PaperlayerView exact revision on arXiv

Source-linked AI summary

SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations

Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, Ivan Martinovic

arXiv:2007.04137v3cs.CVcs.LG

TL;DR

Physical adversarial examples are commonly realized with patches, which can be conspicuous and remain active once deployed. This paper proposes SLAP, which projects crafted perturbations onto real objects, and evaluates the approach on stop-sign detection and recognition. SLAP achieved high success under favorable lighting and bypassed SentiNet, while adaptive adversarial learning hampered attacks with a benign-accuracy cost.

  • Problem

    Physical adversarial attacks often use printed patches that can be salient and keep signs misdetected continuously, limiting selective attacks.

    Source: §1 · p. 1

  • Method

    SLAP uses a light projector and a model of the surface, projection, and camera-perceived image to create short-lived physical adversarial examples.

    Source: §1 · p. 1

  • Results

    Stop signs were undetected in over 99% of camera frames depending on ambient light, and SLAP bypassed SentiNet over 95% of the time.

    Source: §1 · p. 2

  • Takeaways & Limitations

    SLAP supports dynamic physical attacks, while adaptive adversarial learning can prevent most attacks at the cost of reduced benign accuracy.

    Source: §1 · p. 2

    Extending SLAP to non-flat objects requires modeling projection-surface distortion, and projectable area limits feasibility for some objects.

    Source: §6 · p. 13

Abstract

from arXiv · show

Research into adversarial examples (AE) has developed rapidly, yet static adversarial patches are still the main technique for conducting attacks in the real world, despite being obvious, semi-permanent and unmodifiable once deployed. In this paper, we propose Short-Lived Adversarial Perturbations (SLAP), a novel technique that allows adversaries to realize physically robust real-world AE by using a light projector. Attackers can project a specifically crafted adversarial perturbation onto a real-world object, transforming it into an AE. This allows the adversary greater control over the attack compared to adversarial patches: (i) projections can be dynamically turned on and off or modified at will, (ii) projections do not suffer from the locality constraint imposed by patches, making them harder to detect. We study the feasibility of SLAP in the self-driving scenario, targeting both object detector and traffic sign recognition tasks, focusing on the detection of stop signs. We conduct experiments in a variety of ambient light conditions, including outdoors, showing how in non-bright settings the proposed method generates AE that are extremely robust, causing misclassifications on state-of-the-art networks with up to 99% success rate for a variety of angles and distances. We also demostrate that SLAP-generated AE do not present detectable behaviours seen in adversarial patches and therefore bypass SentiNet, a physical AE detection method. We evaluate other defences including an adaptive defender using adversarial learning which is able to thwart the attack effectiveness up to 80% even in favourable attacker conditions.

1 Introduction

The paper introduces SLAP, a projector-based approach for creating dynamic physical adversarial examples, and evaluates it on stop-sign detection and recognition. It reports high attack success under favorable lighting, transfer to Google Vision, and mixed results against defenses.

1 Introduction

  • SLAP uses a projector to create short-lived physical adversarial examples, giving attackers control over when projections are shown and avoiding patch locality constraints.Source: §1 · pp. 1–2
  • The attack models the surface, projection, and camera-perceived image as a three-way additive relationship and accounts for environmental changes during optimization.Source: §1 · p. 2
  • Over 99% of camera frames showed stop signs undetected, depending on ambient light, across four object-detection and traffic-sign-recognition models.The models were Yolov3, Mask-RCNN, Lisa-CNN, and Gtsrb-CNN.Source: §1 · p. 2
  • Mask-RCNN- and Yolov3-crafted examples transferred to Google Vision models in up to 100% of cases, enabling black-box attacks in some settings.Source: §1 · p. 2
  • SLAP bypassed SentiNet over 95% of the time, while an adaptive adversarial-learning defender prevented most attacks at the cost of reduced benign accuracy.Source: §1 · p. 2

2 Background and Related Work

The background covers projector constraints, vision tasks, and prior physical adversarial attacks. It motivates SLAP as a projector-based alternative to persistent, localized patches.

