检索结果-内蒙古大学图书馆

IPAttack: imperceptible adversarial patch to attack object detectors

APPLIED INTELLIGENCE 2025年第6期55卷 1-12页

作者： Wen, Yongming Si, Peiyuan Zhou, Wei Zhao, Zongheng Yi, Chao Liu, Renyang Yunnan Univ Engn Res Ctr Cyberspace Kunming 650500 Yunnan Peoples R China China South to North Water Divers Grp Water Networ Beijing Peoples R China Nanyang Technol Univ Singapore 639798 Singapore Natl Univ Singapore Singapore 117602 Singapore

With the widespread application of deep learning, general object detectors have become increasingly popular in our daily lives. Extensive research, however, has shown that existing detectors are vulnerable to patch-based adversarial attacks, which fool such detectors by crafting adversarial patches. Although existing methods have made significant progress in terms of attack success rate, they still suffer from a highly perceptible problem, making it easy for humans to distinguish these evil examples. To address this issue, in this paper, we propose a novel spatial transform-based end-to-end patch attack method, called IPAttack, to synthesize imperceptible adversarial patches. Our approach estimates a flow field f\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varvec{f}$$\end{document} to formulate adversarial examples rather than introduce small Lp\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$L_p$$\end{document}-norm constrained external perturbations. Besides, to improve the imperceptibility and maintain a high attack performance, we propose the object Detector Class Activation Map (OD-CAM) for objectors to extract the most interesting region, which will be applied to spatial transform to generate the final adversarial examples. Extensive experiments demonstrate that the proposed IPAttack can generate patch-wised adversarial examples with high imperceptibility while achieving the best attack performance compared to existing methods.

关键词： Adversarial attack Adversarial patch object detectors Spatial transform OD-CAM

来源：评论

学校读者我要写书评

暂无评论

Classification and regression Task Integration in distillation for object detectors

引用

NEUROCOMPUTING 2025年 624卷

作者： Su, Hai Jian, Zhenwen Wei, Yanghui Yu, Songsen South China Normal Univ Dept Software Engn Foshan 528225 Guangdong Peoples R China

Knowledge distillation is a popular technique for model compression. However, since knowledge distillation originated in image classification, it primarily concentrates on classification tasks in object detection and often overlooks regression tasks. Emphasizing the classification task while neglecting the regression task can lead to skewed predictions about the model's learning condition in knowledge distillation methods. To address this, we propose Task Integration Distillation (TID), a method that integrates both classification and regression tasks, enhancing the model's ability to accurately capture the learning condition. Inspired by real-world teaching strategies and the concept of learning conditions, TID emphasizes the importance of features derived from both tasks, ensuring a balanced consideration of key and weak areas. We quantify and map the outputs of the two tasks from the object detector onto the feature map. Through this output mapping, we identify key areas and weak areas of the features to assess the model's current learning state. Extensive experiments demonstrate that TID consistently outperforms existing methods, with a notable increase of about 2.0% in mean Average Precision (mAP) over recent feature decoupling and distillation approaches.

关键词： Knowledge distillation object detectors

来源：评论

学校读者我要写书评

暂无评论

Realistic Adversarial Attacks on object detectors Using Generative Models

引用

Journal of Mathematical Sciences (United States) 2024年第2期285卷 245-254页

作者： Shelepneva, D. Arkhipenko, K. Ivannikov Institute for System Programming of the RAS Moscow Russian Federation

An important limitation of existing adversarial attacks on real-world object detectors lies in their threat model: adversarial patch-based methods often produce suspicious images while image generation approaches do not restrict the attacker’s capabilities of modifying the original scene. We design a threat model where the attacker modifies individual image segments and is required to produce realistic images. We also develop and evaluate a white-box attack that utilizes generative adversarial nets and diffusion models as a generator of malicious images. Our attack is able to produce high-fidelity images as measured by the Fréchet inception distance (FID) and reduces the mAP of Faster R-CNN model by over 0.2 on Cityscapes and COCO-Stuff datasets. A PyTorch implementation of our attack is available at https://***/DariaShel/gan-attack. © The Author(s), under exclusive licence to Springer Nature Switzerland AG 2024.

