用扩散模型生成自然且能骗过人体检测的服装对抗补丁
BadPatch: Diffusion-Based Generation of Physical Adversarial Patches
- 从参考图出发，结合掩码生成任意形状的补丁
- 攻击效果媲美顶尖非自然补丁，同时外观更真实
- 适合研究对抗样本防御或个性化安全应用者
印刷在衣物上的物理对抗补丁可使个体逃避人体检测，但现有方法多侧重攻击效果而忽视隐蔽性，导致补丁外观不自然。尽管生成对抗网络和扩散模型能生成更自然的补丁，却难以兼顾隐蔽性与攻击效果，且缺乏用户自定义能力。为此，我们提出 BadPatch——一种基于扩散模型的可定制、自然化的对抗补丁生成框架。该方法允许用户从参考图像开始，利用掩码生成非方形等多样化形状的补丁。为保留原始语义，采用空文本反演将随机噪声映射至单个输入图像，并通过不完整扩散优化（IDO）生成补丁。实验表明，该方法在攻击性能上接近当前最优非自然补丁，同时保持自然外观。基于此，我们构建了 AdvT-shirt-1K，首个包含上千张不同场景拍摄图像的物理对抗T恤数据集，可用于未来防御方法的训练与测试。
原文摘要 · Abstract (English)
Physical adversarial patches printed on clothing can enable individuals to evade person detectors, but most existing methods prioritize attack effectiveness over stealthiness, resulting in aesthetically unpleasing patches. While generative adversarial networks and diffusion models can produce more natural-looking patches, they often fail to balance stealthiness with attack effectiveness and lack flexibility for user customization. To address these limitations, we propose BadPatch, a novel diffusion-based framework for generating customizable and naturalistic adversarial patches. Our approach allows users to start from a reference image (rather than random noise) and incorporates masks to create patches of various shapes, not limited to squares. To preserve the original semantics during the diffusion process, we employ Null-text inversion to map random noise samples to a single input image and generate patches through Incomplete Diffusion Optimization (IDO). Our method achieves attack performance comparable to state-of-the-art non-naturalistic patches while maintaining a natural appearance. Using BadPatch, we construct AdvT-shirt-1K, the first physical adversarial T-shirt dataset comprising over a thousand images captured in diverse scenarios. AdvT-shirt-1K can serve as a useful dataset for training or testing future defense methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。