ADC: Adversarial attacks against object Detection that evade Context consistency checks

TL;DR

This paper introduces ADC, an adaptive attack framework that successfully fools object detectors and evades context consistency defenses, revealing vulnerabilities in current adversarial defense strategies for object detection.

Contribution

The paper presents the first adaptive attack method that simultaneously targets object detection and context consistency checks, exposing weaknesses in recent defense techniques.

Findings

ADC achieves over 85% success in fooling detectors

ADC bypasses context consistency checks over 80% of the time

Vulnerabilities in current context-based defenses are demonstrated

Abstract

Deep Neural Networks (DNNs) have been shown to be vulnerable to adversarial examples, which are slightly perturbed input images which lead DNNs to make wrong predictions. To protect from such examples, various defense strategies have been proposed. A very recent defense strategy for detecting adversarial examples, that has been shown to be robust to current attacks, is to check for intrinsic context consistencies in the input data, where context refers to various relationships (e.g., object-to-object co-occurrence relationships) in images. In this paper, we show that even context consistency checks can be brittle to properly crafted adversarial examples and to the best of our knowledge, we are the first to do so. Specifically, we propose an adaptive framework to generate examples that subvert such defenses, namely, Adversarial attacks against object Detection that evade Context consistency checks (ADC). In ADC, we formulate a joint optimization problem which has two attack goals, viz., (i) fooling the object detector and (ii) evading the context consistency check system, at the same time. Experiments on both PASCAL VOC and MS COCO datasets show that examples generated with ADC fool the object detector with a success rate of over 85% in most cases, and at the same time evade the recently proposed context consistency checks, with a bypassing rate of over 80% in most cases. Our results suggest that how to robustly model context and check its consistency, is still an open problem.