Adversarial Patch

By Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, Justin Gilmer. 2017

1,317 citations recorded by the source corpus.

We present a method to create universal, robust, targeted adversarial image patches in the real world. The patches are universal because they can be used to attack any scene, robust because they work under a wide variety of transformations, and targeted because they can cause a classifier to output any target class. These adversarial patches can be printed, added to any scene, photographed, and presented to image classifiers; even when the patches are small, they cause the classifiers to ignore the other items in the scene and report a chosen target class. To reproduce the results from the paper, our code is available at https://github.com/tensorflow/cleverhans/tree/master/examples/adversarial_patch

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Natural Adversarial Examples (2019, background): “Other work has shown how to print 2D [32, 5] or 3D [38, 1] objects that fool classiﬁers.”
Universal Adversarial Triggers for Attacking and Analyzing NLP (2019, background): “The adversarial threat is higher if an attack is universal : using the exact same attack for any input (Moosavi-Dezfooli et al., 2017; Brown et al., 2017).”
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “Some recent work tries to craft universal perturbations, which would trigger misclassification for multiple images in an uninfected DNN [52], [53].”
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, methodology): “[3] for a range of weighting values α ∈ [0 , 1] .”
Certifying Some Distributional Robustness with Principled Adversarial Training (2017, background): “For example, it is appropriate in certain applications to hedge against adversarial perturbations to a small ﬁxed region of an image [15].”
Evolving Robust Neural Architectures to Defend from Adversarial Attacks (2019, background): “Afterwards, a series of vulnerabilities were found [25],[23],[5],[34].”
Adversarial Logit Pairing (2018, background): “We would like to note that these defense mechanisms are not yet sufﬁcient to secure machine learning in a real sys-tem (see many of the concerns raised by (Brown et al., 2017) and Gilmer et al. (2018)), and that attacks could be developed against our work in the future.”
Motivating the Rules of the Game for Adversarial Example Research (2018, background): “Another example similar in spirit to our background attack is the adversarial patch [105].”
Adversarial Risk and the Dangers of Evaluating Against Weak Attacks (2018, background): “…work also demonstrated that image classiﬁers can be fooled without direct access to the model, so called ‘black-box’ or ‘oblivious’ attacks, (Paper-not et al., 2017; 2016), even when using printed images or 3D physical objects (Kurakin et al., 2016b; Brown et al., 2017; Athalye et al., 2018b).”
Semantic Adversarial Examples (2018, background): “In [22], the authors suggested that instead of small or imperceptible perturbations, the adversary may opt for more effective but noticeable perturbations, and proposed a method to create adversarial patches.”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, methodology): “Taking trafﬁc signs as an example, an adversary performing perturbation-based attacks can draw grafﬁti [4] or place stickers [18] on an existing stop sign in order to exploit a classiﬁer.”
Semidefinite relaxations for certifying robustness to adversarial examples (2018, background): “Many successful attacks involve inconspicious but clearly visible perturbations [11, 24, 6, 4], or large but semantics-preserving perturbations in the case of natural language [15].”
PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts (2023, neutral): “We note that this attack is analogous to universal adversarial perturbation (UAP) (Moosavi-Dezfooli et al., 2017; Brown et al., 2017) and universal adversarial trigger (UAT) (Wallace et al., 2019), extending these concepts to the realm of prompts.”
ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector (2018, methodology): “The Expectation over Transformation [3,4] idea is simple: adding random distortions in each iteration of the optimization to make the resulting perturbation more robust.”
Convolutional neural networks: an overview and application in radiology (2018, neutral): “15) [60 – 63].”
Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection (2019, methodology): “In [3] Brown et al. create a method that, instead of changing pixel values, generates patches that can be digitally placed on the image to fool a classiﬁer.”
Explaining Deep Learning Models with Constrained Adversarial Examples (2019, background): “ regression, decision trees, SVMs, and nearest neighbours. Others show that adversarial examples can carry over to the real world by printing or 3D printing them, and fooling camera based classiﬁers ([6,2,1]). CADEX uses adversarial examples to facilitate an understanding of the model instead of att”
Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors (2019, background): “placed adversarial patches [3] on raw images, forcing classifiers to output incorrect predictions.”
Physical Adversarial Examples for Object Detectors (2018, methodology): “Similar to the “ad-versarial patch” approach of [2], our goal is to create a physical sticker that can be added to any existing scene.”