{"type":"ScholarlyArticle","title":"Learning Coated Adversarial Camouflages for Object Detectors","authors":[{"name":"Yexin Duan","slug":"yexin-duan","given":"Yexin","family":"Duan","affiliation":"Department of Watercraft Power , Army Military Transportation University of PLA , Zhenjiang , China; College of Command and Control Engineering , Army Engineering University of PLA , Nanjing , China"},{"name":"Jialin Chen","slug":"jialin-chen","given":"Jialin","family":"Chen","affiliation":"The 28th Research Institute of China Electronics Technology Group Corporation , Nanjing , China"},{"name":"Xingyu Zhou","slug":"xingyu-zhou","given":"Xingyu","family":"Zhou","affiliation":"Communication Engineering College , Army Engineering University of PLA , Nanjing , China"},{"name":"Junhua Zou","slug":"junhua-zou","given":"Junhua","family":"Zou","affiliation":"College of Command and Control Engineering , Army Engineering University of PLA , Nanjing , China"},{"name":"Zhengyun He","slug":"zhengyun-he","given":"Zhengyun","family":"He","affiliation":"College of Command and Control Engineering , Army Engineering University of PLA , Nanjing , China; Railway Transportation College , Hunan University of Technology , Zhuzhou , China"},{"name":"Jin Zhang","slug":"jin-zhang","given":"Jin","family":"Zhang","affiliation":"Department of Watercraft Power , Army Military Transportation University of PLA , Zhenjiang , China"},{"name":"Wu Zhang","slug":"wu-zhang","given":"Wu","family":"Zhang","affiliation":"College of Command and Control Engineering , Army Engineering University of PLA , Nanjing , China"},{"name":"Zhisong Pan","slug":"zhisong-pan","given":"Zhisong","family":"Pan","affiliation":"College of Command and Control Engineering , Army Engineering University of PLA , Nanjing , China"}],"abstract":"An adversary can fool deep neural network object detectors by generating adversarial noises. Most of the existing works focus on learning local visible noises in an adversarial \"patch\" fashion. However, the 2D patch attached to a 3D object tends to suffer from an inevitable reduction in attack performance as the viewpoint changes. To remedy this issue, this work proposes the Coated Adversarial Camouflage (CAC) to attack the detectors in arbitrary viewpoints. Unlike the patch trained in the 2D space, our camouflage generated by a conceptually different training framework consists of 3D rendering and dense proposals attack. Specifically, we make the camouflage perform 3D spatial transformations according to the pose changes of the object. Based on the multi-view rendering results, the top-n proposals of the region proposal network are fixed, and all the classifications in the fixed dense proposals are attacked simultaneously to output errors. In addition, we build a virtual 3D scene to fairly and reproducibly evaluate different attacks. Extensive experiments demonstrate the superiority of CAC over the existing attacks, and it shows impressive performance both in the virtual scene and the real world. This poses a potential threat to the security-critical computer vision systems.","doi":"10.24963/ijcai.2022/125","url":"https://ijcai.org/proceedings/2022/125","pdf":"https://ijcai.org/proceedings/2022/0125.pdf","markdown":"https://ijcai.org/proceedings/2022/125.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/125","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Computer Vision","track":"Main Track","number":125,"pages":{"first":891,"last":897},"keywords":["Computer Vision: Adversarial learning, adversarial attack and defense methods","Machine Learning: Adversarial Machine Learning"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986458","length_sec":74,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38984601","length_sec":263,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Athalye et al., 2018] Anish Athalye, Logan Engstrom, An- drew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In International conference on machine learning, pages 284-293. PMLR, 2018.","title":"Synthesizing robust adversarial examples","authors":"Anish Athalye, Logan Engstrom, Andrew Ilyas, Kevin Kwok","year":"2018","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Brown et al., 2017] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017.","title":"Adversarial patch","authors":"Dandelion Tom B Brown, Aurko Mané, Martín Roy, Justin Abadi, Gilmer","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Chen et al., 2018] Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. Shapeshifter: Ro- bust physical adversarial attack on faster r-cnn object de- tector. In Joint European Conference on Machine Learn- ing and Knowledge Discovery in Databases, pages 52-68. Springer, 2018.","title":"Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector","authors":"Cory Shang-Tse Chen, Jason Cornelius, Duen Martin, Polo Horng, Chau","year":"2018","venue":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Dong et al., 2019] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4312-4321, 2019.","title":"Evading defenses to transferable adversarial examples by translation-invariant attacks","authors":"Dong","year":"2019","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Everingham et al., 2015] Mark Everingham, SM Ali Es- lami, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes challenge: A retrospective. International journal of com- puter vision, 111(1):98-136, 2015.","title":"The pascal visual object classes challenge: A retrospective","authors":"Mark Everingham, Ali Sm, Luc Eslami, Van Gool, K I Christopher, John Williams, Andrew Winn, Zisserman","year":"2015","venue":"International journal of computer vision","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Huang et al., 2020] Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 720-729, 2020.","title":"Universal