Abstract:Adversarial Examples (AEs) can deceive Deep Neural Networks (DNNs) and have received a lot of attention recently. However, majority of the research on AEs is in the digital domain and the adversarial patches are static, which is very different from many real-world DNN applications such as Traffic Sign Recognition (TSR) systems in autonomous vehicles. In TSR systems, object detectors use DNNs to process streaming video in real time. From the view of object detectors, the traffic sign`s position and quality of the video are continuously changing, rendering the digital AEs ineffective in the physical world. In this paper, we propose a systematic pipeline to generate robust physical AEs against real-world object detectors. Robustness is achieved in three ways. First, we simulate the in-vehicle cameras by extending the distribution of image transformations with the blur transformation and the resolution transformation. Second, we design the single and multiple bounding boxes filters to improve the efficiency of the perturbation training. Third, we consider four representative attack vectors, namely Hiding Attack, Appearance Attack, Non-Target Attack and Target Attack. We perform a comprehensive set of experiments under a variety of environmental conditions, and considering illuminations in sunny and cloudy weather as well as at night. The experimental results show that the physical AEs generated from our pipeline are effective and robust when attacking the YOLO v5 based TSR system. The attacks have good transferability and can deceive other state-of-the-art object detectors. We launched HA and NTA on a brand-new 2021 model vehicle. Both attacks are successful in fooling the TSR system, which could be a life-threatening case for autonomous vehicles. Finally, we discuss three defense mechanisms based on image preprocessing, AEs detection, and model enhancing.

TAE‐RWP: Traceable Adversarial Examples With Recoverable Warping Perturbation

RAE-TPE: A Reversible Adversarial Example Generation Method Based on Thumbnail Preserving Encryption

Unauthorized AI Cannot Recognize Me: Reversible Adversarial Example

Unauthorized AI cannot recognize me

RAE-VWP: A Reversible Adversarial Example-Based Privacy and Copyright Protection Method of Medical Images for Internet of Medical Things

Reversible Adversarial Attack Based on Reversible Image Transformation

Exploiting the Sensitivity of $L_2$ Adversarial Examples to Erase-and-Restore

Poster: Detecting Adversarial Examples Hidden under Watermark Perturbation via Usable Information Theory

WBA: A Warping-based Approach to Generating Imperceptible Adversarial Examples

Reversible Adversarial Examples with Beam Search Attack and Grayscale Invariance

RAEDiff: Denoising Diffusion Probabilistic Models Based Reversible Adversarial Examples Self-Generation and Self-Recovery

Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature

HRAE: Hardware-assisted Randomization Against Adversarial Example Attacks

Enhancing Adversarial Transferability with Adversarial Weight Tuning

Weighted Adaptive Perturbations Adversarial Training for Improving Robustness

Dual Protection for Image Privacy and Copyright Via Traceable Adversarial Examples

Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems

Energy-Based Adversarial Example Detection for SAR Images

Adv-watermark: A Novel Watermark Perturbation for Adversarial Examples.

Generating Traceable Adversarial Text Examples by Watermarking in the Semantic Space

Enhancing targeted transferability via feature space fine-tuning