Human-Producible Adversarial Examples

TL;DR

This paper introduces a novel method for creating physical adversarial examples called adversarial tags, which are simple to produce with a marker pen and can significantly disrupt object detection models like YOLO.

Contribution

The authors present the first human-producible physical adversarial examples using minimal line drawings, demonstrating effectiveness and robustness in real-world scenarios.

Findings

Drawing 4 lines disrupts YOLO in 54.8% of cases

Drawing 9 lines disrupts YOLO in 81.8% of cases

Untrained humans can produce effective adversarial tags

Abstract

Visual adversarial examples have so far been restricted to pixel-level image manipulations in the digital world, or have required sophisticated equipment such as 2D or 3D printers to be produced in the physical real world. We present the first ever method of generating human-producible adversarial examples for the real world that requires nothing more complicated than a marker pen. We call them $\textbf{adversarial tags}$. First, building on top of differential rendering, we demonstrate that it is possible to build potent adversarial examples with just lines. We find that by drawing just $4$ lines we can disrupt a YOLO-based model in $54.8\%$ of cases; increasing this to $9$ lines disrupts $81.8\%$ of the cases tested. Next, we devise an improved method for line placement to be invariant to human drawing error. We evaluate our system thoroughly in both digital and analogue worlds and demonstrate that our tags can be applied by untrained humans. We demonstrate the effectiveness of our method for producing real-world adversarial examples by conducting a user study where participants were asked to draw over printed images using digital equivalents as guides. We further evaluate the effectiveness of both targeted and untargeted attacks, and discuss various trade-offs and method limitations, as well as the practical and ethical implications of our work. The source code will be released publicly.