Abstract:In view of the invisibility and robustness of the existing physical attacks, the authors propose the adversarial catoptric light, which uses genetic algorithm to optimise the physical parameters of the catoptric light to perform black‐box physical attacks. To deploy and implement the attack cost less than $5, this makes the method simple and feasible. (2) Extensive experiments are performed to verify the effectiveness, stealthiness and robustness of our method. (3) An in‐depth analysis of the proposed method was conducted and adversarial defence was performed on it, and the experimental results show that adversarial defence can effectively reduce the attack success rate, but cannot achieve thorough defence. Recent studies have demonstrated that finely tuned deep neural networks (DNNs) are susceptible to adversarial attacks. Conventional physical attacks employ stickers as perturbations, achieving robust adversarial effects but compromising stealthiness. Recent innovations utilise light beams, such as lasers and projectors, for perturbation generation, allowing for stealthy physical attacks at the expense of robustness. In pursuit of implementing both stealthy and robust physical attacks, the authors present an adversarial catoptric light (AdvCL). This method leverages the natural phenomenon of catoptric light to generate perturbations that are both natural and stealthy. AdvCL first formalises the physical parameters of catoptric light and then optimises these parameters using a genetic algorithm to derive the most adversarial perturbation. Finally, the perturbations are deployed in the physical scene to execute stealthy and robust attacks. The proposed method is evaluated across three dimensions: effectiveness, stealthiness, and robustness. Quantitative results obtained in simulated environments demonstrate the efficacy of the proposed method, achieving an attack success rate of 83.5%, surpassing the baseline. The authors utilise common catoptric light as a perturbation to enhance the method's stealthiness, rendering physical samples more natural in appearance. Robustness is affirmed by successfully attacking advanced DNNs with a success rate exceeding 80% in all cases. Additionally, the authors discuss defence strategies against AdvCL and introduce some light‐based physical attacks.

Imperceptible CMOS camera dazzle for adversarial attacks on deep neural networks

Demons Hidden in the Light: Unrestricted Adversarial Illumination Attacks

Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect

Imperceptible Physical Attack against Face Recognition Systems via LED Illumination Modulation

Stealthy and Robust Glitch Injection Attack on Deep Learning Accelerator for Target with Variational Viewpoint.

Adversarial catoptric light: An effective, stealthy and robust physical‐world attack to DNNs

Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity

Adversarial Color Projection: A Projector-Based Physical-World Attack to DNNs

Adversarial Color Film: Effective Physical-World Attack to DNNs

They See Me Rollin': Inherent Vulnerability of the Rolling Shutter in CMOS Image Sensors

Adversarial Attacks Hidden in Plain Sight

Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNs

Adversarial Neon Beam: A Light-Based Physical Attack to DNNs

Light Lies: Optical Adversarial Attack

State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems

Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles

Adversarial Imaging Pipelines

Why Don't You Clean Your Glasses? Perception Attacks with Dynamic Optical Perturbations

Engineering pupil function for optical adversarial attacks

Adversarial Camera Patch: An Effective and Robust Physical-World Attack on Object Detectors