Universal Multi-view Black-box Attack against Object Detectors via Layout Optimization

TL;DR

This paper introduces a universal multi-view black-box attack on object detectors using layout optimization of image stickers on 3D objects, significantly reducing detection accuracy across multiple viewpoints.

Contribution

It proposes a novel layout optimization algorithm for UV textures that enables effective black-box attacks on object detectors from multiple views.

Findings

Detection performance drops by 74.29% on average in multi-view scenarios.

The attack is effective across four common object detectors.

A new evaluation tool based on a photo-realistic simulator is developed.

Abstract

Object detectors have demonstrated vulnerability to adversarial examples crafted by small perturbations that can deceive the object detector. Existing adversarial attacks mainly focus on white-box attacks and are merely valid at a specific viewpoint, while the universal multi-view black-box attack is less explored, limiting their generalization in practice. In this paper, we propose a novel universal multi-view black-box attack against object detectors, which optimizes a universal adversarial UV texture constructed by multiple image stickers for a 3D object via the designed layout optimization algorithm. Specifically, we treat the placement of image stickers on the UV texture as a circle-based layout optimization problem, whose objective is to find the optimal circle layout filled with image stickers so that it can deceive the object detector under the multi-view scenario. To ensure reasonable placement of image stickers, two constraints are elaborately devised. To optimize the layout, we adopt the random search algorithm enhanced by the devised important-aware selection strategy to find the most appropriate image sticker for each circle from the image sticker pools. Extensive experiments conducted on four common object detectors suggested that the detection performance decreases by a large magnitude of 74.29% on average in multi-view scenarios. Additionally, a novel evaluation tool based on the photo-realistic simulator is designed to assess the texture-based attack fairly.