Abstract:With the trend of adversarial attacks, researchers attempt to fool trained object detectors in 2D scenes. Among many of them, an intriguing new form of attack with potential real-world usage is to append adversarial patches (e.g. logos) to images. Nevertheless, much less have we known about adversarial attacks from 3D rendering views, which is essential for the attack to be persistently strong in the physical world. This paper presents a new 3D adversarial logo attack: we construct an arbitrary shape logo from a 2D texture image and map this image into a 3D adversarial logo via a texture mapping called logo transformation. The resulting 3D adversarial logo is then viewed as an adversarial texture enabling easy manipulation of its shape and position. This greatly extends the versatility of adversarial training for computer graphics synthesized imagery. Contrary to the traditional adversarial patch, this new form of attack is mapped into the 3D object world and back-propagates to the 2D image domain through differentiable rendering. In addition, and unlike existing adversarial patches, our new 3D adversarial logo is shown to fool state-of-the-art deep object detectors robustly under model rotations, leading to one step further for realistic attacks in the physical world. Our codes are available at <a class="link-external link-https" href="https://github.com/TAMU-VITA/3D_Adversarial_Logo" rel="external noopener nofollow">this https URL</a>.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to generate 3D adversarial logos in a three - dimensional environment to continuously deceive deep - learning object detectors. Specifically, researchers try to attach adversarial logos of specific shapes to 3D human models and render them into 2D images, so that the target detectors can effectively fail to recognize the human body from different perspectives. This challenge involves several key points: 1. **Extension from 2D to 3D**: Existing adversarial attacks mainly focus on 2D images, but these attacks are often not robust enough when facing 3D view transformations. The method proposed in the paper aims to overcome this limitation and enhance the robustness of attacks by constructing 3D adversarial logos. 2. **Robustness under multiple perspectives**: Traditional 2D adversarial patches are prone to failure under different perspectives. The goal of the paper is to generate a 3D adversarial logo that can maintain its deceptiveness even when the model rotates or the human pose changes. 3. **Generality**: Researchers hope that the generated 3D adversarial logo can be applicable to different 3D human models, rather than being effective only for a specific model. To achieve the above goals, the paper proposes a framework that includes the following steps: - **Logo transformation**: Map a 2D texture image of any shape (referred to as "logo") onto a 3D surface to form a 3D adversarial logo. - **Differentiable rendering**: Use a differentiable renderer to render the 3D model and its adversarial logo into 2D images for adversarial training. - **Loss function design**: Optimize the 3D adversarial logo by designing disappearance loss and total variance loss so that it can effectively deceive object detectors from different perspectives. Through these methods, the paper demonstrates the robustness and effectiveness of its 3D adversarial logo under multiple perspectives, providing new ideas for further research on adversarial attacks in the physical world.

Can 3D Adversarial Logos Cloak Humans?

Generating 3D Adversarial Point Clouds under the Principle of LiDARs

AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Models

Query-Efficient Video Adversarial Attack with Stylized Logo

Learning Transferable 3D Adversarial Cloaks for Deep Trained Detectors

LogoStyleFool: Vitiating Video Recognition Systems via Logo Style Transfer

Physical Adversarial Attack Scheme on Object Detectors using 3D Adversarial Object

Adversarial Texture for Fooling Person Detectors in the Physical World

Face3DAdv: Exploiting Robust Adversarial 3D Patches on Physical Face Recognition

Physical Adversarial Attacks Against Aerial Object Detection With Feature-Aligned Expandable Textures

Physical-World Optical Adversarial Attacks on 3D Face Recognition

Building Towards "Invisible Cloak": Robust Physical Adversarial Attack on YOLO Object Detector

Advertisement Logo Compositing via Adversarial Geometric Consistency Pursuit

Towards Transferable Targeted 3D Adversarial Attack in the Physical World

Local Aggressive Adversarial Attacks on 3D Point Cloud

Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds

Learning Coated Adversarial Camouflages for Object Detectors

AdvART: Adversarial Art for Camouflaged Object Detection Attacks

Adversarial Attacks Hidden in Plain Sight

Optical Adversarial Attack

Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modeling