本文侧重于对探测器的高可转移的对抗性攻击，这很难以黑盒方式攻击，因为它们的多重输出特征和跨架构的多样性。为了追求高攻击可转让性，一种合理的方式是在探测器中找到一个共同的财产，这促进了常见弱点的发现。我们是第一个建议，来自探测器的解释器的相关性图是这样的财产。基于它，我们设计了对探测器（RAD）的相关性攻击，这实现了最先进的可转移性，超过了现有的结果超过20％。在MS Coco上，所有8个黑匣子架构的检测映射大于减半，并且分割地图也受到显着影响。鉴于RAD的巨大可转换性，我们生成用于对象检测和实例分割的第一个对抗性数据集，即对上下文（AOCO）的对手对象，这有助于快速评估和改进探测器的稳健性。

最近的研究表明，即使在攻击者无法访问模型信息的黑匣子场景中，基于深模型的检测器也容易受到对抗示例的影响。大多数现有的攻击方法旨在最大程度地减少真正的积极速率，这通常显示出较差的攻击性能，因为在受攻击的边界框中可以检测到另一个最佳的边界框成为新的真实积极的框架。为了解决这一挑战，我们建议最大程度地降低真实的正速率并最大化误报率，这可以鼓励更多的假阳性对象阻止新的真实正面边界框的产生。它被建模为多目标优化（MOP）问题，通用算法可以搜索帕累托最佳选择。但是，我们的任务具有超过200万个决策变量，导致搜索效率较低。因此，我们将标准的遗传算法扩展到了随机子集选择和称为GARSDC的分裂和矛盾，从而显着提高了效率。此外，为了减轻通用算法中人口质量的敏感性，我们利用具有相似骨架的不同检测器之间的可转移性产生了梯度优先人口。与最先进的攻击方法相比，GARSDC在地图中平均减少12.0，在广泛的实验中查询约1000倍。我们的代码可以在https://github.com/liangsiyuan21/ garsdc找到。

视觉检测是自动驾驶的关键任务，它是自动驾驶计划和控制的关键基础。深度神经网络在各种视觉任务中取得了令人鼓舞的结果，但众所周知，它们容易受到对抗性攻击的影响。在人们改善其稳健性之前，需要对深层视觉探测器的脆弱性进行全面的了解。但是，只有少数对抗性攻击/防御工程集中在对象检测上，其中大多数仅采用分类和/或本地化损失，而忽略了目的方面。在本文中，我们确定了Yolo探测器中与物体相关的严重相关对抗性脆弱性，并提出了针对自动驾驶汽车视觉检测物质方面的有效攻击策略。此外，为了解决这种脆弱性，我们提出了一种新的客观性训练方法，以进行视觉检测。实验表明，针对目标方面的拟议攻击比分别在KITTI和COCO流量数据集中分类和/或本地化损失产生的攻击效率高45.17％和43.50％。此外，拟议的对抗防御方法可以分别在Kitti和Coco交通方面提高检测器对目标攻击的鲁棒性高达21％和12％的地图。

Deep learning-based 3D object detectors have made significant progress in recent years and have been deployed in a wide range of applications. It is crucial to understand the robustness of detectors against adversarial attacks when employing detectors in security-critical applications. In this paper, we make the first attempt to conduct a thorough evaluation and analysis of the robustness of 3D detectors under adversarial attacks. Specifically, we first extend three kinds of adversarial attacks to the 3D object detection task to benchmark the robustness of state-of-the-art 3D object detectors against attacks on KITTI and Waymo datasets, subsequently followed by the analysis of the relationship between robustness and properties of detectors. Then, we explore the transferability of cross-model, cross-task, and cross-data attacks. We finally conduct comprehensive experiments of defense for 3D detectors, demonstrating that simple transformations like flipping are of little help in improving robustness when the strategy of transformation imposed on input point cloud data is exposed to attackers. Our findings will facilitate investigations in understanding and defending the adversarial attacks against 3D object detectors to advance this field.

