Abstract:Deep learning has shown superiority in dealing with complicated and professional tasks (e.g., computer vision, audio, and language processing). However, research works have confirmed that Deep Neural Networks (DNNs) are vulnerable to carefully crafted adversarial perturbations, which cause DNNs confusion on specific tasks. In object detection domain, the background has little contributions to object classification, and the crafted adversarial perturbations added to the background do not improve the adversary effect in fooling deep neural detection models yet induce substantial distortions in generated examples. Based on such situation, we introduce an adversarial attack algorithm named Adaptive Object-oriented Adversarial Method (AO 2 AM). It aims to fool deep neural object detection networks with the adversarial examples by applying the adaptive cumulation of object-based gradients and adding the adaptive object-based adversarial perturbations merely onto objects rather than the whole frame of input images. AO 2 AM can effectively make the representations of generated adversarial samples close to the decision boundary in the latent space, and force deep neural detection networks to yield inaccurate locations and false classification in the process of object detection. Compared with existing adversarial attack methods which generate adversarial perturbations acting on the global scale of the original inputs, the adversarial examples produced by AO 2 AM can effectively fool deep neural object detection networks and maintain a high structural similarity with corresponding clean inputs. Performing adversarial attacks on Faster R-CNN, AO 2 AM gains attack success rate (ASR) over 98.00% on pre-processed Pascal VOC 2007&2012 (Val), and reaches SSIM over 0.870. In Fooling SSD, AO 2 AM receives SSIM exceeding 0.980 on L 2 norm constraint. On SSIM and Mean Attack Ratio, AO 2 AM outperforms adversarial attack methods based on global scale perturbations.

FoolChecker: A platform to evaluate the robustness of images against adversarial attacks

Fooling Neural Network Interpretations - Adversarial Noise to Attack Images.

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks

GreedyFool: Multi-factor imperceptibility and its application to designing a black-box adversarial attack

Revisiting DeepFool: generalization and improvement

Patch-Wise Attack for Fooling Deep Neural Network

FineFool: A novel DNN object contour attack on image recognition based on the attention perturbation adversarial technique

Tailoring Adversarial Attacks on Deep Neural Networks for Targeted Class Manipulation Using DeepFool Algorithm

AdvFoolGen: Creating Persistent Troubles for Deep Classifiers

Fooling Examples: Another Intriguing Property of Neural Networks

GreedyFool: Distortion-Aware Sparse Adversarial Attack

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Detecting and Mitigating Adversarial Perturbations for Robust Face Recognition

Fooling deep neural detection networks with adaptive object-oriented adversarial perturbation

Attacking Adversarial Attacks as A Defense

Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices

Trustworthy adaptive adversarial perturbations in social networks

Adversarial Attacks Hidden in Plain Sight

Benchmarking Adversarial Robustness on Image Classification