DAP: A Dynamic Adversarial Patch for Evading Person Detectors

TL;DR

This paper introduces a novel dynamic adversarial patch (DAP) that is naturalistic, robust to transformations, and more effective in evading person detectors in both digital and physical settings.

Contribution

The paper proposes a new approach for creating stealthy, robust adversarial patches using direct pixel modification and a creases transformation block, improving over GAN-based methods.

Findings

Achieves up to 82.28% success rate against YOLOv7 in digital tests.

Attains 65% success rate in physical-world scenarios.

Outperforms existing state-of-the-art adversarial attack methods.

Abstract

Patch-based adversarial attacks were proven to compromise the robustness and reliability of computer vision systems. However, their conspicuous and easily detectable nature challenge their practicality in real-world setting. To address this, recent work has proposed using Generative Adversarial Networks (GANs) to generate naturalistic patches that may not attract human attention. However, such approaches suffer from a limited latent space making it challenging to produce a patch that is efficient, stealthy, and robust to multiple real-world transformations. This paper introduces a novel approach that produces a Dynamic Adversarial Patch (DAP) designed to overcome these limitations. DAP maintains a naturalistic appearance while optimizing attack efficiency and robustness to real-world transformations. The approach involves redefining the optimization problem and introducing a novel objective function that incorporates a similarity metric to guide the patch's creation. Unlike GAN-based techniques, the DAP directly modifies pixel values within the patch, providing increased flexibility and adaptability to multiple transformations. Furthermore, most clothing-based physical attacks assume static objects and ignore the possible transformations caused by non-rigid deformation due to changes in a person's pose. To address this limitation, a 'Creases Transformation' (CT) block is introduced, enhancing the patch's resilience to a variety of real-world distortions. Experimental results demonstrate that the proposed approach outperforms state-of-the-art attacks, achieving a success rate of up to 82.28% in the digital world when targeting the YOLOv7 detector and 65% in the physical world when targeting YOLOv3tiny detector deployed in edge-based smart cameras.