We Can Always Catch You: Detecting Adversarial Patched Objects WITH or WITHOUT Signature
This work addresses security threats in surveillance and object detection systems by providing effective detection against adversarial patches, though it is incremental as it builds on existing attack methods.
The paper tackles the problem of detecting adversarial patch attacks on object detectors, which can hide objects from surveillance systems, by proposing two detection methods: a fast signature-based method for real-time detection and a robust signature-independent method that can detect unknown attacks and resist defense-aware attacks.
Recently, object detection has proven vulnerable to adversarial patch attacks. The attackers holding a specially crafted patch can hide themselves from state-of-the-art detectors, e.g., YOLO, even in the physical world. This attack can bring serious security threats, such as escaping from surveillance cameras. How to effectively detect this kind of adversarial examples to catch potential attacks has become an important problem. In this paper, we propose two detection methods: the signature-based method and the signature-independent method. First, we identify two signatures of existing adversarial patches that can be utilized to precisely locate patches within adversarial examples. By employing the signatures, a fast signature-based method is developed to detect the adversarial objects. Second, we present a robust signature-independent method based on the \textit{content semantics consistency} of model outputs. Adversarial objects violate this consistency, appearing locally but disappearing globally, while benign ones remain consistently present. The experiments demonstrate that two proposed methods can effectively detect attacks both in the digital and physical world. These methods each offer distinct advantage. Specifically, the signature-based method is capable of real-time detection, while the signature-independent method can detect unknown adversarial patch attacks and makes defense-aware attacks almost impossible to perform.