Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Autoencoder-based Denoising Defense against Adversarial Attacks on Object Detection

Min Geun Song, Gang Min Kim, Woonmin Kim, Yongsik Kim, Jeonghyun Sim, Sangbeom Park, Huy Kang Kim

TL;DR

This work addresses the vulnerability of real-time object detectors to adversarial perturbations. It proposes an autoencoder-based denoising defense that preprocesses inputs before YOLOv5 inference to recover degraded detection performance without retraining. Experiments on COCO vehicle images with Perlin-noise attacks show a substantial drop in bbox mAP (from 0.2890 to 0.1640) and a partial restoration after denoising (to 0.1700) and mAP@50 (to 0.3080), while high-precision localization (mAP@75) sees a slight decline. The study highlights both the potential and limitations of denoising defenses for object detection and suggests avenues for more powerful architectures and broader attack scenarios in future work.

Abstract

Deep learning-based object detection models play a critical role in real-world applications such as autonomous driving and security surveillance systems, yet they remain vulnerable to adversarial examples. In this work, we propose an autoencoder-based denoising defense to recover object detection performance degraded by adversarial perturbations. We conduct adversarial attacks using Perlin noise on vehicle-related images from the COCO dataset, apply a single-layer convolutional autoencoder to remove the perturbations, and evaluate detection performance using YOLOv5. Our experiments demonstrate that adversarial attacks reduce bbox mAP from 0.2890 to 0.1640, representing a 43.3% performance degradation. After applying the proposed autoencoder defense, bbox mAP improves to 0.1700 (3.7% recovery) and bbox mAP@50 increases from 0.2780 to 0.3080 (10.8% improvement). These results indicate that autoencoder-based denoising can provide partial defense against adversarial attacks without requiring model retraining.

Autoencoder-based Denoising Defense against Adversarial Attacks on Object Detection

TL;DR

This work addresses the vulnerability of real-time object detectors to adversarial perturbations. It proposes an autoencoder-based denoising defense that preprocesses inputs before YOLOv5 inference to recover degraded detection performance without retraining. Experiments on COCO vehicle images with Perlin-noise attacks show a substantial drop in bbox mAP (from 0.2890 to 0.1640) and a partial restoration after denoising (to 0.1700) and mAP@50 (to 0.3080), while high-precision localization (mAP@75) sees a slight decline. The study highlights both the potential and limitations of denoising defenses for object detection and suggests avenues for more powerful architectures and broader attack scenarios in future work.

Abstract

Deep learning-based object detection models play a critical role in real-world applications such as autonomous driving and security surveillance systems, yet they remain vulnerable to adversarial examples. In this work, we propose an autoencoder-based denoising defense to recover object detection performance degraded by adversarial perturbations. We conduct adversarial attacks using Perlin noise on vehicle-related images from the COCO dataset, apply a single-layer convolutional autoencoder to remove the perturbations, and evaluate detection performance using YOLOv5. Our experiments demonstrate that adversarial attacks reduce bbox mAP from 0.2890 to 0.1640, representing a 43.3% performance degradation. After applying the proposed autoencoder defense, bbox mAP improves to 0.1700 (3.7% recovery) and bbox mAP@50 increases from 0.2780 to 0.3080 (10.8% improvement). These results indicate that autoencoder-based denoising can provide partial defense against adversarial attacks without requiring model retraining.

Paper Structure

This paper contains 21 sections, 3 equations, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Adversarial Attacks
  4. Adversarial Defenses
  5. Object Detection
  6. Dataset and Evaluation Metrics
  7. Perlin Noise
  8. Proposed Method
  9. Adversarial Noise Generation
  10. Autoencoder Architecture
  11. Training Configuration
  12. Dataset Configuration
  13. Object Detection Evaluation
  14. Experiments
  15. Experimental Setup
  16. ...and 6 more sections

Figures (2)

  • Figure 1: Overview of the proposed autoencoder-based denoising defense pipeline. Adversarial noise is added to clean images using Perlin noise, then the autoencoder removes the perturbation before object detection with YOLOv5.
  • Figure 2: Comparison of normal image (left) and adversarial image (right) with Perlin noise perturbation (maximum norm 30, period 30, frequency sine 30, octave 2).