PaperlayerView exact revision on arXiv

Source-linked AI summary

Physical Adversarial Examples for Object Detectors

Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, Tadayoshi Kohno, Dawn Song

arXiv:1807.07769v2cs.CRcs.CVcs.LG

TL;DR

Physical adversarial attacks had primarily targeted image classifiers, leaving the more complex object-detection setting underexplored despite its use in safety-critical systems. The paper adapts robust physical perturbation methods to detectors, introducing disappearance and creation attacks. YOLO v2 frequently misses adversarial Stop signs, and perturbations can transfer to Faster R-CNN, while broader generalization remains future work.

  • Problem

    Prior physical adversarial-example work focused on classifiers, while object detectors must handle multiple objects, locations, and presence and class predictions in safety-critical settings.

  • Method

    The authors extend RP2 with positional and rotational invariance and use poster or sticker perturbations for disappearance and creation attacks against object detectors.

  • Results

    YOLO v2 missed poster attacks in 85.6% of indoor and 72.5% of outdoor frames, while Faster R-CNN was fooled in 85.9% and 40.2% of frames.

  • Takeaways & Limitations

    Physical perturbations can fool object detectors across laboratory and outdoor conditions, with limited black-box transferability from YOLO to Faster R-CNN.

  • Takeaways & Limitations

    The paper leaves generalization to other physical settings and physical attacks on semantic segmentation networks for future work.

Abstract

from arXiv · show

Deep neural networks (DNNs) are vulnerable to adversarial examples-maliciously crafted inputs that cause DNNs to make incorrect predictions. Recent work has shown that these attacks generalize to the physical domain, to create perturbations on physical objects that fool image classifiers under a variety of real-world conditions. Such attacks pose a risk to deep learning models used in safety-critical cyber-physical systems. In this work, we extend physical attacks to more challenging object detection models, a broader class of deep learning algorithms widely used to detect and label multiple objects within a scene. Improving upon a previous physical attack on image classifiers, we create perturbed physical objects that are either ignored or mislabeled by object detection models. We implement a Disappearance Attack, in which we cause a Stop sign to "disappear" according to the detector-either by covering thesign with an adversarial Stop sign poster, or by adding adversarial stickers onto the sign. In a video recorded in a controlled lab environment, the state-of-the-art YOLOv2 detector failed to recognize these adversarial Stop signs in over 85% of the video frames. In an outdoor experiment, YOLO was fooled by the poster and sticker attacks in 72.5% and 63.5% of the video frames respectively. We also use Faster R-CNN, a different object detection model, to demonstrate the transferability of our adversarial perturbations. The created poster perturbation is able to fool Faster R-CNN in 85.9% of the video frames in a controlled lab environment, and 40.2% of the video frames in an outdoor environment. Finally, we present preliminary results with a new Creation Attack, where in innocuous physical stickers fool a model into detecting nonexistent objects.

1 Introduction

This work extends physical adversarial attacks from image classifiers to object detectors, introducing disappearance and creation attacks for physical Stop-sign perturbations. Experiments show these attacks fool YOLO v2 and transfer to Faster R-CNN across laboratory and outdoor settings.

  • Motivation: Object detectors are harder to attack because they process scene context and jointly predict object presence, location, and class.Unlike classifiers, detectors must be controlled across multiple boxes and scene configurations.
  • Method: The authors extend the RP2 algorithm with transformations accounting for changes in perspective, size, position, and physical scene conditions.The extension targets robust attacks when object location and scale vary dynamically.
  • Method: The Disappearance Attack uses adversarial posters or stickers to make a physical Stop sign ignored by an object detector.The attack varies object distance, location, and perspective while keeping perturbations visually similar to graffiti or lighting artifacts.
  • Results: 85.6% and 72.5% of indoor and outdoor video frames, respectively, fooled YOLO v2 with the poster perturbation.Sticker perturbations fooled YOLO v2 in 85% of laboratory frames and 63.5% of outdoor frames.
  • Results: 85.9% of laboratory frames and 40.2% of outdoor frames fooled Faster R-CNN, demonstrating transferability across detectors.The transferability evaluation used the Faster R-CNN detector in both environments.
  • Additional attack: The Creation Attack uses inconspicuous physical stickers to make detectors recognize nonexistent Stop signs.The authors describe the results as preliminary yet encouraging.

2 Related Work

Prior physical adversarial-example research progressed from printed attacks without physical variation to attacks modeling transformations and environmental conditions. This work shifts the focus from classifiers to object detectors and demonstrates transferability between detector architectures.

  • Prior physical attacks: Printed digital adversarial examples fooled image classifiers, but early experiments lacked variation in viewing angles and distances.This established physical attacks while leaving robustness under changing conditions limited.
  • Robustness improvements: Subsequent work modeled transformations such as viewing-angle changes synthetically or through physical victim datasets to improve robustness.The cited approaches considered rotations, viewing angle, distance, lighting, and other transformations to varying extents.
  • This work: The present work differs from prior classifier-focused studies by extending physical attacks to object detection models using perspective, position, and scale transformations.The authors describe object detectors as a broader model class than classifiers.
  • Prior detector attacks: Earlier experiments suggested that physically fooling YOLO was very challenging.The cited YOLO study used adversarial road signs printed on paper.
  • This work: The paper introduces disappearance and creation attacks using poster or sticker perturbations and reports black-box transferability from YOLO to Faster R-CNN.This contrasts with concurrent work centered on replacing road signs to fool Faster R-CNN.

3 Background on Object Detectors

Object detectors locate and classify multiple objects in a scene, unlike classifiers that produce one dominant-object label. YOLO v2 uses a single CNN and grid-based predictions, creating distinctive challenges for physical attacks.

  • Detection versus classification: Object classifiers produce a label for one object, whereas object detectors both locate and classify multiple objects in a scene.This distinction defines the broader output handled by detection networks.
  • YOLO v2: YOLO and YOLO v2 are single-shot detectors that run one CNN over the image to jointly produce localization and classification confidence scores.This design supports real-time detection capabilities and high accuracy.
  • YOLO v2: For each box, YOLO v2 predicts object probability, center coordinates, width, height, and a distribution over 80 classes.The complete output is a 19 × 19 × 425 tensor.
  • YOLO v2: YOLO v2 organizes 361 grid cells in a 19 × 19 image grid and predicts five bounding boxes for each cell.Each box includes confidence, location, and class-label probabilities.
  • Attack challenges: Physical attacks on detectors must control box confidences and class probabilities across all grid cells while handling arbitrary object position and size.These requirements differ from classifier attacks, which modify class probabilities for an assumed-present centered object.

4 Physical Adversarial Examples for Object Detectors

The paper adapts RP2 to attack object detectors by modeling detector-specific outputs and physical variation. Its modified objective combines detector loss, printability, environmental transformations, and smoother perturbations, supporting both disappearance and creation attacks.

  • 4.1 The RP2 Algorithm: RP2 optimizes perturbations using a masked norm, a printability term, and loss averaged over physically transformed victim images.The transformations model conditions such as viewing angle, distance, lighting, rotation, and position.
  • 4.2.1 Modified Adversarial Loss Function: Object-detector attacks require a loss over bounding boxes and class probabilities rather than a classifier’s single image-level output.The detector loss tracks the maximum probability assigned to the target object anywhere in the scene.
  • 4.2.1 Modified Adversarial Loss Function: The Disappearance Attack lowers every bounding box’s target-object likelihood below the detector threshold using an adversarial poster or stickers on a Stop sign.For YOLO v2, the default detection threshold is 25%.
  • 4.2.2 Creation Attack: The Creation Attack uses an inconspicuous sticker and a composite loss to create a new object localization, then increase the probability of a targeted class.The mask is randomly sampled so the patch can be applied at an arbitrary scene location.
  • 4.2.3 Physical Constraints: The modified RP2 models object rotation and position synthetically because detector attacks must remain effective as target size and location vary.The object is randomly placed and rotated during each optimization epoch.
  • 4.2.3 Noise Smoothing using Total Variation: Replacing the ℓp norm with total variation produces smoother perturbations and increases the attack’s effective range.The ℓp norm produced pixelated perturbations that reduced success, especially at greater viewing distances.

