Source-linked AI summary
Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink
Ranjie Duan, Xiaofeng Mao, A. K. Qin, Yun Yang, Yuefeng Chen, Shaokai Ye, Yuan He
TL;DR
The paper addresses the underexplored threat of physical light beams attacking DNNs in real-world settings. It proposes AdvLB, which optimizes laser-beam parameters for digital and physical attacks, achieving high attack success rates and revealing characteristic laser-induced prediction errors.
Problem
Physical light beams from real sources have not been studied as adversarial attackers against DNNs in real-world scenarios, despite known light-related performance degradation.
Method
AdvLB searches laser-beam parameters, including wavelength, layout, width, and intensity, using model confidence scores to construct adversarial images and physical attacks.
Results
AdvLB achieves 100% indoor and 77.43% outdoor physical attack success rates, while averaging 95.1% success against ResNet50ori with 834 queries.
Takeaways & Limitations
The findings establish laser beams as an easily implemented real-world threat and support studying light-based adversarial perturbations and robustness under poor lighting.
Takeaways & Limitations
The current study fixes laser intensity at 1.0 and leaves dynamic environments, other light sources, additional vision tasks, and effective defenses for future work.
Abstract
from arXiv · showhide
Though it is well known that the performance of deep neural networks (DNNs) degrades under certain light conditions, there exists no study on the threats of light beams emitted from some physical source as adversarial attacker on DNNs in a real-world scenario. In this work, we show by simply using a laser beam that DNNs are easily fooled. To this end, we propose a novel attack method called Adversarial Laser Beam ($AdvLB$), which enables manipulation of laser beam's physical parameters to perform adversarial attack. Experiments demonstrate the effectiveness of our proposed approach in both digital- and physical-settings. We further empirically analyze the evaluation results and reveal that the proposed laser beam attack may lead to some interesting prediction errors of the state-of-the-art DNNs. We envisage that the proposed $AdvLB$ method enriches the current family of adversarial attacks and builds the foundation for future robustness studies for light.
1. Introduction
The paper identifies laser beams as a practical, previously underexplored physical-world threat to DNNs and introduces AdvLB to exploit them without modifying target objects. Experiments evaluate the method digitally and physically, while analyzing the prediction errors it causes.
- Motivation: Laser illumination can make a self-driving car misclassify captured objects, such as recognizing a trolleybus as an amphibian.The example also reports a street sign classified as a soap dispenser.
- Motivation: Unlike digital attacks, physical-world attacks operate on camera-captured scenes, limiting direct manipulation of model inputs.Existing physical attacks often use large perturbations because small changes are difficult for cameras to capture.
- Related limitations: Most existing physical attacks paste crafted stickers or project crafted perturbations, requiring perturbation design and sometimes physical access to the target.The paper positions these requirements as limitations of prior physical-world attack settings.
- AdvLB: AdvLB uses a laser beam directly as adversarial perturbation, enabling flexible attacks on objects without physically changing them.The method can target objects from a distance and perform attacks immediately before image capture.
- AdvLB: AdvLB searches controllable laser-beam physical parameters greedily and uses k-random-restart to reduce local-optimum effects in black-box attacks.The attacker searches using model confidence scores without requiring target-model knowledge.
- Evaluation: 95.1% attack success was achieved in the digital setting, while indoor and outdoor physical tests reached 100% and 77.43%, respectively.The digital evaluation used a subset of ImageNet, and the physical tests demonstrated real-world effectiveness with a laser pointer.
- Analysis: The paper analyzes AdvLB-induced errors and identifies color changes and laser-introduced class features as two broad error categories.These findings are presented as directions for further investigation by attackers and defenders.
2. Background and Related Work
The background distinguishes digital adversarial examples from physical-world attacks and reviews how prior methods modify images, objects, or illumination. It highlights that physical deployment introduces camera and environmental constraints.
- Digital attacks: Digital adversarial attacks add crafted perturbations to clean images and commonly constrain them with l2 or l∞ norm bounds.Other digital methods modify attributes such as color, texture, or physical parameters.
- Physical attacks: Physical attacks generate adversarial examples by presenting altered objects or scenes to cameras for recapture by target models.Examples include printed adversaries, traffic-sign patches, t-shirt patches, and camouflaged shapes.
- Physical attacks: Physical-world conditions such as viewpoint shifts, camera noise, and natural transformations complicate the realization of adversarial examples.These conditions distinguish physical deployment from direct digital input manipulation.
- Lighting devices: Prior lighting-device attacks use projectors or LEDs, but they require crafting perturbations or carefully deploying the lighting hardware.The reviewed projector methods target face-recognition systems, while LED deployment is performed on a cap.
3. Approach
AdvLB models a laser beam through controllable physical parameters and searches for settings that cause a target DNN to misclassify the laser-imposed image. The approach adapts parameter constraints and uses transformed inputs to support physical deployment.
- Laser Beam Definition: The attacked image x_lθ is formed by imposing a parameterized laser layer on clean image x and clipping the result to a valid range.The method uses simple linear image fusion to combine x and lθ.
