TY - JOUR
T1 - Infrared Adversarial Patch Generation Based on Reinforcement Learning
AU - Zhou, Shuangju
AU - Li, Yang
AU - Tan, Wenyi
AU - Zhao, Chenxing
AU - Zhou, Xin
AU - Pan, Quan
N1 - Publisher Copyright:
© 2024 by the authors.
PY - 2024/11
Y1 - 2024/11
N2 - Recently, there has been an increasing concern about the vulnerability of infrared object detectors to adversarial attacks, where the object detector can be easily spoofed by adversarial samples with aggressive patches. Existing attacks employ light bulbs, insulators, and both hot and cold blocks to construct adversarial patches. These patches are complex to create, expensive to produce, or time-sensitive, rendering them unsuitable for practical use. In this work, a straightforward and efficacious attack methodology applicable in the physical realm, wherein the patch configuration is simplified to uniform-sized grayscale patch blocks affixed to the object, is proposed. This approach leverages materials with varying infrared emissivity, which are easy to fabricate and deploy in the real world and can be long-lasting. We use a reinforcement learning approach to gradually optimize the patch generation strategy until the adversarial attack goal is achieved, which supports multi-gray scale patches and explores the effects of patch size and grayscale. The results of our experiments demonstrate the effectiveness of the method. In our configurations, the average accuracy of YOLO v5 in digital space drops from 95.7% to 45.4%, with an attack success rate of 68.3%. It is also possible to spoof the object detector in physical space.
AB - Recently, there has been an increasing concern about the vulnerability of infrared object detectors to adversarial attacks, where the object detector can be easily spoofed by adversarial samples with aggressive patches. Existing attacks employ light bulbs, insulators, and both hot and cold blocks to construct adversarial patches. These patches are complex to create, expensive to produce, or time-sensitive, rendering them unsuitable for practical use. In this work, a straightforward and efficacious attack methodology applicable in the physical realm, wherein the patch configuration is simplified to uniform-sized grayscale patch blocks affixed to the object, is proposed. This approach leverages materials with varying infrared emissivity, which are easy to fabricate and deploy in the real world and can be long-lasting. We use a reinforcement learning approach to gradually optimize the patch generation strategy until the adversarial attack goal is achieved, which supports multi-gray scale patches and explores the effects of patch size and grayscale. The results of our experiments demonstrate the effectiveness of the method. In our configurations, the average accuracy of YOLO v5 in digital space drops from 95.7% to 45.4%, with an attack success rate of 68.3%. It is also possible to spoof the object detector in physical space.
KW - adversarial attack
KW - infrared image
KW - patch
KW - reinforcement learning
UR - http://www.scopus.com/inward/record.url?scp=85208424084&partnerID=8YFLogxK
U2 - 10.3390/math12213335
DO - 10.3390/math12213335
M3 - 文章
AN - SCOPUS:85208424084
SN - 2227-7390
VL - 12
JO - Mathematics
JF - Mathematics
IS - 21
M1 - 3335
ER -