Abstract
In this work, we propose a neural attribution-based attack (NAA) to improve the transferability of adversarial examples, aiming at deceiving object detectors with different backbones or architectures. To measure the neuron attribution (importance) for a CNN layer of detector, we sum the classification scores of all positive proposal boxes to calculate the integrated attention (IA), then get the neuron attribution matrix via element-wise multiplying IA with the feature difference between the clean image be attacked and a black image. Considering that the summation may bias importance values of some neurons, a mask is designed to drop out some neurons. The proposed loss calculated from the rest of neurons is minimized to generated adversarial examples. Since our attack disturbs the upstream feature outputs, it effectively disorders the outputs of downstream tasks, such as box regression and classification, and finally fool the detector. Extensive experiments on PASCAL VOC and COCO dataset demonstrate that our method achieves better transferability compared to the state-of-the-arts.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.770–778 (2016)
Redmon, J., Farhadi, A.: YOLOv3: An incremental improvement. arXiv preprint arXiv:1804.02767 (2018)
Ronneberger, O., Fischer, P., Brox, T.: U-Net: Convolutional networks for biomedical image segmentation. In: Medical Image Computing and Computer-Assisted Intervention–MICCAI 2015, pp. 234–241 (2015)
Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)
Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., Yuille, A.: Adversarial examples for semantic segmentation and object detection. In: Proceedings of the IEEE International Conference on Computer Vision, pp. 1369–1378 (2017)
Liu, X., Yang, H., Liu, Z., Song, L., Li, H., Chen, Y.: DPATCH: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299 (2018)
Waseda, F., Nishikawa, S., Le, T.N., Nguyen, H.H., Echizen, I.: Closer look at the transferability of adversarial examples: how they fool different models differently. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 1360–1368 (2023)
Zhang, C., Benz, P., Karjauv, A., Cho, J.W., Zhang, K., Kweon, I.S.: Investigating top-k white-box and transferable black-box attack. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15085–15094 (2022)
Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204 (2017)
Chow, K.H., Liu, L., Gursoy, M.E., Truex, S., Wei, W., Wu, Y.: TOG: targeted adversarial objectness gradient attacks on real-time object detection systems. arXiv preprint arXiv:2004.04320 (2020)
Liao, Q., Wang, X., Kong, B., Lyu, S., Zhu, B., Yin, Y., Wu, X.: Transferable adversarial examples for anchor free object detection. In: 2021 IEEE International Conference on Multimedia and Expo (ICME), pp. 1–6. (2021)
Huang, H., Chen, Z., Chen, H., Wang, Y., Zhang, K.: T-SEA: transfer-based self-ensemble attack on object detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20514–20523 (2023)
Lu, J., Sibai, H., Fabry, E.: Adversarial examples that fool detectors. arXiv preprint arXiv:1712.02494 (2017)
Li, Y., Tian, D., Chang, M.C., Bian, X., Lyu, S.: Robust adversarial perturbation on deep proposal-based models. arXiv preprint arXiv:1809.05962 (2018)
Zhang, H., Zhou, W., Li, H.: Contextual adversarial attacks for object detection. In: 2020 IEEE International Conference on Multimedia and Expo (ICME), pp. 1–6 (2020)
Wu, X., Huang, L., Gao, C., Lee, W. S., Suzuki, T.: G-UAP: generic universal adversarial perturbation that fools RPN-based detectors. In: ACML, pp. 1204–1217 (2019)
Chen, S.T., Cornelius, C., Martin, J., Chau, D.H.: Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector. In: Machine learning and knowledge discovery in databases: European Conference, ECML PKDD, pp. 52–68 (2019)
Shi, G., Peng, A., Zeng, H.: An enhanced transferable adversarial attack against object detection. In: International Joint Conference on Neural Networks. in press (2023)
Wang, D., Li, C., Wen, S., Han, Q.L., Nepal, S., Zhang, X., Xiang, Y.: Daedalus: breaking non-maximum suppression in object detection via adversarial examples. In: IEEE Trans. Cybern. 52(8), pp.7427–7440 (2021)
Ganeshan, A., BS, V., Babu, R. V.: FDA: feature disruptive attack. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 8069–8079 (2019)
Naseer, M., Khan, S. H., Rahman, S., Porikli, F.: Task-generalizable adversarial attack based on perceptual metric. arXiv preprint arXiv:1811.09020 (2018)
Dhamdhere, K., Sundararajan, M., Yan, Q.: How important is a neuron? arXiv preprint arXiv:1805.12233 (2018)
Zhang, J., Wu, W., Huang, J.T., Huang, Y., Wang, W., Su, Y., Lyu, M.R.: Improving adversarial transferability via neuron attribution-based attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.14993–15002 (2022)
Ren, S., He, K., Girshick, R., Sun, J.: Faster R-CNN: towards real-time object detection with region proposal networks. In: Advances in Neural Information Processing Systems, vol. 28 (2015)
Liu, W., Anguelov, D., Erhan, D., Szegedy, C., Reed, S., Fu, C.Y., Berg, A.C.: SSD: single shot multibox detector. In: ECCV 2016, pp. 21–37 (2016)
Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy, pp. 39–57 (2017)
Athalye, A., Engstrom, L., Ilyas, A., Kwok, K.: Synthesizing robust adversarial examples. In: International Conference on Machine Learning PMLR, pp. 284–293 (2018)
Zhu, X., Lyu, S., Wang, X., Zhao, Q.: TPH-YOLOv5: Improved YOLOv5 based on transformer prediction head for object detection on drone-captured scenarios. In: Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 2778–2788 (2021)
Lin, T., Dollár, P., Girshick, R., He, K., Hariharan, B., Belongie, S.: Feature pyramid networks for object detection. In: IEEE Conference on Computer Vision and Pattern Recognition, pp. 936–944 (2016)
He, K., Gkioxari, G., Dollár, P., Grishick, R.: Mask R-CNN. IEEE Trans. Pattern Anal. Mach. Intell. 42, 386–397 (2017)
Liu, X., Yang, H., Liu, Z., Song, L., Chen, Y., Li, H.H.: DPATCH: an adversarial patch attack on object detectors. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2018)
Hu, Z., Huang, S., Zhu, X., Sun, F., Zhang, B., Hu, X.: Adversarial texture for fooling person detectors in the physical world. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 307–316 (2022)
Acknowledgement
This work was partially supported by NFSC No.62072484, Sichuan Science and Technology Program (No. 2022YFG0321, No. 2022NSFSC0916), the Opening Project of Engineering Research Center of Digital Forensics, Ministry of Education.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Shi, G., Peng, A., Zeng, H., Yu, W. (2024). Neuron Attribution-Based Attacks Fooling Object Detectors. In: Luo, B., Cheng, L., Wu, ZG., Li, H., Li, C. (eds) Neural Information Processing. ICONIP 2023. Communications in Computer and Information Science, vol 1967. Springer, Singapore. https://doi.org/10.1007/978-981-99-8178-6_8
Download citation
DOI: https://doi.org/10.1007/978-981-99-8178-6_8
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-99-8177-9
Online ISBN: 978-981-99-8178-6
eBook Packages: Computer ScienceComputer Science (R0)