Source-linked AI summary
Adversarial camera stickers: A physical camera-based attack on deep learning systems
Juncheng Li, Frank R. Schmidt, J. Zico Kolter
TL;DR
The paper asks whether deep classifiers can be fooled across objects by physically manipulating the camera rather than the objects or digital inputs. It uses a translucent, universal camera-lens sticker and jointly optimizes adversarial perturbations with a physically realizable threat model, demonstrating targeted real-world attacks and a new physical threat model.
Problem
Most adversarial attacks manipulate digital classifier inputs, while existing physical attacks modify the object of interest; the paper investigates camera-side manipulation instead.
Method
The method uses a carefully patterned, mainly translucent lens sticker and jointly optimizes its adversarial perturbation with the camera-achievable threat model.
Results
Targeted attacks on real objects were demonstrated using a single sticker across multiple orientations and scales.
Takeaways & Limitations
The results suggest camera manipulation is a new physically realizable threat vector for adversarially robust machine learning.
Takeaways & Limitations
The physically realizable perturbation class is constrained by camera optics, and feasible parameterizations occupy a narrow range.
Abstract
from arXiv · showhide
Recent work has documented the susceptibility of deep learning systems to adversarial examples, but most such attacks directly manipulate the digital input to a classifier. Although a smaller line of work considers physical adversarial attacks, in all cases these involve manipulating the object of interest, e.g., putting a physical sticker on an object to misclassify it, or manufacturing an object specifically intended to be misclassified. In this work, we consider an alternative question: is it possible to fool deep classifiers, over all perceived objects of a certain type, by physically manipulating the camera itself? We show that by placing a carefully crafted and mainly-translucent sticker over the lens of a camera, one can create universal perturbations of the observed images that are inconspicuous, yet misclassify target objects as a different (targeted) class. To accomplish this, we propose an iterative procedure for both updating the attack perturbation (to make it adversarial for a given classifier), and the threat model itself (to ensure it is physically realizable). For example, we show that we can achieve physically-realizable attacks that fool ImageNet classifiers in a targeted fashion 49.6% of the time. This presents a new class of physically-realizable threat models to consider in the context of adversarially robust machine learning. Our demo video can be viewed at: https://youtu.be/wUVmL33Fx54
1. Introduction
The paper introduces adversarial camera stickers that physically perturb the optical path, causing inconspicuous, targeted misclassification across objects, viewpoints, and scales. Its procedure jointly optimizes adversarial effectiveness and physical realizability.
- 1. Introduction: The attack places a carefully constructed, mainly translucent sticker over the camera lens rather than modifying the observed object.The sticker uses blurry dots that appear mostly imperceptible in camera images.
- 1. Introduction: The threat model injects perturbations on the optical path between camera and object without tampering with the object itself.This differs from physical attacks that directly alter or manufacture the object of interest.
- 1. Introduction: A single universal perturbation must fool classifiers across multiple viewing angles and object scales.The same sticker applies the same perturbation to every captured image.
- 1. Introduction: The method jointly optimizes the attack and the set of perturbations achievable by the camera.This addresses the limited, low-frequency perturbation space imposed by camera optics.
- 1. Introduction: 52% average targeted fooling rate was achieved on real video data with a physically manufactured sticker across five class-target combinations.The experiments used printed stickers on a real camera and physically realistic perturbations on ImageNet.
2. Background and Related Works
The paper situates camera-sticker attacks within physical adversarial-attack research, contrasting them with digital attacks and object-directed physical attacks. Unlike prior object modifications, the proposed sticker targets the camera and remains inconspicuous to viewers.
- Background and Related Works: Digital attacks directly modify classifier inputs, whereas physical attacks alter the real-world scene or object presented to the camera.The related work distinguishes these two broad attack categories in the white-box setting.
- Background and Related Works: Prior physical attacks include adversarial patches placed near objects and manufactured 3D objects designed for misclassification.These methods can require explicit modification of each target object and may be visually apparent.