关键词： adversarial examples diffusion models generative adversarial networks object detectors

来源：评论

学校读者我要写书评

暂无评论

Fooling object detectors in the Physical World with Natural Adversarial Camouflage 22

Fooling Object Detectors in the Physical World with Natural ...

引用

IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) / BigDataSE Conference / CSE Conference / EUC Conference / ISCI Conference

作者： Li, Dandan Li, Yufeng Zhang, Guiqi Sun, Ke Li, Jiangtao Shanghai Univ Sch Comp Engn & Sci Shanghai Peoples R China Purple Mt Labs Nanjing Peoples R China

ISBN: (纸本)9798350381993;9798350382006

Recent research has brought to light the vulnerability of deep neural networks (DNNs) to adversarial examples. While several methods have been proposed for generating physical adversarial examples, they often suffer from a critical flaw conspicuous and easily detectable patterns by humans, limiting their real-world effectiveness. To overcome this limitation, we introduce an innovative approach termed "dual adversarial camouflage" (DAC) that generates natural adversarial camouflage in the physical world. Our DAC method leverages natural styles to hide attacks effectively. The process involves a two-stage training process. In the first stage, we learn the style features from style images. Building on this, the second stage optimizes the camouflage obtained in the first stage by minimizing the target detection score, thus significantly enhancing the attack performance. Experiment results show that the adversarial camouflage generated by our method has high naturalness and can effectively deceive object detectors. In practical tests, the attack success rate of our adversarial camouflage in both the digital and physical worlds is impressive, achieving 96.9% and 80% respectively. This showcases the real-world potential and robustness of our DAC method in evading detection.

关键词： Adversarial Examples Natural Style Adversarial Camouflage object detectors Adversarial Attack

来源：评论

学校读者我要写书评

暂无评论

Evaluation of object detectors in Online Videos 11

Evaluation of Object Detectors in Online Videos

引用

11th International Conference on Intelligent Human-Machine Systems and Cybernetics (IHMSC)

作者： Su, Jiongming Xiang, Fengtao Liu, Hongfu Wu, Jianzhai Natl Univ Def Technol Coll Intelligence Sci & Technol Changsha Peoples R China

ISBN: (纸本)9781728118598

object detectors based on deep convolutional networks generally have problems such as large amount of calculation, accuracy and speed of object detecor cannot have both, and it is difficult to achieve real-time object detection on embedded and mobile devices for online videos. Therefore, evaluating existing object detectors is an important issue that needs to be faced by a wide range of object detection applications. This paper proposes an evaluation method for object detectors in online video scenes. The method comprehensively considers the factors of the law of appeared objects, camera parameters, accuracy and speed of object detectors, and uses a combination of mathematical analysis and simulation experiments. On the Nvidia Jetson TX2 platform, the current major objects detectors have been analyzed and evaluated in detail using our evaluation method. The main evaluation results show that the YOLOv3 family is better than other object detectors and their variants such as SSD and RetinaNet, although it has not the highest accuracy, its fastest speed helps to occupy an advantage in the (different) object detection rate.

关键词： Evaluation object detectors Deep Convolutional Networks Online Videos

来源：评论

学校读者我要写书评

暂无评论

I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for object detectors 24

I Don't Know You, But I Can Catch You: Real-Time Defense aga...

引用

31st Conference on Computer and Communications Security

作者： Lin, Zijin Zhao, Yue Chen, Kai He, Jinwen UCAS Sch Cyber Secur CAS IIE Beijing Peoples R China Chinese Acad Sci IIE Beijing Peoples R China

ISBN: (纸本)9798400706363

Deep neural networks (DNNs) have revolutionized the field of computer vision like object detection with their unparalleled performance. However, existing research has shown that DNNs are vulnerable to adversarial attacks. In the physical world, an adversary could exploit adversarial patches to implement a Hiding Attack (HA) which patches the target object to make it disappear from the detector, and an Appearing Attack (AA) which fools the detector into misclassifying the patch as a specific object. Recently, many defense methods for detectors have been proposed to mitigate the potential threats of adversarial patches. However, such methods still have limitations in generalization, robustness and efficiency. Most defenses are only effective against the HA, leaving the detector vulnerable to the AA. In this paper, we propose NutNet, an innovative model for detecting adversarial patches, with high generalization, robustness and efficiency. With experiments for six detectors including YOLOv2-v4, SSD, Faster RCNN and DETR on both digital and physical domains, the results show that our proposed method can effectively defend against both the HA and AA, with only 0.4% sacrifice of the clean performance. We compare NutNet with four baseline defense methods for detectors, and our method exhibits an average defense performance that is over 2.4 times and 4.7 times higher than existing approaches for HA and AA, respectively. In addition, NutNet only increases the inference time by 8%, which can meet the real-time requirements of the detection systems. Demos and the full paper of NutNet are available at: https://***/view/nutnet.

关键词： Adversarial patch Physical adversarial defense object detectors

来源：评论

学校读者我要写书评

暂无评论

Validation of Safety Metrics for object detectors in Autonomous Driving 24

Validation of Safety Metrics for Object Detectors in Autonom...

引用

39th Annual ACM Symposium on Applied Computing (SAC)

作者： Ronnestad, Andreas Ceccarelli, Andrea Montecchi, Leonardo Norwegian Univ Sci & Technol Trondheim Norway Univ Florence Florence Italy

ISBN: (纸本)9798400702433

object detection consists in perceiving and locating instances of objects in multi-dimensional data, such as images or lidar scans. While object detection is a fundamental step in autonomous vehicles applications, it is typically evaluated with generic metrics like precision and recall. Recently, metrics that take into account safety have been proposed in the literature. In this paper we compare two recently proposed safety metrics models for object detectors, "Planning KL divergence" and "object Criticality Model", validating to what extent they actually measure the safety of an object detector when employed in an autonomous driving application. We base our experiments on the nuScenes dataset, and we compare the two metrics in different scenarios, both nominal ones and with the deliberate injection of detection faults. We conclude that both metrics serve as an indicator of the safety of an object detector, but they also provide different perspectives, and should therefore be used complementarily. As a by-product of this work, we also release a library for the injection of faults in experiments based on the nuScenes object detection task.

关键词： object detectors safety reliability PKL OCM criticality model

来源：评论

学校读者我要写书评

暂无评论

Sanity Checks for Saliency Methods Explaining object detectors 1st

Sanity Checks for Saliency Methods Explaining Object Detecto...

引用

1st World Conference on Explainable Artificial Intelligence (XAI)

作者： Padmanabhan, Deepan Chakravarthi Ploeger, Paul G. Arriaga, Octavio Valdenegro-Toro, Matias Bonn Rhein Sieg Univ Appl Sci St Augustin Germany Univ Bremen Bremen Germany Univ Groningen Groningen Netherlands

ISBN: (纸本)9783031440632;9783031440649

Saliency methods are frequently used to explain Deep Neural Network-based models. Adebayo et al.'s work on evaluating saliency methods for classification models illustrate certain explanation methods fail the model and data randomization tests. However, on extending the tests for various state of the art object detectors we illustrate that the ability to explain a model is more dependent on the model itself than the explanation method. We perform sanity checks for object detection and define new qualitative criteria to evaluate the saliency explanations, both for object classification and bounding box decisions, using Guided Backpropagation, Integrated Gradients, and their Smooth-grad versions, together with Faster R-CNN, SSD, and EfficientDet-D0, trained on COCO. In addition, the sensitivity of the explanation method to model parameters and data labels varies class-wise motivating to perform the sanity checks for each class. We find that EfficientDet-D0 is the most interpretable method independent of the saliency method, which passes the sanity checks with little problems.

