针对目标检测中的分类模块的可迁移对抗样本生成方法研究

This study presents an object detection adversarial attack method (DOG) based on the dynamic optimization of a multi-scale feature grid cluster, aimed at addressing the challenges of poor transferability in white-box attacks and long generation cycles in black-box attacks within the current adversarial example generation techniques. The DOG leverages the C&W adversarial example generation framework, DAG model activation value selection, and R-AP object label resetting. It introduces the maximum/minimum dynamic target category biasing, background resetting, and PSNR(Peak Signal-to-Noise Ratio) rollback mechanisms. By constructing a specialized loss function, the algorithm can iteratively generate adversarial noise, enabling the rapid production of adversarial examples with high attack and transfer rates. Experimental results demonstrate that the DOG performs exceptionally well across the three image classification networks and six object detection networks. In white-box conditions, the attack success rate exceeds 97%, whereas in black-box conditions, it reaches over 51%, showing good generality and efficiency. Additionally, ablation experiments were used to analyze the impact of each module on attack effectiveness, providing a theoretical basis and practical guidance for future research. This study offers new ideas and methods for further exploration of adversarial example generation.

Despite the recent advancements in deploying neural networks for image classification, it has been found that adversarial examples are able to fool these models leading them to misclassify the images. Since these models are now being widely deployed, we provide an insight on the threat of these adversarial examples by evaluating their characteristics and transferability to more complex models that utilize Image Classification as a subtask. We demonstrate the ineffectiveness of adversarial examples when applied to Instance Segmentation & Object Detection models. We show that this ineffectiveness arises from the inability of adversarial examples to withstand transformations such as scaling or a change in lighting conditions. Moreover, we show that there exists a small threshold below which the adversarial property is retained while applying these input transformations. Additionally, these attacks demonstrate weak cross-network transferability across neural network architectures, e.g. VGG16 and ResNet50, however, the attack may fool both the networks if passed sequentially through networks during its formation. The lack of scalability and transferability challenges the question of how adversarial images would be effective in the real world.

In this work, we propose an enhanced adversarial attack based on DAG, to improve the transferability of adversarial example to fool CNN-based object detectors. DAG achieves excellent performance under white-box settings via attacking the detection head, but has poor transferability under black-box cases. We jointly attack the feature map of backbone and the detection head to improve the transferability. Because, we think the attack against high-level feature of backbone can transfer to disturb other homogeneous CNN-based backbones. To this end, we optimize the combination of feature loss of backbone and classification loss of region proposals to generate adversarial examples. Extensive experiments on PASCAL VOC and COCO datasets demonstrate that our attack can transfer to attack the detector with different backbone or different pipelines even under defense situations, and has achieved superior transferability than state-of-the-arts.

With the development of deep learning, image and video processing plays an important role in the age of 5G communication. However, deep neural networks are vulnerable: subtle perturbations can lead to incorrect classification results. Nowadays, adversarial attacks on artificial intelligence models have seen increasing interest. In this study, we propose a new method named FA to generate adversarial examples of object detection models. Based on the generative adversarial network (GAN), we combine the classification and location information to make the generated image look as real as possible. Experimental results on the PASCAL VOC dataset show that our method efficiently and quickly generates the image. Then, we test the transferability of adversarial samples on different datasets and object detection models such as YOLOv4, which also achieve certain transfer performance. Our work provides a basis for further exploring the defects of deep learning and improving the robustness of the systems.

Neural networks are known to be vulnerable to carefully crafted adversarial examples, and these malicious samples often transfer, i.e., they remain adversarial even against other models. Although significant effort has been devoted to the transferability across models, surprisingly little attention has been paid to cross-task transferability, which represents the real-world cybercriminal's situation, where an ensemble of different defense/detection mechanisms need to be evaded all at once. We investigate the transferability of adversarial examples across a wide range of real-world computer vision tasks, including image classification, object detection, semantic segmentation, explicit content detection, and text detection. Our proposed attack minimizes the “dispersion” of the internal feature map, overcoming the limitations of existing attacks, that require task-specific loss functions and/or probing a target model. We conduct evaluation on open-source detection and segmentation models, as well as four different computer vision tasks provided by Google Cloud Vision (GCV) APIs. We demonstrate that our approach outperforms existing attacks by degrading performance of multiple CV tasks by a large margin with only modest perturbations.

Neural networks are known to be vulnerable to carefully crafted adversarial examples, and these malicious samples often transfer, i.e., they maintain their effectiveness even against other models. With great efforts delved into the transferability of adversarial examples, surprisingly, less attention has been paid to its impact on real-world deep learning deployment. In this paper, we investigate the transferability of adversarial examples across a wide range of real-world computer vision tasks, including image classification, explicit content detection, optical character recognition (OCR), and object detection. It represents the cybercriminal's situation where an ensemble of different detection mechanisms need to be evaded all at once. We propose practical attack that overcomes existing attacks' limitation of requiring task-specific loss functions by targeting on the `dispersion' of internal feature map. We report evaluation on four different computer vision tasks provided by Google Cloud Vision APIs to show how our approach outperforms existing attacks by degrading performance of multiple CV tasks by a large margin with only modest perturbations.

Abstract Deep neural network is the main research branch in artificial intelligence and suitable for many decision-making fields. Autonomous driving and unmanned vehicle often depend on deep neural networks for accurate and reliable detection, classification, and ranging of surrounding objects in real on-road environments, either locally or by swarm intelligence among distributed nodes via 5G channel. But, it has been demonstrated that deep neural networks are vulnerable to well-designed adversarial examples that are imperceptible to human eyes in computer vision tasks. It is valuable to study the vulnerability for enhancing the robustness of neural networks. However, existing adversarial examples against object detection models are image-dependent, so in this paper, we implement adversarial attacks against object detection models using universal perturbations. We find the cross-task, cross-model, and cross-dataset transferability of universal perturbations, we train universal perturbations generator firstly and then add the universal perturbations to the target images in two ways: resizing and pile-up, in order to solve the problem that universal perturbations cannot be directly applied to attack object detection models. We use the transferability of universal perturbations to attack black-box object detection models. In this way, the time cost of generating adversarial examples is reduced. A series of experiments are conducted on PASCAL VOC and MS COCO datasets demonstrating the feasibility of cross-task attacks and proving the effectiveness of our attack on two representative object detectors: regression-based models like YOLOv3 and proposal-based models like Faster R-CNN.

