Adversarial camera stickers: A physical camera-based attack on deep learning systems

TL;DR

This paper introduces a novel physical attack on deep learning classifiers by using translucent stickers on camera lenses to create universal, targeted misclassifications, demonstrating a new threat model in adversarial machine learning.

Contribution

It proposes a new physical attack method manipulating the camera lens with translucent stickers to fool classifiers, expanding adversarial attack scenarios beyond object manipulation.

Findings

Achieved 49.6% targeted fooling rate on ImageNet classifiers

Developed an iterative procedure for creating physically realizable adversarial camera stickers

Demonstrated the feasibility of universal, inconspicuous physical attacks

Abstract

Recent work has documented the susceptibility of deep learning systems to adversarial examples, but most such attacks directly manipulate the digital input to a classifier. Although a smaller line of work considers physical adversarial attacks, in all cases these involve manipulating the object of interest, e.g., putting a physical sticker on an object to misclassify it, or manufacturing an object specifically intended to be misclassified. In this work, we consider an alternative question: is it possible to fool deep classifiers, over all perceived objects of a certain type, by physically manipulating the camera itself? We show that by placing a carefully crafted and mainly-translucent sticker over the lens of a camera, one can create universal perturbations of the observed images that are inconspicuous, yet misclassify target objects as a different (targeted) class. To accomplish this, we propose an iterative procedure for both updating the attack perturbation (to make it adversarial for a given classifier), and the threat model itself (to ensure it is physically realizable). For example, we show that we can achieve physically-realizable attacks that fool ImageNet classifiers in a targeted fashion 49.6% of the time. This presents a new class of physically-realizable threat models to consider in the context of adversarially robust machine learning. Our demo video can be viewed at: https://youtu.be/wUVmL33Fx54