一件对抗性服装可突破多种物理世界防御，暴露现有防御的共性漏洞。
A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical World
- 用覆盖人体的大面积对抗性服装测试防御方法，模拟真实攻击场景。
- 同一套服装在物理世界对9种防御模型的攻击成功率超64.84%，未防御模型达96.06%。
- 揭示现有防御机制对自然形态对抗样本的普遍脆弱性，适合安全与对抗研究者参考。
近年来，针对深度学习目标检测器的物理世界对抗攻击受到广泛关注。为防御典型可物理实现的对抗补丁攻击，研究者提出了多种防御方法。然而我们的实验表明，仅增大补丁尺寸即可使这些防御失效。受此启发，我们评估了多种防御方法在对抗性服装上的表现，这类服装在人体上覆盖范围广且外观更自然。实验显示，所有防御方法在数字与物理世界中均表现不佳。此外，我们设计了一套单一对抗性服装，在物理世界中对Faster R-CNN实现了96.06%的攻击成功率（ASR），并在九种防御模型上均超过64.84%的ASR，暴露出现有防御方法对对抗性服装的普遍脆弱性。代码已公开于：https://github.com/weiz0823/adv-clothes-break-multiple-defenses。
原文摘要 · Abstract (English)
In recent years, adversarial attacks against deep learning-based object detectors in the physical world have attracted much attention. To defend against these attacks, researchers have proposed various defense methods against adversarial patches, a typical form of physically-realizable attack. However, our experiments showed that simply enlarging the patch size could make these defense methods fail. Motivated by this, we evaluated various defense methods against adversarial clothes which have large coverage over the human body. Adversarial clothes provide a good test case for adversarial defense against patch-based attacks because they not only have large sizes but also look more natural than a large patch on humans. Experiments show that all the defense methods had poor performance against adversarial clothes in both the digital world and the physical world. In addition, we crafted a single set of clothes that broke multiple defense methods on Faster R-CNN. The set achieved an Attack Success Rate (ASR) of 96.06% against the undefended detector and over 64.84% ASRs against nine defended models in the physical world, unveiling the common vulnerability of existing adversarial defense methods against adversarial clothes. Code is available at: https://github.com/weiz0823/adv-clothes-break-multiple-defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。