Deep neural networks (DNNs) have revolutionized the field of computer vision
like object detection with their unparalleled performance. However, existing
research has shown that DNNs are vulnerable to adversarial attacks. In the
physical world, an adversary could exploit adversarial patches to implement a
Hiding Attack (HA) which patches the target object to make it disappear from
the detector, and an Appearing Attack (AA) which fools the detector into
misclassifying the patch as a specific object. Recently, many defense methods
for detectors have been proposed to mitigate the potential threats of
adversarial patches. However, such methods still have limitations in
generalization, robustness and efficiency. Most defenses are only effective
against the HA, leaving the detector vulnerable to the AA.
In this paper, we propose \textit{NutNet}, an innovative model for detecting
adversarial patches, with high generalization, robustness and efficiency. With
experiments for six detectors including YOLOv2-v4, SSD, Faster RCNN and DETR on
both digital and physical domains, the results show that our proposed method
can effectively defend against both the HA and AA, with only 0.4\% sacrifice of
the clean performance. We compare NutNet with four baseline defense methods for
detectors, and our method exhibits an average defense performance that is over
2.4 times and 4.7 times higher than existing approaches for HA and AA,
respectively. In addition, NutNet only increases the inference time by 8\%,
which can meet the real-time requirements of the detection systems. Demos of
NutNet are available at: https://sites.google.com/view/nutnet.

提出了一种创新的模型 NutNet，用于检测对抗性贴片，在高泛化性、鲁棒性和效率方面表现优异。通过对六个检测器进行实验，包括 YOLOv2-v4，SSD，Faster RCNN 和 DETR 在数字和物理领域上，结果显示我们的方法可以有效防御 HA 和 AA，仅损失 0.4% 的干净性能。与四种基准防御方法进行对比，我们的方法展示了比 HA 和 AA 现有方法分别高 2.4 倍和 4.7 倍的平均防御性能。此外，NutNet 仅增加了 8% 的推理时间，可以满足检测系统的实时要求。NutNet 的演示可在 https://sites.google.com/view/nutnet 上找到。

我不认识你，但我能够捕捉你：针对目标检测的多样对抗性补丁的实时防御

I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse  Adversarial Patches for Object Detectors

In this paper, we presented systematic solutions to build robust and
practical AEs against real world object detectors. Particularly, for Hiding
Attack (HA), we proposed the feature-interference reinforcement (FIR) method
and the enhanced realistic constraints generation (ERG) to enhance robustness,
and for Appearing Attack (AA), we proposed the nested-AE, which combines two
AEs together to attack object detectors in both long and short distance. We
also designed diverse styles of AEs to make AA more surreptitious. Evaluation
results show that our AEs can attack the state-of-the-art real-time object
detectors (i.e., YOLO V3 and faster-RCNN) at the success rate up to 92.4% with
varying distance from 1m to 25m and angles from -60{\deg} to 60{\deg}. Our AEs
are also demonstrated to be highly transferable, capable of attacking another
three state-of-the-art black-box models with high success rate.

本研究提出了一种针对实时目标检测器的建设鲁棒且实用的 AE 系统解决方案，包括针对 HA 的 FIR 方法和 ERG 增强鲁棒性，以及针对 AA 的嵌套 AE，可攻击不同距离和角度下的检测器。实验表明，我们的 AE 系统的攻击成功率可以达到 92.4％，并且可攻击另外三种黑盒模型。