On Physical Adversarial Patches for Object Detection

TL;DR

This paper introduces a novel physical adversarial patch that can be placed anywhere in an image to completely suppress object detection by models like YOLOv3, enabling new physical attack methods without modifying objects.

Contribution

We demonstrate a physical adversarial patch that universally suppresses object detection across the entire scene, unlike previous methods requiring overlap or proximity to objects.

Findings

The patch can hide all objects in an image from detection.

The attack works regardless of the patch's position in the scene.

It enables physical attacks without object modification.

Abstract

In this paper, we demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene. A demo of the system can be found at https://youtu.be/WXnQjbZ1e7Y.