Source-linked AI summary
Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors
Zuxuan Wu, Ser-Nam Lim, Larry Davis, Tom Goldstein
TL;DR
The paper addresses limited evidence about adversarial attacks transferring beyond white-box digital settings, especially across detectors and into the physical world. It systematically trains and evaluates object-detector patches and ensembles across models, classes, datasets, and physical conditions, finding that digital attacks can transfer across these settings, though less reliably than attacks on simple classifiers.
Problem
Existing attacks often assume white-box access or remain digital, while realistic attacks must transfer across models, datasets, and physical viewing conditions.
Method
The paper trains patches that suppress detector objectness scores and evaluates them under white-box, black-box, cross-dataset, cross-class, and physical settings using multiple metrics.
Results
Digital attacks transfer between models, classes, datasets, and into the real world, although less reliably than attacks on simple classifiers.
Takeaways & Limitations
Adversarial patches can affect object detectors beyond their training conditions, including physical-world deployments, but transfer is less reliable than for simple classifiers.
Takeaways & Limitations
The digital attack study focuses on the COCO dataset because of its diversity, with dataset effects considered separately.
Abstract
from arXiv · showhide
We present a systematic study of adversarial attacks on state-of-the-art object detection frameworks. Using standard detection datasets, we train patterns that suppress the objectness scores produced by a range of commonly used detectors, and ensembles of detectors. Through extensive experiments, we benchmark the effectiveness of adversarially trained patches under both white-box and black-box settings, and quantify transferability of attacks between datasets, object classes, and detector models. Finally, we present a detailed study of physical world attacks using printed posters and wearable clothes, and rigorously quantify the performance of such attacks with different metrics.
1 Introduction
The paper studies adversarial attacks that suppress object detectors, emphasizing transfer beyond white-box digital settings into realistic physical conditions. It evaluates transferability across models, classes, datasets, and the physical world, including wearable attacks under fabric distortions.
- Physical attacks must preserve adversarial effects across cameras, resolutions, lighting, distances, and viewing angles.
- Realistic attackers often have black- or grey-box knowledge and require attacks to transfer across digital-to-physical settings, victim models, and datasets.
- The study examines industrial-strength object detectors under both black-box and white-box settings.
- The experiments quantify transfer between detector models, object classes, and datasets, and analyze the transition from digital simulation to real-world attacks.
- Attack degradation is measured using average precision and interpretable success/failure metrics.
- Wearable adversarial clothing is evaluated under complex fabric distortions by quantifying attack success rates.
2 Related Work
Prior work established vulnerabilities in detection and segmentation, but largely focused on digital attacks against individual models. This paper addresses transferability and the challenge of simultaneously suppressing many detector priors.
- Earlier studies attacked segmentation models, detection proposals, region proposal networks, or detector backgrounds using digital perturbations and patches.
- Prior object-detector attacks generally targeted a specific detector without studying transferability.
- Physical-adversarial research includes rendered 3D attacks, toxic signs, physically robust samples, adversarial eyeglasses, and image patches, mainly for classifiers.
- Object detectors are commonly organized as two-stage frameworks or one-stage pipelines.
- Two-stage detectors: Two-stage detectors use region proposals followed by classification, with objectness scores generated for multiple candidate bounding boxes.
- One-stage detectors: One-stage detectors jointly generate object proposals and class labels while predicting objectness scores for default bounding boxes.
- Erasing an object requires fooling the ensemble of overlapping priors because non-maximum suppression can select another high-confidence prior.
- The paper reports both average precision and threshold-based success rates to combine standard evaluation with interpretability.
3 Approach
The approach trains universal patches by rendering them over people under randomized transformations and minimizing detector objectness scores. Smoothness regularization and ensemble training are used to improve patch quality and generalization to unseen detectors.
- The target patch is universal, transferable, dataset agnostic, robust to viewing conditions, and realizable on printed 3D objects.
- Each training iteration overlays a randomly transformed patch onto detected people and updates its pixels to minimize detector objectness scores.
- Brightness, contrast, rotation, translation, sheering, and thin-plate-spline transforms simulate lighting, viewpoint, and fabric-crumpling distortions.
- The detector outputs one objectness score per prior, representing general objectness for two-stage detectors or person-class strength for one-stage detectors.
- The objectness loss penalizes scores above -1, focusing optimization on positive or near-zero scores rather than already low scores.
- Expectation over transformations and training images promotes robustness to real-world distortions and variation across scenes.
- A small total-variation penalty smooths the patch and encourages optimization of pixels that are rarely sampled during rendering.
- Ensemble training replaces the single-detector loss with an ensemble loss to improve generalization to detectors absent during training.
