{"type":"ScholarlyArticle","title":"Transferable Adversarial Attacks for Image and Video Object Detection","authors":[{"name":"Xingxing Wei","slug":"xingxing-wei","given":"Xingxing","family":"Wei","affiliation":"Dept. of Comp. Sci. & Tech. , Institute for Artificial Intelligence ,"},{"name":"Siyuan Liang","slug":"siyuan-liang","given":"Siyuan","family":"Liang","affiliation":"Institute of Information Engineering , Chinese Academy of Sciences; State Key Lab for Intell. Tech. & Sys. , THBI Lab , Tsinghua University"},{"name":"Ning Chen","slug":"ning-chen","given":"Ning","family":"Chen","affiliation":"Dept. of Comp. Sci. & Tech. , Institute for Artificial Intelligence ,"},{"name":"Xiaochun Cao","slug":"xiaochun-cao","given":"Xiaochun","family":"Cao","affiliation":"Institute of Information Engineering , Chinese Academy of Sciences"}],"abstract":"Identifying adversarial examples is beneficial for understanding deep networks and developing robust models. However, existing attacking methods for image object detection have two limitations: weak transferability---the generated adversarial examples often have a low success rate to attack other kinds of detection methods, and high computation cost---they need much time to deal with video data, where many frames need polluting. To address these issues, we present a generative method to obtain adversarial images and videos, thereby significantly reducing the processing time. To enhance transferability, we manipulate the feature maps extracted by a feature network, which usually constitutes the basis of object detectors. Our method is based on the Generative Adversarial Network (GAN) framework, where we combine a high-level class loss and a low-level feature loss to jointly train the adversarial example generator. Experimental results on PASCAL VOC and ImageNet VID datasets show that our method efficiently generates image and video adversarial examples, and more importantly, these adversarial examples have better transferability, therefore being able to simultaneously attack two kinds of  representative object detection models: proposal based models like Faster-RCNN and regression based models like SSD.","doi":"10.24963/ijcai.2019/134","url":"https://ijcai.org/proceedings/2019/134","pdf":"https://ijcai.org/proceedings/2019/0134.pdf","markdown":"https://ijcai.org/proceedings/2019/134.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/134","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Computer Vision","track":"Main track","number":134,"pages":{"first":954,"last":960},"keywords":["Machine Learning: Adversarial Machine Learning","Computer Vision: Recognition: Detection, Categorization, Indexing, Matching, Retrieval, Semantic Interpretation","Computer Vision: Video: Events, Activities and Surveillance"],"videos":[],"references":[{"position":1,"raw":"[Bose and Aarabi, 2018] Avishek Joey Bose and Parham Aarabi. Adversarial attacks on face detectors using neural net based constrained optimization. IEEE MMSP, 2018.","title":"Adversarial attacks on face detectors using neural net based constrained optimization","authors":"Joey Avishek, Parham Bose, Aarabi","year":"2018","venue":"IEEE MMSP","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Carlini and Wagner, 2017] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE S&P, pages 39-57, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"IEEE S&P","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2018] Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Chau. Robust physical adversar- ial attack on faster r-cnn object detector. arXiv preprint arXiv:1804.05810, 2018.","title":"Robust physical adversarial attack on faster r-cnn object detector","authors":"Cory Shang-Tse Chen, Jason Cornelius, Duen Martin, Chau Horng","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Dai et al., 2016] Jifeng Dai, Yi Li, Kaiming He, and Jian Sun. R-fcn: Object detection via region-based fully con- volutional networks. In NeurIPS, pages 379-387, 2016.","title":"R-fcn: Object detection via region-based fully convolutional networks","authors":"Jifeng Dai, Yi Li, Kaiming He, Jian Sun","year":"2016","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Dong et al., 2017] Yinpeng Dong, Hang Su, Jun Zhu, and Fan Bao. Towards interpretable deep neural networks by leveraging adversarial examples. arXiv preprint arXiv:1708.05493, 2017.","title":"Towards interpretable deep neural networks by leveraging adversarial examples","authors":"Dong","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Dong et al., 2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, pages 9185-9193, 2018.","title":"Boosting adversarial attacks with momentum","authors":"Dong","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Evtimov et al., 2017] Ivan Evtimov, Kevin Eykholt, Ear- lence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust physical- world attacks on deep learning models. arXiv preprint arXiv:1707.08945, 1, 2017.","title":"Robust physicalworld attacks on deep learning models","authors":"Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, Dawn Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Girshick et al., 2016] Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Region-based convolutional networks for accurate object detection and segmentation. IEEE TPAMI, 38(1):142-158, 2016.","title":"Region-based convolutional networks for accurate object detection and segmentation","authors":"Ross Girshick, Jeff Donahue, Trevor Darrell, Jitendra Malik","year":"2016","venue":"IEEE TPAMI","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Goodfellow et al., 2015] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. ICLR, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[He et al., 2017] Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In ICCV, pages 2980-2988, 2017.","title":"Kaiming He, Georgia Gkioxari","authors":"He","year":"2017","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Isola et al., 2017] Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to-image translation with con- ditional adversarial networks. ICCV, 2017.","title":"Image-to-image translation