Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectors
Fuente:
arXiv
Guardado en:
| Autores principales: | , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2023
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866912657805672448 |
|---|---|
| author | Lapid, Raz Mizrahi, Eylon Sipper, Moshe |
| author_facet | Lapid, Raz Mizrahi, Eylon Sipper, Moshe |
| contents | Adversarial attacks on deep learning models have received increased attention in recent years. Work in this area has mostly focused on gradient-based techniques, so-called 'white-box' attacks, where the attacker has access to the targeted model's internal parameters; such an assumption is usually untenable in the real world. Additionally, some attacks use the entire pixel space to fool a given model, which is neither practical nor physical. To accommodate these problems we propose the BBNP algorithm (Black-Box Naturalistic Patch): a direct, black-box, naturalistic, gradient-free method that uses the learned image manifold of a pretrained, generative adversarial network (GAN) to generate naturalistic adversarial patches for object detectors. This method performs model-agnostic black-box naturalistic attacks on object detection models by relying solely on the outputs of the model. Comparing our approach against five models, five black-box and two white-box attacks, we show that our proposed method achieves state-of-the-art results, outperforming all other tested black-box approaches. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2303_04238 |
| institution | arXiv |
| publishDate | 2023 |
| record_format | arxiv |
| spellingShingle | Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectors Lapid, Raz Mizrahi, Eylon Sipper, Moshe Computer Vision and Pattern Recognition Artificial Intelligence Neural and Evolutionary Computing Adversarial attacks on deep learning models have received increased attention in recent years. Work in this area has mostly focused on gradient-based techniques, so-called 'white-box' attacks, where the attacker has access to the targeted model's internal parameters; such an assumption is usually untenable in the real world. Additionally, some attacks use the entire pixel space to fool a given model, which is neither practical nor physical. To accommodate these problems we propose the BBNP algorithm (Black-Box Naturalistic Patch): a direct, black-box, naturalistic, gradient-free method that uses the learned image manifold of a pretrained, generative adversarial network (GAN) to generate naturalistic adversarial patches for object detectors. This method performs model-agnostic black-box naturalistic attacks on object detection models by relying solely on the outputs of the model. Comparing our approach against five models, five black-box and two white-box attacks, we show that our proposed method achieves state-of-the-art results, outperforming all other tested black-box approaches. |
| title | Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectors |
| topic | Computer Vision and Pattern Recognition Artificial Intelligence Neural and Evolutionary Computing |
| url | https://arxiv.org/abs/2303.04238 |