AdvRain: Adversarial Raindrops to Attack Camera-Based Smart Vision Systems
-
Published:2023-11-28
Issue:12
Volume:14
Page:634
-
ISSN:2078-2489
-
Container-title:Information
-
language:en
-
Short-container-title:Information
Author:
Guesmi Amira1ORCID, Hanif Muhammad Abdullah1, Shafique Muhammad1
Affiliation:
1. eBrain Lab, Division of Engineering, New York University Abu Dhabi (NYUAD), Abu Dhabi 129188, United Arab Emirates
Abstract
Vision-based perception modules are increasingly deployed in many applications, especially autonomous vehicles and intelligent robots. These modules are being used to acquire information about the surroundings and identify obstacles. Hence, accurate detection and classification are essential to reach appropriate decisions and take appropriate and safe actions at all times. Current studies have demonstrated that “printed adversarial attacks”, known as physical adversarial attacks, can successfully mislead perception models such as object detectors and image classifiers. However, most of these physical attacks are based on noticeable and eye-catching patterns for generated perturbations making them identifiable/detectable by the human eye, in-field tests, or in test drives. In this paper, we propose a camera-based inconspicuous adversarial attack (AdvRain) capable of fooling camera-based perception systems over all objects of the same class. Unlike mask-based FakeWeather attacks that require access to the underlying computing hardware or image memory, our attack is based on emulating the effects of a natural weather condition (i.e., Raindrops) that can be printed on a translucent sticker, which is externally placed over the lens of a camera whenever an adversary plans to trigger an attack. Note, such perturbations are still inconspicuous in real-world deployments and their presence goes unnoticed due to their association with a natural phenomenon. To accomplish this, we develop an iterative process based on performing a random search aiming to identify critical positions to make sure that the performed transformation is adversarial for a target classifier. Our transformation is based on blurring predefined parts of the captured image corresponding to the areas covered by the raindrop. We achieve a drop in average model accuracy of more than 45% and 40% on VGG19 for ImageNet dataset and Resnet34 for Caltech-101 dataset, respectively, using only 20 raindrops.
Funder
NYUAD Center for Cyber Security Tamkeen under the NYUAD Research Institute Center for Interacting Urban Networks Center for Artificial Intelligence and Robotics
Subject
Information Systems
Reference29 articles.
1. Al-Qizwini, M., Barjasteh, I., Al-Qassab, H., and Radha, H. (2017, January 11–14). Deep learning algorithm for autonomous driving using GoogLeNet. Proceedings of the IEEE Intelligent Vehicles Symposium (IV), Los Angeles, CA, USA. 2. Tramèr, F., Zhang, F., Juels, A., Reiter, M.K., and Ristenpart, T. (2016, January 10–12). Stealing Machine Learning Models via Prediction APIs. Proceedings of the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA. 3. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2015). Explaining and Harnessing Adversarial Examples. arXiv. 4. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2016). Adversarial examples in the physical world. arXiv. 5. Carlini, N., and Wagner, D.A. (2016). Towards Evaluating the Robustness of Neural Networks. arXiv.
Cited by
1 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献
|
|