Condition-Invariant Physical Adversarial Attacks via Pixel-Wise Adversarial Learning

Abstract

Research has validated that deep neural networks are vulnerable to a series of methods named adversarial attacks. Such methods greatly impair performance of target networks by manipulating data with perturbations imperceptible to human. However, digital adversarial examples are vulnerable to various physical disturbances, while existing physical attack methods are strictly condition-variant and cannot generate adversarial data maintaining effectiveness with unforeseen disturbances. In this paper, we propose a physical adversarial attack method named Pixel-wise Adversarial Learning in Physical Attacks (P-ALPhA) to generate effective condition-invariant adversarial examples. Each adversarial example is decoupled into two separate clusters of pixels. Pixels in the first cluster are perturbed for adversarial purposes, while pixels in the second cluster are manipulated with a competitive optimization criterion against the adversarial aim. ALPhA enhances aggressiveness of the first cluster of pixels through intra-competition. Moreover, the original benign optimizations on the second cluster of pixels guide stochastic environmental disturbances to have adversarial impacts on the data. Experimental results show that P-ALPhA greatly enhances effectiveness of digital adversarial examples in establishments or simulations of multiple physical conditions. Success of P-ALPhA increases hazardness of adversarial attacks in physical applications of neural networks.