4 Crafting attacks in the digital world
The paper crafts adversarial patches on COCO and evaluates their digital effectiveness across detectors, backbones, datasets, and object classes. Learned patches substantially reduce detector performance, with transfer strongest for ensemble and YOLO-based patches.
- Attack crafting and evaluation: Patches are trained on 10,000 COCO images containing people and evaluated using average precision across YOLOv2, YOLOv3, R50-C4, and R50-FPN detectors.The study includes both one-stage and two-stage detectors and examines white-box and black-box settings.
- White-box effectiveness: At least 29% AP degradation occurs for every detector in digital simulations, reaching 7.5% AP for a YOLOv2 patch tested on YOLOv2-r.All patches also transfer well to corresponding retrained models.
- Cross-detector transfer: YOLO patches transfer effectively to Faster R-CNN models, whereas Faster R-CNN patches are less effective against YOLO models; ensemble patches outperform Faster R-CNN patches but underperform YOLO patches.Grey and Seurat controls help distinguish learned attack behavior from performance loss caused by simple occlusion or visual similarity.
- Transferability across backbones: Patches transfer across detectors with different backbones, including ResNet, ResNeXt, Mask R-CNN, RetinaNet, and FCOS.Figure 5 evaluates patch performance across these backbone and detector variants.
- Transferability across datasets: COCO-trained ensemble patches strongly degrade person detection on VOC and Inria, including models trained with different data distributions.The results support transfer across datasets and show COCO-trained weights are more robust than VOC-trained weights in the reported comparison.
- Transferability across classes: Patches trained on one class suppress multiple classes, with the person patch transferring to almost all 20 VOC categories.Comparable trends are reported on COCO.
5 Physical world attacks
The paper evaluates adversarial posters and paper-doll patches as intermediate steps toward physical attacks, then measures how training choices and physical distortions affect detector evasion. Printed attacks degrade detection, but their effectiveness drops when transferred from digital simulations to physical settings.
- Evaluation: Success attacks produce no person bounding box, partial successes cover less than 50% of the person, and failures successfully detect the person.The study uses cutoff zero for YOLOv2 and tunes other detectors’ thresholds for the best F-1 score on COCO minival.
- Printed posters: Adversarially optimized posters degrade detectors more than baseline patches under both AP and success-rate measurements.The Yolov2 patch achieves the best AP, while R50-FPN is most robust and FCOS most vulnerable in the reported poster results.
- Training variants: The TPS patch underperforms the Yolov2 patch, while the Yolov2 patch improves over Yolov2-noaug in AP but gains shrink under success rates.The authors suggest complex transformations make optimization more difficult during training.
- Transfer to physical settings: Poor Flip-patch performance indicates that learned attacks exploit detector-specific behavior rather than a generic weakness.Digital performance correlates with physical performance, but patches lose effectiveness during digital-to-physical transfer.
- Paper dolls: Paper dolls perform only slightly better than large-format posters, helping isolate camera distortions and physical effects without fabricating textiles.The study uses separately printed patches and images, including crumpled variants to test deformation robustness.
- Experimental scope: Physical attack studies use posters, paper dolls, shirts, and clothes to quantify real-world effects with AP and success rates.Figures compare attack effectiveness across patch types and wearable examples, including Yolov2 shirts and paper dolls.
6 Wearable adversarial examples
The wearable study tests adversarial patterns on shirts under complex fabric deformations and evaluates them using AP and success rates. Wearable attacks substantially degrade detector performance, but transfer across detectors is uneven.
- Results: Wearable attacks significantly degrade detector performance, especially under AP because detected persons often produce multiple fragmented boxes.The study evaluates the collected images under the same settings as the poster study using both AP and success rates.
- Results: Sweatshirts with Yolov2 patterns achieve approximately 50% success rates but transfer poorly to other detectors.The reported transfer gap is especially notable because FCOS is robust to wearable attacks despite vulnerability to printed posters.
- Pattern design: Smaller Yolov2-2 patterns perform worse than larger patterns among the tested Yolov2 shirts.Tiling or reflecting a patch across the shirt does not negatively affect performance, although the patch was not designed for that use.
- Pattern design: Thin-plate-spline augmentation does not improve transferability and is instead detrimental in the wearable setting.The experiment compares TPS-augmented patches with several Yolov2 and ensemble-based shirt patterns.
7 Conclusion
The experiments show that digital attacks can transfer across models, classes, datasets, and into the real world, although less reliably than attacks on simple classifiers. The conclusion emphasizes this transferability despite the greater complexity of object detection and physical conditions.
- Conclusion: Digital attacks transfer between models, classes, datasets, and into the real world, though less reliably than attacks on simple classifiers.The paper frames detector attacks as difficult because many priors and real-world distortions must be manipulated simultaneously.