Fake it till you break it: evaluating the performance of synthetically optimized adversarial patches against real-world imagery

Mohammad Zarei; Chris M. Ward; Joshua Harguess; Marshal Aiken

doi:10.1117/12.2665960

15 June 2023 Fake it till you break it: evaluating the performance of synthetically optimized adversarial patches against real-world imagery

Mohammad Zarei, Chris M. Ward, Joshua Harguess, Marshal Aiken

Author Affiliations +

Proceedings Volume 12525, Geospatial Informatics XIII ; 125250I (2023) https://doi.org/10.1117/12.2665960
Event: SPIE Defense + Commercial Sensing, 2023, Orlando, Florida, United States

Abstract

Deep neural networks (DNNs), enabled by massive open datasets like ImageNet, have produced impressive results in a wide range of fields and applications. ImageNet, a database of over 15 million high-resolution images categorized into 22,000 categories, has revolutionized the field of computer vision with state-of-the-art models achieving 98% accuracy. However, this performance comes at a cost. Recent advances in adversarial machine learning have revealed inherent vulnerabilities in DNN-based models. Adversarial patches have been successfully used to disrupt the performance of artificial intelligence (AI) systems that leverage DNN-based computer vision models, but the trade space of these attacks is not fully understood; adversarial attack generation and validation methods are still nascent. In this paper we explore the generation and performance of synthetically-trained attacks against models trained on real data like MSCOCO, VIRAT and VisDrone. Using a synthetic environment tool built on the Unreal Engine, we generate a synthetic dataset consisting of pedestrians and vehicles, train synthetic object detection models, and optimize adversarial patch attacks on the synthetic feature space of those models. We then apply our synthetic attacks to real image data and examine the efficacy of synthetic patch attacks against models trained on real-word image data. The implications of synthetically optimized attacks are broad: a much larger attack surface for DNN-based computer vision models, development of simulation-based validation pipelines, more effective attacks, and stronger defenses against adversarial examples.

Conference Presentation

Citation Download Citation

Mohammad Zarei, Chris M. Ward, Joshua Harguess, and Marshal Aiken "Fake it till you break it: evaluating the performance of synthetically optimized adversarial patches against real-world imagery", Proc. SPIE 12525, Geospatial Informatics XIII , 125250I (15 June 2023); https://doi.org/10.1117/12.2665960

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available