In recent years, object detection has become very common and has wide applications in various fields. As research deepens, CNN-based object detectors are vulnerable to adversarial examples, and this weakness can also plague aerial object detectors. However, existing attacks can only train one type of patch at one time, and these adversarial patches are usually universal patches. In scenarios where we only want to apply patch to attacks certain categories of targets but do not attack other categories, these patches are not applicable. Meanwhile, due to the training characteristics of universal patches (attacking all categories), they often have an impact on the detection of objects of other categories around them without patches. In this work, we focus on multi-target category adversarial attacks against aerial detection and propose a novel attack method, Multi target distraction attack (MTDA). Specifically, we aim to design different patches for different categories of targets, and generate multiple adversarial examples corresponding to each category through the patch-apply module in order to restrict the attack area to the target area. Furthermore, to achieve higher attack performance on aerial detector, we utilize a novel attention loss to reduce the attention of objects in the target area while improving the attention of non-target areas. The experimental results indicate that compared to traditional attack methods, our method can achieve a higher attack success rate (ASR) on the Yolov3, with the highest ASR of multi-target united attack reaching 99.28%.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Multi-target Attention Dispersion Adversarial Attack Against Aerial Object Detector

  • Panpan Wang,
  • Shujuan Wang,
  • Zhichao Lian,
  • Shuohao Li

摘要

In recent years, object detection has become very common and has wide applications in various fields. As research deepens, CNN-based object detectors are vulnerable to adversarial examples, and this weakness can also plague aerial object detectors. However, existing attacks can only train one type of patch at one time, and these adversarial patches are usually universal patches. In scenarios where we only want to apply patch to attacks certain categories of targets but do not attack other categories, these patches are not applicable. Meanwhile, due to the training characteristics of universal patches (attacking all categories), they often have an impact on the detection of objects of other categories around them without patches. In this work, we focus on multi-target category adversarial attacks against aerial detection and propose a novel attack method, Multi target distraction attack (MTDA). Specifically, we aim to design different patches for different categories of targets, and generate multiple adversarial examples corresponding to each category through the patch-apply module in order to restrict the attack area to the target area. Furthermore, to achieve higher attack performance on aerial detector, we utilize a novel attention loss to reduce the attention of objects in the target area while improving the attention of non-target areas. The experimental results indicate that compared to traditional attack methods, our method can achieve a higher attack success rate (ASR) on the Yolov3, with the highest ASR of multi-target united attack reaching 99.28%.