Rust-Style Patch: A Physical and Naturalistic Camouflage Attacks on Object Detector for Remote Sensing Images
-
Published:2023-02-05
Issue:4
Volume:15
Page:885
-
ISSN:2072-4292
-
Container-title:Remote Sensing
-
language:en
-
Short-container-title:Remote Sensing
Author:
Deng Binyue1, Zhang Denghui1, Dong Fashan1, Zhang Junjian1, Shafiq Muhammad1, Gu Zhaoquan23
Affiliation:
1. Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China 2. School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), Shenzhen 518055, China 3. Department of New Networks, Peng Cheng Laboratory, Shenzhen 518055, China
Abstract
Deep neural networks (DNNs) can improve the image analysis and interpretation of remote sensing technology by extracting valuable information from images, and has extensive applications such as military affairs, agriculture, environment, transportation, and urban division. The DNNs for object detection can identify and analyze objects in remote sensing images through fruitful features of images, which improves the efficiency of image processing and enables the recognition of large-scale remote sensing images. However, many studies have shown that deep neural networks are vulnerable to adversarial attack. After adding small perturbations, the generated adversarial examples will cause deep neural network to output undesired results, which will threaten the normal recognition and detection of remote sensing systems. According to the application scenarios, attacks can be divided into the digital domain and the physical domain, the digital domain attack is directly modified on the original image, which is mainly used to simulate the attack effect, while the physical domain attack adds perturbation to the actual objects and captures them with device, which is closer to the real situation. Attacks in the physical domain are more threatening, however, existing attack methods generally generate the patch with bright style and a large attack range, which is easy to be observed by human vision. Our goal is to generate a natural patch with a small perturbation area, which can help some remote sensing images used in the military to avoid detection by object detectors and im-perceptible to human eyes. To address the above issues, we generate a rust-style adversarial patch generation framework based on style transfer. The framework takes a heat map-based interpretability method to obtain key areas of target recognition and generate irregular-shaped natural-looking patches to reduce the disturbance area and alleviates suspicion from humans. To make the generated adversarial examples have a higher attack success rate in the physical domain, we further improve the robustness of the adversarial patch through data augmentation methods such as rotation, scaling, and brightness, and finally, make it impossible for the object detector to detect the camouflage patch. We have attacked the YOLOV3 detection network on multiple datasets. The experimental results show that our model has achieved a success rate of 95.7% in the digital domain. We also conduct physical attacks in indoor and outdoor environments and achieve an attack success rate of 70.6% and 65.3%, respectively. The structural similarity index metric shows that the adversarial patches generated are more natural than existing methods.
Funder
Major Key Project of PCL
Subject
General Earth and Planetary Sciences
Reference47 articles.
1. Qian, R., Lai, X., and Li, X. (2022). 3D Object Detection for Autonomous Driving: A Survey. Pattern Recognit., 130. 2. Fang, W., Shen, L., and Chen, Y. (2021). Artificial Intelligence and Security, Springer International Publishing. Lecture Notes in Computer Science. 3. Image Segmentation Using Deep Learning: A Survey;Minaee;IEEE Trans. Pattern Anal. Mach. Intell.,2022 4. Ship Detection Based on Deep Learning Using SAR Imagery: A Systematic Literature Review;Yasir;Soft Comput.,2022 5. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014, January 14–16). Intriguing Properties of Neural Networks. Proceedings of the International Conference on Learning Representations (ICLR), Banff, AB, Canada.
Cited by
6 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献
|
|