Spatially robust and visually stealthy physical adversarial attacks on object detection systems

Le résumé fourni par la source

The vulnerability of object detection systems to physical adversarial examples poses an important safety concern for autonomous driving systems. Prior physical attacks built on Expectation Over Transformation (EOT) demonstrate feasibility but often generate conspicuous high-frequency perturbations that are easily perceptible to human observers, limiting their practical stealthiness. To address this, we propose the Spatially Robust Physical Adversarial Attack ( SRPAA ) framework, which jointly minimizes a detection-suppression loss with Total Variation and Laplacian-based smoothness regularizers, producing perturbations that traverse a controllable point on the visual stealth–physical effectiveness frontier : subtle enough for plausible physical deployment, yet structured enough to survive the print-and-recapture pipeline. We formalize the disappearance criterion into two failure modes (FM1: no surviving detection; FM2: surviving non-target detections) and evaluate SRPAA on a multi-camera, multi-detector benchmark with three smartphones and six detectors, including YOLOv5/v8/11, Faster R-CNN, Cascade R-CNN, and RetinaNet. SRPAA achieves Peak Signal-to-Noise Ratio (PSNR) of – dB and Learned Perceptual Image Patch Similarity (LPIPS) of – , substantially better perceptual quality than ShapeShifter ( dB and ), while remaining robust across viewing angles, smartphone cameras, and ambient lighting. It retains cross-variant transferability within the YOLO family, reaching Attack Success Rate (ASR) from a single optimization run. XAI analysis with Grad-CAM, LIME, and SHAP additionally reveals an asymmetric transferability pattern: perturbations optimized for the most robust detector (YOLO11) also fool the simpler YOLOv5, but not vice versa.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.