Brightness-Restricted Adversarial Attack Patch
This addresses the practical issue of stealth in physical-world adversarial attacks for security and machine learning applications, representing an incremental improvement.
The paper tackles the problem of adversarial attack patches being easily detectable due to bright colors by introducing a brightness-restricted patch (BrPatch) that reduces conspicuousness while maintaining effectiveness, with experiments showing attack patches are redundant to brightness and resistant to color transfer and noise.
Adversarial attack patches have gained increasing attention due to their practical applicability in physical-world scenarios. However, the bright colors used in attack patches represent a significant drawback, as they can be easily identified by human observers. Moreover, even though these attacks have been highly successful in deceiving target networks, which specific features of the attack patch contribute to its success are still unknown. Our paper introduces a brightness-restricted patch (BrPatch) that uses optical characteristics to effectively reduce conspicuousness while preserving image independence. We also conducted an analysis of the impact of various image features (such as color, texture, noise, and size) on the effectiveness of an attack patch in physical-world deployment. Our experiments show that attack patches exhibit strong redundancy to brightness and are resistant to color transfer and noise. Based on our findings, we propose some additional methods to further reduce the conspicuousness of BrPatch. Our findings also explain the robustness of attack patches observed in physical-world scenarios.