Adversarial patch attacks, crafted to compromise the integrity of Deep Neural
Networks (DNNs), significantly impact Artificial Intelligence (AI) systems
designed for object detection and classification tasks. The primary purpose of
this work is to defend models against real-world physical attacks that target
object detection and classification. We analyze attack techniques and propose a
robust defense approach. We successfully reduce model confidence by over 20%
using adversarial patch attacks that exploit object shape, texture and
position. Leveraging the inpainting pre-processing technique, we effectively
restore the original confidence levels, demonstrating the importance of robust
defenses in mitigating these threats. Following fine-tuning of an AI model for
traffic sign classification, we subjected it to a simulated pixelized
patch-based physical adversarial attack, resulting in misclassifications. Our
inpainting defense approach significantly enhances model resilience, achieving
high accuracy and reliable localization despite the adversarial attacks. This
contribution advances the resilience and reliability of object detection and
classification networks against adversarial challenges, providing a robust
foundation for critical applications.

我们分析了攻击技术并提出了一种强大的防御方法，通过利用对象的形状、纹理和位置，成功降低了 20% 以上的模型置信度。利用修复预处理技术，有效地恢复了原始的置信水平，展示了强大防御在减轻这些威胁中的重要性。我们的修复防御方法在仿真像素化的基于补丁的物理对抗攻击中显著提高了模型的韧性，实现了高精度和可靠的定位，尽管受到了对抗性攻击。这项工作推动了对抗挑战中对象检测和分类网络的韧性和可靠性的发展，并为关键应用提供了强大的基础。

提高目标检测和分类 AI 模型对抗性贴纸攻击的鲁棒性

Improving the Robustness of Object Detection and Classification AI  models against Adversarial Patch Attacks

The increasing connectivity and intricate remote access environment have made
traditional perimeter-based network defense vulnerable. Zero trust becomes a
promising approach to provide defense policies based on agent-centric trust
evaluation. However, the limited observations of the agent's trace bring
information asymmetry in the decision-making. To facilitate the human
understanding of the policy and the technology adoption, one needs to create a
zero-trust defense that is explainable to humans and adaptable to different
attack scenarios. To this end, we propose a scenario-agnostic zero-trust
defense based on Partially Observable Markov Decision Processes (POMDP) and
first-order Meta-Learning using only a handful of sample scenarios. The
framework leads to an explainable and generalizable trust-threshold defense
policy. To address the distribution shift between empirical security datasets
and reality, we extend the model to a robust zero-trust defense minimizing the
worst-case loss. We use case studies and real-world attacks to corroborate the
results.

本文提出了一种基于部分观测马尔可夫决策过程（POMDP）和一阶元学习的零信任防御框架，可以适应不同攻击场景并且在人类理解上具有解释性和泛化性，同时还扩展了模型实现了最小化最坏情况损失的鲁棒零信任防御。

可解释阈值策略的场景无关零信任防御：一种元学习方法

Scenario-Agnostic Zero-Trust Defense with Explainable Threshold Policy: A Meta-Learning Approach

Recently, techniques have been developed to provably guarantee the robustness
of a classifier to adversarial perturbations of bounded L_1 and L_2 magnitudes
by using randomized smoothing: the robust classification is a consensus of base
classifications on randomly noised samples where the noise is additive. In this
paper, we extend this technique to the L_0 threat model. We propose an
efficient and certifiably robust defense against sparse adversarial attacks by
randomly ablating input features, rather than using additive noise.
Experimentally, on MNIST, we can certify the classifications of over 50% of
images to be robust to any distortion of at most 8 pixels. This is comparable
to the observed empirical robustness of unprotected classifiers on MNIST to
modern L_0 attacks, demonstrating the tightness of the proposed robustness
certificate. We also evaluate our certificate on ImageNet and CIFAR-10. Our
certificates represent an improvement on those provided in a concurrent work
(Lee et al. 2019) which uses random noise rather than ablation (median
certificates of 8 pixels versus 4 pixels on MNIST; 16 pixels versus 1 pixel on
ImageNet.) Additionally, we empirically demonstrate that our classifier is
highly robust to modern sparse adversarial attacks on MNIST. Our
classifications are robust, in median, to adversarial perturbations of up to 31
pixels, compared to 22 pixels reported as the state-of-the-art defense, at the
cost of a slight decrease (around 2.3%) in the classification accuracy. Code is
available at this https URL

使用基于随机平滑的 L1 和 L2 变换来保证分类器对于固定 L0 干扰大小的分类鲁棒性，并提出了一种高效且可验证的防御方法，通过使用随机消融的输入特征而非加性噪声来对抗稀疏的对抗干扰攻击，实验结果验证了其在 MNIST、ImageNet 和 CIFAR-10 上有效的性能。