- Laser Beam Definition: AdvLB represents a laser beam with wavelength, layout, width, and intensity parameters collected in θ.Wavelength controls color; layout determines the beam line, while width and intensity govern perceptibility and brightness.
- Laser Beam Adversarial Attack: AdvLB searches bounded parameter vectors θ using only the target model’s confidence score on the correct label in a black-box setting.The search space is Θ = {θ | θ = [λ, r, b, w, α], ϵ_min ≤ θ ≤ ϵ_max}, and the objective minimizes confidence in the correct class.
- Laser Beam Adversarial Attack: A greedy search randomly selects candidate parameter updates and accepts them when either direction decreases the correct-label confidence, stopping at misclassification or t_max steps.Candidate updates change one of λ, r, b, w, or α, with a selected step size.
- Laser Beam Adversarial Attack: k-random-restart repeats the search from different initializations to reduce the tendency of greedy optimization to become trapped in local optima.The paper reports that this strategy improves search effectiveness.
- Physical Adaptation: Physical adaptation uses real-world parameter constraints and batches of randomly transformed inputs to obtain effective parameter ranges for deployment.Transformations include rotation, translation, and added noise, helping account for difficulty reproducing an exact beam layout.
4. Evaluation
AdvLB is evaluated in digital and physical settings, including controlled indoor and outdoor tests, and its wavelength, width, layout, and restart parameters are ablated. The results show high attack success rates and parameter-dependent adversarial effects, while dynamic environments remain a stated limitation.
- Digital Test: 95.1% attack success rate was achieved on 1000 ImageNet images with 834 queries on average in the digital test.The evaluation used simulated laser beams and correctly classified ImageNet images.
- Physical Test: 100% attack success rate was achieved in the strict indoor physical setting, with digital and reproduced physical attacks producing almost consistent top-3 classifications.The experiment used 450nm, 532nm, and 680nm laser pointers against a banana, conch, and stop sign.
- Physical Test: 77.43% attack success rate was obtained in the outdoor stop-sign test, demonstrating threats from laser beams in an outdoor setting.The test considered a self-driving car approaching a stop sign and used an effective attack range returned by the method.
- Physical Test: The method remains limited in attacking dynamic environments, which the authors leave for future work.The limitation is stated after the outdoor evaluation.
- Ablation Study: 58.9% success rate was achieved by a simulated laser beam with λ = 580, indicating adversarial effects across different images.The wavelength study used ResNet50, 1000 ImageNet images, and unknown target models in a black-box setting.
- Ablation Study: Wider beams increased success from 30.80% to 47.69%, while even width w = 1 achieved 30.80% success.The width ranged from 1 to 40 while other laser parameters were fixed.
- Ablation Study: Attack success depended strongly on layout, with central illumination more likely to produce successful adversarial examples, and increased k-random-restarts gradually improved success.The layout study varied r and b, while the restart study tested k values from 1 to 200.
5. Discussion
The discussion attributes AdvLB’s misclassifications to altered or newly introduced visual cues, including wavelength-dependent class biases. It also reports that laser-beam augmentation provides partial defense without reducing clean-image accuracy.
- Prediction errors: AdvLB errors arise when the beam cancels or changes original image features, or introduces new cues that mislead DNNs.A hedgehog illuminated at 400 nm can acquire a blue-spine cue resembling a cardoon.
- Prediction errors: A 380 nm beam increases the Candle class percentage from 0.19% to 6.21%, showing that wavelength can create dominant class-specific features.The analysis also reports bias toward classes such as Bubble and Volcano, even when light is added at an image corner.
- Prediction errors: CAM analysis shows that adding a beam can bias model attention toward Bubble and Volcano and produce incorrect top-1 predictions.This bias occurs even when the light beam is placed in the corner of the image.
- Defense: Laser-beam augmentation progressively improves robustness without searching for worst-case perturbations at every training step.This approach avoids the higher computation cost associated with finding worst-case AdvLB perturbations.
- Defense: ResNet50rob reduces AdvLB attack success from 95.1% on ResNet50ori to 77.2%, while clean-image accuracy increases slightly by 0.21%.The reported averages use 834 queries for the undefended model and 2576 queries for the defended model.
6. Conclusion and Future Work
The paper presents AdvLB as a laser-based adversarial perturbation applicable in digital and physical settings, exposing an easily implemented real-world threat to DNNs. Future work targets dynamic environments, additional light parameters and sources, broader vision tasks, and stronger defenses.
- Conclusion: AdvLB uses laser beams as adversarial perturbations to generate examples in both digital and physical settings.The authors position this approach as a foundation for studying light-based robustness threats.
- Conclusion: The method reveals an easily implemented real-world threat to DNNs and complements existing physical-world adversarial attacks.The paper emphasizes threats to vision systems under poor light conditions.
- Future work: Future work will adapt AdvLB to dynamic environments and optimize light intensity for more stealthy simulated laser attacks.The authors also plan to investigate other light patterns and sources, including spotlights and natural light.
- Future work: The authors plan to apply AdvLB to object detection and segmentation and develop effective defense strategies.