Suppress with a Patch: Revisiting Universal Adversarial Patch Attacks against Object Detection

TL;DR

This paper investigates how different parameters, especially patch positioning during training, affect the strength of universal adversarial patch attacks on object detection models like YOLOv3, revealing that random placement enhances attack effectiveness.

Contribution

It provides an in-depth analysis of patch generation parameters and demonstrates that random patch positioning during training significantly improves attack success.

Findings

Random patch placement during training increases attack strength.

Increasing patch size during training enhances attack effectiveness.

Patch position variation within a batch yields the best attack results.

Abstract

Adversarial patch-based attacks aim to fool a neural network with an intentionally generated noise, which is concentrated in a particular region of an input image. In this work, we perform an in-depth analysis of different patch generation parameters, including initialization, patch size, and especially positioning a patch in an image during training. We focus on the object vanishing attack and run experiments with YOLOv3 as a model under attack in a white-box setting and use images from the COCO dataset. Our experiments have shown, that inserting a patch inside a window of increasing size during training leads to a significant increase in attack strength compared to a fixed position. The best results were obtained when a patch was positioned randomly during training, while patch position additionally varied within a batch.