Relevance attack on detectors. (April 2022)

• Record Type: Journal Article
• Authors: Chen, Sizhe; He, Fan; Huang, Xiaolin; Zhang, Kun
• Is Part Of: Pattern recognition. Volume 124(2022)
• Publication Date: 2022-04
• Subjects: Adversarial attack -- Attack transferability -- Black-box attack -- Relevance map -- Interpreters -- Object detection; Pattern perception -- Periodicals; Perception des structures -- Périodiques; Patroonherkenning; 006.4
• DOI: 10.1016/j.patcog.2021.108491
• Languages: English
• ISSNs: 0031-3203

Abstract

Highlights: We propose a novel Relevance Attack on Detectors (RAD). We extend DNN interpreters to detectors, find out the most suitable nodes to attack by relevance maps, and explore the best update techniques to increase the transferability. We evaluate RAD on 8 black-box models and find its state-of-the-art transferability, which exceeds existing results by above 20%. Detection and segmentation performance is greatly impaired in various metrics, invalidating the state-of-the-art DNN to a very rudimentary counterpart. By RAD, we create the first adversarial dataset for object detection and instance segmentation, i.e., AOCO. As a potential benchmark, AOCO is generated from COCO and contains 10K high-transferable samples. AOCO helps to quickly evaluate and improve the robustness of detectors. Abstract: This paper focuses on high-transferable adversarial attacks on detectors, which are hard to attack in a black-box manner, because of their multiple-output characteristics and the diversity across architectures. To pursue a high attack transferability, one plausible way is to find a common property across detectors, which facilitates the discovery of common weaknesses. We are the first to suggest that the relevance map from interpreters for detectors is such a property. Based on it, we design a Relevance Attack on Detectors (RAD), which achieves a state-of-the-art transferability, exceeding existing results by above 20%. On MS COCO, the detection mAPs for all 8 black-box architectures are more than halved and the segmentation mAPs are also significantly influenced. Given the great transferability of RAD, we generate the first adversarial dataset for object detection and instance segmentation, i.e., Adversarial Objects in COntext (AOCO), which helps to quickly evaluate and improve the robustness of detectors.