- Background and Related Works: The proposed attack applies a single perturbation across objects, viewpoints, and scales rather than requiring each object to be modified.This universality is the distinguishing operational feature highlighted by the paper.
- Background and Related Works: The dotted camera sticker avoids direct object tampering and is almost unnoticeable to people viewing the image.Its inconspicuousness is illustrated in Figure 1.
3. Crafting Adversarial Stickers
The paper models camera stickers as constrained, differentiable alpha-blending perturbations and jointly fits physical realizability with adversarial optimization. It then searches this restricted space for universal targeted perturbations across multiple images.
- 3.1. A threat model for physical camera sticker attacks: Physical camera attacks require a threat model narrower than general norm-bounded perturbations so the resulting perturbations are achievable by a real camera.The model is designed to capture camera-observed effects rather than arbitrary pixel-level changes.
- 3.3. Constructing adversarial examples: Universal targeted attacks optimize one perturbation over multiple samples, rather than adapting the perturbation separately to each input.The objective can target a specified class while maximizing error across images from the source class.
- 3.1. A threat model for physical camera sticker attacks: A single dot blends each original pixel with a dot color using a position-dependent alpha mask that fades with distance from the dot center.The dot parameters include center location, color, opacity, radius, and smoothness.
- 3.1. A threat model for physical camera sticker attacks: K dot perturbations are composed sequentially into one differentiable camera-sticker perturbation with parameters for every dot.The resulting image remains a continuous function of the real-valued perturbation parameters.
- 3.2. Achieving inconspicuous, physically realizable perturbations: The physical threat model is constrained because printed dots have limited control over radius, opacity, smoothing, and allowable colors, while excessive opacity can make attacks conspicuous.The authors therefore fit the model to manufactured, inconspicuous perturbations and leave only selected colors and locations free.
- 3.2. Achieving inconspicuous, physically realizable perturbations: The physical model is fit by comparing clean and sticker-obscured camera images with SSIM, then optimizing dot parameters through block coordinate descent and position fine-tuning.Color initialization uses a fitted linear transformation from printed RGB values to camera-observed RGB values.
4. Experiments
The experiments evaluate digitally constrained and physically manufactured camera-sticker attacks on ImageNet and real video, including targeted misclassification across viewpoints and scales. They also examine physical realizability, dot count, and optical effects that constrain the attack.
- Experimental setup: The experiments evaluate digital ImageNet attacks and two real-world tasks: keyboard to mouse and stop sign to guitar pick.The real-world evaluations use a camera with a physically attached sticker and ResNet-50 classification.
- ImageNet evaluation: 6-dot perturbations are constrained to patterns that can be physically manufactured, unlike directly optimized digital attacks.The digitally optimized attacks can achieve high fooling rates but may be overly opaque or require unprintable bright colors.
- ImageNet evaluation: 83% fooling is achieved for a universal street-sign-to-projector digital attack, but the perturbation remains physically unrealizable.The attack is overly opaque and uses bright colors that cannot be printed and viewed through a transparent sticker.
- Other experiments: Additional dots increase targeted fooling rates on the digital keyboard-to-mouse attack without diminishing returns through 10 dots.The experiment varies the number of sticker dots while evaluating on the ImageNet test set.
- Other experiments: Camera optics impose a physical limit: printing smaller solid dots eventually produces equally sized but more transparent visual dots.This motivates using small solid opaque dots rather than modeling the printed dots as transparent.
5. Conclusion
The paper demonstrates targeted real-world attacks by modifying the observing camera rather than the object, using a single sticker across orientations and scales. Modeling optical constraints makes these physically realizable perturbations tractable to optimize.
- A single adversarial sticker can targetedly misclassify real objects across multiple orientations and scales.
- Optical constraints limit physically realizable attacks, but fitting a threat model to data captures the allowable perturbations.
- Camera modification creates a new attack vector against machine-learning systems deployed in the real world.