作为一项基本的计算机视觉任务，对象检测在深度神经网络的出现中取得了显着的进步。然而，很少有作品探索对象探测器的对抗性鲁棒性，以抵制在各种现实世界中实用应用的对抗性攻击。探测器受到了不明显的扰动的挑战，在干净的图像上的性能下降，并且在对抗图像上的性能极差。在这项工作中，我们从经验上探索了对象检测中对抗性鲁棒性的模型培训，这极大地归因于学习清洁图像和对抗图像之间的冲突。为了减轻此问题，我们提出了一个基于对抗感知的卷积的稳健检测器（鲁棒），以解开对清洁和对抗性图像的模型学习的梯度。 RubustDet还采用了对抗图像判别器（AID）和重建（CFR）的一致特征，以确保可靠的鲁棒性。对Pascal VOC和MS-Coco的广泛实验表明，我们的模型有效地脱离了梯度，并显着增强了检测鲁棒性，从而保持了清洁图像上的检测能力。

Adversarial attacks hamper the decision-making ability of neural networks by perturbing the input signal. The addition of calculated small distortion to images, for instance, can deceive a well-trained image classification network. In this work, we propose a novel attack technique called Sparse Adversarial and Interpretable Attack Framework (SAIF). Specifically, we design imperceptible attacks that contain low-magnitude perturbations at a small number of pixels and leverage these sparse attacks to reveal the vulnerability of classifiers. We use the Frank-Wolfe (conditional gradient) algorithm to simultaneously optimize the attack perturbations for bounded magnitude and sparsity with $O(1/\sqrt{T})$ convergence. Empirical results show that SAIF computes highly imperceptible and interpretable adversarial examples, and outperforms state-of-the-art sparse attack methods on the ImageNet dataset.

在过去的几年中，对针对基于学习的对象探测器的对抗性攻击进行了广泛的研究。提出的大多数攻击都针对模型的完整性（即导致模型做出了错误的预测），而针对模型可用性的对抗性攻击，这是安全关键领域（例如自动驾驶）的关键方面，尚未探索。机器学习研究社区。在本文中，我们提出了一种新颖的攻击，对端到端对象检测管道的决策潜伏期产生负面影响。我们制作了一种通用的对抗扰动（UAP），该扰动（UAP）针对了许多对象检测器管道中的广泛使用的技术 - 非最大抑制（NMS）。我们的实验证明了拟议的UAP通过添加“幻影”对象来增加单个帧的处理时间的能力，该对象在保留原始对象的检测时（允许攻击时间更长的时间内未检测到）。

It has been well demonstrated that adversarial examples, i.e., natural images with visually imperceptible perturbations added, cause deep networks to fail on image classification. In this paper, we extend adversarial examples to semantic segmentation and object detection which are much more difficult. Our observation is that both segmentation and detection are based on classifying multiple targets on an image (e.g., the target is a pixel or a receptive field in segmentation, and an object proposal in detection). This inspires us to optimize a loss function over a set of pixels/proposals for generating adversarial perturbations. Based on this idea, we propose a novel algorithm named Dense Adversary Generation (DAG), which generates a large family of adversarial examples, and applies to a wide range of state-of-the-art deep networks for segmentation and detection. We also find that the adversarial perturbations can be transferred across networks with different training data, based on different architectures, and even for different recognition tasks. In particular, the transferability across networks with the same architecture is more significant than in other cases. Besides, summing up heterogeneous perturbations often leads to better transfer performance, which provides an effective method of blackbox adversarial attack.

