Source-linked AI summary
ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector
Shang-Tse Chen, Cory Cornelius, Jason Martin, Duen Horng Chau
TL;DR
ShapeShifter addresses the challenge of crafting physical adversarial perturbations that fool object detectors across multiple bounding boxes and real-world viewing conditions. It adapts Expectation over Transformation to object detection and produces stop signs that Faster R-CNN consistently mis-detects as other objects, while applicability to safety- or security-critical systems remains unshown.
Problem
Attacking object detectors is harder than attacking image classifiers because detectors must be misled across multiple bounding boxes and scales, while physical attacks must withstand real-world distortions.
Method
ShapeShifter adapts Expectation over Transformation, which adds random distortions during optimization, to craft robust targeted physical attacks against Faster R-CNN.
Results
ShapeShifter attacks Faster R-CNN with high confidence, and high-confidence perturbations achieve 87% targeted success against the person class and 93% untargeted success across tested distances and angles.
Takeaways & Limitations
The results demonstrate that MS-COCO-learned object detectors can be vulnerable to physical adversarial inputs, creating a potential threat for security- and safety-critical computer vision systems.
Takeaways & Limitations
The attack was evaluated on an off-the-shelf pre-trained object detector, and whether it applies to safety- or security-critical systems remains to be shown.
Abstract
from arXiv · showhide
Given the ability to directly manipulate image pixels in the digital input space, an adversary can easily generate imperceptible perturbations to fool a Deep Neural Network (DNN) image classifier, as demonstrated in prior work. In this work, we propose ShapeShifter, an attack that tackles the more challenging problem of crafting physical adversarial perturbations to fool image-based object detectors like Faster R-CNN. Attacking an object detector is more difficult than attacking an image classifier, as it needs to mislead the classification results in multiple bounding boxes with different scales. Extending the digital attack to the physical world adds another layer of difficulty, because it requires the perturbation to be robust enough to survive real-world distortions due to different viewing distances and angles, lighting conditions, and camera limitations. We show that the Expectation over Transformation technique, which was originally proposed to enhance the robustness of adversarial perturbations in image classification, can be successfully adapted to the object detection setting. ShapeShifter can generate adversarially perturbed stop signs that are consistently mis-detected by Faster R-CNN as other objects, posing a potential threat to autonomous vehicles and other safety-critical computer vision systems.
1 Introduction
ShapeShifter addresses the difficulty of physically attacking object detectors, where perturbations must mislead multiple bounding-box predictions while surviving real-world conditions. It adapts Expectation over Transformation to Faster R-CNN and demonstrates consistent stop-sign misdetections in drive-by tests.
- Object detection is harder to attack than image classification because attacks must mislead multiple bounding boxes at different scales.
- Physical attacks must survive distortions from viewing distance, viewing angle, lighting, and the sensing pipeline.
- Existing physical attacks on object detectors were unsatisfactory because prior perturbations were visually conspicuous or evaluated only in limited settings.
- ShapeShifter adapts Expectation over Transformation from image classification to object detection to improve perturbation robustness.
- The attack generates perturbed stop signs that consistently fool Faster R-CNN in real drive-by tests.
2 Background
The background defines adversarial attacks and introduces Faster R-CNN as a two-stage detector whose multiple detection outputs make it difficult to attack.
- Adversarial Attack: An untargeted adversarial attack seeks a bounded perturbation that changes a model’s prediction, while a targeted attack specifies a different target class.
- Adversarial Attack: Common computer-vision perturbation measures include ℓ2 and ℓ∞ distance.
- Prior Work: Prior work showed imperceptible perturbations for DNNs and physically realizable attacks against image-classification and face-recognition systems.
- Faster R-CNN: Faster R-CNN uses a region proposal network followed by classification and bounding-box regression, sharing convolutional layers across stages.
3 Threat Model
The threat model assumes a powerful white-box adversary who manipulates physical objects rather than camera pixels, with perturbations constrained to realistic shapes and selected pixels.
- The adversary has white-box access to model architecture and weights, enabling forward passes, gradients, and offline attack crafting.
- Whether the method works with black-box access remains open, and iterative attacks may transfer less effectively than non-iterative attacks.
- The adversary cannot digitally manipulate camera pixels and must produce perturbations that survive printing and sensing.
- Perturbations are constrained in shape and limited to pixels judged inconspicuous and physically realistic.
4 Attack Method
ShapeShifter extends change-of-variable optimization and Expectation over Transformation from image classification to targeted attacks on Faster R-CNN. The method models detector outputs and region proposals, while approximating optimization around non-differentiable proposal pruning.
- Method overview: ShapeShifter adapts change-of-variable and Expectation over Transformation attacks from image classification to Faster R-CNN object detection.The method is introduced as an extension of both approaches to the detector setting.
