Attacking Object Detector by Simultaneously Learning Perturbations and Locations

In recent years, much attention has been given to the robustness of deep neural network (DNN). Adding some negligible perturbation to the image will cause the DNN to give wrong results with high confidence, while the human eye can hardly see the difference. However, studies show that attack an object detector is much more difficult than attack a classifier. We proposed a new attack algorithm for DNN based object detector by simultaneously learning perturbations and locations (SLPL). The proposed algorithm attacks an object detector by iterative fast gradient sign method (I-FGSM). Unlike most gradient based algorithms that only learning perturbations, it simultaneously learning perturbations and attack locations. While learning perturbations by backward gradient, it gradually focuses on the most efficient attack locations in an image based accumulated absolute gradient. In addition, we study the stability and transferability of adversarial examples in object detection. Experimental results on Pascal VOC dataset show that, the proposed SLPL gives higher attack succeed ratio and lower perturbation when attacking popular object detectors such as Faster-RCNN and YOLOv4. Nevertheless, the stability and transferability of existing attack algorithms for object detection is far from expected.