Source-linked AI summary
DPatch: An Adversarial Patch Attack on Object Detectors
Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, Yiran Chen
TL;DR
The paper studies how to attack modern object detectors, whose predictions require both localization and classification. It proposes DPatch, an adversarial patch that jointly attacks those components, and finds effective attacks against Faster R-CNN and YOLO, including in black-box settings.
Problem
Object detectors are important deployed systems, while existing image-wide perturbations and classifier-focused patches provide limited practical coverage for attacking detector predictions.
Method
DPatch is an iteratively trained adversarial patch that simultaneously attacks bounding box regression and object classification in Faster R-CNN or YOLO.
Results
DPatch decreases YOLO mAP from 65.7% to 0 and Faster R-CNN with ResNet101 mAP from 75.10% to 0 under untargeted attacks.
Takeaways & Limitations
DPatch attacks are effective in black-box settings and transfer across detector architectures and training datasets, indicating vulnerability to patch-based attacks.
Abstract
from arXiv · showhide
Object detectors have emerged as an indispensable module in modern computer vision systems. In this work, we propose DPatch -- a black-box adversarial-patch-based attack towards mainstream object detectors (i.e. Faster R-CNN and YOLO). Unlike the original adversarial patch that only manipulates image-level classifier, our DPatch simultaneously attacks the bounding box regression and object classification so as to disable their predictions. Compared to prior works, DPatch has several appealing properties: (1) DPatch can perform both untargeted and targeted effective attacks, degrading the mAP of Faster R-CNN and YOLO from 75.10% and 65.7% down to below 1%, respectively. (2) DPatch is small in size and its attacking effect is location-independent, making it very practical to implement real-world attacks. (3) DPatch demonstrates great transferability among different detectors as well as training datasets. For example, DPatch that is trained on Faster R-CNN can effectively attack YOLO, and vice versa. Extensive evaluations imply that DPatch can perform effective attacks under black-box setup, i.e., even without the knowledge of the attacked network's architectures and parameters. Successful realization of DPatch also illustrates the intrinsic vulnerability of the modern detector architectures to such patch-based adversarial attacks.
Introduction
Object detectors remain important but vulnerable systems, while existing image-wide perturbations and classifier-focused patches do not translate cleanly to detector attacks. DPatch addresses this gap by jointly attacking localization and classification with a small patch, including under black-box conditions.
- Object detectors are widely deployed in surveillance and autonomous vehicles, making their adversarial vulnerability an important security concern.
- Full-image additive-noise attacks are less practical for real-world physical deployment because they manipulate the whole image.
- The original adversarial patch fails against Faster R-CNN because detectors first localize multiple objects before classifying them, creating many targets to attack.
- DPatch simultaneously attacks bounding box regression and object classification through an iteratively trained adversarial patch.
- A 40-by-40 DPatch supports both untargeted attacks that disrupt localization and targeted attacks that make the detector detect only the patch.
- DPatch remains effective in black-box settings without knowledge of the attacked network’s architecture or parameters.
Related Work
Prior work established that CNN predictions can be manipulated through adversarial perturbations, using gradient-based, iterative, and related attack methods.
- Adversarial attacks manipulate CNN classification results by adding small perturbations to input examples.
- Existing attack strategies include gradient-based methods such as FGSM and PGD and iterative methods such as DeepFool and Carlini-Wagner.
Proposed Approach
DPatch adapts adversarial patches to object detectors by attacking bounding-box regression and classification together. It is trained with detector losses and evaluated across patch sizes, locations, targeted classes, and detector architectures.
- Detector background: Modern detectors first generate object regions and then classify them, so attacking them requires disrupting many candidate regions rather than one image-level prediction.Faster R-CNN uses region proposals and RoIs; its RPN generates multiple anchor boxes at each sliding position.
- DPATCH training: The training system inserts a randomly initialized patch, evaluates detector classification and bounding-box regression against patch coordinates and a target label, then updates patch pixels by back-propagation.The detector can be Faster R-CNN or YOLO, with untargeted target label 0 and targeted attacks using the selected class label.
- DPATCH formulation: DPatch optimizes an untargeted patch to maximize detector loss for the true class and bounding box, or a targeted patch to minimize loss for specified labels.The targeted objective uses target class label yt and bounding-box label Bt, while patch shifts are sampled uniformly during training.
- DPATCH design: A default 40-by-40 patch is attached to the image corner, while randomly shifting the same-sized patch during training is used to study and promote location invariance.The random-location design samples a new shift at each training iteration without modifying the patch pixels.
- Evaluation settings: Experiments vary patch size and targeted class, and test whether patches trained on one detector can fool another detector with an unknown architecture.Evaluated sizes are 20-by-20, 40-by-40, and 80-by-80; targeted classes include bike, boat, cow, and tv.
Experiments
Experiments show that small DPATCHes can severely degrade Faster R-CNN and YOLO detection, in untargeted and targeted settings. Attack effectiveness depends on training saturation, target class, and patch size, while location has little influence and detector transferability is observed.
- Untargeted DPATCH Attack: A 40-by-40 untargeted DPATCH causes YOLO to misdetect a correctly detected bike as sofa and person.The patch aims to disable the detector rather than make it recognize a particular class.
- Untargeted DPATCH Attack: 65.7% to 0 and 75.10% to 0: untargeted DPATCH reduces YOLO and Faster R-CNN ResNet101 mAP across Pascal VOC 2007 test images.The attack disables detection without requiring a specific target label.
- Targeted DPATCH Attack: A 20-by-20 tv-targeted DPATCH makes Faster R-CNN recognize only the patch region, with predicted probabilities of 0.997 and 1.000 in the reported images.Other objects are ignored, invalidating the detector’s multi-object detection and recognition function.
- Targeted DPATCH Attack: After approximately 200k iterations, targeted DPATCH reduces Faster R-CNN mAP from 75.10% to 0.98% across almost all 20 Pascal VOC 2007 classes.For tv, the reported saturation point is about 180k iterations, after which additional training no longer improves attack effects.
- Targeted DPATCH Attack: Targeted attacks can produce wrong classifications and bounding boxes: class loss may converge while bounding-box loss remains comparatively high.The authors still consider the attack successful because the detector is disabled, not because the patch is accurately localized.
- Further Analysis: Valid attack size varies by class: 20-by-20 patches attack bike, bird, and boat, while 80-by-80 patches still cannot thoroughly misclassify bottle, motor, person, and plant.Patch size is therefore selected according to the classes targeted.
- Further Analysis: Target class strongly affects attack strength: cow and tv reduce mAP to almost 0, whereas bike and boat reduce it to 24.72% and 33.50%.The authors identify tv and cow as more efficient target classes for attacking Faster R-CNN.
Conclusions
DPATCH successfully attacks both two-stage Faster R-CNN and one-stage YOLO detectors by learning and embedding a small patch in input images.
- DPATCH effectively attacks both Faster R-CNN and YOLO detector architectures.
- DPATCH uses a small embedded adversarial patch to attack object detectors.