Transferable adversarial attacks optimize adversaries from a pretrained surrogate model and known label space to fool the unknown black-box models. Therefore, these attacks are restricted by the availability of an effective surrogate model. In this work, we relax this assumption and propose Adversarial Pixel Restoration as a self-supervised alternative to train an effective surrogate model from scratch under the condition of no labels and few data samples. Our training approach is based on a min-max scheme which reduces overfitting via an adversarial objective and thus optimizes for a more generalizable surrogate model. Our proposed attack is complimentary to the adversarial pixel restoration and is independent of any task specific objective as it can be launched in a self-supervised manner. We successfully demonstrate the adversarial transferability of our approach to Vision Transformers as well as Convolutional Neural Networks for the tasks of classification, object detection, and video segmentation. Our training approach improves the transferability of the baseline unsupervised training method by 16.4% on ImageNet val. set. Our codes&pre-trained surrogate models are available at: https://github.com/HashmatShadab/APR

Object detectors based on convolutional neural networks (CNNs) have been widely applied for autonomous driving and industrial defect detection. Recent studies have shown that they are vulnerable to adversarial examples. Existing attack methods rely on the output of the object detector’s detection head to generate adversarial examples, which limits their applicability. Furthermore, optimizing the loss function of the object detector to generate adversarial perturbations can cause the perturbations to overfit to the source object detector, reducing the transferability of adversarial examples. To address these issues, we propose a novel adversarial example generation framework consisting of a spatial-frequency information masking (SFIM) method and two independent attack branches. The SFIM method masks partial spatial and frequency domain information of the augmented examples to generate diverse adversarial examples. The two independent attack branches, one targeting the backbone network and the other targeting the region proposal network (RPN), are fused with the SFIM method. The two attack branches do not rely on the output of the object detector’s detection head and are applicable to different attack scenarios. Extensive experiments on the PASCAL VOC and MS COCO datasets show that the adversarial examples generated by the proposed framework are highly transferable and can effectively attack black-box detectors of different architectures.

Deep neural networks have been demonstrated to be vulnerable to adversarial attacks: subtle perturbations can completely change the classification results. Their vulnerability has led to a surge of research in this direction. However, most works dedicated to attacking anchor-based object detection models. In this work, we aim to present an effective and efficient algorithm to generate adversarial examples to attack anchor-free object models based on two approaches. First, we conduct category-wise instead of instance-wise attacks on the object detectors. Second, we leverage the high-level semantic information to generate the adversarial examples. Surprisingly, the generated adversarial examples it not only able to effectively attack the targeted anchor-free object detector but also to be transferred to attack other object detectors, even anchor-based detectors such as Faster R-CNN.

Adversarial attacks against deep learning-based object detectors (ODs) have been studied extensively in the past few years. These attacks cause the model to make incorrect predictions by placing a patch containing an adversarial pattern on the target object or anywhere within the frame. However, none of prior research proposed a misclassification attack on ODs, in which the patch is applied on the target object. In this study, we propose a novel, universal, targeted, label-switch attack against the state-of-the-art object detector, YOLO. In our attack, we use (i) a tailored projection function to enable the placement of the adversarial patch on multiple target objects in the image ( e.g ., cars), each of which may be located a different distance away from the camera or have a different view angle relative to the camera, and (ii) a unique loss function capable of changing the label of the attacked objects. The proposed universal patch, which is trained in the digital domain, is transferable to the physical domain. We performed an extensive evaluation using different types of object detectors, different video streams captured by different cameras, and various target classes, and evaluated different configurations of the adversarial patch in the physical domain. at:

In practical black-box attack scenarios, most of the existing transfer-based attacks employ pretrained models (e.g. ResNet50) as the substitute models. Unfortunately, these substitute models are not always appropriate for transfer-based attacks. Firstly, these models are usually trained on a largescale annotated dataset, which is extremely expensive and time-consuming to construct. Secondly, the primary goal of these models is to perform a specific task, such as image classification, which is not developed for adversarial attacks. To tackle the above issues, i.e., high cost and over-fitting on taskspecific models, we propose an Affordable and Generalizable Substitute (AGS) training framework tailored for transferbased adversarial attack. Specifically, we train the substitute model from scratch by our proposed adversary-centric constrastive learning. This proposed learning mechanism introduces another sample with slight adversarial perturbations as an additional positive view of the input image, and then encourages the adversarial view and two benign views to interact comprehensively with each other. To further boost the generalizability of the substitute model, we propose adversarial invariant learning to maintain the representations of the adversarial example invariants under augmentations with various strengths. Our AGS model can be trained solely with unlabeled and out-of domain data and avoid overfitting to any task-specific models, because of its inherently self-supervised nature. Extensive experiments demonstrate that our AGS achieves comparable or superior performance compared to substitute models pretrained on the complete ImageNet training set, when executing attacks across a diverse range of target models, including ViTs, robustly trained models, object detection and segmentation models. Our source codes are available at https://github.com/lwmming/AGS.