with conditional adversarial networks","authors":"Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, Alexei A Efros","year":"2017","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kingma and Ba, 2014] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.","title":"Adam: A method for stochastic optimization","authors":"P Diederik, Jimmy Kingma, Ba","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Li et al., 2018] Yuezun Li, Daniel Tian, Xiao Bian, Si- wei Lyu, et al. Robust adversarial perturbation on deep proposal-based models. BMVC, 2018.","title":"Robust adversarial perturbation on deep proposal-based models","authors":"Yuezun Li, Daniel Tian, Xiao Bian, Siwei Lyu","year":"2018","venue":"BMVC","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Liu et al., 2016] Wei Liu, Dragomir Anguelov, Dumitru Er- han, Christian Szegedy, Scott Reed, Cheng-Yang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In ECCV, pages 21-37. Springer, 2016.","title":"Ssd: Single shot multibox detector","authors":"Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yang Fu, Alexander C Berg","year":"2016","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Moosavi-Dezfooli et al., 2016] Seyed-Mohsen Moosavi- Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep- fool: a simple and accurate method to fool deep neural networks. In CVPR, pages 2574-2582, 2016.","title":"Deepfool: a simple and accurate method to fool deep neural networks","authors":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Pascal Frossard","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Pang et al., 2018] Tianyu Pang, Chao Du, Yinpeng Dong, and Jun Zhu. Towards robust detection of adversarial ex- amples. In NeurIPS, pages 4584-4594, 2018.","title":"Towards robust detection of adversarial examples","authors":"Tianyu Pang, Chao Du, Yinpeng Dong, Jun Zhu","year":"2018","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Poursaeed et al., 2018] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversar- ial perturbations. In CVPR, June 2018.","title":"Generative adversarial perturbations","authors":"Omid Poursaeed, Isay Katsman, Bicheng Gao, Serge Belongie","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Raghunathan et al., 2018] Aditi Raghunathan, Jacob Stein- hardt, and Percy Liang. Certified defenses against adver- sarial examples. arXiv preprint arXiv:1801.09344, 2018.","title":"Certified defenses against adversarial examples","authors":"Aditi Raghunathan, Jacob Steinhardt, Percy Liang","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Redmon et al., 2016] Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Uni- fied, real-time object detection. In CVPR, pages 779-788, 2016.","title":"You only look once: Unified, real-time object detection","authors":"Joseph Redmon, Santosh Divvala, Ross Girshick, Ali Farhadi","year":"2016","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Ren et al., 2017] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: towards real-time object detection with region proposal networks. IEEE TPAMI, (6):1137-1149, 2017.","title":"Faster r-cnn: towards real-time object detection with region proposal networks","authors":"Ren","year":"2017","venue":"IEEE TPAMI","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Sharif et al., 2016] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recogni- tion. In CCS, pages 1528-1540, 2016.","title":"Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition","authors":"Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, Michael K Reiter","year":"2016","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. ICLR, 2015.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2015","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Wei et al., 2018] Xingxing Wei, Jun Zhu, Sitong Feng, and Hang Su. Video-to-video translation with global temporal consistency. In ACMMM, pages 18-25, 2018.","title":"Video-to-video translation with global temporal consistency","authors":"Xingxing Wei, Jun Zhu, Sitong Feng, Hang Su","year":"2018","venue":"ACMMM","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Wei et al., 2019] Xingxing Wei, Jun Zhu, Yuan Sha, and Hang Su. Sparse adversarial perturbations for videos. In AAAI, 2019.","title":"Sparse adversarial perturbations for videos","authors":"Xingxing Wei, Jun Zhu, Yuan Sha, Hang Su","year":"2019","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Xiao et al., 2018] Chaowei Xiao, Bo Li, Jun-Yan Zhu, War- ren He, Mingyan Liu, and Dawn Song. Generating adver- sarial examples with adversarial networks. arXiv preprint arXiv:1801.02610, 2018.","title":"Generating adversarial examples with adversarial networks","authors":"Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, Dawn Song","year":"2018","venue":null,"doi":null,"url":null,"internal_url":"/proceedings/2018/543"},{"position":27,"raw":"[Xie et al., 2017] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial ex- amples for semantic segmentation and object detection. In ICCV, 2017.","title":"Adversarial examples for semantic segmentation and object detection","authors":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, Alan Yuille","year":"2017","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Zeiler and Fergus, 2014] Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In ECCV, pages 818-833, 2014.","title":"Visualizing and understanding convolutional networks","authors":"D Matthew, Rob Zeiler, Fergus","year":"2014","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Zhu et al., 2017a] Xizhou Zhu, Yujie Wang, Jifeng Dai, Lu Yuan, and Yichen Wei. Flow-guided feature aggrega- tion for video object detection. In ICCV, volume 3, 2017.","title":"Flow-guided feature aggregation for video object detection","authors":"Zhu","year":"2017","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Zhu et al., 2017b] Xizhou Zhu, Yuwen Xiong, Jifeng Dai, Lu Yuan, and Yichen Wei. Deep feature flow for video recognition. In ICCV, volume 1, page 3, 2017.","title":"Deep feature flow for video recognition","authors":"Zhu","year":"2017","venue":"ICCV","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}