Zero-Query Black-Box Adversarial Attacks Using Transferability on Object Detection Models
TL;DR
A zero-query attack is proposed that exploits transferability such that it generates a universal adversarial perturbation (UAP) by the ensemble of multiple surrogate models that are white-box accessible and use the UAP to attack the target model in the black-box environment.
Abstract
: Non-maximum suppression (NMS) is commonly used to filter redundant detection results in object detection models. Several white-box adversarial attacks to induce false positives by circumventing the NMS and increasing the number of false bounding boxes have been studied. However, since white-box attacks require internal parameters of the target model, actual viable environments are limited. This paper aims at an adversarial attack in a more feasible black-box environment threat model without internal parameters of the target model. Specifically, we propose a zero-query attack that exploits transferability such that we generate a universal adversarial perturbation (UAP) by the ensemble of multiple surrogate models that are white-box accessible and use the UAP to attack the target model in the black-box environment. We show that by increasing the number of surrogate models, we can achieve the false positive rate of the target model up to 84.4% in COCO2017 dataset and 82.9% in BDD100K dataset for targeting YOLOv8, and 87.2% in COCO2017 and 79.7% in BDD100K for targeting YOLOv9.