An Adversarial Patch Attack for Vehicle Detectors in the Physical World

Compared with global pixel-level adversarial samples, adversarial patches do not pursue visual concealment and are easier to achieve attack effects in the physical world. However, most of the existing adversarial patch attacks on vehicles have overlooked the influence of patch coverage position in the physical world. Some methods have not conducted real physical patch attack experiments, and the test of attack effect has been limited to the digital world. At the same time, during the patch optimization process, the attack effect when transferred to other models has not been considered. In this paper, we propose a vehicle adversarial patch attack method based on model perception and attention. Based on the model perception to high-frequency information, we use such high-frequency information of the image that the model cannot correctly classify as the initial adversarial patch to enhance the transferability. Based on the model attention patterns, the attention region of the model is obtained, and cover this region with patches as much as possible to achieve the attack more easily. Experiments demonstrate that our patch can remarkably reduce the detection accuracy of model in the digital world, while ensuring the attack effect of the adversarial patch in the physical world.