对象攻击是对象检测的现实世界中可行的。然而，大多数以前的作品都试图学习应用于对象的本地“补丁”到愚蠢的探测器，这在斜视视角变得较低。为了解决这个问题，我们提出了致密的提案攻击（DPA）来学习探测器的单件，物理和针对性的对抗性伪装。伪装是一体的，因为它们是作为一个物体的整体生成的，因为当在任意观点和不同的照明条件下拍摄时，它们保持对抗性，并且由于它们可能导致探测器被定义为特定目标类别的检测器。为了使生成的伪装在物理世界中稳健，我们介绍了改造的组合来模拟物理现象。此外，为了改善攻击，DPA同时攻击固定建议中的所有分类。此外，我们使用Unity Simulation Engine构建虚拟3D场景，以公平地和可重复地评估不同的物理攻击。广泛的实验表明，DPA优于最先进的方法，并且对于任何物体而言，它是通用的，并且对现实世界的广泛性良好，对安全关键的计算机视觉系统构成潜在的威胁。

Although Deep Neural Networks (DNNs) have achieved impressive results in computer vision, their exposed vulnerability to adversarial attacks remains a serious concern. A series of works has shown that by adding elaborate perturbations to images, DNNs could have catastrophic degradation in performance metrics. And this phenomenon does not only exist in the digital space but also in the physical space. Therefore, estimating the security of these DNNs-based systems is critical for safely deploying them in the real world, especially for security-critical applications, e.g., autonomous cars, video surveillance, and medical diagnosis. In this paper, we focus on physical adversarial attacks and provide a comprehensive survey of over 150 existing papers. We first clarify the concept of the physical adversarial attack and analyze its characteristics. Then, we define the adversarial medium, essential to perform attacks in the physical world. Next, we present the physical adversarial attack methods in task order: classification, detection, and re-identification, and introduce their performance in solving the trilemma: effectiveness, stealthiness, and robustness. In the end, we discuss the current challenges and potential future directions.

物体检测中的物理对抗攻击引起了越来越受到关注。然而，最先前的作品专注于通过生成单独的对抗贴片来隐藏来自探测器的物体，该贴片仅覆盖车辆表面的平面部分并且无法在物理场景中攻击多视图，长距离和部分封闭的探测器对象。为了弥合数字攻击与物理攻击之间的差距，我们利用完整的3D车辆表面来提出坚固的全面覆盖伪装攻击（FCA）到愚弄探测器。具体来说，我们首先尝试在整个车辆表面上渲染非平面伪装纹理。为了模仿现实世界的环境条件，我们将引入转换功能，将渲染的伪装车辆转移到照片现实场景中。最后，我们设计了一个有效的损失功能，以优化伪装纹理。实验表明，全面覆盖伪装攻击不仅可以在各种测试用例下优于最先进的方法，而且还可以推广到不同的环境，车辆和物体探测器。 FCA的代码可用于：https://idrl-lab.github.io/full-coverage-camouflage -Adversarial-Attack/。

在过去的十年中，深度学习急剧改变了传统的手工艺特征方式，具有强大的功能学习能力，从而极大地改善了传统任务。然而，最近已经证明了深层神经网络容易受到对抗性例子的影响，这种恶意样本由小型设计的噪音制作，误导了DNNs做出错误的决定，同时仍然对人类无法察觉。对抗性示例可以分为数字对抗攻击和物理对抗攻击。数字对抗攻击主要是在实验室环境中进行的，重点是改善对抗性攻击算法的性能。相比之下，物理对抗性攻击集中于攻击物理世界部署的DNN系统，这是由于复杂的物理环境（即亮度，遮挡等），这是一项更具挑战性的任务。尽管数字对抗和物理对抗性示例之间的差异很小，但物理对抗示例具有特定的设计，可以克服复杂的物理环境的效果。在本文中，我们回顾了基于DNN的计算机视觉任务任务中的物理对抗攻击的开发，包括图像识别任务，对象检测任务和语义细分。为了完整的算法演化，我们将简要介绍不涉及身体对抗性攻击的作品。我们首先提出一个分类方案，以总结当前的物理对抗攻击。然后讨论现有的物理对抗攻击的优势和缺点，并专注于用于维持对抗性的技术，当应用于物理环境中时。最后，我们指出要解决的当前身体对抗攻击的问题并提供有前途的研究方向。