由于缺乏对AI模型的安全性和鲁棒性的信任，近年来，深度学习模型（尤其是针对安全至关重要的系统）中的对抗性攻击正在越来越受到关注。然而，更原始的对抗性攻击可能是身体上不可行的，或者需要一些难以访问的资源，例如训练数据，这激发了斑块攻击的出现。在这项调查中，我们提供了全面的概述，以涵盖现有的对抗贴片攻击技术，旨在帮助感兴趣的研究人员迅速赶上该领域的进展。我们还讨论了针对对抗贴片的检测和防御措施的现有技术，旨在帮助社区更好地了解该领域及其在现实世界中的应用。

在过去的十年中，深度学习急剧改变了传统的手工艺特征方式，具有强大的功能学习能力，从而极大地改善了传统任务。然而，最近已经证明了深层神经网络容易受到对抗性例子的影响，这种恶意样本由小型设计的噪音制作，误导了DNNs做出错误的决定，同时仍然对人类无法察觉。对抗性示例可以分为数字对抗攻击和物理对抗攻击。数字对抗攻击主要是在实验室环境中进行的，重点是改善对抗性攻击算法的性能。相比之下，物理对抗性攻击集中于攻击物理世界部署的DNN系统，这是由于复杂的物理环境（即亮度，遮挡等），这是一项更具挑战性的任务。尽管数字对抗和物理对抗性示例之间的差异很小，但物理对抗示例具有特定的设计，可以克服复杂的物理环境的效果。在本文中，我们回顾了基于DNN的计算机视觉任务任务中的物理对抗攻击的开发，包括图像识别任务，对象检测任务和语义细分。为了完整的算法演化，我们将简要介绍不涉及身体对抗性攻击的作品。我们首先提出一个分类方案，以总结当前的物理对抗攻击。然后讨论现有的物理对抗攻击的优势和缺点，并专注于用于维持对抗性的技术，当应用于物理环境中时。最后，我们指出要解决的当前身体对抗攻击的问题并提供有前途的研究方向。

深度神经网络（DNN）被视为易受对抗性攻击的影响，而现有的黑匣子攻击需要广泛查询受害者DNN以实现高成功率。对于查询效率，由于它们的梯度相似度（GS），即代理的攻击梯度与受害者的攻击梯度类似，因此使用受害者的代理模型来生成可转移的对抗性示例（AES）。但是，通常忽略了它们对输出的相似性，即预测相似性（PS），以在不查询受害者的情况下通过代理过滤效率低效查询。要共同利用和还优化代理者的GS和PS，我们开发QueryNet，一个可以显着减少查询的统一攻击框架。 Querynet通过多识别代理人创造性地攻击，即通过不同的代理商为一个样本工艺几个AES，并且还使用代理人来决定查询最有前途的AE。之后，受害者的查询反馈累积以优化代理人的参数，还可以优化其架构，增强GS和PS。虽然Querynet无法获得预先接受预先训练的代理人，但根据我们的综合实验，它与可接受的时间内的替代方案相比，它会降低查询。 ImageNet，只允许8位图像查询，无法访问受害者的培训数据。代码可在https://github.com/allenchen1998/querynet上获得。

Adversarial patch is an important form of real-world adversarial attack that brings serious risks to the robustness of deep neural networks. Previous methods generate adversarial patches by either optimizing their perturbation values while fixing the pasting position or manipulating the position while fixing the patch's content. This reveals that the positions and perturbations are both important to the adversarial attack. For that, in this paper, we propose a novel method to simultaneously optimize the position and perturbation for an adversarial patch, and thus obtain a high attack success rate in the black-box setting. Technically, we regard the patch's position, the pre-designed hyper-parameters to determine the patch's perturbations as the variables, and utilize the reinforcement learning framework to simultaneously solve for the optimal solution based on the rewards obtained from the target model with a small number of queries. Extensive experiments are conducted on the Face Recognition (FR) task, and results on four representative FR models show that our method can significantly improve the attack success rate and query efficiency. Besides, experiments on the commercial FR service and physical environments confirm its practical application value. We also extend our method to the traffic sign recognition task to verify its generalization ability.

