The Practicality Of Physical Adversarial Examples For Deep Learning Models

In recent years,deep learning models have made significant progress and have been widely used in various artificial intelligence systems.However,deep learning models are not only susceptible to carefully designed digital noise,but also to physical objects with specific patterns and shapes,which are known as physical adversarial examples.There are different types of physical adversarial examples in different tasks,including printed photos,fabric patterns,3D printed objects,etc.Research on physical adversarial examples is important for evaluating and ensuring the robustness and security of deep learning models.Moreover,it can also be applied to protect citizen privacy and crucial items.However,many existing methods for crafting physical adversarial examples suffer from several practical defects in real life,including problems with concealment,adaptability,and feasibility.The concealment problem refers to the fact that physical adversarial examples are too conspicuous to humans.The adaptability problem refers to the inability of physical adversarial examples to adapt to unforeseeable changes in certain physical environments.The feasibility problem refers to the difficulty of implementing the physical adversarial examples in real life.In order to alleviate these problems,this dissertation studies the practicality of physical adversarial examples in three common deep-learning tasks: visual object recognition,visual person detection,and point cloud vehicle detection.The main contributions of this dissertation are as follows:1.To alleviate the concealment problem,an attack framework is proposed based on the amplification Trojan networks that can amplify and enhance the adversarial effectiveness of the adversarial pictures to the target network with a very small noise scale,thus making the adversarial noise inconspicuous;a differentiable approach is proposed for generating camouflage patterns that resemble typical texture patterns,thus enhancing the naturalness of the adversarial clothes covered with such patterns and making them less conspicuous to humans.2.To alleviate the adaptability problem,a method is proposed for extending the adversarial patches to scalable texture pattern which has continuous patterns and local adversarial effectiveness,thus improving the adversarial effectiveness of the adversarial clothes covered with such patterns at multiple viewing angles;a method is proposed for generating topologically plausible projection,and a pipeline is proposed based on this projection for non-rigid perturbation in 3D mesh models.3.To alleviate the feasibility problem,an attack pipeline is proposed based on optical material for coating vehicles,thus increasing the feasibility of crafting the adversarial vehicles in the real world.