Abstract:Recent studies have shown that deep learning-based classifiers are vulnerable to malicious inputs, i.e., adversarial examples. A practical solution is to construct a perceptible but localized perturbation called patch, making the well-trained models misclassified. However, most existing patch-based adversarial attacks focus on designing patches with localized rectangles, squares, or grids, ignoring the effect of the non-local patch. In this paper, we propose a novel cross-shaped patch attack paradigm (CSPA), a simple yet efficient and effective adversarial attack in Black-box scenarios. Specifically, the cross-shaped patch consists of two line segments intersected and perpendicular to each other at the midpoint. These two line segments are designed to be sufficiently thin and long to reach the four corners of the input image nearly. Thus, the patch has a globalized perturbation capacity while preserving its continuousness. The content and location of cross-shaped patch are then iteratively optimized by a carefully contrived random search-based algorithm to maximize this global property. Comprehensive experiments are conducted on four benchmark datasets against various victim networks. The results show that the proposed CSPA outperforms the existing patch-based attacks regarding both attack success rate and query efficiency by a large margin. Specifically, compared with the baselines, CSPA increases the success rate by up to 20% on ImageNet and reaches 100% on the CIFAR-100 and CIFAR-10 datasets. Meanwhile, CSPA reduces the average number of queries by up to 7 times. Even for the white-box attack scenario, our designed cross-shaped patch can still be applicable, achieving state-of-the-art performance.

Robustness Out of the Box: Compositional Representations Naturally Defend Against Black-Box Patch Attacks

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Adversarial Training against Location-Optimized Adversarial Patches

PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking

Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks.

Improving the Robustness of Object Detection and Classification AI models against Adversarial Patch Attacks

Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detection

PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches

Robustness of 3D Deep Learning in an Adversarial Setting

Minority Reports Defense: Defending Against Adversarial Patches

Cross-shaped Adversarial Patch Attack

Defending Adversarial Patches via Joint Region Localizing and Inpainting

On the Adversarial Robustness of Camera-based 3D Object Detection

PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch

Testing Robustness Against Unforeseen Adversaries

Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks

Shadows Aren't So Dangerous After All: A Fast and Robust Defense Against Shadow-Based Adversarial Attacks

Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples

Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices

Defensive Patches for Robust Recognition in the Physical World

Towards Robustness against Unsuspicious Adversarial Examples