- Robust optimization: Expectation over Transformation adds random translations, rotations, and scaling during optimization to improve perturbation robustness.Transformations can overlay the perturbed object onto backgrounds and optionally apply masks to constrain its shape.
- Robust optimization: The optimization minimizes expected target-class loss across transformed object-background composites while penalizing deviation from the original object.The expectation is over training backgrounds and transformations, and the empirical mean can be used for optimization.
- Detector formulation: An object detector outputs selected detections, each containing class probabilities and four-coordinate object locations.For simplicity, the method selects the top-N detections ranked by confidence, although the detector may produce different numbers of detections.
- Faster R-CNN extension: For Faster R-CNN, ShapeShifter simultaneously attacks classifications from all region proposals generated by the region proposal network.The method defines classification loss on each proposal sub-image before combining the proposal-level attacks.
- Faster R-CNN extension: Because proposal-pruning heuristics such as non-maximum suppression are non-differentiable, the method fixes pruned proposals after a forward pass before optimizing the second stage.This provides an approximate solution rather than end-to-end optimization through proposal pruning.
5 Evaluation
The evaluation tests ShapeShifter on printed stop signs against Faster R-CNN across controlled viewing conditions and drive-by videos. High-confidence perturbations achieve strong indoor and physical attack results, while transferability to other detectors is limited.
- Experimental setup: The evaluation uses a pre-trained Faster R-CNN with Inception-v2 features trained on MS-COCO, focusing on the stop sign class.Stop signs were chosen for their relevance to self-driving cars and their flat shape, which is easy to print.
- Experimental setup: Printed adversarial stop signs were photographed indoors across distances from 5’ to 40’ and angles from 0° to 60°.The camera always pointed at the sign, and these combinations were intended to mimic vehicle viewpoints.
- Indoor results: 87% targeted success was achieved for the person attack, while the high-confidence untargeted attack reached 93% success indoors.The sports-ball targeted attack had lower targeted success but matched the untargeted attack’s success rate.
- Indoor results: Low-confidence perturbations achieved substantially lower attack success rates than high-confidence perturbations.The authors therefore identified higher-confidence perturbations as more suitable for the challenging drive-by tests.
- Drive-by results: In drive-by tests, the person perturbation was detected as a person in 190 of 405 frames, while the sports-ball perturbation was detected as sports ball in 160 of 445 frames.The person perturbation was correctly detected as a stop sign once; the sports-ball perturbation was never detected as a stop sign.
- Transferability: Transfer to eight other MS-COCO-trained detectors was generally poor, with untargeted perturbations transferring least successfully.The most susceptible models were Faster R-CNN Inception-ResNet-V2 and SSD MobileNet-V2, and the authors leave broader transferability analysis for future work.
6 Discussion & Future Work
The discussion highlights that ShapeShifter’s perturbations are overt and may be extended beyond stop signs, while defenses and deployment assumptions remain open challenges.
- The paper contrasts human recognition of unusual stop signs with object-detector behavior, noting that detectors may classify them as something else.The examples include non-standard signs with language changes, graffiti, stickers, or occlusion, which humans would still identify as stop signs.
- ShapeShifter’s perturbations visibly deviate from standard stop signs, unlike imperceptible image-recognition attacks.The authors note that humans would probably notice these deviations, even though automated systems may still be fooled.
- A digital perturbation can make part of a stop sign resemble a baseball or tennis ball, leading the detector to identify that region as a sports ball with high confidence.The authors use this example to illustrate that automated systems may be fooled even when the perturbation is visually recognizable.
- The attack can potentially be adapted to arbitrary objects such as street lights or trash bins without restricting perturbation shape and color.The paper describes this as an extension of the attack method to other physical objects.
- Adversarial training has not yet scaled to high-performing ImageNet models, and its effectiveness against overt, large-deviation perturbations remains unclear.The discussion also notes that many other defenses suffer from gradient masking or obfuscation.
7 Conclusion
The conclusion reports that Faster R-CNN can be attacked with high confidence and frames object-detection systems as a potential security concern. It also limits the demonstrated scope to an off-the-shelf pre-trained detector and states that transfer to safety- or security-critical systems remains to be shown.
- Faster R-CNN can be attacked with high confidence despite having been considered more robust to physical adversarial attacks.
- The work demonstrates vulnerability in MS-COCO-learned object detectors and identifies adversarial inputs as a potential concern for safety- and security-critical systems.
- The demonstrated setting uses an off-the-shelf pre-trained object detector, rather than the detectors used by many real-world safety- or security-relevant systems.
- Whether this attack style applies to safety- or security-critical systems that use object detectors remains to be shown.