Recent studies reveal that deep neural network (DNN) based object detectors are vulnerable to adversarial attacks in the form of adding the perturbation to the images, leading to the wrong output of object detectors. Most current existing works focus on generating perturbed images, also called adversarial examples, to fool object detectors. Though the generated adversarial examples themselves can remain a certain naturalness, most of them can still be easily observed by human eyes, which limits their further application in the real world. To alleviate this problem, we propose a differential evolution based dual adversarial camouflage (DE_DAC) method, composed of two stages to fool human eyes and object detectors simultaneously. Specifically, we try to obtain the camouflage texture, which can be rendered over the surface of the object. In the first stage, we optimize the global texture to minimize the discrepancy between the rendered object and the scene images, making human eyes difficult to distinguish. In the second stage, we design three loss functions to optimize the local texture, making object detectors ineffective. In addition, we introduce the differential evolution algorithm to search for the near-optimal areas of the object to attack, improving the adversarial performance under certain attack area limitations. Besides, we also study the performance of adaptive DE_DAC, which can be adapted to the environment. Experiments show that our proposed method could obtain a good trade-off between the fooling human eyes and object detectors under multiple specific scenes and objects.

Recent studies show that the state-of-the-art deep neural networks (DNNs) are vulnerable to adversarial examples, resulting from small-magnitude perturbations added to the input. Given that that emerging physical systems are using DNNs in safety-critical situations, adversarial examples could mislead these systems and cause dangerous situations. Therefore, understanding adversarial examples in the physical world is an important step towards developing resilient learning algorithms. We propose a general attack algorithm, Robust Physical Perturbations (RP 2 ), to generate robust visual adversarial perturbations under different physical conditions. Using the real-world case of road sign classification, we show that adversarial examples generated using RP 2 achieve high targeted misclassification rates against standard-architecture road sign classifiers in the physical world under various environmental conditions, including viewpoints. Due to the current lack of a standardized testing method, we propose a two-stage evaluation methodology for robust physical adversarial examples consisting of lab and field tests. Using this methodology, we evaluate the efficacy of physical adversarial manipulations on real objects. With a perturbation in the form of only black and white stickers, we attack a real stop sign, causing targeted misclassification in 100% of the images obtained in lab settings, and in 84.8% of the captured video frames obtained on a moving vehicle (field test) for the target classifier.

如今，配备了AI系统的摄像机可以捕获和分析图像以自动检测人员。但是，当在现实世界（即物理对抗示例）中收到故意设计的模式时，AI系统可能会犯错误。先前的作品表明，可以在衣服上打印对抗斑块，以逃避基于DNN的人探测器。但是，当视角（即相机与物体的角度）变化时，这些对抗性示例可能会在攻击成功率中造成灾难性下降。要执行多角度攻击，我们提出了对抗纹理（Advexture）。 advtexture可以用任意形状覆盖衣服，以便穿着这样的衣服的人可以从不同的视角躲避人探测器。我们提出了一种生成方法，称为基于环形作用的可扩展生成攻击（TC-EGA），以用重复的结构来制作advexture。我们用advexure印刷了几块布，然后在物理世界中制作了T恤，裙子和连衣裙。实验表明，这些衣服可以欺骗物理世界中的人探测器。

Machine learning models are known to be susceptible to adversarial perturbation. One famous attack is the adversarial patch, a sticker with a particularly crafted pattern that makes the model incorrectly predict the object it is placed on. This attack presents a critical threat to cyber-physical systems that rely on cameras such as autonomous cars. Despite the significance of the problem, conducting research in this setting has been difficult; evaluating attacks and defenses in the real world is exceptionally costly while synthetic data are unrealistic. In this work, we propose the REAP (REalistic Adversarial Patch) benchmark, a digital benchmark that allows the user to evaluate patch attacks on real images, and under real-world conditions. Built on top of the Mapillary Vistas dataset, our benchmark contains over 14,000 traffic signs. Each sign is augmented with a pair of geometric and lighting transformations, which can be used to apply a digitally generated patch realistically onto the sign. Using our benchmark, we perform the first large-scale assessments of adversarial patch attacks under realistic conditions. Our experiments suggest that adversarial patch attacks may present a smaller threat than previously believed and that the success rate of an attack on simpler digital simulations is not predictive of its actual effectiveness in practice. We release our benchmark publicly at https://github.com/wagner-group/reap-benchmark.

