Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attacks

TL;DR

This paper introduces a black-box adversarial attack method that generates ghost objects to inflate inference time in object detection, revealing significant security vulnerabilities with low-cost attacks across multiple models.

Contribution

It extends 'steal now, decrypt later' attacks to generate ghost objects in black-box scenarios, demonstrating effective attacks without prior model knowledge.

Findings

Successful attacks on various models and Google Vision API

Average attack cost less than $1

Highlights security vulnerabilities in AI object detection

Abstract

Latency attacks against object detection represent a variant of adversarial attacks that aim to inflate the inference time by generating additional ghost objects in a target image. However, generating ghost objects in the black-box scenario remains a challenge since information about these unqualified objects remains opaque. In this study, we demonstrate the feasibility of generating ghost objects in adversarial examples by extending the concept of "steal now, decrypt later" attacks. These adversarial examples, once produced, can be employed to exploit potential vulnerabilities in the AI service, giving rise to significant security concerns. The experimental results demonstrate that the proposed attack achieves successful attacks across various commonly used models and Google Vision API without any prior knowledge about the target model. Additionally, the average cost of each attack is less than \$ 1 dollars, posing a significant threat to AI security.