Deep neural networks are widely used in tasks such as autonomous driving and computer vision. Previous studies have shown that it is susceptible to adversarial attacks, resulting in erroneous outputs. However, adversarial attacks against object detection networks are difficult to implement due to the high complexity of the object detection algorithm itself. We propose a transferable adversarial attack method for object detection networks, and collect a large number of real car images for model training and testing. We design a classification probability loss function based on inter-class probability distribution and an IoU loss function based on the predicted bounding box to train the generation of adversarial perturbations. The perturbation is covered on the hood of the car so that the vehicle can successfully escape the object detection model. At the same time, we place the printed adversarial patch on real-world cars and use methods such as perspective transformation and affine transformation to enhance the robustness of adversarial attacks in various complex physical environments. The experimental results in indoor and outdoor scenes show that the adversarial perturbation jointly trained by the above two loss functions can successfully attack the YOLOv3 detector, reducing the number of cars detected by the detector by 91.2% and 90.7% respectively. The proposed attack method performs well in both the digital and physical domains and can be transferred between different detection models.

The study of LiDAR-based 3D object detection and its robustness under adversarial attacks has achieved great progress. However, existing adversarial attack methods mainly focus on the targeted object, which destroys the integrity of the object and makes the attack easy to perceive. In this work, we propose a novel adversarial attack against deep 3D object detection models named the contextual attribution maps-guided attack (CAMGA). Based on the combinations of subregions in the context area and their impact on the prediction results, contextual attribution maps can be generated. An attribution map exposes the influence of individual subregions in the context area on the detection results and narrows down the scope of the adversarial attack. Subsequently, perturbations are generated under the guidance of a dual loss, which is proposed to suppress the detection results and maintain visual imperception simultaneously. The experimental results proved that the CAMGA method achieved an attack success rate of over 68% on three large-scale datasets and 83% on the KITTI dataset. Meanwhile, the CAMGA has a transfer attack success rate of at least 50% against all four victim detectors, as they all overly rely on contextual information.

3D adversarial attacks have garnered significant attention in the realm of autonomous driving security due to their high feasibility and multi-view effectiveness. However, existing 3D attacks have limited transferability, primarily due to their overfitting to surrogate models. To address this limitation, we introduce a novel 3D adversarial attack method based on implicit texture modeling, termed ImAdv, against 3D object detection models. Specifically, ImAdv utilizes a positional encoder and a MLP to map the 3D coordinates of an object’s surface to the RGB color space, thereby reformulating the object’s texture within an implicit framework. This method significantly reduces the parameter number for color modeling, thus mitigating overfitting and improving transferability. Furthermore, we propose two innovative techniques to enhance the transferability, Random Texture Reset (RandReset) and Texture Model Averaging. RandReset randomly restores portions of the adversarial texture, increasing the training set diversity and mitigating overfitting. Texture Model Averaging employs self-ensembling of multiple texture checkpoints during the training phase to reduce overfitting in the final texture model. Comprehensive experiments demonstrate the superiority of our methods, which outperform previous methods by 17.18% in average black-box attack success rate. Additionally, our method shows strong transferability and practicality in zero-shot cross-task attacks and physical attacks.

Deep neural networks (DNNs) have been widely used in remote sensing but demonstrated to be vulnerable with adversarial examples. By adding elaborately designed perturbations on the clean images, DNNs may output wrong prediction. Research on adversarial attack contributes to the study of model robustness. However, previous methods mainly focus on white-box scenario or digital domain for classification tasks, while the vulnerability of remote sensing detectors has not been fully explored. Aiming at attacking black-box remote sensing detectors in physical domain, we propose to generate a transferable physical adversarial patch (TPAP) as the perturbations. Specifically, the initial patch is optimized by a U-Net and modified by the plane mask and position mask before applied to the clean image. By attacking a surrogate model, TPAP can be transferred to the target model. Abundant experimental results validate the attack ability of TPAP and evaluate the robustness of current one-stage detectors.

With the rapid development of Deep Neural Networks (DNNs), remote sensing image analysis has achieved significant progress in scene classification, object detection, and semantic segmentation. However, the increasing deployment of DNNs in real-world remote sensing applications exposes them to adversarial risks. A critical challenge in this domain is the poor visual stealth of black-box adversarial examples, perturbations are often easily perceived by humans, limiting their practicality. This issue stems from the distribution mismatch between visually salient regions and model-sensitive regions in remote sensing images. The current approaches predominantly focus on improving attack success rates while neglecting such heterogeneity, resulting in redundant and conspicuous perturbations. To address this, we propose a Dual-Region Hierarchical Attack (DRHA) that improves stealth and attack performance by using the different roles of visually salient and model-sensitive regions. Shallow perturbations are applied to salient areas to preserve perceptual similarity, while directional perturbations guided by integrated gradients target high-contribution regions to enhance model deception. Our method leverages superpixel segmentation and attribution analysis to localize perturbation regions precisely. Experiments on the UCM and AID datasets show that DRHA improves average success rates by 10%–32% over baseline methods, while maintaining superior stealth and perturbation sparsity. These results demonstrate the effectiveness of region-aware attack design in constructing imperceptible and transferable adversarial examples for remote sensing tasks.

This study revises previous work by emphasizing the integration of surrogate models into query-based black-box adversarial attacks, showcasing their effectiveness in reducing query counts and enhancing robustness. This observation highlights a critical gap in decision-based (hard label) approaches, which have not yet effectively integrated surrogate models. In this paper, we propose a novel decision-based approach to black-box adversarial attacks. By utilizing intermediate layer features of the surrogate network and optimizing the query feedback process, the proposed method achieves competitive results with a significant reduction in query counts (up to 99.73% lower compared to existing methods). Extensive experiments validate its performance across diverse tasks, including image classification, object detection, and face recognition. This work demonstrates the potential for enhancing the practicality of decision-based attacks in real-world scenarios.