Standard methods for generating adversarial examples for neural networks do not consistently fool neural network classifiers in the physical world due to a combination of viewpoint shifts, camera noise, and other natural transformations, limiting their relevance to real-world systems. We demonstrate the existence of robust 3D adversarial objects, and we present the first algorithm for synthesizing examples that are adversarial over a chosen distribution of transformations. We synthesize two-dimensional adversarial images that are robust to noise, distortion, and affine transformation. We apply our algorithm to complex three-dimensional objects, using 3D-printing to manufacture the first physical adversarial objects. Our results demonstrate the existence of 3D adversarial objects in the physical world.

To assess the vulnerability of deep learning in the physical world, recent works introduce adversarial patches and apply them on different tasks. In this paper, we propose another kind of adversarial patch: the Meaningful Adversarial Sticker, a physically feasible and stealthy attack method by using real stickers existing in our life. Unlike the previous adversarial patches by designing perturbations, our method manipulates the sticker's pasting position and rotation angle on the objects to perform physical attacks. Because the position and rotation angle are less affected by the printing loss and color distortion, adversarial stickers can keep good attacking performance in the physical world. Besides, to make adversarial stickers more practical in real scenes, we conduct attacks in the black-box setting with the limited information rather than the white-box setting with all the details of threat models. To effectively solve for the sticker's parameters, we design the Region based Heuristic Differential Evolution Algorithm, which utilizes the new-found regional aggregation of effective solutions and the adaptive adjustment strategy of the evaluation criteria. Our method is comprehensively verified in the face recognition and then extended to the image retrieval and traffic sign recognition. Extensive experiments show the proposed method is effective and efficient in complex physical conditions and has a good generalization for different tasks.

由于缺乏对AI模型的安全性和鲁棒性的信任，近年来，深度学习模型（尤其是针对安全至关重要的系统）中的对抗性攻击正在越来越受到关注。然而，更原始的对抗性攻击可能是身体上不可行的，或者需要一些难以访问的资源，例如训练数据，这激发了斑块攻击的出现。在这项调查中，我们提供了全面的概述，以涵盖现有的对抗贴片攻击技术，旨在帮助感兴趣的研究人员迅速赶上该领域的进展。我们还讨论了针对对抗贴片的检测和防御措施的现有技术，旨在帮助社区更好地了解该领域及其在现实世界中的应用。

已经证明了现代自动驾驶感知系统在处理互补输入之类的利用图像时，已被证明可以改善互补投入。在孤立中，已发现2D图像非常容易受到对抗性攻击的影响。然而，有有限的研究与图像特征融合的多模态模型的对抗鲁棒性。此外，现有的作品不考虑跨输入方式一致的物理上可实现的扰动。在本文中，我们通过将对抗物体放在主车辆的顶部上展示多传感器检测的实际敏感性。我们专注于身体上可实现的和输入 - 不可行的攻击，因为它们是在实践中执行的可行性，并且表明单个通用对手可以隐藏来自最先进的多模态探测器的不同主机。我们的实验表明，成功的攻击主要是由易于损坏的图像特征引起的。此外，我们发现，在将图像特征中的现代传感器融合方法中，对抗攻击可以利用投影过程来在3D中跨越区域产生误报。朝着更强大的多模态感知系统，我们表明，具有特征剥夺的对抗训练可以显着提高对这种攻击的鲁棒性。然而，我们发现标准的对抗性防御仍然努力防止由3D LIDAR点和2D像素之间不准确的关联引起的误报。

