研究自然对抗补丁在真实交通标志检测中的迁移效果，验证其有效性与评估方法。
Physical Evaluation of Naturalistic Adversarial Patches for Camera-Based Traffic-Sign Detection
- 用真实背景构建定制数据集，训练模型生成对抗补丁。
- 不同距离和位置下，补丁使检测器对停止标志置信度下降。
- 提出系统化物理测试协议，适合自动驾驶安全研究者参考。
本文研究了自然对抗补丁（NAPs）在真实交通标志检测场景中的迁移性能，实验基于为自动驾驶车辆（AV）环境定制的复合数据集CompGTSRB进行。该数据集通过将德国交通标志识别基准（GTSRB）中的标志实例贴到目标平台采集的无畸变背景上构建。使用YOLOv5模型在CompGTSRB上训练，并采用生成对抗网络（GAN）结合潜空间优化生成补丁，遵循现有NAP方法。在Quanser QCar测试平台上，利用前向CSI摄像头开展系列实验。结果显示，在不同距离、补丁尺寸和位置配置下，NAPs均显著降低检测器对STOP类标志的置信度。研究还提供了详细的方法步骤，验证了CompGTSRB数据集及所提系统性物理评估协议的有效性。该工作推动了针对嵌入式感知流水线中局部补丁干扰的防御机制研究。
原文摘要 · Abstract (English)
This paper studies how well Naturalistic Adversarial Patches (NAPs) transfer to a physical traffic sign setting when the detector is trained on a customized dataset for an autonomous vehicle (AV) environment. We construct a composite dataset, CompGTSRB (which is customized dataset for AV environment), by pasting traffic sign instances from the German Traffic Sign Recognition Benchmark (GTSRB) onto undistorted backgrounds captured from the target platform. CompGTSRB is used to train a YOLOv5 model and generate patches using a Generative Adversarial Network (GAN) with latent space optimization, following existing NAP methods. We carried out a series of experiments on our Quanser QCar testbed utilizing the front CSI camera provided in QCar. Across configurations, NAPs reduce the detector's STOP class confidence. Different configurations include distance, patch sizes, and patch placement. These results along with a detailed step-by-step methodology indicate the utility of CompGTSRB dataset and the proposed systematic physical protocols for credible patch evaluation. The research further motivate researching the defenses that address localized patch corruption in embedded perception pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。