Nowadays, general object detectors like YOLO and Faster R-CNN as well as their variants are widely exploited in many applications. Many works have revealed that these detectors are extremely vulnerable to adversarial patch attacks. The perturbed regions generated by previous patch-based attack works on object detectors are very large which are not necessary for attacking and perceptible for human eyes. To generate much less but more efficient perturbation, we propose a novel patch-based method for attacking general object detectors. Firstly, we propose a patch selection and refining scheme to find the pixels which have the greatest importance for attack and remove the inconsequential perturbations gradually. Then, for a stable ensemble attack, we balance the gradients of detectors to avoid over-optimizing one of them during the training phase. Our RPAttack can achieve an amazing missed detection rate of 100% for both Yolo v4 and Faster R-CNN while only modifies 0.32% pixels on VOC 2007 test set. Our code is available at https://github.com/VDIGPKU/RPAttack.
翻译：目前,像YOLO和Appear R-CNN这样的普通物体探测器及其变异器在许多应用中被广泛利用。许多工程显示,这些探测器极易受到对抗性孔状攻击攻击的伤害。以前对物体探测器的补丁攻击工作所产生的扰动区域非常大,对人体眼睛来说,这些区域是没有必要的。为了产生更小、更有效率的扰动,我们建议采用新的补丁法攻击一般物体探测器。首先,我们提议一个补丁选择和精炼办法,以找到对攻击具有最大重要性的像素,并逐步消除无序扰动。然后,对于稳定的共感攻击,我们平衡探测器的梯度,以避免在训练阶段过度优化其中的一个。我们的RPattack可以实现惊人的100 %的错失探测率,Yolo v4和快速R-CNN,同时只修改VOC2007测试设置上的0.32%的像素。我们的代码可在https://github.com/VGPIKU/RPAtack上查阅。
相关内容
微信扫码咨询专知VIP会员