5 Evaluation

The evaluation tests physical disappearance and creation attacks across YOLO v2 and Faster R-CNN in laboratory, outdoor, and close-range video settings. Disappearance attacks remain effective but weaken outdoors, while creation attacks show variable detection of nonexistent Stop signs.

  • Experimental setup: The experiments evaluate disappearance attacks with YOLO v2 and Faster R-CNN, plus a creation attack with YOLO v2.YOLO v2 is evaluated as a white-box model, while Faster R-CNN is used to assess transferability.
  • Experimental setup: The disappearance evaluation uses a full-sign poster and two rectangular stickers applied to a Stop sign.The poster uses an octagonal mask, while the sticker perturbation places rectangles at the sign’s top and bottom.
  • Disappearance results: At least 85% of indoor video frames contained no Stop sign bounding box for both YOLO v2 disappearance perturbations.Outdoor success decreased for both attacks, with the sticker perturbation especially weak when only part of the sign remained in view.
  • Transferability results: Both disappearance perturbations transferred to Faster R-CNN relatively well indoors but experienced significant outdoor success-rate decreases.The poster transferred especially well in stable environments, according to the reported evaluation.
  • Creation results: A sample creation-attack frame contains 4 adversarial stickers recognized as Stop signs by YOLO v2.The stickers were placed on large flat objects and videos were recorded within 10 feet.
  • Creation results: YOLO v2 detected Stop signs in 25%–79% of frames when multiple creation-attack stickers were placed on large flat objects.The creation attack was more sensitive to sticker size, surroundings, and camera movement than the disappearance attack.

6 Discussion

The discussion identifies environmental, attack-design, task-extension, and deployment questions that remain open, while emphasizing positional and rotational invariance as a key advance for attacking object detectors.

  • Limitations: Extreme conditions can erase perturbation details, suggesting future attacks should target macro features such as the sign’s perceived shape.Poor lighting, far distance, and sharp angles may leave only shape, general color, and lettering clearly visible.
  • Alternative attacks on object detectors: Future object-detector attacks could preserve an object’s bounding box while changing its label or cause nonsensical physical objects to be detected.Both alternatives have been shown to work digitally and could have major safety implications.
  • Extensions to semantic segmentation: Extending physical attack techniques from detectors to semantic segmentation remains an important future-work question.Semantic segmentation labels every pixel in a scene as belonging to an object.
  • Impact on Real Systems: The attacks target YOLO v2’s detection component in isolation, so their ability to compromise an end-to-end cyber-physical control pipeline remains open.The paper notes that real systems generally base decisions on a majority of predictions, while the attack makes YOLO miss the sign in a majority of tested frames.
  • Contribution: The paper extends RP2 with positional and rotational invariance to attack state-of-the-art object detectors in relatively controlled settings.This is presented as a key step toward understanding object detectors’ vulnerability to physical adversarial examples.

7 Conclusion

The paper extends robust physical perturbation generation from classifiers to object detectors by adding positional and rotational invariance. Experiments show that adversarial Stop signs can evade YOLO v2 and that the poster perturbation transfers to Faster R-CNN, with performance varying across environments and perturbation types.

  • Conclusion: The authors extend a classifier attack algorithm with positional and rotational invariance to generate physical perturbations for object detectors.The target models detect and label multiple objects within dynamic scenes.
  • Conclusion: YOLO failed to recognize adversarial Stop signs in 85.6% of controlled-lab poster frames and 85% of controlled-lab sticker frames.Outdoor failure rates were 72.5% for posters and 63.5% for stickers.
  • Conclusion: The poster perturbation fooled Faster R-CNN in 85.9% of controlled-lab video frames and 40.2% of outdoor video frames.This demonstrates limited blackbox transferability to a different object detector.
  • Conclusion: The work takes steps toward understanding object detectors’ vulnerability to physical adversarial examples.The experiments focus on physically perturbing Stop signs so YOLO ignores them.
Loading 1807.07769v2…