Although deep neural networks (DNNs) are known to be fragile, no one has
studied the effects of zooming-in and zooming-out of images in the physical
world on DNNs performance. In this paper, we demonstrate a novel physical
adversarial attack technique called Adversarial Zoom Lens (AdvZL), which uses a
zoom lens to zoom in and out of pictures of the physical world, fooling DNNs
without changing the characteristics of the target object. The proposed method
is so far the only adversarial attack technique that does not add physical
adversarial perturbation attack DNNs. In a digital environment, we construct a
data set based on AdvZL to verify the antagonism of equal-scale enlarged images
to DNNs. In the physical environment, we manipulate the zoom lens to zoom in
and out of the target object, and generate adversarial samples. The
experimental results demonstrate the effectiveness of AdvZL in both digital and
physical environments. We further analyze the antagonism of the proposed data
set to the improved DNNs. On the other hand, we provide a guideline for defense
against AdvZL by means of adversarial training. Finally, we look into the
threat possibilities of the proposed approach to future autonomous driving and
variant attack ideas similar to the proposed attack.

本研究介绍了一种名为 Adversarial Zoom Lens（AdvZL）的新型物理对抗攻击技术，使用变焦镜头对物理世界中的图像进行缩放，从而欺骗深度神经网络，同时不会改变目标对象的特征。通过数字环境和物理环境的实验证明了该方法的有效性，并提出了对抗训练的防御建议。还探讨了该方法对未来自动驾驶的威胁可能性以及类似所提出攻击的变种威胁思路。

对抗变焦镜头：一种新型实体世界攻击 DNNs

Adversarial Zoom Lens: A Novel Physical-World Attack to DNNs

Most existing deep neural networks (DNNs) are easily disturbed by slight
noise. As far as we know, there are few researches on physical adversarial
attack technology by deploying lighting equipment. The light-based physical
adversarial attack technology has excellent covertness, which brings great
security risks to many applications based on deep neural networks (such as
automatic driving technology). Therefore, we propose a robust physical
adversarial attack technology with excellent covertness, called adversarial
laser point (AdvLS), which optimizes the physical parameters of laser point
through genetic algorithm to perform physical adversarial attack. It realizes
robust and covert physical adversarial attack by using low-cost laser
equipment. As far as we know, AdvLS is the first light-based adversarial attack
technology that can perform physical adversarial attacks in the daytime. A
large number of experiments in the digital and physical environments show that
AdvLS has excellent robustness and concealment. In addition, through in-depth
analysis of the experimental data, we find that the adversarial perturbations
generated by AdvLS have superior adversarial attack migration. The experimental
results show that AdvLS impose serious interference to the advanced deep neural
networks, we call for the attention of the proposed physical adversarial attack
technology.

提出低成本的物理对抗攻击技术 ——Adversarial Laser Point，该技术利用遗传算法的方式优化激光点的物理参数来对深度神经网络进行对抗攻击，具有出色的隐蔽性和强鲁棒性。实验表明，该技术在数字和物理环境中均表现出极高的对抗干扰能力，同时生成的对抗扰动具有超越性的迁移攻击能力。

对抗性激光点攻击：用于对 DNNs 的强大且隐秘的物理对抗攻击

Adversarial Laser Spot: Robust and Covert Physical Adversarial Attack to DNNs

In this paper, we study physical adversarial attacks on object detectors in
the wild. Previous works mostly craft instance-dependent perturbations only for
rigid or planar objects. To this end, we propose to learn an adversarial
pattern to effectively attack all instances belonging to the same object
category, referred to as Universal Physical Camouflage Attack (UPC).
Concretely, UPC crafts camouflage by jointly fooling the region proposal
network, as well as misleading the classifier and the regressor to output
errors. In order to make UPC effective for non-rigid or non-planar objects, we
introduce a set of transformations for mimicking deformable properties. We
additionally impose optimization constraint to make generated patterns look
natural to human observers. To fairly evaluate the effectiveness of different
physical-world attacks, we present the first standardized virtual database,
AttackScenes, which simulates the real 3D world in a controllable and
reproducible environment. Extensive experiments suggest the superiority of our
proposed UPC compared with existing physical adversarial attackers not only in
virtual environments (AttackScenes), but also in real-world physical
environments. Code and dataset are available at
this https URL

本文研究了野外物体探测器的物理对抗攻击，提出了一种名为 UPC 的通用物理迷彩攻击，通过联合欺骗区域提议网络以及误导分类器和回归器来进行伪装，同时引入了一组模仿可变形物体属性的变换，实验表明，在虚拟和真实世界的物理攻击中，UPC 比现有的物理对抗攻击者更具优越性。