Brightness-Restricted Adversarial Attack Patch

TL;DR

This paper introduces a brightness-restricted adversarial patch that reduces visual conspicuousness while maintaining attack effectiveness, analyzing feature impacts and proposing methods to enhance stealthiness in physical-world attacks.

Contribution

The paper presents a novel brightness-restricted attack patch (BrPatch) that minimizes visual detectability and analyzes feature effects on attack robustness in real-world scenarios.

Findings

Attack patches are redundant to brightness.

They resist color transfer and noise.

Proposed methods further reduce patch conspicuousness.

Abstract

Adversarial attack patches have gained increasing attention due to their practical applicability in physical-world scenarios. However, the bright colors used in attack patches represent a significant drawback, as they can be easily identified by human observers. Moreover, even though these attacks have been highly successful in deceiving target networks, which specific features of the attack patch contribute to its success are still unknown. Our paper introduces a brightness-restricted patch (BrPatch) that uses optical characteristics to effectively reduce conspicuousness while preserving image independence. We also conducted an analysis of the impact of various image features (such as color, texture, noise, and size) on the effectiveness of an attack patch in physical-world deployment. Our experiments show that attack patches exhibit strong redundancy to brightness and are resistant to color transfer and noise. Based on our findings, we propose some additional methods to further reduce the conspicuousness of BrPatch. Our findings also explain the robustness of attack patches observed in physical-world scenarios.