Structured Universal Adversarial Attacks on Object Detection for Video Sequences

TL;DR

The paper investigates vulnerabilities of video-based object detectors to universal adversarial perturbations and introduces a minimally distorted attack that uses nuclear norm regularization to create structured background perturbations. The optimization is solved with an adaptive optimistic exponentiated gradient (AO-Exp) method that promotes low-rank perturbations while maintaining stealth across frames. Empirical results on PETS 2009, EPFL-RLC, and CW4C show that the proposed AO-Exp and its low-rank variant outperform LoRa-PGD and FW-Nucl baselines in both effectiveness (lower IoU_acc) and stealth (lower MAP and ||δ||_*). The work provides public code and suggests future directions for defenses and dynamic-camera scenarios.

Abstract

Video-based object detection plays a vital role in safety-critical applications. While deep learning-based object detectors have achieved impressive performance, they remain vulnerable to adversarial attacks, particularly those involving universal perturbations. In this work, we propose a minimally distorted universal adversarial attack tailored for video object detection, which leverages nuclear norm regularization to promote structured perturbations concentrated in the background. To optimize this formulation efficiently, we employ an adaptive, optimistic exponentiated gradient method that enhances both scalability and convergence. Our results demonstrate that the proposed attack outperforms both low-rank projected gradient descent and Frank-Wolfe based attacks in effectiveness while maintaining high stealthiness. All code and data are publicly available at https://github.com/jsve96/AO-Exp-Attack.

Figures (7)

• Figure 1: Shows conceptual framework of universal adversarial attack on object detector. A carefully crafted Universal Adversarial Perturbation (UAP) suppresses all bounding boxes after applied on clean frames.
• Figure 2: The $\ell_1$ attack introduces flickering noise that trails moving objects and spreads across the street in subsequent frames, whereas the nuclear norm-based attack perturbs orthogonal spatial patterns of the video frames, resulting in more structured and spatially coherent perturbations.
• Figure 3: Shows frame number 55 of the PETS 2009 dataset for three different camera views.
• Figure 4: Shows three frames from the EPFL-RLC dataset.
• Figure 5: Shows three frames from the first video clip of the camera capturing the crossroad intersection in Coldwater (CW4C).