Transferable and Robust Dynamic Adversarial Attack Against Object Detection Models

Object detection models have been widely deployed in physical world applications, and they are vulnerable to adversarial attacks. However, most adversarial attacks are implemented in a glass box setting, and under ideal shooting conditions, such as fixed distances and angles, and thus have limited attack success rate (ASR) in practice. In this article, we present a transferable and robust dynamic adversarial attack where the adversarial patches can be printed on or attached to nonrigid objects, such as clothes. We develop a cascade module with a momentum-based technique to optimize adversarial patches against various object detection models, achieving better transferability of the patches in a closed box setting. We also develop a strategy of distance-adaptive patch generation and employ perspective transformation to enhance the robustness of patches. To evaluate the attack performance, we conduct extensive experiments on seven mainstream object detection models at different distances and angles. The results show that our method can achieve an average ASR of 69.85%, which is 3.27 times that of the baseline method at 3 m.