On Physical Adversarial Patches for Object Detection
This enables new physical attacks on object detection systems without modifying objects, posing a security threat for applications like surveillance and autonomous vehicles.
The paper tackles the problem of physical adversarial attacks on object detectors by showing that a single patch placed anywhere in an image can suppress detection of all objects, even those far from the patch, as demonstrated with YOLOv3.
In this paper, we demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene. A demo of the system can be found at https://youtu.be/WXnQjbZ1e7Y.