Source-linked AI summary
Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World
Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, Xianglong Liu
TL;DR
Physical adversarial attacks remain difficult because existing perturbations have weak transferability across models and suspicious visual appearance. DAS suppresses model-shared and human-specific attention to generate transferable, context-correlated camouflages, and experiments across digital and physical classification and detection report that it outperforms state-of-the-art baselines.
Problem
Existing physical adversarial methods have weak transferability across different target models and visually suspicious perturbations.
Method
DAS distracts model-shared attention from target to non-target regions and evades human bottom-up attention with scenario-context-correlated camouflage.
Results
DAS outperforms state-of-the-art baselines in digital and physical experiments spanning classification and detection tasks.
Takeaways & Limitations
DAS produces adversarial camouflage designed to be transferable across models and more natural to human perception.
Takeaways & Limitations
The study focuses mainly on black-box attacks and identifies real-vehicle evaluation and robustness against different noises as future work.
Abstract
from arXiv · showhide
Deep learning models are vulnerable to adversarial examples. As a more threatening type for practical deep learning systems, physical adversarial examples have received extensive research attention in recent years. However, without exploiting the intrinsic characteristics such as model-agnostic and human-specific patterns, existing works generate weak adversarial perturbations in the physical world, which fall short of attacking across different models and show visually suspicious appearance. Motivated by the viewpoint that attention reflects the intrinsic characteristics of the recognition process, this paper proposes the Dual Attention Suppression (DAS) attack to generate visually-natural physical adversarial camouflages with strong transferability by suppressing both model and human attention. As for attacking, we generate transferable adversarial camouflages by distracting the model-shared similar attention patterns from the target to non-target regions. Meanwhile, based on the fact that human visual attention always focuses on salient items (e.g., suspicious distortions), we evade the human-specific bottom-up attention to generate visually-natural camouflages which are correlated to the scenario context. We conduct extensive experiments in both the digital and physical world for classification and detection tasks on up-to-date models (e.g., Yolo-V5) and significantly demonstrate that our method outperforms state-of-the-art methods.
1. Introduction
Physical adversarial attacks are challenging because real-world conditions weaken perturbations, while existing methods have limited transferability and suspicious visual appearance. DAS addresses both issues by suppressing shared model attention and human-specific visual attention, with experiments reporting superior performance to state-of-the-art methods.
- Physical attacks modify real objects and face constraints such as lighting, distance, and camera conditions that impair adversarial perturbations.
- Existing physical attacks rely on model-specific clues, weakening transferability across target models and producing visually suspicious perturbations.
- DAS distracts model-shared attention from target to non-target regions through connected graphs to generate transferable adversarial camouflages.
- DAS evades human bottom-up attention by generating camouflages with strong semantic correlation to the scenario context, producing more natural appearances.
- Extensive digital and physical experiments on classification and detection tasks demonstrate that DAS outperforms other state-of-the-art methods.
2. Related Works
Prior work distinguishes digital attacks, which perturb input pixels, from physical attacks, which modify real-object appearance. Physical methods include painted camouflages and localized adversarial patches.
- Adversarial attacks are categorized by settings including targeted or untargeted objectives and white-box or black-box access.
- Digital attacks generate adversarial perturbations in the input data's digital pixel domain, including gradient-based methods such as FGSM and PGD.
- Physical attacks modify real-object visual characteristics, often by transferring digitally generated perturbations onto painted objects.
- Adversarial patches constrain noise to small, localized regions without a perturbation constraint.
3. Approach
DAS defines physical adversarial camouflage as an attention-suppression problem, targeting both model attention for transferability and human attention for visual naturalness. It replaces an object's texture with an adversarial texture while preserving contextual and shape-related cues.
- 3.1. Problem Definitions: Physical attacks replace an object's original texture with an adversarial texture rendered under environmental conditions such as camera views, distance, and illumination.The rendered adversarial image is intended to fool real deep learning systems when the camouflage is painted or overlaid on an object.
