Undermining Trust in Multimodal Computer Vision Models: Realistic Adversarial Patches

Abstract

Adversarial patches have emerged as a serious threat to aerial-based deep learning systems, with multimodal models being discussed as a potential solution. Existing research optimizes patches for aerial sensory in the multimodal space but is based on the physically simplified assumption that the appearance of the patches is invariant across multimodal fusion levels, which leads to an overestimation of their effectiveness. We demonstrate that a once-optimized patch, including patches trained solely on RGB data, retains sufficient attack efficacy to undermine trust in automation systems across the majority of evaluated architectures, even after physically inspired transformations across different multimodal fusion levels. Across a range of state-of-the-art CNN and Transformer architectures, such a patch leads to irritation rates of up to 21.2%, evaluated on a comprehensive RGB-LWIR fusion dataset consisting of various daytime conditions and seasons, and ten long-wave infrared fusion levels. These results imply, from a conceptual point of view, that the disturbing characteristics of adversarial patches remain present even after multimodal translation. From a practical perspective, this study provides a more realistic evaluation setting for multimodal patches and shows that the usage of a multi-stage fusion multimodal approach does not sufficiently cover against the trust-erosion arising from patches, particularly against cross-modal transfer from RGB-trained patches.