Adversarial attacks on thermal infrared imaging expose the risk of related applications. Estimating the security of these systems is essential for safely deploying them in the real world. In many cases, realizing the attacks in the physical space requires elaborate special perturbations. These solutions are often \emph{impractical} and \emph{attention-grabbing}. To address the need for a physically practical and stealthy adversarial attack, we introduce \textsc{HotCold} Block, a novel physical attack for infrared detectors that hide persons utilizing the wearable Warming Paste and Cooling Paste. By attaching these readily available temperature-controlled materials to the body, \textsc{HotCold} Block evades human eyes efficiently. Moreover, unlike existing methods that build adversarial patches with complex texture and structure features, \textsc{HotCold} Block utilizes an SSP-oriented adversarial optimization algorithm that enables attacks with pure color blocks and explores the influence of size, shape, and position on attack performance. Extensive experimental results in both digital and physical environments demonstrate the performance of our proposed \textsc{HotCold} Block. \emph{Code is available: \textcolor{magenta}{https://github.com/weihui1308/HOTCOLDBlock}}.

人群计数已被广泛用于估计安全至关重要的场景中的人数，被证明很容易受到物理世界中对抗性例子的影响（例如，对抗性斑块）。尽管有害，但对抗性例子也很有价值，对于评估和更好地理解模型的鲁棒性也很有价值。但是，现有的对抗人群计算的对抗性示例生成方法在不同的黑盒模型之间缺乏强大的可传递性，这限制了它们对现实世界系统的实用性。本文提出了与模型不变特征正相关的事实，本文提出了感知的对抗贴片（PAP）生成框架，以使用模型共享的感知功能来定制对对抗性的扰动。具体来说，我们将一种自适应人群密度加权方法手工制作，以捕获各种模型中不变的量表感知特征，并利用密度引导的注意力来捕获模型共享的位置感知。证明它们都可以提高我们对抗斑块的攻击性转移性。广泛的实验表明，我们的PAP可以在数字世界和物理世界中实现最先进的进攻性能，并且以大幅度的优于以前的提案（最多+685.7 MAE和+699.5 MSE）。此外，我们从经验上证明，对我们的PAP进行的对抗训练可以使香草模型的性能受益，以减轻人群计数的几个实际挑战，包括跨数据集的概括（高达-376.0 MAE和-376.0 MAE和-354.9 MSE）和对复杂背景的鲁棒性（上升）至-10.3 MAE和-16.4 MSE）。

Adversarial patch is an important form of real-world adversarial attack that brings serious risks to the robustness of deep neural networks. Previous methods generate adversarial patches by either optimizing their perturbation values while fixing the pasting position or manipulating the position while fixing the patch's content. This reveals that the positions and perturbations are both important to the adversarial attack. For that, in this paper, we propose a novel method to simultaneously optimize the position and perturbation for an adversarial patch, and thus obtain a high attack success rate in the black-box setting. Technically, we regard the patch's position, the pre-designed hyper-parameters to determine the patch's perturbations as the variables, and utilize the reinforcement learning framework to simultaneously solve for the optimal solution based on the rewards obtained from the target model with a small number of queries. Extensive experiments are conducted on the Face Recognition (FR) task, and results on four representative FR models show that our method can significantly improve the attack success rate and query efficiency. Besides, experiments on the commercial FR service and physical environments confirm its practical application value. We also extend our method to the traffic sign recognition task to verify its generalization ability.

经过对人体跟踪系统引起的隐私问题的调查，我们提出了一种黑盒对抗攻击方法，该方法对最先进的人类检测模型，称为Invisibilitee。该方法学习了可打印的对抗图案，适用于T恤，这些T恤在人体跟踪系统前的物理世界中抓起佩戴者。我们设计了一种角度不足的学习方案，该方案利用了时尚数据集的分割和几何扭曲过程，因此生成的对抗模式可有效从所有摄像机角度和看不见的黑盒检测模型欺骗人检测器。数字环境和物理环境中的经验结果表明，随着Invisibilitee的启用，人体跟踪系统检测佩戴者的能力显着下降。

