Recent work demonstrated the lack of robustness of optical flow networks to physical, patch-based adversarial attacks. The possibility to physically attack a basic component of automotive systems is a reason for serious concerns. In this paper, we analyze the cause of the problem and show that the lack of robustness is rooted in the classical aperture problem of optical flow estimation in combination with bad choices in the details of the network architecture. We show how these mistakes can be rectified in order to make optical flow networks robust to physical, patch-based attacks. Additionally, we take a look at global white-box attacks in the scope of optical flow. We find that targeted white-box attacks can be crafted to bias flow estimation models towards any desired output, but this requires access to the input images and model weights. Our results indicate that optical flow networks are robust to universal attacks.
翻译:最近的工作表明,光学流动网络对身体上的、基于补丁的对抗性攻击缺乏稳健性。物理攻击汽车系统一个基本组成部分的可能性是引起严重关切的一个原因。在本文件中,我们分析问题的原因,并表明缺乏稳健性的根源在于光学流动估计的典型孔径问题,同时在网络结构的细节中作出错误的选择。我们展示了如何纠正这些错误,以便使光学流动网络对身体上的、基于补丁的对抗性攻击具有稳健性。此外,我们审视了光学流动范围内的全球白箱攻击。我们发现,定向白箱攻击可以形成偏向任何预期产出的偏向流量估计模型,但这需要访问输入图像和模型重量。我们的结果表明,光学流动网络对普遍攻击具有稳健性。