Transferable Physical Attack against Object Detection with Separable Attention

TL;DR

This paper introduces a novel attention-based physical adversarial attack method that enhances transferability across unseen object detection models by manipulating separable attention maps to create effective camouflage.

Contribution

The paper proposes a new transferable physical attack method using multi-scale attention maps and a novel attention-based loss to improve black-box attack success rates.

Findings

Outperforms state-of-the-art methods in transferability

Uses multi-scale attention maps to capture object features

Suppresses foreground attention, enhances background attention

Abstract

Transferable adversarial attack is always in the spotlight since deep learning models have been demonstrated to be vulnerable to adversarial samples. However, existing physical attack methods do not pay enough attention on transferability to unseen models, thus leading to the poor performance of black-box attack.In this paper, we put forward a novel method of generating physically realizable adversarial camouflage to achieve transferable attack against detection models. More specifically, we first introduce multi-scale attention maps based on detection models to capture features of objects with various resolutions. Meanwhile, we adopt a sequence of composite transformations to obtain the averaged attention maps, which could curb model-specific noise in the attention and thus further boost transferability. Unlike the general visualization interpretation methods where model attention should be put on the foreground object as much as possible, we carry out attack on separable attention from the opposite perspective, i.e. suppressing attention of the foreground and enhancing that of the background. Consequently, transferable adversarial camouflage could be yielded efficiently with our novel attention-based loss function. Extensive comparison experiments verify the superiority of our method to state-of-the-art methods.