EVD4UAV: An Altitude-Sensitive Benchmark to Evade Vehicle Detection in UAV

TL;DR

This work introduces EVD4UAV, an altitude-sensitive UAV vehicle-detection benchmark with 6,284 images and 90,886 fine-grained vehicle annotations captured at 50m, 70m, and 90m to study patch-based evasion. It proposes a unified adversarial patch and evaluates white-box and two black-box attacks (CLIP-based and distribution-based) against Faster R-CNN, DETR, and YOLOv8, using a gradient-based patch update $P^{i+1} = P^{i} - \eta \cdot \nabla_{P} \mathcal{L}_a$ and detector-specific loss functions. Results show white-box patches outperform black-box patches, yet no method achieves robust altitude-insensitive performance across all heights, underscoring altitude as a critical factor in defense and attack design. The work highlights the need for altitude-aware defenses and provides a dataset and methodology to advance robustness in UAV-based vehicle detection.

Abstract

Vehicle detection in Unmanned Aerial Vehicle (UAV) captured images has wide applications in aerial photography and remote sensing. There are many public benchmark datasets proposed for the vehicle detection and tracking in UAV images. Recent studies show that adding an adversarial patch on objects can fool the well-trained deep neural networks based object detectors, posing security concerns to the downstream tasks. However, the current public UAV datasets might ignore the diverse altitudes, vehicle attributes, fine-grained instance-level annotation in mostly side view with blurred vehicle roof, so none of them is good to study the adversarial patch based vehicle detection attack problem. In this paper, we propose a new dataset named EVD4UAV as an altitude-sensitive benchmark to evade vehicle detection in UAV with 6,284 images and 90,886 fine-grained annotated vehicles. The EVD4UAV dataset has diverse altitudes (50m, 70m, 90m), vehicle attributes (color, type), fine-grained annotation (horizontal and rotated bounding boxes, instance-level mask) in top view with clear vehicle roof. One white-box and two black-box patch based attack methods are implemented to attack three classic deep neural networks based object detectors on EVD4UAV. The experimental results show that these representative attack methods could not achieve the robust altitude-insensitive attack performance.

Figures (7)

• Figure 1: Example vehicle detection before and after the adversarial attack in the altitudes of 50m, 90m in the proposed altitude-sensitive EVD4UAV dataset. Due to the space limit, the altitude of 70m is skipped.
• Figure 2: Total number of (a) images and (b) fine-grained annotated vehicles of our EVD4UAV in different UAV altitudes (50m, 70m, 90m).
• Figure 3: Example vehicle images in EVD4UAV with labeled horizontal bounding boxes, rotated bounding boxes, and instance-level segmentation masks from top to bottom.
• Figure 4: Proportions of (a) images in four scenes, (b) annotated vehicle color attribute, (c) annotated vehicle type attribute in EVD4UAV.
• Figure 5: Schematic representation of adversarial patch generation and application processes for white-box and black-box attacks on UAV vehicle detectors, highlighting the path from patch creation to detector evasion and classification discrepancy.