Source-linked AI summary
Adversarial Examples that Fool Detectors
Jiajun Lu, Hussein Sibai, Evan Fabry
TL;DR
The paper asks whether adversarial examples, previously demonstrated mainly for classifiers, can fool object detectors—a question with potential road-safety implications. It develops a registration-based construction that optimizes patterns across views, and shows that the resulting examples fool Faster RCNN and YOLO digitally and can fool detectors physically, although large disruptions are required.
Problem
Adversarial examples had been demonstrated for classifiers but not detectors, whose bounding-box search may disrupt adversarial patterns; the gap matters for smart-vehicle road safety.
Method
The paper registers video frames into a shared object coordinate system and optimizes adversarial patterns across viewing conditions for detector attacks.
Results
The construction fools Faster RCNN and transfers to YOLO, while digitally generalized attacks with large perturbations can also produce physical adversarial objects.
Takeaways & Limitations
The results establish that adversarial examples can fool detectors digitally and physically in suitable circumstances, despite detector-specific localization challenges.
Abstract
from arXiv · showhide
An adversarial example is an example that has been adjusted to produce a wrong label when presented to a system at test time. To date, adversarial example constructions have been demonstrated for classifiers, but not for detectors. If adversarial examples that could fool a detector exist, they could be used to (for example) maliciously create security hazards on roads populated with smart vehicles. In this paper, we demonstrate a construction that successfully fools two standard detectors, Faster RCNN and YOLO. The existence of such examples is surprising, as attacking a classifier is very different from attacking a detector, and that the structure of detectors - which must search for their own bounding box, and which cannot estimate that box very accurately - makes it quite likely that adversarial patterns are strongly disrupted. We show that our construction produces adversarial examples that generalize well across sequences digitally, even though large perturbations are needed. We also show that our construction yields physical objects that are adversarial.
1. Introduction
The paper addresses whether adversarial examples can fool object detectors, whose bounding-box search and labeling structure differs from classification. It introduces detector attacks that transfer digitally, work physically in suitable circumstances, and require large pattern disruptions.
- Motivation: The paper studies whether adversarial examples can fool detectors, motivated by potential security hazards involving smart vehicles.Road-sign detection is presented as a particularly consequential application.
- Motivation: Detectors must first identify bounding boxes before labeling objects, making their behavior more complex than that of classifiers.The paper notes that detectors’ box coverage and sampling patterns are complex and poorly understood.
- Contributions: The proposed method reliably causes Faster RCNN to miss or mislabel examples, and the unmodified examples also fool YOLO 9000.Transfer across these two detector architectures is presented as evidence that the construction generalizes across models.
- Contributions: The constructed adversarial examples can be physically created and fool detectors in suitable circumstances, while also bypassing recent image-processing defenses.The physical attacks are reported as successful despite the practical constraints of the setting.
- Contributions: Detector attacks require quite large disruptions, with physical adversarial examples needing larger disruptions than digital examples.This requirement distinguishes the demonstrated detector attacks from the small perturbations commonly associated with classifier attacks.
2. Background
Prior work established adversarial examples for classifiers and some physical objects, but detector attacks remained unresolved because detectors must locate objects before labeling them. Earlier stop-sign attacks did not fool standard detectors, underscoring the gap this paper targets.
- Adversarial examples: Classifier attacks typically search for examples near correctly labeled inputs while inducing misclassification, often using small perturbations.The literature also reports transferability and physical persistence for some classifier attacks.
- Adversarial examples: Physical adversarial objects have been shown to remain misclassified across different viewing angles at roughly fixed distances.The prior texture-search procedure renders the object under sampled viewing conditions and optimizes the texture for misclassification.
- Defenses: Image-processing defenses may remove unnatural adversarial patterns, although adversarial examples can be difficult to distinguish from ordinary inputs.The background reviews both detection difficulty and defenses based on feature or image processing.
- Detectors and classifiers: Attacking a road-sign detector matters more than attacking a road-sign classifier because real images contain many objects and require localization plus labeling.The paper frames detector attacks as a potential road-safety hazard.
- Prior detector work: Earlier physical stop signs were misclassified after cropping, but that procedure did not fool a standard detector because cropping poorly approximated detector box selection.The prior attack was not intended as a detector attack.
3. Method
The method registers object video frames into a shared root coordinate system, then optimizes a texture pattern across diverse views to reduce detector scores. It uses small sign-gradient updates, extends the construction to faces, and finds that distance constraints do not yield small perturbations.
- Core approach: The method generates digital and physical adversarial examples robust to changing viewing conditions through registration and reconstruction from moving-camera video.Accurate 3D alignment is required; stop signs are convenient because they are 2D polygons, while faces use a virtual 3D model.
- Stop signs: Training frames are aligned with a shared texture map, and the pattern is optimized to look like a stop sign while fooling Faster RCNN.The construction uses correspondences between stop-sign vertices in frames and the root-coordinate texture.
- Optimization: The optimization averages gradients across training frames and uses the sign of the gradients because large unsigned-gradient steps frequently stall.A very small step length represents an update of one least significant bit.
- Optimization: The optimization may run for hundreds or thousands of steps and can terminate when validation attacks succeed in more than 90% of cases.A fixed iteration count is an alternative termination criterion.
- Perturbation constraints: Constraining L2 distance to the original stop sign changes the perturbation pattern but does not produce small perturbations.The distance constraint is intended to reduce perceptibility, yet the experiments show that it cannot achieve that goal in magnitude.
- Extending to faces: The construction extends to faces by reconstructing a shared face mesh and establishing dense pixel-to-mesh and mesh-to-pixel correspondences.Face geometry and identity and expression variation are represented with a morphable face model.
4. Results
The experiments show that small perturbations can fool detectors on single images, but attacks that generalize across views or into physical settings require much larger pattern changes. Successful attacks can transfer from Faster RCNN to YOLO and, under suitable circumstances, to physical objects.
- Generalizing across view conditions: Generalizing attacks across view conditions requires significant changes to stop-sign and face patterns.The authors generate unified perturbations from multiple video frames and test them on new view conditions.
- Defenses and perturbation size: The experiments indicate that simple defenses fail against adversarial examples that generalize, while physical examples require larger disruptions than digital ones.The paper reports that the distance constraint changes perturbation patterns but does not enable small perturbations.
- Single-image attacks: Small perturbations suffice to fool Faster RCNN on single stop-sign and face images, though this has no practical significance.Whole-image perturbations can cause missed detections, while region-specific perturbations can produce a wrong label or missed face detection.
- Physical-world attacks: Physical attacks are less effective than digital attacks: the two less-perturbed stop signs remain detectable, while the most strongly perturbed sign is harder to detect.The physical experiments use printed adversarial patterns attached to real stop signs and evaluate videos with Faster RCNN.
- Generalizing to YOLO: Successful Faster RCNN attacks generalize to YOLO, especially for large or extremely large perturbations and tree backgrounds.Table 1 reports detection rates for both detectors across backgrounds, distances, and train/validation/test splits.
- Interpretation: The authors hypothesize that large, recognizable patterns generalize better because they rely on robust pattern recognition rather than fragile numerical accumulation.They connect this hypothesis to the disruption of large patterns during physical transfer.
5. Conclusion
The paper demonstrates adversarial examples that fool detectors, including physical objects. However, the constructed attacks require large perturbations, suggesting detector box prediction may provide a natural defense.
- The paper demonstrates the first adversarial examples that can fool detectors.
- The construction also produces physical objects that fool detectors.
- All constructed adversarial perturbations require large perturbations.
- The results suggest that detector box prediction acts as a form of natural defense.