实时生成能适应场景的物理对抗样本,提升真实世界攻击效果。
DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Time
- 通过残差引导探索,缓解噪声反馈对对抗模式学习的干扰
- 在DETR等检测器上实现58.8%平均准确率下降,性能提升2.07倍
- 适合研究物理攻击防御或需要动态对抗样本的场景
物理对抗样本(PAEs)被视为深度学习应用中现实风险的预警信号,值得深入研究。然而,现有PAE生成方法对多样变化场景的适应能力有限,亟需实时光场感知的动态PAEs。其核心挑战在于,在攻击训练噪声反馈下学习对抗样本与观察者信息之间的稀疏关系。为此,我们提出DynamicPAE,首个实现场景感知实时物理攻击的生成框架。为解决噪声反馈导致的探索困难,引入残差引导的对抗模式探索技术;通过重构任务放松攻击训练,丰富反馈信息,实现更全面的对抗样本探索。为解决生成器与真实场景间的对齐问题,设计分布匹配的攻击场景对齐机制,包括条件不确定性对齐数据模块和偏度对齐的目标重加权模块,前者使训练环境贴近攻击者不完整观测,后者通过偏度控制器实现跨目标一致的隐蔽性控制。数字与物理实验表明,DynamicPAE在代表性目标检测器(如DETR)上实现58.8%平均准确率下降,较最先进静态生成方法提升2.07倍。本工作为动态PAEs的端到端建模打开新路径。
原文摘要 · Abstract (English)
Physical adversarial examples (PAEs) are regarded as whistle-blowers of real-world risks in deep-learning applications, thus worth further investigation. However, current PAE generation studies show limited adaptive attacking ability to diverse and varying scenes, revealing the urgent requirement of dynamic PAEs that are generated in real time and conditioned on the observation from the attacker. The key challenge in generating dynamic PAEs is learning the sparse relation between PAEs and the observation of attackers under the noisy feedback of attack training. To address the challenge, we present DynamicPAE, the first generative framework that enables scene-aware real-time physical attacks. Specifically, to address the noisy feedback problem that obfuscates the exploration of scene-related PAEs, we introduce the residual-guided adversarial pattern exploration technique. Residual-guided training, which relaxes the attack training with a reconstruction task, is proposed to enrich the feedback information, thereby achieving a more comprehensive exploration of PAEs. To address the alignment problem between the trained generator and the real-world scenario, we introduce the distribution-matched attack scenario alignment, consisting of the conditional-uncertainty-aligned data module and the skewness-aligned objective re-weighting module. The former aligns the training environment with the incomplete observation of the real-world attacker. The latter facilitates consistent stealth control across different attack targets with the skewness controller. Extensive digital and physical evaluations demonstrate the superior attack performance of DynamicPAE, attaining a 2.07 $\times$ boost (58.8% average AP drop under attack) on representative object detectors (e.g., DETR) over state-of-the-art static PAE generating methods. Overall, our work opens the door to end-to-end modeling of dynamic PAEs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。