针对大模型目标检测器,提出一种高效隐蔽的对抗注意力攻击方法。
Adversarial Attention Perturbations for Large Object Detection Transformers
- 通过可学习注意力机制,聚焦图像脆弱区域生成扰动。
- 在COCO数据集上使检测器失败率提升最高达83%。
- 适用于各类检测模型,扰动几乎无法被肉眼察觉。
对抗扰动是揭示神经网络漏洞的有效工具。现有目标检测对抗方法要么仅适用于基于CNN的检测器,要么对基于Transformer的检测器效果不佳。本文提出一种面向目标检测Transformer的注意力聚焦进攻梯度(AFOG)攻击方法。AFOG具有神经架构无关性,能统一攻击大型Transformer检测器和传统CNN检测器。其核心贡献包括:首先,利用可学习注意力机制,将扰动集中于多框检测任务中的易受攻击区域,相比非注意力基线性能提升最高达30.6%;其次,攻击损失函数通过可学习注意力更新,融合两种特征损失并迭代注入对抗扰动;最后,AFOG是一种高效且隐蔽的对抗扰动方法,通过生成视觉上几乎不可察觉的扰动,精准打击检测变压器的弱点,导致训练良好的目标检测模型失效。在COCO数据集上对12种大型检测变压器进行的大量实验验证了AFOG的有效性。实证结果还表明,AFOG在对抗基于Transformer和基于CNN的检测器时,性能优于现有方法最高达83%,同时具备更优的速度与不可感知性。代码已开源:https://github.com/zacharyyahn/AFOG。
原文摘要 · Abstract (English)
Adversarial perturbations are useful tools for exposing vulnerabilities in neural networks. Existing adversarial perturbation methods for object detection are either limited to attacking CNN-based detectors or weak against transformer-based detectors. This paper presents an Attention-Focused Offensive Gradient (AFOG) attack against object detection transformers. By design, AFOG is neural-architecture agnostic and effective for attacking both large transformer-based object detectors and conventional CNN-based detectors with a unified adversarial attention framework. This paper makes three original contributions. First, AFOG utilizes a learnable attention mechanism that focuses perturbations on vulnerable image regions in multi-box detection tasks, increasing performance over non-attention baselines by up to 30.6%. Second, AFOG's attack loss is formulated by integrating two types of feature loss through learnable attention updates with iterative injection of adversarial perturbations. Finally, AFOG is an efficient and stealthy adversarial perturbation method. It probes the weak spots of detection transformers by adding strategically generated and visually imperceptible perturbations which can cause well-trained object detection models to fail. Extensive experiments conducted with twelve large detection transformers on COCO demonstrate the efficacy of AFOG. Our empirical results also show that AFOG outperforms existing attacks on transformer-based and CNN-based object detectors by up to 83% with superior speed and imperceptibility. Code is available at https://github.com/zacharyyahn/AFOG.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。