To assess the vulnerability of deep learning in the physical world, recent works introduce adversarial patches and apply them on different tasks. In this paper, we propose another kind of adversarial patch: the Meaningful Adversarial Sticker, a physically feasible and stealthy attack method by using real stickers existing in our life. Unlike the previous adversarial patches by designing perturbations, our method manipulates the sticker's pasting position and rotation angle on the objects to perform physical attacks. Because the position and rotation angle are less affected by the printing loss and color distortion, adversarial stickers can keep good attacking performance in the physical world. Besides, to make adversarial stickers more practical in real scenes, we conduct attacks in the black-box setting with the limited information rather than the white-box setting with all the details of threat models. To effectively solve for the sticker's parameters, we design the Region based Heuristic Differential Evolution Algorithm, which utilizes the new-found regional aggregation of effective solutions and the adaptive adjustment strategy of the evaluation criteria. Our method is comprehensively verified in the face recognition and then extended to the image retrieval and traffic sign recognition. Extensive experiments show the proposed method is effective and efficient in complex physical conditions and has a good generalization for different tasks.

Adversarial attacks can easily fool object recognition systems based on deep neural networks (DNNs). Although many defense methods have been proposed in recent years, most of them can still be adaptively evaded. One reason for the weak adversarial robustness may be that DNNs are only supervised by category labels and do not have part-based inductive bias like the recognition process of humans. Inspired by a well-known theory in cognitive psychology -- recognition-by-components, we propose a novel object recognition model ROCK (Recognizing Object by Components with human prior Knowledge). It first segments parts of objects from images, then scores part segmentation results with predefined human prior knowledge, and finally outputs prediction based on the scores. The first stage of ROCK corresponds to the process of decomposing objects into parts in human vision. The second stage corresponds to the decision process of the human brain. ROCK shows better robustness than classical recognition models across various attack settings. These results encourage researchers to rethink the rationality of currently widely-used DNN-based object recognition models and explore the potential of part-based models, once important but recently ignored, for improving robustness.

Recent researches show that the deep learning based object detection is vulnerable to adversarial examples. Generally, the adversarial attack for object detection contains targeted attack and untargeted attack. According to our detailed investigations, the research on the former is relatively fewer than the latter and all the existing methods for the targeted attack follow the same mode, i.e., the object-mislabeling mode that misleads detectors to mislabel the detected object as a specific wrong label. However, this mode has limited attack success rate, universal and generalization performances. In this paper, we propose a new object-fabrication targeted attack mode which can mislead detectors to `fabricate' extra false objects with specific target labels. Furthermore, we design a dual attention based targeted feature space attack method to implement the proposed targeted attack mode. The attack performances of the proposed mode and method are evaluated on MS COCO and BDD100K datasets using FasterRCNN and YOLOv5. Evaluation results demonstrate that, the proposed object-fabrication targeted attack mode and the corresponding targeted feature space attack method show significant improvements in terms of image-specific attack, universal performance and generalization capability, compared with the previous targeted attack for object detection. Code will be made available.

对抗性攻击可以迫使基于CNN的模型通过巧妙地操纵人类侵犯的输入来产生不正确的输出。探索这种扰动可以帮助我们更深入地了解神经网络的脆弱性，并为反对杂项对手提供深入学习的鲁棒性。尽管大量研究着重于图像，音频和NLP的鲁棒性，但仍缺乏视觉对象跟踪的对抗示例（尤其是以黑盒方式）的作品。在本文中，我们提出了一种新颖的对抗性攻击方法，以在黑色框设置下为单个对象跟踪产生噪音，其中仅在跟踪序列的初始框架上添加了扰动，从整个视频剪辑的角度来看，这很难注意到这一点。具体而言，我们将算法分为三个组件，并利用加固学习，以精确地定位重要的框架贴片，同时减少不必要的计算查询开销。与现有技术相比，我们的方法需要在视频的初始化框架上进行更少的查询，以操纵竞争性甚至更好的攻击性能。我们在长期和短期数据集中测试我们的算法，包括OTB100，DOCT2018，UAV123和LASOT。广泛的实验证明了我们方法对三种主流类型的跟踪器类型的有效性：歧视，基于暹罗和强化学习的跟踪器。

