CBA: Contextual Background Attack against Optical Aerial Detection in the Physical World

TL;DR

This paper introduces a novel physical attack framework called Contextual Background Attack (CBA) that effectively deceives aerial detectors by optimizing adversarial patches based on contextual background, achieving high transferability and robustness in real-world scenarios.

Contribution

The paper proposes a new physical attack method that enhances transferability and efficacy against aerial detection by leveraging contextual background optimization without smudging targets.

Findings

CBA achieves superior attack success rates in physical scenarios.

Adversarial patches are more transferable and robust.

The method effectively fools aerial detectors both on and outside patches.

Abstract

Patch-based physical attacks have increasingly aroused concerns. However, most existing methods focus on obscuring targets captured on the ground, and some of these methods are simply extended to deceive aerial detectors. They smear the targeted objects in the physical world with the elaborated adversarial patches, which can only slightly sway the aerial detectors' prediction and with weak attack transferability. To address the above issues, we propose to perform Contextual Background Attack (CBA), a novel physical attack framework against aerial detection, which can achieve strong attack efficacy and transferability in the physical world even without smudging the interested objects at all. Specifically, the targets of interest, i.e. the aircraft in aerial images, are adopted to mask adversarial patches. The pixels outside the mask area are optimized to make the generated adversarial patches closely cover the critical contextual background area for detection, which contributes to gifting adversarial patches with more robust and transferable attack potency in the real world. To further strengthen the attack performance, the adversarial patches are forced to be outside targets during training, by which the detected objects of interest, both on and outside patches, benefit the accumulation of attack efficacy. Consequently, the sophisticatedly designed patches are gifted with solid fooling efficacy against objects both on and outside the adversarial patches simultaneously. Extensive proportionally scaled experiments are performed in physical scenarios, demonstrating the superiority and potential of the proposed framework for physical attacks. We expect that the proposed physical attack method will serve as a benchmark for assessing the adversarial robustness of diverse aerial detectors and defense methods.