Object-fabrication Targeted Attack for Object Detection

TL;DR

This paper introduces a novel targeted attack method for object detection that fabricates designated objects in images, regardless of their presence, by leveraging feature space manipulation and a dual attention mechanism, improving attack success rates.

Contribution

The paper proposes a new targeted feature space attack that can create designated objects in images without relying on their actual presence, enhancing attack versatility and effectiveness.

Findings

Significant improvement in attack success rates over previous methods

Effective on multiple datasets and detection models

Capable of fabricating objects regardless of their presence in images

Abstract

Recent studies have demonstrated that object detection networks are usually vulnerable to adversarial examples. Generally, adversarial attacks for object detection can be categorized into targeted and untargeted attacks. Compared with untargeted attacks, targeted attacks present greater challenges and all existing targeted attack methods launch the attack by misleading detectors to mislabel the detected object as a specific wrong label. However, since these methods must depend on the presence of the detected objects within the victim image, they suffer from limitations in attack scenarios and attack success rates. In this paper, we propose a targeted feature space attack method that can mislead detectors to `fabricate' extra designated objects regardless of whether the victim image contains objects or not. Specifically, we introduce a guided image to extract coarse-grained features of the target objects and design an innovative dual attention mechanism to filter out the critical features of the target objects efficiently. The attack performance of the proposed method is evaluated on MS COCO and BDD100K datasets with FasterRCNN and YOLOv5. Evaluation results indicate that the proposed targeted feature space attack method shows significant improvements in terms of image-specific, universality, and generalization attack performance, compared with the previous targeted attack for object detection.