Using Frequency Attention to Make Adversarial Patch Powerful Against Person Detector

TL;DR

This paper introduces a frequency-domain attention module to enhance adversarial patches, significantly improving attack success rates against small and medium objects in person detection without harming larger targets.

Contribution

It is the first to apply frequency domain attention to optimize adversarial patch attacks on object detectors, boosting effectiveness on small and medium targets.

Findings

Increases attack success rates by 4.18% for small targets.

Improves success rate by 3.89% for medium targets.

Maintains high success rate for large targets.

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial attacks. In particular, object detectors may be attacked by applying a particular adversarial patch to the image. However, because the patch shrinks during preprocessing, most existing approaches that employ adversarial patches to attack object detectors would diminish the attack success rate on small and medium targets. This paper proposes a Frequency Module(FRAN), a frequency-domain attention module for guiding patch generation. This is the first study to introduce frequency domain attention to optimize the attack capabilities of adversarial patches. Our method increases the attack success rates of small and medium targets by 4.18% and 3.89%, respectively, over the state-of-the-art attack method for fooling the human detector while assaulting YOLOv3 without reducing the attack success rate of big targets.