Out-of-the-box: Black-box Causal Attacks on Object Detectors
This addresses the vulnerability of object detectors to adversarial attacks, providing a tool for developers to analyze and potentially prevent such attacks, though it is incremental as it builds on existing black-box methods.
The paper tackled the problem of creating explainable and imperceptible adversarial attacks on object detectors by introducing BlackCAtt, a black-box algorithm that uses causal pixel sets, resulting in performance improvements such as being 2.7 times better at removing detections and 5.75 times better at triggering spurious detections on the COCO dataset.
Adversarial perturbations are a useful way to expose vulnerabilities in object detectors. Existing perturbation methods are frequently white-box and architecture specific. More importantly, while they are often successful, it is rarely clear why they work. Insights into the mechanism of this success would allow developers to understand and analyze these attacks, as well as fine-tune the model to prevent them. This paper presents BlackCAtt, a black-box algorithm and a tool, which uses minimal, causally sufficient pixel sets to construct explainable, imperceptible, reproducible, architecture-agnostic attacks on object detectors. BlackCAtt combines causal pixels with bounding boxes produced by object detectors to create adversarial attacks that lead to the loss, modification or addition of a bounding box. BlackCAtt works across different object detectors of different sizes and architectures, treating the detector as a black box. We compare the performance of BlackCAtt with other black-box attack methods and show that identification of causal pixels leads to more precisely targeted and less perceptible attacks. On the COCO test dataset, our approach is 2.7 times better than the baseline in removing a detection, 3.86 times better in changing a detection, and 5.75 times better in triggering new, spurious, detections. The attacks generated by BlackCAtt are very close to the original image, and hence imperceptible, demonstrating the power of causal pixels.