Transferable Adversarial Attacks for Image and Video Object Detection (1811.12641v5)

Abstract: Adversarial examples have been demonstrated to threaten many computer vision tasks including object detection. However, the existing attacking methods for object detection have two limitations: poor transferability, which denotes that the generated adversarial examples have low success rate to attack other kinds of detection methods, and high computation cost, which means that they need more time to generate an adversarial image, and therefore are difficult to deal with the video data. To address these issues, we utilize a generative mechanism to obtain the adversarial image and video. In this way, the processing time is reduced. To enhance the transferability, we destroy the feature maps extracted from the feature network, which usually constitutes the basis of object detectors. The proposed method is based on the Generative Adversarial Network (GAN) framework, where we combine the high-level class loss and low-level feature loss to jointly train the adversarial example generator. A series of experiments conducted on PASCAL VOC and ImageNet VID datasets show that our method can efficiently generate image and video adversarial examples, and more importantly, these adversarial examples have better transferability, and thus, are able to simultaneously attack two kinds of representative object detection models: proposal based models like Faster-RCNN, and regression based models like SSD.

• The paper introduces the Unified and Efficient Adversary (UEA) that enhances adversarial transferability across both image and video object detectors.
• It leverages a GAN-based architecture combined with high-level class loss and multi-scale attention feature distortions to affect proposal- and regression-based models.
• Empirical results on PASCAL VOC and ImageNet VID highlight a substantial mAP drop and nearly 1000-fold speedup in adversary generation compared to prior methods.

Transferable Adversarial Attacks for Image and Video Object Detection: An Expert's Overview

The paper by Wei et al. explores a notable advancement in the domain of adversarial attacks within computer vision, particularly focusing on the vulnerabilities of object detection models in both image and video contexts. The paper introduces the Unified and Efficient Adversary (UEA) method, which aims to solve two primary challenges faced by current adversarial attack strategies: weak transferability and high computational cost.

Methodological Advances

The proposed UEA framework is designed based on a Generative Adversarial Network (GAN) architecture. It strategically integrates a combination of high-level class loss and low-level feature distortion to enhance the transferability of the generated adversarial examples across different detection models, namely proposal-based models like Faster-RCNN and regression-based models like SSD. One significant advancement claimed by the authors is the ability of UEA to successfully attack both these detection paradigms, unlike prior methods such as Dense Adversary Generation (DAG), which are primarily effective only against one type of model.

The authors detail a multi-scale attention feature loss mechanism that manipulates the feature maps, derived from varying layers of the feature network, to augment the attack's effectiveness over black-box models. Attention weights, computed from the network's proposal regions, ensure that perturbations are focused on vital regions, thereby maintaining the imperceptibility of adversarial alterations.

Empirical Validation

Their empirical studies conducted on benchmark datasets such as PASCAL VOC and ImageNet VID demonstrate the efficacy and efficiency of UEA. The results indicate that UEA achieves optimal adversarial performance with a substantial mean Average Precision (mAP) drop in detection accuracy for both targeted detector models. Specifically, UEA registers an almost 1000-fold improvement in the processing time when generating adversarial instances compared to DAG, showcasing a marked improvement in computational efficiency.

Practical and Theoretical Implications

The significance of this research lies in its dual impact. Practically, the ability of the UEA method to swiftly generate potent adversarial examples poses implications for the security and robustness design of current detection systems. Theoretically, it propels the understanding of neural network vulnerabilities, especially emphasizing the role of feature manipulation across different layers—a tactic that could inform the development of more resilient model architectures against adversarial threats.

Future Perspectives

The implementation of the UEA framework heralds future research into the intricacies of feature-level and classifier-level interplays in crafting adversarial examples. Further exploration could delve into the method's adaptability and robustness against evolving architectural innovations within DNN-based object detectors. As adversarial attack techniques become increasingly sophisticated, so too must the corresponding defense mechanisms, which remain an open area for development.

In conclusion, the paper elucidates a sophisticated approach to object detection vulnerability through the UEA, providing a significant contribution to the field of adversarial machine learning. The balance between attack efficacy, computational efficiency, and model transferability marks a pivotal stride toward understanding and enhancing AI robustness in visual systems.