Object detection has been widely used in many safety- critical tasks, such as autonomous driving. However, its vulnerability to adversarial examples has not been sufficiently studied, especially under the practical scenario of black-box attacks, where the attacker can only access the query feedback of predicted bounding-boxes and top- 1 scores returned by the attacked model. Compared with black-box attack to image classification, there are two main challenges in black-box attack to detection. Firstly, even if one bounding-box is successfully attacked, another sub- optimal bounding-box may be detected near the attacked bounding-box. Secondly, there are multiple bounding- boxes, leading to very high attack cost. To address these challenges, we propose a Parallel Rectangle Flip Attack (PRFA) via random search. We explain the difference between our method with other attacks in Fig. 1. Specifically, we generate perturbations in each rectangle patch to avoid sub-optimal detection near the attacked region. Besides, utilizing the observation that adversarial perturbations mainly locate around objects’ contours and critical points under white-box attacks, the search space of attacked rectangles is reduced to improve the attack efficiency. Moreover, we develop a parallel mechanism of attacking multiple rectangles simultaneously to further accelerate the attack process. Extensive experiments demonstrate that our method can effectively and efficiently attack various popular object detectors, including anchor-based and anchor- free, and generate transferable adversarial examples.

It is well known that query-based attacks tend to have relatively higher success rates in adversarial black-box attacks. While research on black-box attacks is actively being conducted, relatively few studies have focused on pixel attacks that target only a limited number of pixels. In image classification, query-based pixel attacks often rely on patches, which heavily depend on randomness and neglect the fact that scattered pixels are more suitable for adversarial attacks. Moreover, to the best of our knowledge, query-based pixel attacks have not been explored in the field of object detection. To address these issues, we propose a novel pixel-based black-box attack called Remember and Forget Pixel Attack using Reinforcement Learning(RFPAR), consisting of two main components: the Remember and Forget processes. RFPAR mitigates randomness and avoids patch dependency by leveraging rewards generated through a one-step RL algorithm to perturb pixels. RFPAR effectively creates perturbed images that minimize the confidence scores while adhering to limited pixel constraints. Furthermore, we advance our proposed attack beyond image classification to object detection, where RFPAR reduces the confidence scores of detected objects to avoid detection. Experiments on the ImageNet-1K dataset for classification show that RFPAR outperformed state-of-the-art query-based pixel attacks. For object detection, using the MSCOCO dataset with YOLOv8 and DDQ, RFPAR demonstrates comparable mAP reduction to state-of-the-art query-based attack while requiring fewer query. Further experiments on the Argoverse dataset using YOLOv8 confirm that RFPAR effectively removed objects on a larger scale dataset. Our code is available at https://github.com/KAU-QuantumAILab/RFPAR.

No abstract available

Deep learning models excel in various applications but remain vulnerable to adversarial attacks. Previous adversarial attacks focused on the vulnerability of direct content understanding tasks such as classification and object detection. Implicit interactions play a vital role in intelligent tasks. However, limited attention has been paid to implicit interaction understanding, such as relationships and behaviours. This paper addresses this gap by investigating the vulnerability of implicit interaction understanding in the context of adversarial attacks. Specifically, we introduce a novel adversarial attack task, Interaction Attack (IA), which aims to interfere with scene interaction understanding without affecting direct instance recognition. This task presents unique challenges: (a) interactions are intrinsically tied to scene objects, making independent exploration difficult, and (b) interactions often lack explicit visual cues, complicating direct optimization processes. We propose a novel adversarial attack framework for implicit interactions, named Hard-label Black-box Adversarial Instance Attack (HB-AIA). HB-AIA comprises three key modules, including an Interaction Area Sampling module identifying vulnerable anchors for adversarial instance positioning, an Object Category Search module exploring surrogate categories with higher obfuscation scores for vulnerable anchors, and an Adversarial Instance Generation module crafting adversarial instances with targeted co-occurrence obfuscation to disrupt specific interactions in vulnerable areas. Furthermore, we establish an adversarial attack benchmark based on the Human-Object Interaction task to estimate the vulnerability of implicit interactions. Experiments demonstrate the effectiveness.

Adversarial attack adds an imperceptible perturbation on images to fool a model. Though existing adversarial attack methods have demonstrated great success in image classification tasks, they suffer inferior attack performances on object detection. We find that there exists multi-target gradient conflict (MGC) between different targets during attack process in object detection. To tackle this issue, we propose an effective pixel-level attack method, namely Selective Consistency Gradient Attack (SCGA). First, we select a dominant gradient direction by gradient ranking. Then, we introduce the gradient conflict rate to select targets with consistent gradients to improve attack efficiency. Finally, the perturbation is generated by gradient merging. Experiments on COCO 2017 validation subset verify the effectiveness of SCGA on both white-box attack and black-box attack, outperforming other methods with a large margin.

Benefiting from the robust feature representation capability of convolutional neural networks (CNNs), the object detection technology of intelligent high-altitude UAV remote sensing has been developed rapidly. In this field, the adversarial examples (AEs) pose serious security risks and vulnerabilities to deep learning-based systems. Due to the limitation of object size, image degradation, and scene brightness, adding adversarial disturbances to small and dense objects is extremely challenging. To study the threat of AE for UAV object detection, a dynamic bi-level integrated attack (DBI-Attack) is proposed for intensive multi-scale UAV object detection. Firstly, we use the dynamic iterative attack (DIA) method to generate perturbation on the classification level by improving the momentum iterative fast gradient sign method (MIM). Secondly, the bi-level adversarial attack method (BAAM) is constructed to add global perturbation on the decision level for completing the white-box attack. Finally, the integrated black-box attack method (IBAM) is combined to realize the black-box mislabeling and fabrication attacks. We experiment on the real drone traffic vehicle detection datasets to better evaluate the attack effectiveness. The experimental results show that the proposed method can achieve mislabeling and fabrication attacks on the UAV object detectors in black-box conditions. Furthermore, the adversarial training is applied to improve the model robustness. This work aims to call more attention to the adversarial and defensive aspects of UAV target detection models.