physical camouflage attacks on object detectors","authors":"Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, Ning Liu","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Lin et al., 2014] Tsung-Yi Lin, Michael Maire, Serge Be- longie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Com- mon objects in context. In European conference on com- puter vision, pages 740-755. Springer, 2014.","title":"Microsoft coco: Common objects in context","authors":"Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, C Lawrence, Zitnick","year":"2014","venue":"European conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Lu et al., 2017] Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. No need to worry about adversarial ex- amples in object detection in autonomous vehicles. arXiv preprint arXiv:1707.03501, 2017.","title":"No need to worry about adversarial examples in object detection in autonomous vehicles","authors":"Jiajun Lu, Hussein Sibai, Evan Fabry, David Forsyth","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Redmon and Farhadi, 2018] Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018.","title":"Yolov3: An incremental improvement","authors":"Joseph Redmon, Ali Farhadi","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Ren et al., 2015] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: Towards real-time ob- ject detection with region proposal networks. Advances in neural information processing systems, 28:91-99, 2015.","title":"Faster r-cnn: Towards real-time object detection with region proposal networks","authors":"Ren","year":"2015","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Selvaraju et al., 2017] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on com- puter vision, pages 618-626, 2017.","title":"Grad-cam: Visual explanations from deep networks via gradient-based localization","authors":"Selvaraju","year":"2017","venue":"Proceedings of the IEEE international conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. In 3rd International Con- ference on Learning Representations, ICLR, 2015.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2015","venue":"3rd International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Sitawarin et al., 2018] Chawin Sitawarin, Arjun Nitin Bhagoji, Arsalan Mosenia, Mung Chiang, and Prateek Mittal. Darts: Deceiving autonomous cars with toxic signs. arXiv preprint arXiv:1802.06430, 2018.","title":"Chawin Sitawarin, Arjun Nitin Bhagoji","authors":"Sitawarin","year":"2018","venue":"Darts: Deceiving autonomous cars with toxic signs","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Song et al., 2018] Dawn Song, Kevin Eykholt, Ivan Evti- mov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical ad- versarial examples for object detectors. In 12th {USENIX} Workshop on Offensive Technologies ({WOOT} 18), 2018.","title":"Physical adversarial examples for object detectors","authors":"Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, Tadayoshi Kohno","year":"2018","venue":"12th {USENIX} Workshop on Offensive Technologies ({WOOT} 18)","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR, 2014.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2014","venue":"2nd International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Szegedy et al., 2016] Christian Szegedy, Vincent Van- houcke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818-2826, 2016.","title":"Rethinking the inception architecture for computer vision","authors":"Szegedy","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Thys et al., 2019] Simen Thys, Wiebe Van Ranst, and Toon Goedemé. Fooling automated surveillance cameras: ad- versarial patches to attack person detection. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 0-0, 2019.","title":"Fooling automated surveillance cameras: adversarial patches to attack person detection","authors":"Simen Thys, Wiebe Van Ranst, Toon Goedemé","year":"2019","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Xie et al., 2017] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision, pages 1369-1378, 2017.","title":"Adversarial examples for semantic segmentation and object detection","authors":"Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, Alan Yuille","year":"2017","venue":"Proceedings of the IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Xie et al., 2019] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Im- proving transferability of adversarial examples with input diversity. In Proceedings of the IEEE Conference on Com- puter Vision and Pattern Recognition, pages 2730-2739, 2019.","title":"Improving transferability of adversarial examples with input diversity","authors":"Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Alan L Zhou Ren, Yuille","year":"2019","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Zhang et al., 2019] Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. Camou: Learning physical ve- hicle camouflages to adversarially attack detectors in the wild. In International Conference on Learning Represen- tations, 2019.","title":"Camou: Learning physical vehicle camouflages to adversarially attack detectors in the wild","authors":"Yang Zhang, Hassan Foroosh, Philip David, Boqing Gong","year":"2019","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zhou et al., 2019] Yi Zhou, Xiaodong He, Lei Huang, Li Liu, Fan Zhu, Shanshan Cui, and Ling Shao. Col- laborative learning of semi-supervised segmentation and classification for medical images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2079-2088, 2019.","title":"Collaborative learning of semi-supervised segmentation and classification for medical images","authors":"Yi Zhou, Xiaodong He, Lei Huang, Li Liu, Fan Zhu, Shanshan Cui, Ling Shao","year":"2019","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}