Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores

TL;DR

This work investigates adversarial patch threats to object detection in fully unmanned stores, evaluating Hiding, Creating, and Altering attacks on YOLO v5 and Faster R-CNN in both digital and physical testbeds. It introduces a novel color histogram similarity loss, $L_{His}$, in HSV space to leverage attacker knowledge of target object color, and combines multiple losses into a final patch objective to maximize practical disruption, including a new complete IoU metric $CIoU$ for bounding-box realism. The study demonstrates that physical patches can significantly degrade real-time detections, with shadow and transfer black-box attacks further amplifying risk, and shows that robustness varies by target class and detector architecture. The findings underscore the need for proactive defenses and robust training to safeguard unmanned retail environments against adversarial threats in real-world conditions.

Abstract

The advent of convenient and efficient fully unmanned stores equipped with artificial intelligence-based automated checkout systems marks a new era in retail. However, these systems have inherent artificial intelligence security vulnerabilities, which are exploited via adversarial patch attacks, particularly in physical environments. This study demonstrated that adversarial patches can severely disrupt object detection models used in unmanned stores, leading to issues such as theft, inventory discrepancies, and interference. We investigated three types of adversarial patch attacks -- Hiding, Creating, and Altering attacks -- and highlighted their effectiveness. We also introduce the novel color histogram similarity loss function by leveraging attacker knowledge of the color information of a target class object. Besides the traditional confusion-matrix-based attack success rate, we introduce a new bounding-boxes-based metric to analyze the practical impact of these attacks. Starting with attacks on object detection models trained on snack and fruit datasets in a digital environment, we evaluated the effectiveness of adversarial patches in a physical testbed that mimicked a real unmanned store with RGB cameras and realistic conditions. Furthermore, we assessed the robustness of these attacks in black-box scenarios, demonstrating that shadow attacks can enhance success rates of attacks even without direct access to model parameters. Our study underscores the necessity for robust defense strategies to protect unmanned stores from adversarial threats. Highlighting the limitations of the current defense mechanisms in real-time detection systems and discussing various proactive measures, we provide insights into improving the robustness of object detection models and fortifying unmanned retail environments against these attacks.

Figures (10)

• Figure 1: Procedure of adversarial patch initialization.
• Figure 2: Adversarial patch generation process per $p_{0}$ according to the epochs. All generated patches are similar in color to the target class object.
• Figure 3: Histograms of reference image and adversarial patch in RGB (top) and hue saturation value (bottom) spaces.
• Figure 4: Bounding box generation results of adversarial patches for Creating attacks in a digital environment based on patch location. Blue bounding boxes indicate the target class, whereas other colors represent the original classes.
• Figure 5: Visualization of performance differences in adversarial patch attacks based on target classes.