Object-fabrication Targeted Attack for Object Detection

TL;DR

A targeted feature space attack method is proposed that can mislead detectors to `fabricate' extra designated objects regardless of whether the victim image contains objects or not and shows significant improvements in terms of image-specific, universality, and generalization attack performance, compared with the previous targeted attack for object detection.

Abstract

Recent studies have demonstrated that object detection networks are usually vulnerable to adversarial examples. Generally, adversarial attacks for object detection can be categorized into targeted and untargeted attacks. Compared with untargeted attacks, targeted attacks present greater challenges and all existing targeted attack methods launch the attack by misleading detectors to mislabel the detected object as a specific wrong label. However, since these methods must depend on the presence of the detected objects within the victim image, they suffer from limitations in attack scenarios and attack success rates. In this paper, we propose a targeted feature space attack method that can mislead detectors to `fabricate' extra designated objects regardless of whether the victim image contains objects or not. Specifically, we introduce a guided image to extract coarse-grained features of the target objects and design an innovative dual attention mechanism to filter out the critical features of the target objects efficiently. The attack performance of the proposed method is evaluated on MS COCO and BDD100K datasets with FasterRCNN and YOLOv5. Evaluation results indicate that the proposed targeted feature space attack method shows significant improvements in terms of image-specific, universality, and generalization attack performance, compared with the previous targeted attack for object detection.

Figures (11)

• Figure 1: The existing targeted attack methods VS the proposed targeted feature space attack. The existing methods must rely on the detected objects to launch attacks while the proposed method can launch attacks on any image regardless of whether contains objects or not.
• Figure 2: The framework of the proposed targeted feature space attack. A victim image $\textbf{x}^s$ and a guided image $\textbf{x}^g$ containing a target object $o^t$ are used to conduct the targeted attack. Firstly, the features of the guided image and adversarial example are extracted by two identical detection models, i.e. $\textbf{v}^{g}_i$ and $\textbf{v}^{adv}_i$. Then, the critical features that represent $o^t$ are filtered out by the proposed dual attention mechanism. Finally, the adversarial example can be obtained by optimizing a loss function $\mathcal{L}$ consisting of the attention weights (${w}^c_i$, $\textbf{w}^s_i$) and features ($\textbf{v}^{g}_i$, $\textbf{v}^{adv}_i$).
• Figure 3: Part of the guided images containing the target objects. The first row is the guided images on the MS COCO dataset, second row is the guided images on the BDD100K dataset.
• Figure 4: The subjective illustrations of the proposed TFA and TOG on FasterRCNN and YOLOv5. The first two rows are the detection results of the MS COCO dataset while the last two rows are the detection results of the BDD100K dataset. Better to zoom in electronic version for viewing.
• Figure 5: The semantic information changes of different layers of FasterRCNN when performing TFA on two victim images.