研究对抗补丁在自动驾驶语义分割中的跨模型攻击效果
Cross-Model Transferability of Adversarial Patches in Real-time Segmentation for Autonomous Driving
- 基于期望变换设计更真实的实时攻击补丁
- 跨模型测试显示攻击对不同架构几乎无效
- 补丁攻击在CNN中影响局部，而ViT影响更广
对抗攻击对深度学习模型构成重大威胁，尤其在医疗和自动驾驶等安全关键领域。近期基于补丁的攻击因其‘拖放’特性，在实时推理场景中表现出高效性。针对语义分割任务，本文提出一种基于期望变换（EOT）的新型对抗补丁攻击方法，更具现实意义。为有效训练该攻击，还设计了一种简化损失函数，便于分析与实现。在此基础上，系统研究了在特定分割模型上优化的对抗补丁是否能迁移攻击其他模型。实验覆盖当前主流的卷积神经网络（CNN）模型如PIDNet-S、PIDNet-M、PIDNet-L，以及基于视觉变压器（ViT）的Segformer模型，均在广泛使用的Cityscapes数据集上进行。结果表明：尽管对抗补丁在未见过图像上具有高迁移性，但在不同模型间迁移效果极差，无论针对CNN还是ViT模型均如此。此外，对于CNN模型，攻击影响范围局限；而对ViT模型则更具全局性。按类别分析发现，如‘天空’等简单类别受误分类影响较小。项目代码已开源。
原文摘要 · Abstract (English)
Adversarial attacks pose a significant threat to deep learning models, particularly in safety-critical applications like healthcare and autonomous driving. Recently, patch based attacks have demonstrated effectiveness in real-time inference scenarios owing to their 'drag and drop' nature. Following this idea for Semantic Segmentation (SS), here we propose a novel Expectation Over Transformation (EOT) based adversarial patch attack that is more realistic for autonomous vehicles. To effectively train this attack we also propose a 'simplified' loss function that is easy to analyze and implement. Using this attack as our basis, we investigate whether adversarial patches once optimized on a specific SS model, can fool other models or architectures. We conduct a comprehensive cross-model transferability analysis of adversarial patches trained on SOTA Convolutional Neural Network (CNN) models such PIDNet-S, PIDNet-M and PIDNet-L, among others. Additionally, we also include the Segformer model to study transferability to Vision Transformers (ViTs). All of our analysis is conducted on the widely used Cityscapes dataset. Our study reveals key insights into how model architectures (CNN vs CNN or CNN vs. Transformer-based) influence attack susceptibility. In particular, we conclude that although the transferability (effectiveness) of attacks on unseen images of any dimension is really high, the attacks trained against one particular model are minimally effective on other models. And this was found to be true for both ViT and CNN based models. Additionally our results also indicate that for CNN-based models, the repercussions of patch attacks are local, unlike ViTs. Per-class analysis reveals that simple-classes like 'sky' suffer less misclassification than others. The code for the project is available at: https://github.com/p-shekhar/adversarial-patch-transferability
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。