论文标题
针对道路标志识别中深度学习模型的有针对性的物理世界注意力攻击
Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition
论文作者
论文摘要
现实世界的交通标志识别是迈向建造自动驾驶汽车的重要一步，其中大多数高度依赖于深度神经网络（DNNS）。最近的研究表明，DNN非常容易受到对抗例子的影响。已经提出了许多攻击方法来理解和生成对抗性示例，例如基于梯度的攻击，基于得分的攻击，基于决策的攻击和基于转移的攻击。但是，这些算法中的大多数在现实世界的道路标志攻击中都是无效的，因为（1）对于快速移动的汽车而言，对每帧的迭代学习扰动是不现实的，并且（2）最优化的算法在没有考虑其多样化的贡献的情况下平等地遍历了所有像素。为了减轻这些问题，本文提出了针对现实世界道路攻击的目标注意力攻击方法（TAA）方法。 Specifically, we have made the following contributions: (1) we leverage the soft attention map to highlight those important pixels and skip those zero-contributed areas - this also helps to generate natural perturbations, (2) we design an efficient universal attack that optimizes a single perturbation/noise based on a set of training images under the guidance of the pre-trained attention map, (3) we design a simple objective function that can be easily optimized, (4) we evaluate the TAA对现实世界数据集的有效性。实验结果验证了TAA方法可提高攻击率（接近10％），并减少了与流行的RP2方法相比，扰动损失（约四分之一）。此外，我们的TAA还提供了良好的特性，例如可传递性和概括能力。我们提供代码和数据以确保可重复性：https：//github.com/advattack/roadsignattack。
Real world traffic sign recognition is an important step towards building autonomous vehicles, most of which highly dependent on Deep Neural Networks (DNNs). Recent studies demonstrated that DNNs are surprisingly susceptible to adversarial examples. Many attack methods have been proposed to understand and generate adversarial examples, such as gradient based attack, score based attack, decision based attack, and transfer based attacks. However, most of these algorithms are ineffective in real-world road sign attack, because (1) iteratively learning perturbations for each frame is not realistic for a fast moving car and (2) most optimization algorithms traverse all pixels equally without considering their diverse contribution. To alleviate these problems, this paper proposes the targeted attention attack (TAA) method for real world road sign attack. Specifically, we have made the following contributions: (1) we leverage the soft attention map to highlight those important pixels and skip those zero-contributed areas - this also helps to generate natural perturbations, (2) we design an efficient universal attack that optimizes a single perturbation/noise based on a set of training images under the guidance of the pre-trained attention map, (3) we design a simple objective function that can be easily optimized, (4) we evaluate the effectiveness of TAA on real world data sets. Experimental results validate that the TAA method improves the attack successful rate (nearly 10%) and reduces the perturbation loss (about a quarter) compared with the popular RP2 method. Additionally, our TAA also provides good properties, e.g., transferability and generalization capability. We provide code and data to ensure the reproducibility: https://github.com/AdvAttack/RoadSignAttack.
