Empirical Evaluation of Physical Adversarial Patch Attacks Against Overhead Object Detection Models

TL;DR

This paper empirically evaluates the effectiveness of physical adversarial patches against overhead object detection models in desert scenes, revealing significant challenges in real-world implementation and implications for AI safety.

Contribution

It extends adversarial patch testing to aerial imagery, demonstrating increased difficulty in physical attacks under challenging environmental conditions.

Findings

Physical patches are less effective in aerial scenarios.

Environmental conditions reduce attack success rates.

Implications for real-world AI safety are significant.

Abstract

Adversarial patches are images designed to fool otherwise well-performing neural network-based computer vision models. Although these attacks were initially conceived of and studied digitally, in that the raw pixel values of the image were perturbed, recent work has demonstrated that these attacks can successfully transfer to the physical world. This can be accomplished by printing out the patch and adding it into scenes of newly captured images or video footage. In this work we further test the efficacy of adversarial patch attacks in the physical world under more challenging conditions. We consider object detection models trained on overhead imagery acquired through aerial or satellite cameras, and we test physical adversarial patches inserted into scenes of a desert environment. Our main finding is that it is far more difficult to successfully implement the adversarial patch attacks under these conditions than in the previously considered conditions. This has important implications for AI safety as the real-world threat posed by adversarial examples may be overstated.