关键词： object detectors Saliency methods Sanity checks

来源：评论

学校读者我要写书评

暂无评论

Seeing isn't Believing: Towards More Robust Adversarial Attack Against Real World object detectors 19

Seeing isn't Believing: Towards More Robust Adversarial Atta...

引用

ACM SIGSAC Conference on Computer and Communications Security (CCS)

作者： Zhao, Yue Zhu, Hong Liang, Ruigang Shen, Qintao Zhang, Shengzhi Chen, Kai Chinese Acad Sci Inst Informat Engn SKLOIS Beijing Peoples R China Univ Chinese Acad Sci Sch Cyber Secur Beijing Peoples R China Boston Univ Dept Comp Sci Metropolitan Coll Boston MA 02215 USA

ISBN: (纸本)9781450367479

Recently Adversarial Examples (AEs) that deceive deep learning models have been a topic of intense research interest. Compared with the AEs in the digital space, the physical adversarial attack is considered as a more severe threat to the applications like face recognition in authentication, objection detection in autonomous driving cars, etc. In particular, deceiving the object detectors practically, is more challenging since the relative position between the object and the detector may keep changing. Existing works attacking object detectors are still very limited in various scenarios, e.g., varying distance and angles, etc. In this paper, we presented systematic solutions to build robust and practical AEs against real world object detectors. Particularly, for Hiding Attack (HA), we proposed the feature-interference reinforcement (FIR) method and the enhanced realistic constraints generation (ERG) to enhance robustness, and for Appearing Attack (AA), we proposed the nested-AE, which combines two AEs together to attack object detectors in both long and short distance. We also designed diverse styles of AEs to make AA more surreptitious. Evaluation results show that our AEs can attack the state-of-the-art real-time object detectors (i.e., YOLO V3 and faster-RCNN) at the success rate up to 92.4% with varying distance from 1m to 25m and angles from -60 degrees to 60 degrees(1). Our AEs are also demonstrated to be highly transferable, capable of attacking another three state-of-the-art black-box models with high success rate.

关键词： Physical adversarial attack object detectors Neural networks

来源：评论

学校读者我要写书评

暂无评论

NaturalAE: Natural and robust physical adversarial examples for object detectors

引用

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS 2021年 57卷

作者： Xue, Mingfu Yuan, Chengxiang He, Can Wang, Jian Liu, Weiqiang Nanjing Univ Aeronaut & Astronaut Coll Comp Sci & Technol Nanjing Peoples R China Nanjing Univ Aeronaut & Astronaut Coll Elect & Informat Engn Nanjing Peoples R China

Recently, many studies show that deep neural networks (DNNs) are susceptible to adversarial examples, which are generated by adding imperceptible perturbations to the input of DNN. However, in order to convince that adversarial examples are real threats in real physical world, it is necessary to study and evaluate the adversarial examples in real-world scenarios. In this paper, we propose a natural and robust physical adversarial example attack method targeting object detectors under real-world conditions, which is more challenging than targeting image classifiers. The generated adversarial examples are robust to various physical constraints and visually look similar to the original images, thus these adversarial examples are natural to humans and will not cause any suspicions. First, to ensure the robustness of the adversarial examples in real-world conditions, the proposed method exploits different image transformation functions (Distance, Angle, Illumination and Photographing), to simulate various physical changes during the iterative optimization of the adversarial examples generation. Second, to construct natural adversarial examples, the proposed method uses an adaptive mask to constrain the area and intensities of the added perturbations, and utilizes the real-world perturbation score (RP S) to make the perturbations be similar to those real noises in physical world. Compared with existing studies, our generated adversarial examples can achieve a high success rate with less conspicuous perturbations. Experimental results demonstrate that, the generated adversarial examples are robust under various indoor and outdoor physical conditions, including different distances, angles, illuminations, and photographing. Specifically, the attack success rate of generated adversarial examples indoors and outdoors is high up to 73.33% and 82.22%, respectively. Meanwhile, the proposed method ensures the naturalness of the generated adversarial example, and the size of added

关键词： Physical adversarial examples Artificial intelligence security Deep learning object detectors

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：