Abstract:Patch-based adversarial attacks were proven to compromise the robustness and reliability of computer vision systems. However, their conspicuous and easily detectable nature challenge their practicality in real-world setting. To address this, recent work has proposed using Generative Adversarial Networks (GANs) to generate naturalistic patches that may not attract human attention. However, such approaches suffer from a limited latent space making it challenging to produce a patch that is efficient, stealthy, and robust to multiple real-world transformations. This paper introduces a novel approach that produces a Dynamic Adversarial Patch (DAP) designed to overcome these limitations. DAP maintains a naturalistic appearance while optimizing attack efficiency and robustness to real-world transformations. The approach involves redefining the optimization problem and introducing a novel objective function that incorporates a similarity metric to guide the patch's creation. Unlike GAN-based techniques, the DAP directly modifies pixel values within the patch, providing increased flexibility and adaptability to multiple transformations. Furthermore, most clothing-based physical attacks assume static objects and ignore the possible transformations caused by non-rigid deformation due to changes in a person's pose. To address this limitation, a 'Creases Transformation' (CT) block is introduced, enhancing the patch's resilience to a variety of real-world distortions. Experimental results demonstrate that the proposed approach outperforms state-of-the-art attacks, achieving a success rate of up to 82.28% in the digital world when targeting the YOLOv7 detector and 65% in the physical world when targeting YOLOv3tiny detector deployed in edge-based smart cameras.

Transferable Black-Box Attack against Face Recognition with Spatial Mutable Adversarial Patch

Improving Transferability of Adversarial Patches on Face Recognition with Generative Models

Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition

Adversarial Patch Attacks on Deep-Learning-Based Face Recognition Systems Using Generative Adversarial Networks

EAP: an Effective Black-Box Impersonation Adversarial Patch Attack Method on Face Recognition in the Physical World

Face3DAdv: Exploiting Robust Adversarial 3D Patches on Physical Face Recognition

MakeupAttack: Feature Space Black-box Backdoor Attack on Face Recognition via Makeup Transfer

Generating Transferable and Stealthy Adversarial Patch via Attention-guided Adversarial Inpainting

Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks.

DAP: A Dynamic Adversarial Patch for Evading Person Detectors

Controllable Evaluation and Generation of Physical Adversarial Patch on Face Recognition

NeRFTAP: Enhancing Transferability of Adversarial Patches on Face Recognition Using Neural Radiance Fields

Query-Efficient Decision-based Black-Box Patch Attack

Black-box Attacks on Face Recognition Via Affine-Invariant Training

DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection

Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices

Restricted Black-Box Adversarial Attack Against DeepFake Face Swapping

Toward Transferable Attack via Adversarial Diffusion in Face Recognition

RADAP: A Robust and Adaptive Defense Against Diverse Adversarial Patches on Face Recognition

Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognition