Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Higher-Order Adversarial Patches for Real-Time Object Detectors

Jens Bayer, Stefan Becker, David Münch, Michael Arens, Jürgen Beyerer

TL;DR

This work studies higher-order adversarial patches for real-time object detectors by framing a cat-and-mouse game between attacker patch optimization and defender adversarial training, using YOLOv10b as the testbed. It introduces sequential, higher-order patches and four experimental settings to assess robustness, transferability, and the limits of adversarial training. The findings indicate that higher-order patches have stronger disruptive power and that training against lower-order patches does not fully protect against higher-order attacks, highlighting a generalization gap. The results have practical implications for deploying robust object detectors in adversarial settings and motivate further work on convergence and enhanced defenses.

Abstract

Higher-order adversarial attacks can directly be considered the result of a cat-and-mouse game -- an elaborate action involving constant pursuit, near captures, and repeated escapes. This idiom describes the enduring circular training of adversarial attack patterns and adversarial training the best. The following work investigates the impact of higher-order adversarial attacks on object detectors by successively training attack patterns and hardening object detectors with adversarial training. The YOLOv10 object detector is chosen as a representative, and adversarial patches are used in an evasion attack manner. Our results indicate that higher-order adversarial patches are not only affecting the object detector directly trained on but rather provide a stronger generalization capacity compared to lower-order adversarial patches. Moreover, the results highlight that solely adversarial training is not sufficient to harden an object detector efficiently against this kind of adversarial attack. Code: https://github.com/JensBayer/HigherOrder

Higher-Order Adversarial Patches for Real-Time Object Detectors

TL;DR

This work studies higher-order adversarial patches for real-time object detectors by framing a cat-and-mouse game between attacker patch optimization and defender adversarial training, using YOLOv10b as the testbed. It introduces sequential, higher-order patches and four experimental settings to assess robustness, transferability, and the limits of adversarial training. The findings indicate that higher-order patches have stronger disruptive power and that training against lower-order patches does not fully protect against higher-order attacks, highlighting a generalization gap. The results have practical implications for deploying robust object detectors in adversarial settings and motivate further work on convergence and enhanced defenses.

Abstract

Higher-order adversarial attacks can directly be considered the result of a cat-and-mouse game -- an elaborate action involving constant pursuit, near captures, and repeated escapes. This idiom describes the enduring circular training of adversarial attack patterns and adversarial training the best. The following work investigates the impact of higher-order adversarial attacks on object detectors by successively training attack patterns and hardening object detectors with adversarial training. The YOLOv10 object detector is chosen as a representative, and adversarial patches are used in an evasion attack manner. Our results indicate that higher-order adversarial patches are not only affecting the object detector directly trained on but rather provide a stronger generalization capacity compared to lower-order adversarial patches. Moreover, the results highlight that solely adversarial training is not sufficient to harden an object detector efficiently against this kind of adversarial attack. Code: https://github.com/JensBayer/HigherOrder
Paper Structure (19 sections, 1 equation, 3 figures, 1 table)

This paper contains 19 sections, 1 equation, 3 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. A Cat-and-Mouse Game
  4. Adversarial Patches
  5. Adversarial Training
  6. Higher Order Patches
  7. Experimental Setup
  8. Conducted Experiments
  9. Datasets
  10. Object Detectors
  11. Adversarial Patch Optimization
  12. Adversarial Training
  13. Evaluation
  14. Baseline
  15. Cat-and-Mouse-Game
  16. ...and 4 more sections

Figures (3)

  • Figure 1: Playing the cat-and-mouse game: The mouse (attacker) tries to hide from the cat (defender). By integrating hardened models and optimized attack patterns into the respective optimization processes, a cat-and-mouse dynamic emerges.
  • Figure 2: Heatmap of the performance of higher-order patches and higher-order networks on the evaluation set. The columns represent the order of the tested adversarial patches, while the rows indicate the order of the evaluated network. The shade of each cell encodes the arithmetic mean of the achieved $\Delta\text{AP}=AP_\text{Grayscale} - AP$ of a network for a set of 4 validation patches. $\mu$ is the row- and columnwise arithmetic mean.
  • Figure 3: Results of the transferability study. Each bar shows the mean performance of 21 detectors for the corresponding patches of the given order. In addition, the standard deviation is given.