Deep Neural Networks (DNNs) are vulnerable to the black-box adversarial attack that is highly transferable. This threat comes from the distribution gap between adversarial and clean samples in feature space of the target DNNs. In this paper, we use Deep Generative Networks (DGNs) with a novel training mechanism to eliminate the distribution gap. The trained DGNs align the distribution of adversarial samples with clean ones for the target DNNs by translating pixel values. Different from previous work, we propose a more effective pixel level training constraint to make this achievable, thus enhancing robustness on adversarial samples. Further, a class-aware feature-level constraint is formulated for integrated distribution alignment. Our approach is general and applicable to multiple tasks, including image classification, semantic segmentation, and object detection. We conduct extensive experiments on different datasets. Our strategy demonstrates its unique effectiveness and generality against black-box attacks.

Deep neural networks (DNNs) have been widely used in remote sensing but demonstrated to be sensitive with adversarial examples. By introducing carefully designed perturbations to clean images, DNNs can be led to incorrect predictions. Adversarial patch is commonly used to conduct adversarial attack, where traditional methods optimize its content and position separately, neglecting the coupling relation of two factors. In this paper, we propose a black-box attack framework targeting fine-grained aircraft recognition, named PatchGen, simultaneously optimizing both content and position of physical adversarial patches. For the requirements of physical attack, we further constrain the patch in object region and utilize elaborate criteria to evaluate its naturalness to alleviate the distortion when applying the patch in real world. We comprehensively validate our method in fine-grained aircraft classification, extending to object detection subsequently. Extensive experiments demonstrate that the proposed method achieves superior attack performance efficiently for classification and detection tasks in digital domain. Moreover, we validate the effectiveness of the adversarial patch under diverse circumstances in the physical world and prove that our method can be applied to different models as well as various domains.

Considering the failure of fully exploring the transferability of samples, domain adaptation (DA) is still troubled by the problem of the disturbed distribution of the target domain. In this article, a conditional domain confusion network (CDCN) is proposed, which commits to exploit the minimum class confusion (MCC) to achieve unsupervised cross-domain detection. To utilize the transferability of samples to better respond to domain shift, we first propose a transfer disturbance factor under the guidance of class confusion to constrain the classifier, designed to eliminate the impact of hard-to-transfer samples on the model. Moreover, an adaptive auxiliary component is embedded before the classifier, aiming at improving the generalization performance of the model, which adjusts the intra- and interclass distances of samples by uniting the classification loss to better fit the classifier. Extensive experiments are performed on multiple transfer tasks, which demonstrate the superiority of our proposed CDCN over the state-of-the-art DA strategies.

No abstract available

Identifying adversarial examples is beneficial for understanding deep networks and developing robust models. However, the transferability of existing attacking methods for image object detection is weak. This is mainly due to the different categorizations of object detectors, typically categorized into two-stage and single-stage detection models. Adversarial examples for a specific model type often have a low success rate when attacking other detectors. In this paper a new transferable adversarial example generation method called MLFAdv is proposed. This method applies low-frequency adversarial loss and feature loss to enhance the transferability of adversarial examples. To avoid redundant perturbations to non-critical regions to improve the generation efficiency of adversarial examples, MLFAdv uses the feature weight matrix of Gradient-weighted Class Activation Mapping (Grad-CAM) as a mask on clean images to screen out the task-irrelevant areas and guide the adversarial perturbation to focus on salient regions during generating adversarial examples. The experimental results on Pascal VOC show that the proposed MLFAdv method significantly improves the attack transfer rate compared to general adversarial example generation methods and achieves the best attack effect.

Object detection models have been widely deployed in physical world applications, and they are vulnerable to adversarial attacks. However, most adversarial attacks are implemented in a glass box setting, and under ideal shooting conditions, such as fixed distances and angles, and thus have limited attack success rate (ASR) in practice. In this article, we present a transferable and robust dynamic adversarial attack where the adversarial patches can be printed on or attached to nonrigid objects, such as clothes. We develop a cascade module with a momentum-based technique to optimize adversarial patches against various object detection models, achieving better transferability of the patches in a closed box setting. We also develop a strategy of distance-adaptive patch generation and employ perspective transformation to enhance the robustness of patches. To evaluate the attack performance, we conduct extensive experiments on seven mainstream object detection models at different distances and angles. The results show that our method can achieve an average ASR of 69.85%, which is 3.27 times that of the baseline method at 3 m.

Current Transferable Adversarial Examples (TAE) are primarily generated by adding Adversarial Noise (AN). Recent studies emphasize the importance of optimizing Data Augmentation (DA) parameters along with AN, which poses a greater threat to real-world AI applications. However, existing DA-based strategies often struggle to find optimal solutions due to the challenging DA search procedure without proper guidance. In this work, we propose a novel DA-based attack algorithm, GADT. GADT identifies suitable DA parameters through iterative antagonism and uses posterior estimates to update AN based on these parameters. We uniquely employ a differentiable DA operation library to identify adversarial DA parameters and introduce a new loss function as a metric during DA optimization. This loss term enhances adversarial effects while preserving the original image content, maintaining attack crypticity. Extensive experiments on public datasets with various networks demonstrate that GADT can be integrated with existing transferable attack methods, updating their DA parameters effectively while retaining their AN formulation strategies. Furthermore, GADT can be utilized in other black-box attack scenarios, e.g., query-based attacks, offering a new avenue to enhance attacks on real-world AI applications in both research and industrial contexts.

Transfer attacks generate significant interest for real-world black-box applications by crafting transferable adversarial examples through surrogate models. Whereas, existing works essentially directly optimize the single-level objective w.r.t. the surrogate model, which always leads to poor interpretability of attack mechanism and limited generalization performance over unknown victim models. In this work, we propose the BilEvel Transfer AttacK (BETAK) framework by establishing an initialization derived bilevel optimization paradigm, which explicitly reformulates the nested constraint relationship between the Upper-Level (UL) pseudo-victim attacker and the Lower-Level (LL) surrogate attacker. Algorithmically, we introduce the Hyper Gradient Response (HGR) estimation as an effective feedback for the transferability over pseudo-victim attackers, and propose the Dynamic Sequence Truncation (DST) technique to dynamically adjust the back-propagation path for HGR and reduce computational overhead simultaneously. Meanwhile, we conduct detailed algorithmic analysis and provide convergence guarantee to support non-convexity of the LL surrogate attacker. Extensive evaluations demonstrate substantial improvement of BETAK (e.g., 53.41% increase of attack success rates against IncRes-v2_ens victim) against different victims and defense methods in targeted and untargeted attack scenarios.

