Abstract:Local feature extractors are the cornerstone of many computer vision tasks. However, their vulnerability to adversarial attacks can significantly compromise their effectiveness. This paper discusses approaches to attack sophisticated local feature extraction algorithms and models to achieve two distinct goals: (1) forcing a match between originally non-matching image regions, and (2) preventing a match between originally matching regions. At the end of the paper, we discuss the performance and drawbacks of different patch generation methods.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: **The vulnerability of local feature extractors to adversarial attacks in computer vision tasks**. Specifically, the author focuses on how to generate adversarial patches to cause local feature extractors to produce mismatches or prevent correct matches when processing 3D images, thus affecting their effectiveness. ### Specific description of the problem: 1. **Forcing originally non - matching image regions to match**: - By placing specific adversarial patches in the image, two originally dissimilar regions are wrongly recognized as similar. 2. **Preventing originally matching image regions from matching**: - By placing adversarial patches, two originally similar regions are no longer correctly recognized as similar. ### Background and motivation: - **Importance of local feature extractors**: Local feature extractors are the core components of many computer vision tasks. For example, self - driving cars rely on accurate feature extraction for safe navigation. - **Risks of adversarial attacks**: If these powerful models are sensitive to small perturbations in the input data, it may lead to serious misjudgments, especially in critical application scenarios (such as self - driving). ### Research methods: - **Adversarial patch generation**: The author uses multiple methods to generate adversarial patches, including hand - designed based on checkerboard patterns, adversarial patch generation based on gradient ascent (such as FGSM and PGD), and optimization methods combined with checkerboard pattern initialization. - **Mask generation**: Determine the position and shape of the adversarial patch applied to the image to ensure that the patch can effectively interfere with feature matching from different perspectives. - **Experimental evaluation**: Use the HPatches dataset to evaluate the performance of the generated adversarial patches in different scenarios, including masks of different sizes, scale invariance, and cross - model transferability. ### Main contributions: - **First proposed adversarial patch attack against SuperPoint**: Demonstrated how to attack the well - known local feature extraction algorithm SuperPoint by synthesizing adversarial patches. - **Revealed the vulnerability of local feature extractors**: Proposed a simple and effective method to attack local feature extractors and pointed out the directions for future research, such as designing stronger attack patterns and defense mechanisms. Through these studies, the author hopes to draw people's attention to the security issues of local feature extractors and promote the further development of related fields.

Adversarial Patch for 3D Local Feature Extractor

An Adversarial Attack Via Feature Contributive Regions

Vulnerability of Feature Extractors in 2D Image-based 3D Object Retrieval

Defending Adversarial Patches via Joint Region Localizing and Inpainting

Adversarial Training against Location-Optimized Adversarial Patches

Face3DAdv: Exploiting Robust Adversarial 3D Patches on Physical Face Recognition

PAD: Patch-Agnostic Defense against Adversarial Patch Attacks

Design and Interpretation of Universal Adversarial Patches in Face Detection

Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detection

Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices

DPG: a model to build feature subspace against adversarial patch attack

Cross-shaped Adversarial Patch Attack

Adversarial patch attacks against aerial imagery object detectors

DPatch: An Adversarial Patch Attack on Object Detectors

Eigenpatches -- Adversarial Patches from Principal Components

Generating Visually Realistic Adversarial Patch

You Cannot Easily Catch Me: A Low-Detectable Adversarial Patch for Object Detectors

D-UAP: Initially Diversified Universal Adversarial Patch Generation Method

Fight Fire with Fire: Combating Adversarial Patch Attacks using Pattern-randomized Defensive Patches

Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks.

PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking