通过控制图像失真，实现对目标检测器的高成功率攻击
Distortion-Aware Adversarial Attacks on Bounding Boxes of Object Detectors
- 基于检测框掩码和训练损失，添加可控制失真的噪声扰动
- 白盒攻击成功率100%，黑盒攻击达98%
- 适用于评估检测器鲁棒性，推动更抗干扰模型研发
近年来，基于深度学习的目标检测在诸多实际应用中展现出高精度，因而日益受到对抗攻击的关注。然而，现有研究多集中于分类器攻击，难以匹配目标检测的实际场景。本文提出一种新方法，通过在训练过程中扰动目标置信度分数，生成能够欺骗目标检测器的对抗样本。该方法基于检测对象的掩码，结合训练损失，利用迭代图像梯度实现加性噪声的嵌入，并对原始图像失真进行控制。我们在MS COCO 2017和PASCAL VOC 2012数据集上对YOLOv8、Faster R-CNN、RetinaNet和Swin Transformer等主流检测器进行了测试。实验表明，白盒攻击成功率可达100%，黑盒攻击成功率高达98%。同时分析了攻击成功率与图像失真之间的权衡关系。代码与文档已公开。
原文摘要 · Abstract (English)
Deep learning-based object detection has become ubiquitous in the last decade due to its high accuracy in many real-world applications. With this growing trend, these models are interested in being attacked by adversaries, with most of the results being on classifiers, which do not match the context of practical object detection. In this work, we propose a novel method to fool object detectors, expose the vulnerability of state-of-the-art detectors, and promote later works to build more robust detectors to adversarial examples. Our method aims to generate adversarial images by perturbing object confidence scores during training, which is crucial in predicting confidence for each class in the testing phase. Herein, we provide a more intuitive technique to embed additive noises based on detected objects' masks and the training loss with distortion control over the original image by leveraging the gradient of iterative images. To verify the proposed method, we perform adversarial attacks against different object detectors, including the most recent state-of-the-art models like YOLOv8, Faster R-CNN, RetinaNet, and Swin Transformer. We also evaluate our technique on MS COCO 2017 and PASCAL VOC 2012 datasets and analyze the trade-off between success attack rate and image distortion. Our experiments show that the achievable success attack rate is up to $100$\% and up to $98$\% when performing white-box and black-box attacks, respectively. The source code and relevant documentation for this work are available at the following link: https://github.com/anonymous20210106/attack_detector
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。