The Weaknesses of Adversarial Camouflage in Overhead Imagery

TL;DR

This paper investigates the effectiveness and detectability of adversarial camouflage patches in overhead imagery, revealing that while they can fool object detectors, they are often more detectable than the objects they aim to hide.

Contribution

The study introduces a library of 24 adversarial patches with varying translucency for multiple object classes in overhead imagery and analyzes their efficacy and detectability.

Findings

Adversarial patches can fool object detectors in overhead imagery.

Patches are on average 24% more detectable than the objects they hide.

Translucency of patches significantly affects their effectiveness.

Abstract

Machine learning is increasingly critical for analysis of the ever-growing corpora of overhead imagery. Advanced computer vision object detection techniques have demonstrated great success in identifying objects of interest such as ships, automobiles, and aircraft from satellite and drone imagery. Yet relying on computer vision opens up significant vulnerabilities, namely, the susceptibility of object detection algorithms to adversarial attacks. In this paper we explore the efficacy and drawbacks of adversarial camouflage in an overhead imagery context. While a number of recent papers have demonstrated the ability to reliably fool deep learning classifiers and object detectors with adversarial patches, most of this work has been performed on relatively uniform datasets and only a single class of objects. In this work we utilize the VisDrone dataset, which has a large range of perspectives and object sizes. We explore four different object classes: bus, car, truck, van. We build a library of 24 adversarial patches to disguise these objects, and introduce a patch translucency variable to our patches. The translucency (or alpha value) of the patches is highly correlated to their efficacy. Further, we show that while adversarial patches may fool object detectors, the presence of such patches is often easily uncovered, with patches on average 24% more detectable than the objects the patches were meant to hide. This raises the question of whether such patches truly constitute camouflage. Source code is available at https://github.com/IQTLabs/camolo.