Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Human-in-the-Middle Attack against Object Detection Systems

Han Wu, Sareh Rowlands, Johan Wahlstrom

TL;DR

This work models a new vulnerability class where a human-in-the-middle hardware channel injects perturbations into sensor data used by object detectors. It introduces PCB, a gradient-based method for both image-specific and universal perturbations, delivered via hardware between a USB camera and the detector, leveraging learning-rate decay and two loss formulations. Three novel evaluation metrics are proposed to capture attack strength and stability, along with an open-source white-box toolbox for real-time attacks. Experiments on VOC2012 and CARLA with YOLO demonstrate real-time feasibility and reveal significant safety implications for autonomous perception systems.

Abstract

Object detection systems using deep learning models have become increasingly popular in robotics thanks to the rising power of CPUs and GPUs in embedded systems. However, these models are susceptible to adversarial attacks. While some attacks are limited by strict assumptions on access to the detection system, we propose a novel hardware attack inspired by Man-in-the-Middle attacks in cryptography. This attack generates a Universal Adversarial Perturbations (UAP) and injects the perturbation between the USB camera and the detection system via a hardware attack. Besides, prior research is misled by an evaluation metric that measures the model accuracy rather than the attack performance. In combination with our proposed evaluation metrics, we significantly increased the strength of adversarial perturbations. These findings raise serious concerns for applications of deep learning models in safety-critical systems, such as autonomous driving.

A Human-in-the-Middle Attack against Object Detection Systems

TL;DR

This work models a new vulnerability class where a human-in-the-middle hardware channel injects perturbations into sensor data used by object detectors. It introduces PCB, a gradient-based method for both image-specific and universal perturbations, delivered via hardware between a USB camera and the detector, leveraging learning-rate decay and two loss formulations. Three novel evaluation metrics are proposed to capture attack strength and stability, along with an open-source white-box toolbox for real-time attacks. Experiments on VOC2012 and CARLA with YOLO demonstrate real-time feasibility and reveal significant safety implications for autonomous perception systems.

Abstract

Object detection systems using deep learning models have become increasingly popular in robotics thanks to the rising power of CPUs and GPUs in embedded systems. However, these models are susceptible to adversarial attacks. While some attacks are limited by strict assumptions on access to the detection system, we propose a novel hardware attack inspired by Man-in-the-Middle attacks in cryptography. This attack generates a Universal Adversarial Perturbations (UAP) and injects the perturbation between the USB camera and the detection system via a hardware attack. Besides, prior research is misled by an evaluation metric that measures the model accuracy rather than the attack performance. In combination with our proposed evaluation metrics, we significantly increased the strength of adversarial perturbations. These findings raise serious concerns for applications of deep learning models in safety-critical systems, such as autonomous driving.
Paper Structure (19 sections, 6 equations, 9 figures, 1 table, 2 algorithms)

This paper contains 19 sections, 6 equations, 9 figures, 1 table, 2 algorithms.

Table of Contents

  1. Introduction
  2. Contributions
  3. Preliminaries
  4. Object Detection Models
  5. Adversarial Attacks
  6. The Human-in-the-Middle Attack
  7. Problem Formulation
  8. Generating the perturbation (The PCB Attack)
  9. Image-specific PCB Attack
  10. Image-agnostic PCB Attack
  11. Applying the perturbation (the hardware attack)
  12. Experimental Evaluation
  13. Evaluation Metrics
  14. Initialization Methods
  15. Learning Rate Decay
  16. ...and 4 more sections

Figures (9)

  • Figure 1: The Human-in-the-Middle (HitM) hardware attack.
  • Figure 2: Our approach to generate and apply adversarial perturbations in bold.
  • Figure 3: The architecture of the Human-in-the-Middle hardware attack and its differences from physical and digital attacks.
  • Figure 4: The limitations of Mean Average Precision (mAP).
  • Figure 5: The image-specific PCB fabrication attack using different initialization methods.
  • ...and 4 more figures