Optical Adversarial Attack

TL;DR

OPAD introduces a novel physical-space adversarial attack using structured illumination to fool image classifiers without physical object manipulation, incorporating projector-camera modeling for effective optically-based attacks.

Contribution

This work presents the first optical adversarial attack method that leverages structured illumination and models the projector-camera system for effective physical-space attacks.

Findings

OPAD successfully fools classifiers on real 3D objects.

The attack works in white-box, black-box, targeted, and untargeted settings.

Theoretical limits of the attack system are quantified.

Abstract

We introduce OPtical ADversarial attack (OPAD). OPAD is an adversarial attack in the physical space aiming to fool image classifiers without physically touching the objects (e.g., moving or painting the objects). The principle of OPAD is to use structured illumination to alter the appearance of the target objects. The system consists of a low-cost projector, a camera, and a computer. The challenge of the problem is the non-linearity of the radiometric response of the projector and the spatially varying spectral response of the scene. Attacks generated in a conventional approach do not work in this setting unless they are calibrated to compensate for such a projector-camera model. The proposed solution incorporates the projector-camera model into the adversarial attack optimization, where a new attack formulation is derived. Experimental results prove the validity of the solution. It is demonstrated that OPAD can optically attack a real 3D object in the presence of background lighting for white-box, black-box, targeted, and untargeted attacks. Theoretical analysis is presented to quantify the fundamental performance limit of the system.