2.1 Projector technology

  • Brighter ambient light reduces projector-image contrast and color quality, while projecting onto non-white or non-screen materials changes the resulting image.The paper describes empirically modeling such environmental changes in Section 4.1.Source: §2.1 · pp. 2–3

2.2 Object Detection

  • Object detectors return bounding boxes, whereas traffic-sign recognizers typically classify a sign cutout; the paper uses Yolov3, Mask-RCNN, Lisa-CNN, and Gtsrb-CNN.Yolov3 is single-stage; Mask-RCNN extends the two-stage Faster-RCNN approach with segmentation.Source: §2.2 · p. 3

2.3 Physical Adversarial Examples

  • Prior physical attacks used printed posters, stickers, or other localized perturbations, which can be salient and leave signs continuously misdetected.Projector-based attacks can be switched on or off to target particular vehicles and leave no physical trace.Source: §2.3 · p. 3
  • SentiNet detects patch attacks by identifying localized high-saliency regions and testing their effects on benign images, but SLAP examples bypass it.Figure 2 illustrates a sunflower patch causing a stop sign to be misclassified.Source: §2.3 · pp. 3–4, Figure 2 · p. 3

3 Threat Model

The threat model places an attacker near a stop sign with a projector and a line of sight to the sign. The goal is to make the sign undetected by vehicle networks, potentially targeting particular vehicles.

Goal

  • The attacker seeks to make a stop sign undetected by vehicle networks, a failure that could lead approaching vehicles to ignore the sign.Source: §3 · p. 4
  • Printed patches are unsuitable for selectively targeting vehicles because they would cause continuous sign misdetection and could raise passenger suspicion.Source: §3 · p. 4

Capabilities and Knowledge

  • The attacker needs control of a projector and a position with visual line of sight, but not necessarily physical access to the sign; white-box and transfer-based black-box settings are considered.Source: §3 · p. 4

4 Method

SLAP models how a projector, target surface, and camera jointly determine the captured image, then optimizes projected perturbations for physical conditions. Its data collection and training account for camera behavior and varied viewing and lighting conditions.

4.1 Modelling projectable perturbations

  • The projection model is fitted from sampled surface, projection, and camera-output colors, enabling gradients to pass through it during adversarial-example generation.The model approximates camera-captured output colors for projected images and surfaces; its training triples fit a two-hidden-layer ReLU network.Source: §4.1 · pp. 4–5
  • Camera measurements use 10-frame pixel medians to reduce sensor noise and interleave each projected color with 10 unprojected frames to accommodate sensor adaptation.The sensor’s color readings adjust over several frames after a projection appears.Source: §4.1 · p. 5, Figure 6 · p. 5

4.2 AE Generation

  • Adversarial generation optimizes the projected image through the projection model and target network, with grid-based color cells and total variation constraining physical realizability.The loss targets the sum of stop-sign detection probabilities for object detectors or the stop-sign class probability for traffic-sign recognizers.Source: §4.2 · p. 6

4.3 Training Data Augmentation

  • Training uses Expectation over Transformation with synthetic backgrounds and sign alignments, augmenting conditions with perspective, distance, rotation, brightness, and camera-aspect-ratio changes.Perspective transforms prioritize plausible sign placement and height; sign sizes are limited to those detected confidently in non-adversarial settings.Source: §4.3 · pp. 6–7

4.4 Remarks

  • Optimization generates fresh batches of transformed stop-sign images, and the authors report reaching convergence with 50 perturbation modifications rather than 500, in under 10 minutes for Yolov3.They use 20-image batches, train for up to 50 epochs, and backpropagate twice on the 20% worst-performing batches in each epoch.Source: §4.4 · p. 7

5 Evaluation

The evaluation tested SLAP indoors across controlled light levels and outdoors in a moving-vehicle test, using two object detectors and two traffic-sign recognizers. Attacks were highly successful in dim light, while higher ambient light reduced effectiveness; the evaluation also examined defenses and transferability.