近年来，图像分类器的BlackBox传输攻击已被广泛研究。相比之下，对对象探测器的转移攻击取得了很小的进展。对象探测器采用图像的整体视图，并检测一个对象（或缺乏）通常取决于场景中的其他对象。这使得这种探测器本质上的上下文感知和对抗的攻击比目标图像分类器更具挑战性。在本文中，我们提出了一种新的方法来为对象检测器生成上下文感知攻击。我们表明，通过使用对象及其相关位置的共同发生和尺寸作为上下文信息，我们可以成功地生成目标的错误分类攻击，该攻击比最先进的Blackbox对象探测器上实现更高的转移成功率。我们在帕斯卡VOC和MS Coco Datasets的各种对象探测器上测试我们的方法，与其他最先进的方法相比，性能提高了高达20美元的百分点。

经过对人体跟踪系统引起的隐私问题的调查，我们提出了一种黑盒对抗攻击方法，该方法对最先进的人类检测模型，称为Invisibilitee。该方法学习了可打印的对抗图案，适用于T恤，这些T恤在人体跟踪系统前的物理世界中抓起佩戴者。我们设计了一种角度不足的学习方案，该方案利用了时尚数据集的分割和几何扭曲过程，因此生成的对抗模式可有效从所有摄像机角度和看不见的黑盒检测模型欺骗人检测器。数字环境和物理环境中的经验结果表明，随着Invisibilitee的启用，人体跟踪系统检测佩戴者的能力显着下降。

考虑到整个时间领域的信息有助于改善自动驾驶中的环境感知。但是，到目前为止，尚未研究暂时融合的神经网络是否容易受到故意产生的扰动，即对抗性攻击，或者时间历史是否是对它们的固有防御。在这项工作中，我们研究了用于对象检测的时间特征网络是否容易受到通用对抗性攻击的影响。我们评估了两种类型的攻击：整个图像和本地界面贴片的不可察觉噪声。在这两种情况下，使用PGD以白盒方式生成扰动。我们的实验证实，即使攻击时间的一部分时间都足以欺骗网络。我们在视觉上评估生成的扰动，以了解攻击功能。为了增强鲁棒性，我们使用5-PGD应用对抗训练。我们在Kitti和Nuscenes数据集上进行的实验证明了通过K-PGD鲁棒化的模型能够承受研究的攻击，同时保持基于地图的性能与未破坏模型的攻击。

人群计数已被广泛用于估计安全至关重要的场景中的人数，被证明很容易受到物理世界中对抗性例子的影响（例如，对抗性斑块）。尽管有害，但对抗性例子也很有价值，对于评估和更好地理解模型的鲁棒性也很有价值。但是，现有的对抗人群计算的对抗性示例生成方法在不同的黑盒模型之间缺乏强大的可传递性，这限制了它们对现实世界系统的实用性。本文提出了与模型不变特征正相关的事实，本文提出了感知的对抗贴片（PAP）生成框架，以使用模型共享的感知功能来定制对对抗性的扰动。具体来说，我们将一种自适应人群密度加权方法手工制作，以捕获各种模型中不变的量表感知特征，并利用密度引导的注意力来捕获模型共享的位置感知。证明它们都可以提高我们对抗斑块的攻击性转移性。广泛的实验表明，我们的PAP可以在数字世界和物理世界中实现最先进的进攻性能，并且以大幅度的优于以前的提案（最多+685.7 MAE和+699.5 MSE）。此外，我们从经验上证明，对我们的PAP进行的对抗训练可以使香草模型的性能受益，以减轻人群计数的几个实际挑战，包括跨数据集的概括（高达-376.0 MAE和-376.0 MAE和-354.9 MSE）和对复杂背景的鲁棒性（上升）至-10.3 MAE和-16.4 MSE）。