Abstract:Transferable adversarial attack is always in the spotlight since deep learning models have been demonstrated to be vulnerable to adversarial samples. However, existing physical attack methods do not pay enough attention on transferability to unseen models, thus leading to the poor performance of black-box <a class="link-external link-http" href="http://attack.In" rel="external noopener nofollow">this http URL</a> this paper, we put forward a novel method of generating physically realizable adversarial camouflage to achieve transferable attack against detection models. More specifically, we first introduce multi-scale attention maps based on detection models to capture features of objects with various resolutions. Meanwhile, we adopt a sequence of composite transformations to obtain the averaged attention maps, which could curb model-specific noise in the attention and thus further boost transferability. Unlike the general visualization interpretation methods where model attention should be put on the foreground object as much as possible, we carry out attack on separable attention from the opposite perspective, i.e. suppressing attention of the foreground and enhancing that of the background. Consequently, transferable adversarial camouflage could be yielded efficiently with our novel attention-based loss function. Extensive comparison experiments verify the superiority of our method to state-of-the-art methods.

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is the poor transferability of existing physical attack methods in black - box attacks. Specifically, existing physical attack methods often do not pay enough attention to the transferability to unknown models, which leads to poor performance in black - box attack scenarios. To overcome this limitation, the author proposes a new method for generating physically realizable adversarial camouflage to achieve transferable attacks against detection models. ### Main contributions of the paper: 1. **Separate Attention Attack (ASA)**: For the first time, a separate attention attack method based on a new attention loss function is proposed. This method consists of two modules: a foreground attention suppression module and a background attention amplification module. 2. **Multi - scale attention maps**: Multi - scale attention maps are developed based on the detection model to capture object features at different resolutions. By smoothing these maps through a series of composite transformations, model - specific noise can be reduced and transferability can be further improved. 3. **Experimental verification**: The experimental results show that the proposed method is superior to other state - of - the - art methods in terms of black - box transferability. ### Method overview: - **Preliminary processing**: Use the differentiable renderer provided by Pytorch3D to generate 2D images containing foreground objects and a pure white background. Obtain the object mask by setting the background pixel value to zero and the foreground pixel value to one. - **Multi - scale attention map generation**: Inspired by Grad - CAM, a low - noise attention generation method suitable for detection models is proposed. By linearly combining the activation maps and the corresponding weights, a rough attention map is generated, and these maps are aligned by inverse transformation, and finally an average attention map is obtained. - **Separate attention attack**: Different from the traditional overall attention attack, this method suppresses foreground attention and enhances background attention respectively. The loss function consists of a foreground attention suppression loss and a background attention amplification loss. - **Optimization algorithm**: Combine the separate attention loss, the smoothing loss and the non - printability score to optimize the adversarial texture and generate a physical adversarial pattern with high naturalness and transferability. ### Experimental results: - **Comparative experiments**: Compared with several existing advanced methods (such as DAS, FCA and ATA), the proposed method shows significant advantages in transferability from white - box models to black - box models. - **Ablation experiments**: By adjusting the hyperparameters and analyzing the influence of different attention loss terms, the effectiveness of the method is verified. In conclusion, this paper effectively improves the transferability of physical adversarial attacks in black - box scenarios by introducing separate attention attacks and multi - scale attention maps, providing new ideas for physical adversarial attacks in practical applications.

Transferable Physical Attack against Object Detection with Separable Attention

Generate Transferable Adversarial Physical Camouflages via Triplet Attention Suppression

Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World

Universal Physical Camouflage Attacks on Object Detectors

Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion

Full-coverage Invisible Camouflage for Adversarial Targeted Attack

DTA: Physical Camouflage Attacks using Differentiable Transformation Network

Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors.

Object-Aware Transfer-Based Black-Box Adversarial Attack on Object Detector.

Evading Defenses to Transferable Adversarial Examples by Mitigating Attention Shift

A Transferable Adversarial Attack Against Object Detection Networks

Learning Coated Adversarial Camouflages for Object Detectors

Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical World

Push & Pull: Transferable Adversarial Examples With Attentive Attack

Pattern Corruption-Assisted Physical Attacks Against Object Detection in UAV Remote Sensing

Transferable Adversarial Attacks for Image and Video Object Detection

Misleading attention and classification: An adversarial attack to fool object detection models in the real world

Unified Adversarial Patch for Cross-modal Attacks in the Physical World

Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectors

Camouflaged Adversarial Patch Attack on Object Detector

FCA: Learning a 3D Full-Coverage Vehicle Camouflage for Multi-View Physical Adversarial Attack