深度学习安全机器人吗？由于嵌入式系统可以访问更强大的CPU和GPU，因此在机器人应用中，启用深度学习的对象检测系统变得无处不在。同时，先前的研究揭示了深度学习模型容易受到对抗性攻击的影响。这会使现实世界的机器人受到威胁吗？我们的研究借用了来自密码学的主要中间攻击的想法，以攻击对象检测系统。我们的实验结果证明，我们可以在一分钟内产生强大的通用对抗扰动（UAP），然后使用扰动通过中间攻击来攻击检测系统。我们的发现引起了对深度学习模型在安全至关重要系统（例如自动驾驶）中的应用的严重关注。

智能机器人在准确的对象检测模型上取决于感知环境。深度学习安全性的进步揭示了对象检测模型容易受到对抗性攻击的影响。但是，先前的研究主要关注攻击静态图像或离线视频。目前尚不清楚这种攻击是否会危害动态环境中的现实世界机器人应用。理论发现和现实世界应用之间仍然存在差距。我们通过提出第一次实时在线攻击对象检测模型来弥合差距。我们设计了三个攻击，这些攻击在所需位置为不存在的对象制造边界框。

随着深度神经网络中的研究的发展，深度卷积网络对于自动驾驶任务而言是可行的。在驾驶任务的自动化中采用端到端模型有一种新兴趋势。但是，以前的研究揭示了深层神经网络在分类任务中容易受到对抗性攻击的影响。对于回归任务，例如自动驾驶，这些攻击的效果仍然很少探索。在这项研究中，我们设计了针对端到端自动驾驶系统的两次白盒针对性攻击。驾驶模型将图像作为输入并输出转向角度。我们的攻击只能通过扰动输入图像来操纵自主驾驶系统的行为。两种攻击都可以在不使用GPU的情况下实时对CPU进行实时启动。这项研究旨在引起人们对安全关键系统中端到端模型的应用的担忧。

深度学习的进步使得广泛的有希望的应用程序。然而，这些系统容易受到对抗机器学习（AML）攻击的影响;对他们的意见的离前事实制作的扰动可能导致他们错误分类。若干最先进的对抗性攻击已经证明他们可以可靠地欺骗分类器，使这些攻击成为一个重大威胁。对抗性攻击生成算法主要侧重于创建成功的例子，同时控制噪声幅度和分布，使检测更加困难。这些攻击的潜在假设是脱机产生的对抗噪声，使其执行时间是次要考虑因素。然而，最近，攻击者机会自由地产生对抗性示例的立即对抗攻击已经可能。本文介绍了一个新问题：我们如何在实时约束下产生对抗性噪音，以支持这种实时对抗攻击？了解这一问题提高了我们对这些攻击对实时系统构成的威胁的理解，并为未来防御提供安全评估基准。因此，我们首先进行对抗生成算法的运行时间分析。普遍攻击脱机产生一般攻击，没有在线开销，并且可以应用于任何输入;然而，由于其一般性，他们的成功率是有限的。相比之下，在特定输入上工作的在线算法是计算昂贵的，使它们不适合在时间约束下的操作。因此，我们提出房间，一种新型实时在线脱机攻击施工模型，其中离线组件用于预热在线算法，使得可以在时间限制下产生高度成功的攻击。

Deep learning-based 3D object detectors have made significant progress in recent years and have been deployed in a wide range of applications. It is crucial to understand the robustness of detectors against adversarial attacks when employing detectors in security-critical applications. In this paper, we make the first attempt to conduct a thorough evaluation and analysis of the robustness of 3D detectors under adversarial attacks. Specifically, we first extend three kinds of adversarial attacks to the 3D object detection task to benchmark the robustness of state-of-the-art 3D object detectors against attacks on KITTI and Waymo datasets, subsequently followed by the analysis of the relationship between robustness and properties of detectors. Then, we explore the transferability of cross-model, cross-task, and cross-data attacks. We finally conduct comprehensive experiments of defense for 3D detectors, demonstrating that simple transformations like flipping are of little help in improving robustness when the strategy of transformation imposed on input point cloud data is exposed to attackers. Our findings will facilitate investigations in understanding and defending the adversarial attacks against 3D object detectors to advance this field.