Exploring effective and transferable adversarial examples is vital for understanding the characteristics and mechanisms of Vision Transformers (ViTs). However, adversarial examples generated from surrogate models often exhibit weak transferability in black-box settings due to overfitting. Existing methods improve transferability by diversifying perturbation inputs or applying uniform gradient regularization within surrogate models, yet they have not fully leveraged the shared and unique features of surrogate models trained on the same task, leading to suboptimal transfer performance. Therefore, enhancing perturbations of common information shared by surrogate models and suppressing those tied to individual characteristics offers an effective way to improve transferability. Accordingly, we propose a commonality-oriented gradient optimization strategy (COGO) consisting of two components: Commonality Enhancement (CE) and Individuality Suppression (IS). CE perturbs the mid-to-low frequency regions, leveraging the fact that ViTs trained on the same dataset tend to rely more on mid-to-low frequency information for classification. IS employs adaptive thresholds to evaluate the correlation between backpropagated gradients and model individuality, assigning weights to gradients accordingly. Extensive experiments demonstrate that COGO significantly improves the transfer success rates of adversarial attacks, outperforming current state-of-the-art methods.

Previous works have extensively studied the transferability of adversarial samples in untargeted black-box scenarios. However, it still remains challenging to craft targeted adversarial examples with higher transferability than non-targeted ones. Recent studies reveal that the traditional Cross-Entropy (CE) loss function is insufficient to learn transferable targeted adversarial examples due to the issue of vanishing gradient. In this work, we provide a comprehensive investigation of the CE loss function and find that the logit margin between the targeted and untargeted classes will quickly obtain saturation in CE, which largely limits the transferability. Therefore, in this paper, we devote to the goal of continually increasing the logit margin along the optimization to deal with the saturation issue and propose two simple and effective logit calibration methods, which are achieved by downscaling the logits with a temperature factor and an adaptive margin, respectively. Both of them can effectively encourage optimization to produce a larger logit margin and lead to higher transferability. Besides, we show that minimizing the cosine distance between the adversarial examples and the classifier weights of the target class can further improve the transferability, which is benefited from downscaling logits via L2-normalization. Experiments conducted on the ImageNet dataset validate the effectiveness of the proposed methods, which outperform the state-of-the-art methods in black-box targeted attacks. The source code is available at Link.

In recent years, despite significant advancements in adversarial attack research, the security challenges in cross-modal scenarios, such as the transferability of adversarial attacks between infrared, thermal, and RGB images, have been overlooked. These heterogeneous image modalities collected by different hardware devices are widely prevalent in practical applications, and the substantial differences between modalities pose significant challenges to attack transferability. In this work, we explore a novel cross-modal adversarial attack strategy, termed multiform attack. We propose a dual-layer optimization framework based on gradient-evolution, facilitating efficient perturbation transfer between modalities. In the first layer of optimization, the framework utilizes image gradients to learn universal perturbations within each modality and employs evolutionary algorithms to search for shared perturbations with transferability across different modalities through secondary optimization. Through extensive testing on multiple heterogeneous datasets, we demonstrate the superiority and robustness of Multiform Attack compared to existing techniques. This work not only enhances the transferability of cross-modal adversarial attacks but also provides a new perspective for understanding security vulnerabilities in cross-modal systems.

Multimodal Large Language Models (MLLMs) are becoming integral to autonomous driving (AD) systems due to their strong vision-language reasoning capabilities. However, MLLMs are vulnerable to adversarial attacks, particularly adversarial patch attacks, which can pose serious threats in real-world scenarios. Existing patch-based attack methods are primarily designed for object detection models and perform poorly when transferred to MLLM-based systems due to the latter's complex architectures and reasoning abilities. To address these limitations, we propose PhysPatch, a physically realizable and transferable adversarial patch framework tailored for MLLM-based AD systems. PhysPatch jointly optimizes patch location, shape, and content to enhance attack effectiveness and real-world applicability. It introduces a semantic-based mask initialization strategy for realistic placement, an SVD-based local alignment loss with patch-guided crop-resize to improve transferability, and a potential field-based mask refinement method. Extensive experiments across open-source, commercial, and reasoning-capable MLLMs demonstrate that PhysPatch significantly outperforms prior methods in steering MLLM-based AD systems toward target-aligned perception and planning outputs. Moreover, PhysPatch consistently places adversarial patches in physically feasible regions of AD scenes, ensuring strong real-world applicability and deployability.

Detecting prohibited objects in images requires models that combine high accuracy with resilience to adversarial perturbations. This study presents a comparative evaluation of three state-of-the-art architectures—Vision Transformer (ViT B16), EfficientNetV2-L, and YOLO12—and an ensemble of these models for multi-label detection of illicit content (weapons, drugs, nudity, violence, benign) in forensic imagery. A dataset of 13 556 images was split 60/20/20 into training, validation, and test sets. Each model was trained using binary cross-entropy (for classification heads) and YOLO loss (for detection heads) and evaluated on clean data and adversarial examples generated by FGSM (ϵ = 8/255) and PGD (α = 2/255, 10 iterations). On clean images, ViT B16 and EfficientNetV2-L achieved 93.5% and 92.8% accuracy, respectively, while YOLO12 reached 84.0%. Under PGD attack, accuracies dropped to 81.0%, 79.5%, and 68.0%. The averaging ensemble attained 95.2% clean accuracy, 85.5% adversarial accuracy, and 96.8% recall. Results demonstrate that architectural diversity and ensemble fusion significantly enhance both detection performance and adversarial robustness in security-critical applications.

