Generating Minimalist Adversarial Perturbations to Test Object-Detection Models: An Adaptive Multi-Metric Evolutionary Search Approach

TL;DR

Object-detection models are vulnerable to adversarial examples, and existing tests either require white-box access or produce unnecessary perturbations. The paper introduces TM-EVO, a triple-metric adaptive genetic algorithm that seeks minimal perturbations by combining three normalized metrics in a fitness function $fitness(I) = w_1 M_1(I) + w_2 M_2(I) + w_3 M_3(I)$, with plateau-based weight adaptation and an adaptive mutation-noise reduction step. Empirical evaluation on DETR (Transformer-based) and Faster R-CNN (CNN-based) across COCO and KITTI shows TM-EVO reduces perturbations by about $60.8\%$ in $L_0$ relative to EvoAttack and achieves competitive or superior $L_2$ performance, with runtimes remaining similar. These results yield a practical, reproducible framework for efficient black-box adversarial testing of object detectors, enabling more rigorous robustness assessments in real-world settings.

Abstract

Deep Learning (DL) models excel in computer vision tasks but can be susceptible to adversarial examples. This paper introduces Triple-Metric EvoAttack (TM-EVO), an efficient algorithm for evaluating the robustness of object-detection DL models against adversarial attacks. TM-EVO utilizes a multi-metric fitness function to guide an evolutionary search efficiently in creating effective adversarial test inputs with minimal perturbations. We evaluate TM-EVO on widely-used object-detection DL models, DETR and Faster R-CNN, and open-source datasets, COCO and KITTI. Our findings reveal that TM-EVO outperforms the state-of-the-art EvoAttack baseline, leading to adversarial tests with less noise while maintaining efficiency.

Figures (1)

• Figure 1: Comparing TM-EVO and EVO algorithms: (a) L0 norm results, (b) L2 norm results, and (c) run time results.