REVIEW 4 cited by
Defending Against Physically Realizable Attacks on Image Classification
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust models, adversarial training with PGD attacks and randomized smoothing, exhibit very limited effectiveness against three of the highest profile physical attacks. Next, we propose a new abstract adversarial model, rectangular occlusion attacks, in which an adversary places a small adversarially crafted rectangle in an image, and develop two approaches for efficiently computing the resulting adversarial examples. Finally, we demonstrate that adversarial training using our new attack yields image classification models that exhibit high robustness against the physically realizable attacks we study, offering the first effective generic defense against such attacks.
Forward citations
Cited by 4 Pith papers
-
Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks
InsCAT adds a contrastive loss that aligns adversarially clothed people with clean people and pushes away from texture-only images, reducing texture false positives from 46.9% to 7.3% while lifting average attack AP to 82.3%.
-
Human-Imperceptible Physical Adversarial Attack for NIR Face Recognition Models
Infrared-absorbing ink patches, shaped and placed by a black-box evolutionary search, can fool NIR face recognition models in the physical world while remaining visually unobtrusive.
-
Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
A camera-steering reinforcement learning agent reduces adversarial patch attack success rates to roughly 1-7% in simulated face recognition, 3D object classification, and driving detection, while preserving clean accuracy.
-
Fall Leaf Adversarial Attack on Traffic Sign Classification
A leaf-shaped occlusion can flip some traffic sign classifications in the LISA-CNN model, but the evidence is limited to five signs and best-case placements.
Discussion (0). Continue with ORCID to comment.