Towards Adversarial Patch Analysis and Certified Defense against Crowd Counting

TL;DR

This paper evaluates the vulnerability of crowd counting neural networks to adversarial patches and introduces a certified defense method, demonstrating significant robustness improvements and attack effectiveness.

Contribution

It proposes a novel adversarial patch attack method (APAM) for crowd counting models and a regression-based randomized ablation defense, advancing robustness analysis and protection.

Findings

Adversarial patches can severely degrade crowd counting accuracy with less than 6% pixel perturbation.

The proposed APAM attack is effective both digitally and physically.

The randomized ablation defense outperforms traditional adversarial training in robustness.

Abstract

Crowd counting has drawn much attention due to its importance in safety-critical surveillance systems. Especially, deep neural network (DNN) methods have significantly reduced estimation errors for crowd counting missions. Recent studies have demonstrated that DNNs are vulnerable to adversarial attacks, i.e., normal images with human-imperceptible perturbations could mislead DNNs to make false predictions. In this work, we propose a robust attack strategy called Adversarial Patch Attack with Momentum (APAM) to systematically evaluate the robustness of crowd counting models, where the attacker's goal is to create an adversarial perturbation that severely degrades their performances, thus leading to public safety accidents (e.g., stampede accidents). Especially, the proposed attack leverages the extreme-density background information of input images to generate robust adversarial patches via a series of transformations (e.g., interpolation, rotation, etc.). We observe that by perturbing less than 6\% of image pixels, our attacks severely degrade the performance of crowd counting systems, both digitally and physically. To better enhance the adversarial robustness of crowd counting models, we propose the first regression model-based Randomized Ablation (RA), which is more sufficient than Adversarial Training (ADT) (Mean Absolute Error of RA is 5 lower than ADT on clean samples and 30 lower than ADT on adversarial examples). Extensive experiments on five crowd counting models demonstrate the effectiveness and generality of the proposed method. The supplementary materials and certificate retrained models are available at \url{https://www.dropbox.com/s/hc4fdx133vht0qb/ACM_MM2021_Supp.pdf?dl=0}