Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors
This addresses a critical vulnerability in safety-critical domains like autonomous driving, where availability attacks are previously unexplored, representing a novel but incremental advance in adversarial machine learning.
The paper tackles the problem of adversarial attacks on deep object detectors by targeting model availability rather than integrity, proposing a universal adversarial perturbation that exploits non-maximum suppression to increase processing time by up to 2.5 times while keeping original detections intact.
Adversarial attacks against deep learning-based object detectors have been studied extensively in the past few years. Most of the attacks proposed have targeted the model's integrity (i.e., caused the model to make incorrect predictions), while adversarial attacks targeting the model's availability, a critical aspect in safety-critical domains such as autonomous driving, have not yet been explored by the machine learning research community. In this paper, we propose a novel attack that negatively affects the decision latency of an end-to-end object detection pipeline. We craft a universal adversarial perturbation (UAP) that targets a widely used technique integrated in many object detector pipelines -- non-maximum suppression (NMS). Our experiments demonstrate the proposed UAP's ability to increase the processing time of individual frames by adding "phantom" objects that overload the NMS algorithm while preserving the detection of the original objects which allows the attack to go undetected for a longer period of time.