在过去的十年中，深度学习急剧改变了传统的手工艺特征方式，具有强大的功能学习能力，从而极大地改善了传统任务。然而，最近已经证明了深层神经网络容易受到对抗性例子的影响，这种恶意样本由小型设计的噪音制作，误导了DNNs做出错误的决定，同时仍然对人类无法察觉。对抗性示例可以分为数字对抗攻击和物理对抗攻击。数字对抗攻击主要是在实验室环境中进行的，重点是改善对抗性攻击算法的性能。相比之下，物理对抗性攻击集中于攻击物理世界部署的DNN系统，这是由于复杂的物理环境（即亮度，遮挡等），这是一项更具挑战性的任务。尽管数字对抗和物理对抗性示例之间的差异很小，但物理对抗示例具有特定的设计，可以克服复杂的物理环境的效果。在本文中，我们回顾了基于DNN的计算机视觉任务任务中的物理对抗攻击的开发，包括图像识别任务，对象检测任务和语义细分。为了完整的算法演化，我们将简要介绍不涉及身体对抗性攻击的作品。我们首先提出一个分类方案，以总结当前的物理对抗攻击。然后讨论现有的物理对抗攻击的优势和缺点，并专注于用于维持对抗性的技术，当应用于物理环境中时。最后，我们指出要解决的当前身体对抗攻击的问题并提供有前途的研究方向。

在过去的几年中，对针对基于学习的对象探测器的对抗性攻击进行了广泛的研究。提出的大多数攻击都针对模型的完整性（即导致模型做出了错误的预测），而针对模型可用性的对抗性攻击，这是安全关键领域（例如自动驾驶）的关键方面，尚未探索。机器学习研究社区。在本文中，我们提出了一种新颖的攻击，对端到端对象检测管道的决策潜伏期产生负面影响。我们制作了一种通用的对抗扰动（UAP），该扰动（UAP）针对了许多对象检测器管道中的广泛使用的技术 - 非最大抑制（NMS）。我们的实验证明了拟议的UAP通过添加“幻影”对象来增加单个帧的处理时间的能力，该对象在保留原始对象的检测时（允许攻击时间更长的时间内未检测到）。

Although Deep Neural Networks (DNNs) have achieved impressive results in computer vision, their exposed vulnerability to adversarial attacks remains a serious concern. A series of works has shown that by adding elaborate perturbations to images, DNNs could have catastrophic degradation in performance metrics. And this phenomenon does not only exist in the digital space but also in the physical space. Therefore, estimating the security of these DNNs-based systems is critical for safely deploying them in the real world, especially for security-critical applications, e.g., autonomous cars, video surveillance, and medical diagnosis. In this paper, we focus on physical adversarial attacks and provide a comprehensive survey of over 150 existing papers. We first clarify the concept of the physical adversarial attack and analyze its characteristics. Then, we define the adversarial medium, essential to perform attacks in the physical world. Next, we present the physical adversarial attack methods in task order: classification, detection, and re-identification, and introduce their performance in solving the trilemma: effectiveness, stealthiness, and robustness. In the end, we discuss the current challenges and potential future directions.

经过对人体跟踪系统引起的隐私问题的调查，我们提出了一种黑盒对抗攻击方法，该方法对最先进的人类检测模型，称为Invisibilitee。该方法学习了可打印的对抗图案，适用于T恤，这些T恤在人体跟踪系统前的物理世界中抓起佩戴者。我们设计了一种角度不足的学习方案，该方案利用了时尚数据集的分割和几何扭曲过程，因此生成的对抗模式可有效从所有摄像机角度和看不见的黑盒检测模型欺骗人检测器。数字环境和物理环境中的经验结果表明，随着Invisibilitee的启用，人体跟踪系统检测佩戴者的能力显着下降。

视觉检测是自动驾驶的关键任务，它是自动驾驶计划和控制的关键基础。深度神经网络在各种视觉任务中取得了令人鼓舞的结果，但众所周知，它们容易受到对抗性攻击的影响。在人们改善其稳健性之前，需要对深层视觉探测器的脆弱性进行全面的了解。但是，只有少数对抗性攻击/防御工程集中在对象检测上，其中大多数仅采用分类和/或本地化损失，而忽略了目的方面。在本文中，我们确定了Yolo探测器中与物体相关的严重相关对抗性脆弱性，并提出了针对自动驾驶汽车视觉检测物质方面的有效攻击策略。此外，为了解决这种脆弱性，我们提出了一种新的客观性训练方法，以进行视觉检测。实验表明，针对目标方面的拟议攻击比分别在KITTI和COCO流量数据集中分类和/或本地化损失产生的攻击效率高45.17％和43.50％。此外，拟议的对抗防御方法可以分别在Kitti和Coco交通方面提高检测器对目标攻击的鲁棒性高达21％和12％的地图。