深度学习大大提高了单眼深度估计（MDE）的性能，这是完全基于视觉的自主驾驶（AD）系统（例如特斯拉和丰田）的关键组成部分。在这项工作中，我们对基于学习的MDE产生了攻击。特别是，我们使用基于优化的方法系统地生成隐形的物理对象贴片来攻击深度估计。我们通过面向对象的对抗设计，敏感的区域定位和自然风格的伪装来平衡攻击的隐身和有效性。使用现实世界的驾驶场景，我们评估了对并发MDE模型的攻击和AD的代表下游任务（即3D对象检测）。实验结果表明，我们的方法可以为不同的目标对象和模型生成隐形，有效和健壮的对抗贴片，并在物体检测中以1/1/的斑点检测到超过6米的平均深度估计误差和93％的攻击成功率（ASR）车辆后部9个。具有实际车辆的三个不同驾驶路线上的现场测试表明，在连续视频帧中，我们导致超过6米的平均深度估计误差，并将对象检测率从90.70％降低到5.16％。

It has been well demonstrated that adversarial examples, i.e., natural images with visually imperceptible perturbations added, cause deep networks to fail on image classification. In this paper, we extend adversarial examples to semantic segmentation and object detection which are much more difficult. Our observation is that both segmentation and detection are based on classifying multiple targets on an image (e.g., the target is a pixel or a receptive field in segmentation, and an object proposal in detection). This inspires us to optimize a loss function over a set of pixels/proposals for generating adversarial perturbations. Based on this idea, we propose a novel algorithm named Dense Adversary Generation (DAG), which generates a large family of adversarial examples, and applies to a wide range of state-of-the-art deep networks for segmentation and detection. We also find that the adversarial perturbations can be transferred across networks with different training data, based on different architectures, and even for different recognition tasks. In particular, the transferability across networks with the same architecture is more significant than in other cases. Besides, summing up heterogeneous perturbations often leads to better transfer performance, which provides an effective method of blackbox adversarial attack.

对抗贴片是旨在欺骗其他表现良好的基于​​神经网络的计算机视觉模型的图像。尽管这些攻击最初是通过数字方式构想和研究的，但由于图像的原始像素值受到干扰，但最近的工作表明，这些攻击可以成功地转移到物理世界中。可以通过打印补丁并将其添加到新捕获的图像或视频素材的场景中来实现。在这项工作中，我们进一步测试了在更具挑战性的条件下物理世界中对抗斑块攻击的功效。我们考虑通过空中或卫星摄像机获得的高架图像训练的对象检测模型，并测试插入沙漠环境场景中的物理对抗斑块。我们的主要发现是，在这些条件下成功实施对抗贴片攻击要比在先前考虑的条件下更难。这对AI安全具有重要意义，因为可能被夸大了对抗性例子所带来的现实世界威胁。

深度神经网络容易受到来自对抗性投入的攻击，并且最近，特洛伊木马误解或劫持模型的决定。我们通过探索有界抗逆性示例空间和生成的对抗网络内的自然输入空间来揭示有界面的对抗性实例 - 通用自然主义侵害贴片的兴趣类 - 我们呼叫TNT。现在，一个对手可以用一个自然主义的补丁来手臂自己，不太恶意，身体上可实现，高效 - 实现高攻击成功率和普遍性。 TNT是普遍的，因为在场景中的TNT中捕获的任何输入图像都将：i）误导网络（未确定的攻击）;或ii）迫使网络进行恶意决定（有针对性的攻击）。现在，有趣的是，一个对抗性补丁攻击者有可能发挥更大的控制水平 - 选择一个独立，自然的贴片的能力，与被限制为嘈杂的扰动的触发器 - 到目前为止只有可能与特洛伊木马攻击方法有可能干扰模型建设过程，以嵌入风险发现的后门;但是，仍然意识到在物理世界中部署的补丁。通过对大型视觉分类任务的广泛实验，想象成在其整个验证集50,000张图像中进行评估，我们展示了TNT的现实威胁和攻击的稳健性。我们展示了攻击的概括，以创建比现有最先进的方法实现更高攻击成功率的补丁。我们的结果表明，攻击对不同的视觉分类任务（CIFAR-10，GTSRB，PUBFIG）和多个最先进的深神经网络，如WieredEnet50，Inception-V3和VGG-16。