5.1 Experimental Setup

  • The controlled evaluation measured five indoor ambient-light levels and tested two object detectors and two traffic-sign recognizers using stop-sign videos recorded at varied distances and angles.The procedure profiled the projection model, optimized a projected image, then recorded videos with the projection on; detection was counted per frame, with sign cutouts used for the recognizers.Source: §5.1 · pp. 8–9

5.2 Indoor Results

  • >99% attack success rate was achieved in dimmer indoor lighting for every network except Mask-RCNN, with attacks spanning 1–12 m and viewing angles from -30° to 30°.At 300 lux, success was greatly reduced for Mask-RCNN and Gtsrb-CNN; at 600 lux, degradation was evident for Yolov3 and Lisa-CNN as well.Source: §5.2 · p. 9, Figure 10 · p. 10
  • Mask-RCNN was consistently more resilient than the other networks, but required up to 14 times Yolov3’s execution time: 300 ms versus 22 ms.The authors suggest this resilience may reflect robust features or the region proposal network.Source: §5.2 · p. 9

5.3 Road Driving Test

  • In the road-driving test, attack success was 100% for Lisa-CNN and Gtsrb-CNN and over 77% for Mask-RCNN and Yolov3.The car approached at 10–15 km/h under approximately 120 lux with headlights on; the test covered about 18 m to 7 m. Reusing indoor-optimized projections produced similar success without repeating profiling or optimization.Source: §5.3 · pp. 10–11, Figure 11 · p. 11

5.4 Defences

  • SentiNet failed to detect SLAP in over 95% of evaluated frames, while adversarial learning stopped a good portion of attacks.Input randomization did not detect the attack and degraded model accuracy; adversarially trained models also had benign-accuracy degradation, and only an adaptive defender—not an adaptive adversary—was evaluated.Source: §5.4 · pp. 11–12, Table 3 · p. 12

5.5 Attack Transferability

  • Transferability was strong in low light but degraded quickly at 300 lux and above; attacks crafted on Mask-RCNN and Gtsrb-CNN transferred better to their counterparts than the reverse direction.Adversarially trained models reduced transferability from surrogate models.Source: §5.5 · p. 12

6 Discussion

SLAP feasibility depends on ambient light and projector reach: low-light conditions are more favorable, and projector power and throw ratio affect usable distance. Generalizing beyond flat, reflective signs brings additional surface, size, and optimization constraints.

Attack Feasibility

  • Attack feasibility drops quickly in bright conditions; daytime use is suggested for low-light periods below 400 lux, while high-beam headlights were not considered.The authors report that ordinary car-headlight light was negligible relative to projection luminosity in their outdoor experiments.Source: §6 · p. 12
  • Table 4 compares projections tested against target models; its caption marks white-box pairs and notes Google Vision sampling and distance filtering.Google Vision is tested at one frame per 30 frames, and frames beyond 6 m are removed because the model often misses them in baseline conditions.Source: Table 4 · p. 13
  • At 120 lux ambient light, 800 lux on the sign is the measured success threshold; the weaker projector reaches 7.5 m and the more expensive one 13 m.The projectors cost $3,200 and $44,379, respectively.Source: Figure 13 · p. 12, §6 · p. 13

Attack Generalizability

  • Extending SLAP beyond flat traffic signs requires modeling non-flat surface distortion, and projectable area, material reflectivity, and object-specific optimization constrain its reach.The authors identify traffic signs as easier targets because of their high reflectivity; small projectable areas can make objects such as bikes difficult targets.Source: §6 · p. 13

7 Conclusions

The paper presents SLAP, a projector-based approach to short-lived physical adversarial examples, and evaluates it in an autonomous-driving stop-sign scenario. Its experiments report real-world robustness and identify both bypass of an existing physical-AE defense and a trade-off for adaptive adversarial learning.

7 Conclusions

  • SLAP uses a light projector to create short-lived physical adversarial examples that make stop signs undetected by DNNs on passing vehicles.The evaluation focuses on the autonomous-driving scenario.Source: §7 · p. 13
  • The evaluation reports robust real-world attacks and finds that existing physical-AE defenses do not work against SLAP, while adaptive adversarial learning hampers attacks at the cost of reduced accuracy.The experiments include outdoor and varied-light conditions, and test Yolov3, Mask-RCNN, Lisa-CNN, and Gtsrb-CNN.Source: §7 · p. 13
  • The authors call for further investigation of SLAP as an attack vector combining modifiable object detection with opportunistic attacks.They frame this as a step toward awareness and countermeasure research for light-projection adversarial examples.Source: §7 · p. 13

A Attack on Different Objects

The appendix examines SLAP on a give-way sign and a bottle using a reduced evaluation. It reports successful example frames in 180-lux ambient light, with bottle tests limited to foreground-sized objects.