对象检测器的大多数黑盒对抗攻击方案主要面临两个缺点：需要访问目标模型并生成效率低下的对抗示例（未能使对象大量消失）。为了克服这些缺点，我们提出了基于语义分割和模型反转（SSMI）的黑框对抗攻击方案。我们首先使用语义分割技术定位目标对象的位置。接下来，我们设计一个邻居背景像素更换，以用背景像素替换目标区域像素，以确保不容易通过人类视力检测到像素修饰。最后，我们重建一个可识别的示例，并使用蒙版矩阵在重建的示例中选择像素以修改良性图像以生成对抗性示例。详细的实验结果表明，SSMI可以产生有效的对抗例子，以逃避人眼的感知并使感兴趣的对象消失。更重要的是，SSMI的表现优于同样的攻击。新标签和消失的标签的最大增加为16％，对象检测的MAP指标的最大减少为36％。

Adversarial attacks hamper the decision-making ability of neural networks by perturbing the input signal. The addition of calculated small distortion to images, for instance, can deceive a well-trained image classification network. In this work, we propose a novel attack technique called Sparse Adversarial and Interpretable Attack Framework (SAIF). Specifically, we design imperceptible attacks that contain low-magnitude perturbations at a small number of pixels and leverage these sparse attacks to reveal the vulnerability of classifiers. We use the Frank-Wolfe (conditional gradient) algorithm to simultaneously optimize the attack perturbations for bounded magnitude and sparsity with $O(1/\sqrt{T})$ convergence. Empirical results show that SAIF computes highly imperceptible and interpretable adversarial examples, and outperforms state-of-the-art sparse attack methods on the ImageNet dataset.

To assess the vulnerability of deep learning in the physical world, recent works introduce adversarial patches and apply them on different tasks. In this paper, we propose another kind of adversarial patch: the Meaningful Adversarial Sticker, a physically feasible and stealthy attack method by using real stickers existing in our life. Unlike the previous adversarial patches by designing perturbations, our method manipulates the sticker's pasting position and rotation angle on the objects to perform physical attacks. Because the position and rotation angle are less affected by the printing loss and color distortion, adversarial stickers can keep good attacking performance in the physical world. Besides, to make adversarial stickers more practical in real scenes, we conduct attacks in the black-box setting with the limited information rather than the white-box setting with all the details of threat models. To effectively solve for the sticker's parameters, we design the Region based Heuristic Differential Evolution Algorithm, which utilizes the new-found regional aggregation of effective solutions and the adaptive adjustment strategy of the evaluation criteria. Our method is comprehensively verified in the face recognition and then extended to the image retrieval and traffic sign recognition. Extensive experiments show the proposed method is effective and efficient in complex physical conditions and has a good generalization for different tasks.

对抗斑块产生的标准方法导致嘈杂的显着模式，这些模式很容易被人类识别。最近的研究提出了几种使用生成对抗网络（GAN）生成自然斑块的方法，但在对象检测用例中只评估了其中的一些方法。此外，技术的状态主要集中于通过直接与补丁重叠的输入中抑制一个大边界框。补丁附近的抑制对象是一项不同的，更复杂的任务。在这项工作中，我们评估了现有的方法，以生成不起眼的补丁。我们已经针对不同的计算机视觉任务而开发的适应方法，用于Yolov3和CoCo数据集的对象检测用例。我们已经评估了两种生成自然主义斑块的方法：通过将斑块的产生纳入GAN训练过程和使用预审计的GAN。在这两种情况下，我们都评估了性能和自然主义斑块外观之间的权衡。我们的实验表明，使用预先训练的GAN有助于获得逼真的斑块，同时保留类似于常规的对抗斑块的性能。

物体检测中的物理对抗攻击引起了越来越受到关注。然而，最先前的作品专注于通过生成单独的对抗贴片来隐藏来自探测器的物体，该贴片仅覆盖车辆表面的平面部分并且无法在物理场景中攻击多视图，长距离和部分封闭的探测器对象。为了弥合数字攻击与物理攻击之间的差距，我们利用完整的3D车辆表面来提出坚固的全面覆盖伪装攻击（FCA）到愚弄探测器。具体来说，我们首先尝试在整个车辆表面上渲染非平面伪装纹理。为了模仿现实世界的环境条件，我们将引入转换功能，将渲染的伪装车辆转移到照片现实场景中。最后，我们设计了一个有效的损失功能，以优化伪装纹理。实验表明，全面覆盖伪装攻击不仅可以在各种测试用例下优于最先进的方法，而且还可以推广到不同的环境，车辆和物体探测器。 FCA的代码可用于：https://idrl-lab.github.io/full-coverage-camouflage -Adversarial-Attack/。

The authors thank Nicholas Carlini (UC Berkeley) and Dimitris Tsipras (MIT) for feedback to improve the survey quality. We also acknowledge X. Huang (Uni. Liverpool), K. R. Reddy (IISC), E. Valle (UNICAMP), Y. Yoo (CLAIR) and others for providing pointers to make the survey more comprehensive.

