NaturalAE: Natural and Robust Physical Adversarial Examples for Object Detectors

TL;DR

This paper introduces a method for creating natural, robust physical adversarial examples that can fool object detectors in real-world conditions while remaining visually similar to original images.

Contribution

The paper proposes a novel approach combining physical constraints, adaptive masking, and real-world perturbation scoring to generate effective, natural-looking adversarial examples for object detection.

Findings

High attack success rates indoors (73.33%) and outdoors (82.22%)

Adversarial examples are robust under various physical conditions

Perturbations are less conspicuous and more natural than previous methods

Abstract

In this paper, we propose a natural and robust physical adversarial example attack method targeting object detectors under real-world conditions. The generated adversarial examples are robust to various physical constraints and visually look similar to the original images, thus these adversarial examples are natural to humans and will not cause any suspicions. First, to ensure the robustness of the adversarial examples in real-world conditions, the proposed method exploits different image transformation functions, to simulate various physical changes during the iterative optimization of the adversarial examples generation. Second, to construct natural adversarial examples, the proposed method uses an adaptive mask to constrain the area and intensities of the added perturbations, and utilizes the real-world perturbation score (RPS) to make the perturbations be similar to those real noises in physical world. Compared with existing studies, our generated adversarial examples can achieve a high success rate with less conspicuous perturbations. Experimental results demonstrate that, the generated adversarial examples are robust under various indoor and outdoor physical conditions, including different distances, angles, illuminations, and photographing. Specifically, the attack success rate of generated adversarial examples indoors and outdoors is high up to 73.33% and 82.22%, respectively. Meanwhile, the proposed method ensures the naturalness of the generated adversarial example, and the size of added perturbations is much smaller than the perturbations in the existing works. Further, the proposed physical adversarial attack method can be transferred from the white-box models to other object detection models.