Fooling Aerial Detectors by Background Attack via Dual-Adversarial-Induced Error Identification

• Published in: IEEE transactions on geoscience and remote sensing Vol. 62; p. 1
• Main Authors: Wang, Xiaofei, Mei, Shaohui, Lian, Jiawei, Lu, Yingjie
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.01.2024; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: aerial detection; Background attack; Closed box; Comparative analysis; Datasets; Detectors; dual adversarial induction; Error detection; Face recognition; false negatives; false positives; Object recognition; Perturbation methods; Robustness; Sensors; Target masking; Task analysis; Training
• ISSN: 0196-2892; 1558-0644
• DOI: 10.1109/TGRS.2024.3386533

Recent developments in adversarial attack have witnessed the success of background attack against object detectors. However, most existing methods attack detectors by luring targets into background. Therefore, an innovative Background Attack framework via Dual-adversarial-induced Error Identification (BADEI) is proposed to attack detectors by deceiving background as targets, as well as deceiving targets as background, where the attack performance can be greatly enhanced by these two kinds of induced error identification. Specifically, a mechanism that generates the adversarial background is proposed to result in dual error detection, where the background can conceal the specified targets and cause the misclassification of the adversarial pattern in the background as a specific category. Moreover, an unoccluded training strategy (UTS) that leverages the target mask of an image is introduced to strategically place adaptive adversarial background beneath the targets while optimizing and updating the pixel values of the background outside the target region, which can enhance attack effectiveness for adversarial background, significantly degrade the targets' average accuracy, and enhance the robustness of background. Finally, a dual deceptive loss function (D 2 LF) is carefully formulated to generate false negatives (FNs) and false positives (FPs) to achieve untargeted attacks for hiding objects as well as targeted attacks for erroneously recognizing objects. Extensive experiments and comparative analysis of various victim network models on two datasets (including DOTA dataset and RSOD dataset) confirm that the proposed framework exhibits superior performance over the state-of-the-art methods in both digital and physical scenarios.