论文标题
捍卫对象探测器免受分布外平滑的补丁攻击
Defending Object Detectors against Patch Attacks with Out-of-Distribution Smoothing
论文作者
论文摘要
针对对象探测器的补丁攻击由于其物理上可实现并且与实用系统更加紧密而引起了人们的关注。为了应对这种威胁，已经提出了许多新的防御措施，以训练补丁分段模型，以检测和删除图像传递给下游模型。我们通过灵活的框架（oodsmoother）统一了这些方法，该框架表征了旨在去除对抗斑块的方法的属性。该框架自然会引导我们进行设计1）一种新颖的自适应攻击，它打破了对象探测器上现有的补丁攻击防御措施，以及2）一种利用语义先验的新型防御方法Semprior。 Semprior背后的我们的主要见解是，现有的基于机器学习的补丁检测器难以学习语义先验，并且明确合并它们可以提高性能。我们发现，仅SEMPRIOR可提供40％的增益，或与现有防御能力相结合时最多可获得60％的增益。
Patch attacks against object detectors have been of recent interest due to their being physically realizable and more closely aligned with practical systems. In response to this threat, many new defenses have been proposed that train a patch segmenter model to detect and remove the patch before the image is passed to the downstream model. We unify these approaches with a flexible framework, OODSmoother, which characterizes the properties of approaches that aim to remove adversarial patches. This framework naturally guides us to design 1) a novel adaptive attack that breaks existing patch attack defenses on object detectors, and 2) a novel defense approach SemPrior that takes advantage of semantic priors. Our key insight behind SemPrior is that the existing machine learning-based patch detectors struggle to learn semantic priors and that explicitly incorporating them can improve performance. We find that SemPrior alone provides up to a 40% gain, or up to a 60% gain when combined with existing defenses.
