Source-linked AI summary
Fooling automated surveillance cameras: adversarial patches to attack person detection
Simen Thys, Wiebe Van Ranst, Toon Goedemé
TL;DR
Existing real-world adversarial attacks largely target fixed-pattern objects, leaving attacks against visually diverse persons insufficiently explored despite security implications. This paper optimizes printable patches against person detectors and finds that they reduce detection effectiveness, including in filmed real-world scenarios. The patches transfer poorly to substantially different architectures, defining an important scope limitation.
Problem
Prior real-world object-detector attacks targeted classes with limited visual variation, while attacking person detection requires handling substantial intra-class variety and matters for surveillance security.
Method
The paper optimizes image pixels to generate printable adversarial patches that minimize probabilities associated with person detection, including objectness and class-related objectives.
Results
Printed patches work quite well at hiding persons from object detectors in real-world camera footage, and minimizing object loss produced the most effective patches in the experiments.
Takeaways & Limitations
The results suggest that security systems using similar person detectors might be vulnerable to this kind of real-world attack.
Takeaways & Limitations
The current patches do not transfer well to completely different architectures such as Faster R-CNN.
Abstract
from arXiv · showhide
Adversarial attacks on machine learning models have seen increasing interest in the past years. By making only subtle changes to the input of a convolutional neural network, the output of the network can be swayed to output a completely different result. The first attacks did this by changing pixel values of an input image slightly to fool a classifier to output the wrong class. Other approaches have tried to learn "patches" that can be applied to an object to fool detectors and classifiers. Some of these approaches have also shown that these attacks are feasible in the real-world, i.e. by modifying an object and filming it with a video camera. However, all of these approaches target classes that contain almost no intra-class variety (e.g. stop signs). The known structure of the object is then used to generate an adversarial patch on top of it. In this paper, we present an approach to generate adversarial patches to targets with lots of intra-class variety, namely persons. The goal is to generate a patch that is able successfully hide a person from a person detector. An attack that could for instance be used maliciously to circumvent surveillance systems, intruders can sneak around undetected by holding a small cardboard plate in front of their body aimed towards the surveillance camera. From our results we can see that our system is able significantly lower the accuracy of a person detector. Our approach also functions well in real-life scenarios where the patch is filmed by a camera. To the best of our knowledge we are the first to attempt this kind of attack on targets with a high level of intra-class variety like persons.
1. Introduction
CNNs achieve accurate computer-vision models but are difficult to interpret, and standard person-detector evaluation may not reveal targeted vulnerabilities relevant to security systems. This paper addresses that risk by creating a small printable adversarial patch intended to hide people from object detectors.
- CNNs learn hierarchical visual features through millions of parameters, producing accurate models while reducing interpretability.
- Standard test sets measure person-detection performance on annotated images but generally lack examples designed to steer or specifically fool the model.
- Targeted vulnerabilities can matter for security systems because they may allow attackers to circumvent surveillance cameras used for break-in prevention.
- The paper creates a small, around 40cm×40cm, printable adversarial patch as a cloaking device to hide people from object detectors.
- The paper evaluates patches quantitatively on the Inria dataset and qualitatively using real-life video footage of a held patch.
2. Related work
Prior adversarial work progressed from digital classifier attacks to printable attacks on faces and fixed-pattern objects, including real-world stop-sign attacks. This paper targets YOLOv2 while addressing the largely unstudied challenge of attacking a visually diverse class such as persons.
- Adversarial attacks on classification tasks: Earlier classifier attacks changed image pixels slightly, while later patch methods digitally placed optimized patterns on images and used multiple images for intra-class robustness.
- Real-world adversarial attack for face recognition: Printed eyeglasses demonstrated real-world attacks against facial-recognition systems, with optimization across poses and colors constrained by printer representability.
- Real-world adversarial attacks for object detection: Real-world object-detector attacks targeted stop signs using transformation-based robustness, including YOLOv2 white-box attacks that transferred to Faster R-CNN.
- Novelty: Previous object-detector attacks focused on fixed visual patterns such as traffic signs and did not account for intra-class variety.
- Novelty: The paper states that no previous work had proposed a detection method working on a diverse class such as persons.
- Object detection: YOLOv2 is a fully convolutional single-shot detector that predicts bounding boxes, objectness, and class scores in one network pass.
3. Generating adversarial patches against person detectors
The paper generates printable adversarial patches for person detectors by optimizing patch pixels against detector outputs while accounting for printability, smoothness, and real-world variation. It compares objectness, class, and combined objectives to hide people despite their varied appearance and contexts.
- Challenges and data: The method targets printable patches that reduce person-detector accuracy despite substantial variation in people’s appearance, poses, contexts, and patch placement.The approach uses real images of different people rather than modifying one artificial target image.
- Loss function: The total objective combines non-printability, total-variation, and object losses, with the first two scaled by empirically determined factors α and β.The losses respectively encourage printable colors, smooth transitions, and lower detector scores.
- Optimization: The optimizer freezes detector weights, initializes the patch randomly, and updates only patch values using Adam.Optimization minimizes the total loss while leaving the network unchanged.
- Detector objectives: The detector objective is tested in three forms: minimizing person-class probability, minimizing objectness, or minimizing their product.Class minimization can make the patch resemble another COCO class, whereas objectness minimization produces a less class-specific patch.
- Challenges and data: Training uses detector-generated bounding boxes from real person images and places patches at fixed positions relative to those boxes.The workflow can also use footage from a target environment to produce scene-specific patches, while experiments use the Inria pedestrian dataset.
- Real-world robustness: To improve real-world robustness, training randomly rotates, scales, noises, brightens, and contrasts patches while preserving differentiability through every operation.These transformations model changes introduced by printing, filming, lighting, viewing angle, and camera effects.
4. Results
The generated patches substantially reduce person-detector alarms on the Inria test set, with object-score minimization performing best. Qualitative examples also show effective hiding in test images and printed real-world footage, although correct positioning is important.
- Generated patches substantially lower detector alarms compared with the clean baseline and random-noise control.The evaluation compares OBJ-CLS, OBJ, and CLS against NOISE and CLEAN using precision–recall curves.
- Minimizing the object score produces the lowest Average Precision among the tested patch objectives.OBJ has a larger impact than minimizing the class score or their product.
- In most Inria test images, the best generated patch successfully hides the person from YOLOv2.Failures occur when the patch is not aligned with the person’s center, matching its training placement.
- Printed patches work quite well in real-world footage, but holding them in the trained position is important.The real-world evaluation uses a printed version of the patch filmed by a camera.
5. Conclusion
The paper presents printable adversarial patches for hiding people from person detectors and finds that object-loss minimization creates the most effective patches. Printed patches also work quite well in real-world tests, suggesting vulnerability in similar detector-based security systems.
- The system generates printable adversarial patches for person detectors by minimizing detector probabilities associated with person appearance.
- Minimizing object loss creates the most effective patches among the compared approaches.
- Printed patches work quite well at hiding persons from object detectors in real-world tests.
- The results suggest that security systems using similar detectors might be vulnerable to this type of attack.
6. Future work
Future work focuses on improving patch robustness and transferability across conditions and detector architectures. The current patches do not transfer well to completely different architectures such as Faster R-CNN.
- The authors propose more affine transformations and simulated 3D-person data to improve patch robustness.
- Current patches do not transfer well to completely different architectures like Faster R-CNN.Optimizing for multiple architectures simultaneously might improve transferability.