高级检索

    针对自动驾驶系统目标检测器的迁移隐蔽攻击方法

    Towards Transferable and Stealthy Attacks Against Object Detection in Autonomous Driving Systems

    • 摘要: 基于深度学习的目标检测算法已广泛应用,与此同时最近的一系列研究表明现有的目标检测算法容易受到对抗性攻击的威胁,造成检测器失效. 然而,聚焦于自动驾驶场景下对抗攻击的迁移性研究较少,并且鲜有研究关注该场景下对抗攻击的隐蔽性. 针对现有研究的不足,将对抗样本的优化类比于机器学习模型的训练过程,设计了提升攻击迁移性的算法模块. 并且通过风格迁移的方式和神经渲染技术,提出并实现了迁移隐蔽攻击方法(transferable and stealthy attack,TSA). 具体来说,首先将对抗样本进行重复拼接,结合掩膜生成最终纹理,并将其应用于整个车辆表面. 为了模拟真实的环境条件,使用物理变换函数将渲染的伪装车辆嵌入逼真的场景中. 最后,通过设计的损失函数优化对抗样本. 仿真实验表明,TSA方法在攻击迁移能力上超过了现有方法,并在外观上具有一定的隐蔽性. 此外,通过物理域实验进一步证明了TSA方法在现实世界中能够保持有效的攻击性能.

       

      Abstract: Deep learning-based object detection algorithms have been widely applied, while recent research indicates that these algorithms are vulnerable to adversarial attacks, causing detectors to either misidentify or miss the target. Nonetheless, research focusing on the transferability of adversarial attacks in autonomous driving is limited, and few studies address the stealthiness of such attacks in this scenario. To address these limitations in current research, an algorithmic module to enhance attack transferability is designed by drawing an analogy between optimizing adversarial examples and the training process of machine learning models. Additionally, through employing style transfer techniques and neural rendering, a transferable and stealthy attack method (TSA) is proposed and implemented. Specifically, the adversarial examples are first repeatedly stitched together and combined with masks to generate the final texture, which is then applied to the entire vehicle surface. To simulate real-world conditions, a physical transformation function is used to embed the rendered camouflaged vehicle into realistic scenes. Finally, the adversarial examples are optimized using a designed loss function. Simulation experiments demonstrate that the TSA method surpasses existing methods in attack transferability and exhibits a certain level of stealthiness in appearance. Furthermore, physical domain experiments validate that the TSA method maintains effective attack performance in real-world scenarios.

       

    /

    返回文章
    返回