Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling

TL;DR

This paper improves remote adversarial patch attacks on face detectors by introducing tiling and scaling techniques, resulting in more effective obstruction of face detection compared to general object detector attacks.

Contribution

It proposes a novel patch placement method and loss function tailored for face detectors, addressing scale and class characteristic challenges.

Findings

Patch attacks on face detectors are more effective with tiling and scaling.

Proposed methods outperform general object detector patch attacks.

Enhanced attack success in face detection scenarios.

Abstract

This paper discusses the attack feasibility of Remote Adversarial Patch (RAP) targeting face detectors. The RAP that targets face detectors is similar to the RAP that targets general object detectors, but the former has multiple issues in the attack process the latter does not. (1) It is possible to detect objects of various scales. In particular, the area of small objects that are convolved during feature extraction by CNN is small,so the area that affects the inference results is also small. (2) It is a two-class classification, so there is a large gap in characteristics between the classes. This makes it difficult to attack the inference results by directing them to a different class. In this paper, we propose a new patch placement method and loss function for each problem. The patches targeting the proposed face detector showed superior detection obstruct effects compared to the patches targeting the general object detector.