G-UAP: Generic Universal Adversarial Perturbation that Fools RPN-based Detectors

Xing Wu, Lifeng Huang, Chengying Gao
Proceedings of The Eleventh Asian Conference on Machine Learning, PMLR 101:1204-1217, 2019.

Abstract

Adversarial perturbation constructions have been demonstrated for object detection, but these are image-specific perturbations. Recent works have shown the existence of image-agnostic perturbations called universal adversarial perturbation (UAP) that can fool the classifiers over a set of natural images. In this paper, we extend this kind perturbation to attack deep proposal-based object detectors. We present a novel and effective approach called G-UAP to craft universal adversarial perturbations, which can explicitly degrade the detection accuracy of a detector on a wide range of image samples. Our method directly misleads the Region Proposal Network (RPN) of the detectors into mistaking foreground (objects) for background without specifying an adversarial label for each target (RPN’s proposal), and even without considering that how many objects and object-like targets are in the image. The experimental results over three state-of-the-art detectors and two datasets demonstrate the effectiveness of the proposed method and transferability of the universal perturbations.

Cite this Paper

BibTeX
@InProceedings{pmlr-v101-wu19a, title = {G-UAP: Generic Universal Adversarial Perturbation that Fools RPN-based Detectors}, author = {Wu, Xing and Huang, Lifeng and Gao, Chengying}, booktitle = {Proceedings of The Eleventh Asian Conference on Machine Learning}, pages = {1204--1217}, year = {2019}, editor = {Lee, Wee Sun and Suzuki, Taiji}, volume = {101}, series = {Proceedings of Machine Learning Research}, month = {17--19 Nov}, publisher = {PMLR}, pdf = {http://proceedings.mlr.press/v101/wu19a/wu19a.pdf}, url = {https://proceedings.mlr.press/v101/wu19a.html}, abstract = {Adversarial perturbation constructions have been demonstrated for object detection, but these are image-specific perturbations. Recent works have shown the existence of image-agnostic perturbations called universal adversarial perturbation (UAP) that can fool the classifiers over a set of natural images. In this paper, we extend this kind perturbation to attack deep proposal-based object detectors. We present a novel and effective approach called G-UAP to craft universal adversarial perturbations, which can explicitly degrade the detection accuracy of a detector on a wide range of image samples. Our method directly misleads the Region Proposal Network (RPN) of the detectors into mistaking foreground (objects) for background without specifying an adversarial label for each target (RPN’s proposal), and even without considering that how many objects and object-like targets are in the image. The experimental results over three state-of-the-art detectors and two datasets demonstrate the effectiveness of the proposed method and transferability of the universal perturbations.} }
Endnote
%0 Conference Paper %T G-UAP: Generic Universal Adversarial Perturbation that Fools RPN-based Detectors %A Xing Wu %A Lifeng Huang %A Chengying Gao %B Proceedings of The Eleventh Asian Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2019 %E Wee Sun Lee %E Taiji Suzuki %F pmlr-v101-wu19a %I PMLR %P 1204--1217 %U https://proceedings.mlr.press/v101/wu19a.html %V 101 %X Adversarial perturbation constructions have been demonstrated for object detection, but these are image-specific perturbations. Recent works have shown the existence of image-agnostic perturbations called universal adversarial perturbation (UAP) that can fool the classifiers over a set of natural images. In this paper, we extend this kind perturbation to attack deep proposal-based object detectors. We present a novel and effective approach called G-UAP to craft universal adversarial perturbations, which can explicitly degrade the detection accuracy of a detector on a wide range of image samples. Our method directly misleads the Region Proposal Network (RPN) of the detectors into mistaking foreground (objects) for background without specifying an adversarial label for each target (RPN’s proposal), and even without considering that how many objects and object-like targets are in the image. The experimental results over three state-of-the-art detectors and two datasets demonstrate the effectiveness of the proposed method and transferability of the universal perturbations.
APA
Wu, X., Huang, L. & Gao, C.. (2019). G-UAP: Generic Universal Adversarial Perturbation that Fools RPN-based Detectors. Proceedings of The Eleventh Asian Conference on Machine Learning, in Proceedings of Machine Learning Research 101:1204-1217 Available from https://proceedings.mlr.press/v101/wu19a.html.

Related Material