Adversarial Semantic Contour for Object Detection

TL;DR

This paper introduces Adversarial Semantic Contour (ASC), a novel method leveraging object contours to efficiently generate minimal pixel modifications that fool various object detectors, highlighting vulnerabilities in current models.

Contribution

The paper proposes a contour-guided adversarial attack method that reduces search space and enhances attack effectiveness against object detectors.

Findings

ASC outperforms manual patterns like patches and grids.

Modifying less than 5% of object area can mislead detectors.

Effective against SSD512, Yolov4, Mask RCNN, Faster RCNN.

Abstract

Modern object detectors are vulnerable to adversarial examples, which brings potential risks to numerous applications, e.g., self-driving car. Among attacks regularized by $\ell_p$ norm, $\ell_0$-attack aims to modify as few pixels as possible. Nevertheless, the problem is nontrivial since it generally requires to optimize the shape along with the texture simultaneously, which is an NP-hard problem. To address this issue, we propose a novel method of Adversarial Semantic Contour (ASC) guided by object contour as prior. With this prior, we reduce the searching space to accelerate the $\ell_0$ optimization, and also introduce more semantic information which should affect the detectors more. Based on the contour, we optimize the selection of modified pixels via sampling and their colors with gradient descent alternately. Extensive experiments demonstrate that our proposed ASC outperforms the most commonly manually designed patterns (e.g., square patches and grids) on task of disappearing. By modifying no more than 5\% and 3.5\% of the object area respectively, our proposed ASC can successfully mislead the mainstream object detectors including the SSD512, Yolov4, Mask RCNN, Faster RCNN, etc.