With rapid progress and significant successes in a wide spectrum of applications, deep learning is being applied in many safety-critical environments. However, deep neural networks have been recently found vulnerable to well-designed input samples, called adversarial examples. Adversarial perturbations are imperceptible to human but can easily fool deep neural networks in the testing/deploying stage. The vulnerability to adversarial examples becomes one of the major risks for applying deep neural networks in safety-critical environments. Therefore, attacks and defenses on adversarial examples draw great attention. In this paper, we review recent findings on adversarial examples for deep neural networks, summarize the methods for generating adversarial examples, and propose a taxonomy of these methods. Under the taxonomy, applications for adversarial examples are investigated. We further elaborate on countermeasures for adversarial examples. In addition, three major challenges in adversarial examples and the potential solutions are discussed.

Although deep learning has made remarkable progress in processing various types of data such as images, text and speech, they are known to be susceptible to adversarial perturbations: perturbations specifically designed and added to the input to make the target model produce erroneous output. Most of the existing studies on generating adversarial perturbations attempt to perturb the entire input indiscriminately. In this paper, we propose ExploreADV, a general and flexible adversarial attack system that is capable of modeling regional and imperceptible attacks, allowing users to explore various kinds of adversarial examples as needed. We adapt and combine two existing boundary attack methods, DeepFool and Brendel\&Bethge Attack, and propose a mask-constrained adversarial attack system, which generates minimal adversarial perturbations under the pixel-level constraints, namely ``mask-constraints''. We study different ways of generating such mask-constraints considering the variance and importance of the input features, and show that our adversarial attack system offers users good flexibility to focus on sub-regions of inputs, explore imperceptible perturbations and understand the vulnerability of pixels/regions to adversarial attacks. We demonstrate our system to be effective based on extensive experiments and user study.

基于深的神经网络（DNNS）基于合成孔径雷达（SAR）自动靶标识别（ATR）系统已显示出非常容易受到故意设计但几乎无法察觉的对抗扰动的影响，但是当添加到靶向物体中时，DNN推断可能会偏差。在将DNN应用于高级SAR ATR应用时，这会导致严重的安全问题。因此，增强DNN的对抗性鲁棒性对于对现代现实世界中的SAR ATR系统实施DNN至关重要。本文旨在构建更健壮的DNN基于DNN的SAR ATR模型，探讨了SAR成像过程的领域知识，并提出了一种新型的散射模型引导的对抗攻击（SMGAA）算法，该算法可以以电磁散射响应的形式产生对抗性扰动（称为对抗散射器） ）。提出的SMGAA由两个部分组成：1）参数散射模型和相应的成像方法以及2）基于自定义的基于梯度的优化算法。首先，我们介绍了有效的归因散射中心模型（ASCM）和一种通用成像方法，以描述SAR成像过程中典型几何结构的散射行为。通过进一步制定几种策略来考虑SAR目标图像的领域知识并放松贪婪的搜索程序，建议的方法不需要经过审慎的态度，但是可以有效地找到有效的ASCM参数来欺骗SAR分类器并促进SAR分类器并促进强大的模型训练。对MSTAR数据集的全面评估表明，SMGAA产生的对抗散射器对SAR处理链中的扰动和转换比当前研究的攻击更为强大，并且有效地构建了针对恶意散射器的防御模型。

Recent researches show that the deep learning based object detection is vulnerable to adversarial examples. Generally, the adversarial attack for object detection contains targeted attack and untargeted attack. According to our detailed investigations, the research on the former is relatively fewer than the latter and all the existing methods for the targeted attack follow the same mode, i.e., the object-mislabeling mode that misleads detectors to mislabel the detected object as a specific wrong label. However, this mode has limited attack success rate, universal and generalization performances. In this paper, we propose a new object-fabrication targeted attack mode which can mislead detectors to `fabricate' extra false objects with specific target labels. Furthermore, we design a dual attention based targeted feature space attack method to implement the proposed targeted attack mode. The attack performances of the proposed mode and method are evaluated on MS COCO and BDD100K datasets using FasterRCNN and YOLOv5. Evaluation results demonstrate that, the proposed object-fabrication targeted attack mode and the corresponding targeted feature space attack method show significant improvements in terms of image-specific attack, universal performance and generalization capability, compared with the previous targeted attack for object detection. Code will be made available.