Setup

  • The reduced tests apply SLAP to a give-way sign for traffic-sign classifiers and a bottle for object detectors.They test the objects' correct or incorrect classification across photos after the experiment procedure used for the stop-sign evaluation.Source: A Attack on Different Objects · p. 16
  • Extending the method to other objects requires changing the projection mask; non-flat surfaces also require modeling their distortion.The paper discusses this distortion as a consideration for extending the attack beyond flat objects.Source: A Attack on Different Objects · p. 16

Results

  • Example frames show successful attacks on the other objects at 180 lux, alongside legitimate frames classified correctly.For the bottle, Mask-RCNN and Yolov3 tests restrict size to [150, 250].Source: A Attack on Different Objects · p. 16

B Additional Results

The appendix points to extended results for three previously described experiment areas.

B Additional Results

  • The appendix provides extended results on controlled detection, road-driving tests, and transferability-based cross-network attacks.It refers readers to Sections B.1, B.2, and B.3, respectively.Source: B Additional Results · p. 16

B.1 Detection Results

The indoor experiment reports results across five ambient-light settings, from 120 to 600 lux.

B.1 Detection Results

  • Results are reported for the indoor experiment at 120, 180, 300, 440, and 600 lux.The passage refers to Figure 18 but does not provide its outcome values.Source: §B.1 · p. 16

B.2 Road Driving Test

The outdoor driving test reports results in Figure 17 and example frames in Figure 16.

B.2 Road Driving Test

  • The outdoor driving test reports results for all measured light settings and example frames from the 120-lux setting.The cited passage does not state the results’ values or outcomes.Source: §B.2 · p. 16

B.3 Attack Transferability

The transferability section reports results for evaluated model pairs, including models trained from scratch.

B.3 Attack Transferability

  • Transferability results cover each evaluated model pair, including Lisa-CNN(s) and Gtsrb-CNN(s) trained from scratch.The cited passage refers to Table 5 but does not provide its result values.Source: §B.3 · p. 16

C SentiNet Description

SentiNet is motivated by the localized, high-saliency regions created by physical adversarial patches. The section describes its saliency-based detection procedure and identifies the visualized attack settings and examples.

C SentiNet Description

  • SentiNet’s rationale is that physical patches create small, highly salient image regions that are difficult for attackers to avoid without replacing the object.The authors chose SentiNet because it was specifically designed to detect physical adversarial examples.Source: C SentiNet Description · p. 16
  • Because GradCam++ produces coarse 4×4 maps on Gtsrb-CNN and Lisa-CNN, the authors use XRAI to obtain input-resolution salient regions.The passage says the coarse GradCam++ masks made salient areas difficult to identify accurately.Source: C SentiNet Description · p. 16
  • SentiNet’s threshold function uses average confidence on benign images with salient masks replaced by inert patterns and the fooled percentage after mask overlay.The fooled percentage is the share of benign test images classified as the suspected adversarial class after overlay.Source: C SentiNet Description · pp. 16–17
  • Table 5 reports transferability across model pairs, marking white-box pairs and distinguishing adversarially trained and scratch-trained models.Google Vision is tested on one frame per second, and frames beyond 6 m are excluded because baseline detection is poor there.Source: Table 5 · p. 18
  • Figures 14 and 15 show attacks on Give Way and Bottle, while Figure 16 shows the stop sign undetected in outdoor 120-lux frames.Figure 15 gives detection thresholds of 0.4 for Yolov3 and 0.6 for Mask-RCNN; Figure 16’s blue tracker is manually set.Source: Figure 14 · p. 19, Figure 15 · p. 20, Figure 16 · p. 21
  • Figure 17 organizes outdoor moving-vehicle results by four light levels and model, while Figure 18 summarizes success rates across angles, distances, models, and settings.Figure 17 also reports each network’s detection threshold and non-adversarial baseline performance.Source: Figure 17 · p. 21, Figure 18 · p. 22
Loading 2007.04137v3…