SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations

TL;DR

This paper introduces SLAP, a novel technique using a light projector to create dynamic, physically robust adversarial examples that are harder to detect and more controllable than traditional patches, especially effective in self-driving scenarios.

Contribution

SLAP enables dynamic, controllable physical adversarial examples using projection, improving robustness and stealth over static patches in real-world attacks.

Findings

Achieves up to 99% attack success rate in various conditions.

Bypasses detection methods like SentiNet effectively.

Adaptive defenses can reduce attack success by up to 80%.

Abstract

Research into adversarial examples (AE) has developed rapidly, yet static adversarial patches are still the main technique for conducting attacks in the real world, despite being obvious, semi-permanent and unmodifiable once deployed. In this paper, we propose Short-Lived Adversarial Perturbations (SLAP), a novel technique that allows adversaries to realize physically robust real-world AE by using a light projector. Attackers can project a specifically crafted adversarial perturbation onto a real-world object, transforming it into an AE. This allows the adversary greater control over the attack compared to adversarial patches: (i) projections can be dynamically turned on and off or modified at will, (ii) projections do not suffer from the locality constraint imposed by patches, making them harder to detect. We study the feasibility of SLAP in the self-driving scenario, targeting both object detector and traffic sign recognition tasks, focusing on the detection of stop signs. We conduct experiments in a variety of ambient light conditions, including outdoors, showing how in non-bright settings the proposed method generates AE that are extremely robust, causing misclassifications on state-of-the-art networks with up to 99% success rate for a variety of angles and distances. We also demostrate that SLAP-generated AE do not present detectable behaviours seen in adversarial patches and therefore bypass SentiNet, a physical AE detection method. We evaluate other defences including an adaptive defender using adversarial learning which is able to thwart the attack effectiveness up to 80% even in favourable attacker conditions.