, and TV loss to attack Faster R-CNN, YOLOv2 [35] based trafﬁc sign recognition models [36, 37, 38].”
Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors (2019, background): “Stop signs attacks on object detectors are considered in [8,5].”
Blind Backdoors in Deep Learning Models (2020, background): “In contrast to physical adversarial examples [21, 51], which involve artificially generated objects, we focus on backdoors triggered by real objects.”
AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning (2018, methodology): “The ad-blocker’s inputs can also be controlled by multiple entities, a constraint reminiscent of those that arise in physical-world attacks [12, 28, 29, 49, 75].”
Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks (2021, methodology): “To systematically generate adversarial 3D objects, we adopt an optimization-based approach similar to prior works [5]– [11].”
Adversarial T-Shirt! Evading Person Detectors in a Physical World (2019, background): “digital space only. Recently, some works showed that it is possible to create adversarial perturbations on physical objects and fool DNN-based decision makers under a variety of real-world conditions [8, 9, 10, 11, 12, 13, 14, 15, 16]. However, most of the studied physical adversarial attacks encoun”
Bag of Tricks for Adversarial Training (2020, background): “Adversarial attacks can be also realized in the physical world (Kurakin et al., 2017; Song et al., 2018a).”
Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection (2019, methodology): “The most recent work we found to fool object detectors in the real-world is the work of Eykholt et al [18].”
SentiNet: Detecting Physical Attacks Against Deep Learning Systems (2018, background): “More speciﬁcally, we consider three types of attack that we review below: physical adversarial examples [2], [4], [11], [12], [27], [40], data poisoning attacks [20], and trojaned models [25], [30].”
ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector (2018, background): “3 Three months after our work appeared on arXiv, the authors of [7] revealed their approaches in a separate paper [21] and discussed the differences with our work.”
Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training (2019, background): “Adversarial examples have been shown to be ubiquitous beyond classification, ranging from object detection [64, 18] to speech recognition [11, 9].”
Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving (2019, background): “Researchers also apply adversarial examples to the physical world to fool machine learning models [17, 27, 28].”