Physical adversarial attacks threaten to fool object detection systems, but reproducible research on the real-world effectiveness of physical patches and how to defend against them requires a publicly available benchmark dataset. We present APRICOT, a collection of over 1,000 annotated photographs of printed adversarial patches in public locations. The patches target several object categories for three COCO-trained detection models, and the photos represent natural variation in position, distance, lighting conditions, and viewing angle. Our analysis suggests that maintaining adversarial robustness in uncontrolled settings is highly challenging, but it is still possible to produce targeted detections under white-box and sometimes black-box settings. We establish baselines for defending against adversarial patches through several methods, including a detector supervised with synthetic data and unsupervised methods such as kernel density estimation, Bayesian uncertainty, and reconstruction error. Our results suggest that adversarial patches can be effectively flagged, both in a high-knowledge, attack-specific scenario, and in an unsupervised setting where patches are detected as anomalies in natural images. This dataset and the described experiments provide a benchmark for future research on the effectiveness of and defenses against physical adversarial objects in the wild.

本文介绍了一个公开的基准数据集APRICOT，它包含了1000多张带有标注的公共场所中的物理对抗贴片（adversarial patches）照片，用于对物体检测系统中的物理对抗攻击进行实验和研究，并提出了包括合成数据和无监督方法在内的一些防御策略。通过实验分析，作者们表明在非受控制的情况下，维护系统的抗干扰能力具有挑战性，但在一些特定的条件下，可以有效地检测出恶意贴片。

APRICOT：物理对抗攻击物体检测数据集