Learning Coated Adversarial Camouflages for Object Detectors

TL;DR

This paper introduces Coated Adversarial Camouflage (CAC), a novel 3D-aware attack method that effectively fools object detectors from multiple viewpoints, highlighting security risks in vision systems.

Contribution

The work proposes a new 3D rendering-based adversarial camouflage framework that maintains attack effectiveness across different viewpoints, unlike traditional 2D patch methods.

Findings

CAC outperforms existing attack methods in virtual and real-world tests.

The approach demonstrates robustness against viewpoint changes in object detection.

Extensive experiments confirm the effectiveness and potential security threats of CAC.

Abstract

An adversary can fool deep neural network object detectors by generating adversarial noises. Most of the existing works focus on learning local visible noises in an adversarial "patch" fashion. However, the 2D patch attached to a 3D object tends to suffer from an inevitable reduction in attack performance as the viewpoint changes. To remedy this issue, this work proposes the Coated Adversarial Camouflage (CAC) to attack the detectors in arbitrary viewpoints. Unlike the patch trained in the 2D space, our camouflage generated by a conceptually different training framework consists of 3D rendering and dense proposals attack. Specifically, we make the camouflage perform 3D spatial transformations according to the pose changes of the object. Based on the multi-view rendering results, the top-n proposals of the region proposal network are fixed, and all the classifications in the fixed dense proposals are attacked simultaneously to output errors. In addition, we build a virtual 3D scene to fairly and reproducibly evaluate different attacks. Extensive experiments demonstrate the superiority of CAC over the existing attacks, and it shows impressive performance both in the virtual scene and the real world. This poses a potential threat to the security-critical computer vision systems.