DNN-based video object detection (VOD) powers autonomous driving and video surveillance industries with rising importance and promising opportunities. However, adversarial patch attack yields huge concern in live vision tasks because of its practicality, feasibility, and powerful attack effectiveness. This work proposes Themis, a software/hardware system to defend against adversarial patches for real-time robust video object detection. We observe that adversarial patches exhibit extremely localized superficial feature importance in a small region with non-robust predictions, and thus propose the adversarial region detection algorithm for adversarial effect elimination. Themis also proposes a systematic design to efficiently support the algorithm by eliminating redundant computations and memory traffics. Experimental results show that the proposed methodology can effectively recover the system from the adversarial attack with negligible hardware overhead.
翻译:以DNN为基础的视频物体探测(VOD)使自动驾驶和视频监视行业拥有越来越重要和充满希望的机会,然而,对抗性补丁攻击由于其实用性、可行性和强大的攻击效果,在现场视觉任务中引起了极大的关注。这项工作提议建立Themis软件/硬件系统,用以防御实时强力视频物体探测的对抗性补丁。我们观察到,对立性补丁在一个小型区域表现出极其局部的表面特征,具有非野蛮预测的重要性,因此提出了消除对抗性效果的对抗性区域探测算法。Themis还提出一个系统性的设计,通过消除多余的计算和记忆传输,高效率地支持算法。实验结果表明,拟议的方法能够有效地从对抗性攻击中以微小的硬件中恢复系统。