Abstract. Deep neural networks (DNNs) are crucial in self-driving car technology but are vulnerable to adversarial attacks that manipulate visual input to mislead decision-making processes. Traditional physical adversarial attacks, such as patch-based methods, often use noticeable patches on target objects, making them easily detectable by humans. Recent advancements include camera-based attacks that apply perturbations directly to camera lenses for stealthier impacts, although these typically require multiple patches and insider model knowledge, making them impractical. We introduce a camera patch attack using a single patch optimized via particle swarm optimization (PSO) to enhance adversarial effects without extensive modifications. The method is tested digitally and physically, proving its robustness and efficacy in generating deceptive inputs that challenge both object detection and image classification systems while also exploring defensive measures against such attacks. Ultimately, an ensemble attack strategy is proposed to enhance transferability. Robustness is demonstrated through successful attacks on advanced DNNs, achieving success rates >80% in all scenarios. We support the attention and consideration of the approach framework due to its simplicity, robustness, and stealthiness, as it offers a means of achieving efficient, stealthy, and effective attacks.

Black-box adversarial attacks bypass internal target model information, broadening their applicability and making them a critical area in deep learning security. However, most existing methods prioritize attack success over perturbation imperceptibility, resulting in visually detectable perturbations. Addressing this, we propose the Grad-CAM-guided Perceptibility-Reduced Ensemble Attack (GPEA), integrating ensemble learning and Gradient-weighted Class Activation Mapping (Grad-CAM) to improve both attack success and perturbation imperceptibility. GPEA comprises two modules: Dynamic Weight Ensemble (DWE) and Grad-CAM-Based Perturbation Restriction (GPR). DWE introduces a novel weight initialization and adjustment scheme, optimizing surrogate model contributions to enhance black-box attack success. GPR applies Grad-CAM to restrict perturbations to critical image areas, markedly reducing perceptibility. Experimental results demonstrate the effectiveness of GPEA in balancing attack success and imperceptibility across various datasets and models. On VOC dataset, GPEA improves the black-box attack success rate by up to 8.4% over state-of-the-art methods; across five target models, it achieves average improvements of 18.5%, 16%, 36.4%, 33.9%, and 26.8% in SSIM, PSNR, LPIPS, ℓ0, and ℓ2 metrics, respectively.

Compared to query-based black-box attacks, transferbased black-box attacks do not require any information of the attacked models, which ensures their secrecy. However, most existing transfer-based approaches rely on ensembling multiple models to boost the attack transferability, which is time- and resource-intensive, not to mention the difficulty of obtaining diverse models on the same task. To address this limitation, in this work, we focus on the single-model transfer-based black-box attack on object detection, utilizing only one model to achieve a high-transferability adversarial attack on multiple black-box detectors. Specifically, we first make observations on the patch optimization process of the existing method and propose an enhanced attack framework by slightly adjusting its training strategies. Then, we analogize patch optimization with regular model optimization, proposing a series of self-ensemble approaches on the input data, the attacked model, and the adversarial patch to efficiently make use of the limited information and prevent the patch from overfitting. The experimental results show that the proposed framework can be applied with multiple classical base attack methods (e.g., PGD and MIM) to greatly improve the black-box transferability of the well-optimized patch on multiple mainstream detectors, meanwhile boosting white-box performance. Our code is available at https://github.com/VDIGPKU/TSEA.

Deep learning-based object detection models are the core components for acquiring environmental information in autonomous driving perception systems. With the development and widespread adoption of autonomous driving technology, the vulnerability of object detection models to adversarial perturbations has attracted increasing attention. In this paper, we propose a black-box adversarial attack method for object detection models in autonomous driving scenarios, termed Black-box attack via Ensemble Transfer with harmonic balancing (BET) and Box Suppression Query (BSQ). The proposed approach dynamically balances the inherent gradient discrepancies among multiple heterogeneous models to construct a surrogate ensemble, thereby improving attack transferability. Meanwhile, a box count constraint regularization strategy tailored to the characteristics of detection tasks is introduced to further enhance attack efficiency. Experimental results on the mainstream VOC dataset show that, using only 5 surrogate models, our method achieves over 80 % success rate in object disappearance attacks against 5 mainstream target model architectures with an average of only about 12 queries, yielding an absolute improvement of approximately 16 % over baseline methods.

No abstract available

Deep neural network (DNN) -based object detectors have achieved remarkable success, but recent research has revealed their vulnerability to backdoor attacks. The attacks cause the poisoned model to output results normally on benign images, but outputs results specified by the attacker on images inserted with a trigger. Although backdoor attacks have been extensively investigated on image classification tasks, their exploration in object detection tasks remains limited. With the increasing application of object detectors in safety-sensitive fields such as autonomous driving, backdoor attacks on object detection tasks may have serious consequences. Currently, strategies for object disappearance attack scenarios exhibit certain limitations. First, these strategies typically exhibit a one-to-one correspondence, implying that the insertion of one trigger can only result in the disappearance of one object. Second, these strategies typically necessitate the attacker’s knowledge of the object’s precise location information to achieve its disappearance, thereby rendering real-time insertion of triggers unfeasible. Finally, these strategies exhibit diminished attack success rates when applied to two-stage detectors. The paper presents a global object disappearance attack scenario and proposes a simple, covert, and highly effective attack strategy. Experimental evaluations are conducted on four widely-used object detection models (Yolov5s, Yolov8s, Faster R-CNN, and Libra R-CNN) using two benchmark datasets (PASCAL VOC $07+12$ and MS COCO2017) to validate the effectiveness of the proposed strategy. The results demonstrate that the success rate of this attack strategy exceeds 96%, while the poison rate is only 10%.

