防止检测器依赖攻击纹理，提升物理攻击下的鲁棒性
Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks
- 通过实例级对比学习，让模型关注人体特征而非攻击纹理
- 在渲染和真实服装上测试，平均攻击准确率82.3%，误报率降至7.3%
- 适用于多种检测器架构，适合自动驾驶等安全关键场景
AI驱动的视觉感知系统广泛应用于智能交通与自动驾驶。然而，可物理实现的对抗性外观对这些关键系统构成严重可靠性挑战。传统对抗训练虽有效，但对抗纹理与正样本频繁共现会导致检测器将纹理本身视为物体存在的证据，形成纹理捷径。这导致仅含纹理输入时产生误检，并削弱跨攻击泛化能力。本文提出InsCAT，一种实例级对比对抗训练框架，阻止检测器将对抗纹理作为独立决策线索。SICA将对抗人体特征与对应干净特征对齐，同时与纯纹理负样本分离；ROPO和Guard持续施加攻击压力并协调训练。我们在渲染nuScenes、INRIAPerson、打印衣物数据集及三种检测器族上评估了八种独立生成的攻击纹理。InsCAT在渲染nuScenes上平均攻击准确率达82.3%，优于最强基线11.1个百分点；相比AT-Mix，纹理误报率从46.9%降至7.3%。物理实测中F1得分达96.6%，误报率仅1.8%。在独立训练的检测器上保持一致增益，表明其对不同架构的通用性。结果表明，鲁棒物理检测需保留目标相关证据，同时防止对抗纹理成为独立决策依据。
原文摘要 · Abstract (English)
AI-enabled visual perception systems are increasingly deployed in intelligent transportation infrastructure and autonomous vehicle related applications. However, physically realizable adversarial appearances pose a significant reliability challenge for these safety-critical systems. Adversarial training is effective, but repeated co-occurrence between adversarial texture and positive person instances can cause detectors to treat the texture itself as evidence of object presence, forming a patch texture shortcut. The detector may then treat texture as evidence for the target, causing false detections on texture-only inputs and weakening cross attack generalisation. We propose InsCAT, an instance-level contrastive adversarial training framework that prevents detectors from using adversarial texture as an independent decision cue. SICA aligns adversarial person features with matched clean features and separates them from texture-only negatives, while ROPO and Guard maintain online attack pressure and coordinate training. We evaluate eight independently generated attack textures on rendered nuScenes, INRIAPerson, printed garments, and three detector families. InsCAT achieves an average attack AP of 82.3% on rendered nuScenes, exceeding the strongest baseline by 11.1 points.Relative to AT-Mix, texture FPR decreases from 46.9% to 7.3%. Physical tests yield an F1 score of 96.6% and an FPR of 1.8%. Consistent gains across separately trained detectors demonstrate applicability across architectures with direct inference. The findings show that robust physical detection depends on preserving target related evidence while preventing adversarial texture from becoming an independent decision cu
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。