- 3.2. Framework Overview: DAS suppresses both model and human attention to generate visually-natural physical adversarial camouflage with strong transferability.The framework separates model-attention distraction from human-attention evasion.
- 3.3. Model Attention Distraction: Model attention is distracted by exploiting patterns shared across models and shifting heat regions from the target object toward non-target regions.The method treats shared attention patterns as model-agnostic structures that can transfer attacks across different models.
- 3.3. Model Attention Distraction: An attention module can be an arbitrary deep learning model rather than the target model, supporting attention-based attack transferability.The attention map represents how strongly regions contribute to model predictions.
- 3.3. Model Attention Distraction: Minimizing the attention distraction loss shrinks salient regions and lowers their pixel values, producing a less heated, distracted attention map.The connected-graph formulation decreases overall connectivity and node weights within salient regions.
- 3.4. Human Attention Evasion: Human attention is evaded by correlating camouflage appearance with scenario context, using a semantically associated seed patch, and preserving its shape information.An edge-derived mask limits perturbations in edge regions, while contextual correlation makes the camouflage less suspicious to human perception.
4. Experiments
The experiments evaluate DAS in digital and physical settings across classification and detection, then analyze its transferable attention mechanism and human-perceived naturalness. Results show strong transferable attacks, including against varied models, while ablations separate the roles of model-attention distraction and human-attention evasion.
- Experimental Settings: The evaluation uses Accuracy for classification and P@0.5 for detection, with comparisons against UPC, CAMOU, and MeshAdv.The physical setup uses printed camouflages attached to a toy car and images captured across directions, angles, distances, and surroundings.
- Experimental Settings: DAS is evaluated in digital and physical worlds for classification and detection using multiple established classification and detection architectures.The classification models include Inception-V3, VGG-19, ResNet-152, and DenseNet; detection models include Yolo-V5, SSD, Faster R-CNN, and Mask R-CNN.
- Physical World Attack: DAS achieves competitive transferable attacking ability in the physical world, with reported classification results of 31.94% on Inception-V3, 27.78% on VGG-19, 29.86% on ResNet-152, and 34.03% on DenseNet.The authors also report that DAS retains attacking ability against Yolo-V5 despite its strong performance.
- Model Attention Analysis: Different models show similar attention patterns for the same image, and their attention maps have comparatively high SSIM similarities.The analysis uses visualizations across four models and pairwise SSIM comparisons of attention maps.
- Model Attention Analysis: Changing the target class distracts attention away from salient objects and makes it sparser across the image, supporting attention distraction as an attack mechanism.The authors summarize that models can be attacked toward wrong predictions by distracting their attention.
- Human Perception Study: In the human perception study, 60.4% of participants judged DAS camouflage natural-looking, outperforming other methods by more than 17 percentage points.Additionally, 49.6% recognized the ground-truth label for DAS camouflages, reported as better than other methods.
- Ablation Studies: The ablation study attributes transferable attacking ability mainly to model-attention distraction and natural appearance to human-attention evasion.Under Ld, Le, and Ld + Le settings, reported accuracies are 36.53%, 59.87%, and 39.86%, with corresponding SSIM values of 0.6905, 0.9987, and 0.7551.
5. Conclusion
The paper proposes DAS, which suppresses both model and human attention to generate transferable, visually natural physical adversarial camouflages. Experiments across digital and physical worlds and classification and detection tasks show that DAS outperforms state-of-the-art baselines, while real-vehicle evaluation remains future work.
- DAS suppresses model-shared attention to improve transferability and human-specific attention to produce natural, unsuspicious camouflage.The method distracts shared attention from target to non-target regions and preserves a semantically associated seed content patch.
- DAS outperforms state-of-the-art baselines in black-box experiments spanning classification and detection tasks across digital and physical worlds.
- Real-vehicle attack performance remains an open direction, including deployment through projection or 3D printing on a real-world vehicle.