Deep neural networks (DNNs) have demonstrated remarkable success in tasks such as image classification and object detection, but remain vulnerable to adversarial attacks. To enhance the adversarial transferability across different architectures (e.g., from CNNs to ViTs), existing attacks leverage various strategies such as input transformations, gradient rectification, custom optimization objectives, and model ensembles, but struggle with limited effectiveness under minimal knowledge (e.g., the number of surrogate models). In this work, we propose a novel self-ensemble feature alignment(SEFA) strategy that significantly boosts adversarial transferability with minimal resource overhead. Motivated by the observation that adversarial transferability correlates with feature similarity across models, we leverage Centered Kernel Alignment (CKA) to measure and investigate intermediate features in both inter- and intra-model representation spaces. By splitting a single model into multiple sub-networks and aligning their feature spaces, our method effectively enhances adversarial transferability without relying on additional surrogate models. Experiments on the ImageNet dataset demonstrate that our approach achieves an average ASR of 80.0% (ResNet-50 surrogate) and 75.9% (Inc-v3 surrogate) on ImageNet, which outperform the second-best method (i.e., BSR) by +8.3% and +4.7% respectively. Further, it can seamlessly integrate with existing attacks to further increase cross architecture transferability.

As a general-purpose vision-language pretraining model, CLIP demonstrates strong generalization ability in image-text alignment tasks and has been widely adopted in downstream applications such as image classification and image-text retrieval. However, it struggles with fine-grained tasks such as object detection and semantic segmentation. While many variants aim to improve CLIP on these tasks, its robustness to adversarial perturbations remains underexplored. Understanding how adversarial examples transfer across tasks is key to assessing CLIP's generalization limits and security risks. In this work, we conduct a systematic empirical analysis of the cross-task transfer behavior of CLIP-based models on image-text retrieval, object detection, and semantic segmentation under adversarial perturbations. We find that adversarial examples generated from fine-grained tasks (e.g., object detection and semantic segmentation) often exhibit stronger transfer potential than those from coarse-grained tasks, enabling more effective attacks against the original CLIP model. Motivated by this observation, we propose a novel framework, Multi-Task Adversarial CLIP (MT-AdvCLIP), which introduces a task-aware feature aggregation loss and generates perturbations with enhanced cross-task generalization capability. This design strengthens the attack effectiveness of fine-grained task models on the shared CLIP backbone. Experimental results on multiple public datasets show that MT-AdvCLIP significantly improves the adversarial transfer success rate (The average attack success rate across multiple tasks is improved by over 39%.) against various CLIP-derived models, without increasing the perturbation budget. This study reveals the transfer mechanism of adversarial examples in multi-task CLIP models, offering new insights into multi-task robustness evaluation and adversarial example design.

Skip connection is an essential ingredient for modern deep models to be deeper and more powerful. Despite their huge success in normal scenarios (state-of-the-art classification performance on natural examples), we investigate and identify an interesting property of skip connections under adversarial scenarios, namely, the use of skip connections allows easier generation of highly transferable adversarial examples. Specifically, in ResNet-like models (with skip connections), we find that biasing backpropagation to favor gradients from skip connections-while suppressing those from residual modules via a decay factor-allows one to craft adversarial examples with high transferability. Based on this insight, we propose the Skip Gradient Method (SGM). Although starting from ResNet-like models in vision domains, we further extend SGM to more advanced architectures, including Vision Transformers (ViTs), models with varying-length paths, and other domains such as natural language processing. We conduct comprehensive transfer-based attacks against diverse model families, including ResNets, Transformers, Inceptions, Neural Architecture Search-based models, and Large Language Models (LLMs). The results demonstrate that employing SGM can greatly improve the transferability of crafted attacks in almost all cases. Furthermore, we demonstrate that SGM can still be effective under more challenging settings such as ensemble-based attacks, targeted attacks, and against defense equipped models. At last, we provide theoretical explanations and empirical insights on how SGM works. Our findings not only motivate new adversarial research into the architectural characteristics of models but also open up further challenges for secure model architecture design.

In recent years, CNN-based object detectors have been widely adopted in autonomous systems. Although their capabilities are employed across various industries, these detectors are inherently susceptible to adversarial attacks. Despite extensive studies on their effects on image classification, adversarial attacks remain largely unexplored in object detection. In particular, we note the reduced number of studies employing benchmarks for these types of attacks. Object detectors can be easily deceived by adding carefully devised perturbations to their inputs, rendering them unreliable. This study investigates the transferability of one such adversarial attack type, the Targeted Objectness Gradient (TOG), on different variations of the YOLO architecture to formally assess its vulnerability under different scenarios in the maritime domain. To investigate the significance of TOG adversarial attacks across variations of YOLO architectures and combinations of maritime datasets (all publicly available), we conducted a statistical analysis of black-box and white-box attacks. Our research questions were formulated to address a range of concerns that encompass various complexities to be considered in the detection of maritime objects. Our presented results underline the transferable nature of TOG adversarial attacks and the compelling need to benchmark such attacks in the maritime object detection domain.

Currently, most few-shot object detection (FSOD) methods apply the two-stage training strategy, which first requires training in abundant base classes and transfers the learned prior knowledge to the novel stage. However, due to the inherent imbalance between the base and novel classes, the trained model tends to have a bias toward recognizing novel classes as base ones when they are similar. To address this problem, we propose an adversarial feature training (AFT) strategy aimed at effectively calibrating the decision boundary between novel and base classes to alleviate classification confusion in FSOD. Specifically, we introduce the Classification Level Fast Gradient Sign Method (CL-FGSM), which leverages gradient information from the classifier module to generate adversarial samples with extra feature attention. By attacking the high-level features, we can create adversarial feature samples that are combined with clean high-level features in a suitable range of proportions. Such adversarial feature samples, generated by CL-FGSM, are then combined with clean high-level features in a suitable range of proportions to train the few-shot detector. By this, the novel model is forced to learn extra class-specific features that improve the robustness of the classifier to establish a correct decision boundary, which avoids confusion between base and novel classes in FSOD. Extensive experiments demonstrate that our proposed AFT strategy effectively calibrates the classification decision boundary to avoid classification confusion between base and novel classes and significantly improves the performance of FSOD. Our code is available at https://github.com/wutianxu/AFT.