Traits & Transferability of Adversarial Examples against Instance Segmentation & Object Detection

TL;DR

This paper investigates the effectiveness and transferability of adversarial examples against complex models like instance segmentation and object detection, finding they are generally ineffective due to transformations and architecture differences.

Contribution

It provides new insights into the limitations of adversarial examples on advanced models and highlights their weak transferability and robustness against common input transformations.

Findings

Adversarial examples are ineffective against instance segmentation and object detection models.

Transformations like scaling and lighting reduce adversarial effectiveness.

Limited transferability of adversarial examples across different neural network architectures.

Abstract

Despite the recent advancements in deploying neural networks for image classification, it has been found that adversarial examples are able to fool these models leading them to misclassify the images. Since these models are now being widely deployed, we provide an insight on the threat of these adversarial examples by evaluating their characteristics and transferability to more complex models that utilize Image Classification as a subtask. We demonstrate the ineffectiveness of adversarial examples when applied to Instance Segmentation & Object Detection models. We show that this ineffectiveness arises from the inability of adversarial examples to withstand transformations such as scaling or a change in lighting conditions. Moreover, we show that there exists a small threshold below which the adversarial property is retained while applying these input transformations. Additionally, these attacks demonstrate weak cross-network transferability across neural network architectures, e.g. VGG16 and ResNet50, however, the attack may fool both the networks if passed sequentially through networks during its formation. The lack of scalability and transferability challenges the question of how adversarial images would be effective in the real world.