Texture- and Shape-based Adversarial Attacks for Vehicle Detection in Synthetic Overhead Imagery

2024-12-20

arXiv.org

AI Summary

Aerial vehicle detection is vulnerable to adversarial attacks (AAs), yet existing methods neglect physical realizability, limiting practical deployment. Method: We propose a robust adversarial attack method jointly constraining texture and shape, the first to systematically incorporate imaging and manufacturing constraints—namely pixelation, masking, limited color palettes, and controllable shape deformation—to model the trade-off between physical feasibility and attack effectiveness. Leveraging mainstream detectors (e.g., YOLO), our approach integrates constrained optimization, texture synthesis, and deformation modeling to generate printable, deployable adversarial perturbations. Contributions/Results: Extensive evaluation across three detector architectures demonstrates consistently high attack success rates alongside significantly improved physical implementability. We also release the first synthetic aerial vehicle dataset featuring fine-grained annotations. Both code and dataset will be made publicly available.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web
• Search and Retrieval-Augmented AI: Ad search and search for Web retail

Abstract

Detecting vehicles in aerial images can be very challenging due to complex backgrounds, small resolution, shadows, and occlusions. Despite the effectiveness of SOTA detectors such as YOLO, they remain vulnerable to adversarial attacks (AAs), compromising their reliability. Traditional AA strategies often overlook the practical constraints of physical implementation, focusing solely on attack performance. Our work addresses this issue by proposing practical implementation constraints for AA in texture and/or shape. These constraints include pixelation, masking, limiting the color palette of the textures, and constraining the shape modifications. We evaluated the proposed constraints through extensive experiments using three widely used object detector architectures, and compared them to previous works. The results demonstrate the effectiveness of our solutions and reveal a trade-off between practicality and performance. Additionally, we introduce a labeled dataset of overhead images featuring vehicles of various categories. We will make the code/dataset public upon paper acceptance.

Problem

• Adversarial attacks on aerial vehicle detection models
• Impact of texture and shape modifications on attack performance
• Balancing attack practicality with effectiveness trade-offs

Innovation

• Texture-based adversarial attacks with practical constraints
• Shape modification analysis for attack performance impact
• Performance-practicality trade-off evaluation across detector architectures