檢測對抗樣本

How can just wearing a specific type of t-shirt make you invisible to the person detection and human surveillance systems? Well, researchers have found and exploited the Achilles’ heel of deep neural networks — the framework behind some of the best object detectors out there (YOLOv2, Faster R-CNN, HRNetv2, to name a few).

僅穿著特定類型的T恤如何使人檢測和人類監視系統看不見？ 好吧，研究人員已經發現并利用了深度神經網絡的致命弱點-深陷其中的一些最佳對象檢測器(YOLOv2，Faster R-CNN，HRNetv2等)。

較早的方法： (Earlier approach:)

In [1], the authors manage to get a benchmark accuracy of deception of 57% in real-world use cases. However, this is not the first time attempts have been made to deceive an object detector. In [2] the authors designed a way for their model to learn and generate patches that could deceive the detector. This patch, when worn on a cardboard piece (or any flat surface) could evade the person detector albeit with an accuracy of 18%

在[1]中，作者設法在實際使用案例中獲得了57％的基準欺騙準確性。 但是，這并不是第一次嘗試欺騙對象檢測器。 在[2]中，作者為他們的模型設計了一種方法來學習并生成可能欺騙檢測器的補丁。 將該貼片戴在硬紙板片(或任何平坦表面)上時，即使準確度為18％，也可以避開人體檢測儀

From [2]. Left: The person without a patch is successfully detected. Right: The person holding the patch is ignored.從[2]開始。 左：成功檢測到沒有補丁的人。 正確：拿著補丁的人將被忽略。

“Confusing” or “fooling” the neural network like this is called making a physical adversarial attack or a real-world adversarial attack. These attacks, initially based on intricately altered pixel values, confuse the network (based on its training data) into labeling the object as “unknown” or simply ignoring it.

像這樣“混淆”或“欺騙”神經網絡稱為進行物理對抗攻擊或真實世界對抗攻擊。 這些攻擊最初基于復雜變化的像素值，使網絡(基于其訓練數據)使該對象標記為“未知”，或者只是忽略了它。

Authors in [2] transform images in their training data, apply an initial patch, and feed the resulting image into the detector. The object loss obtained is used to change the pixel values in the patch and aimed at minimising the objectness score.

[2]中的作者將其訓練數據中的圖像進行轉換，應用初始補丁，然后將生成的圖像輸入檢測器。 獲得的對象損失是用來改變在補丁中的像素值和旨在最小化對象性得分。

From [2]. Generating patches and getting the object loss.從[2]開始。 生成補丁并丟失對象。

However, other than the low accuracy of 18%, this approach is limited to rigid carriers like a cardboard and doesn’t perform well when the captured frame has a distorted or skewed patch. Moreover, it certainly doesn’t work well when printed on t-shirts.

但是，除了18％的低精度外，此方法僅限于硬紙板之類的剛性載體，并且當捕獲的框架變形或傾斜時，效果不佳。 而且，當印在T恤上時，它當然不能很好地工作。

“A person’s movement can result in significantly and constantly changing wrinkles (aka deformations) in their clothes” [1]. Thus making the task of developing a generalised adversarial patch even more difficult.

“一個人的運動可能會導致其衣服中的皺紋持續顯著變化(又稱變形)” [1]。 因此，開發通用對抗補丁的任務變得更加困難。

新的方法： (New Approach:)

The new approach in [1] employs Thin Plate Spline Mapping to model cloth deformations. These deformations simulate a realistic problem faced by previous attempts at using adversarial patterns. Taking care of different deformations would drastically improve the system's performance as it would be able to not-detect the pattern in more number of frames.

[1]中的新方法采用薄板樣條映射來模擬布料變形。 這些變形模擬了以前使用對抗性模式所面臨的現實問題。 照顧不同的變形將極大地改善系統的性能，因為它將無法在更多幀中檢測到圖案。

Understanding Splines themselves would be enough to get a rough idea of what they are trying to do with this approach.

理解樣條線本身就足以大致了解他們要使用此方法進行的操作。

花鍵： (Splines:)

For a more formal, mathematical definition you can check this out, and for a more simplified understanding, I think this article does it best.

對于一個比較正式的，數學定義你可以檢查這個出來，一個更簡單的理解，我覺得這個文章做它最好的。

In an intuitive sense, splines help plot arbitrary functions smoothly — especially ones that require interpolations. Splines help model this missing data: here in modeling cloth deformation, where deformations in the patch shape can be seen in successive frames, we can use an advanced form of polynomial splines called Thin Plate Spline (TPS).

從直覺上講，樣條曲線有助于平滑繪制任意函數，尤其是那些需要插值的函數。 樣條線有助于對缺失的數據進行建模：這里是在布料變形建模中，在連續的幀中可以看到補丁形狀的變形，我們可以使用稱為薄板樣條線 (TPS)的多項式樣條線的高級形式。

Check out this article by Columbia that illustrates and explains TPS Regression well.

查看Columbia 撰寫的這篇文章 ，它很好地說明和解釋了TPS回歸。

These changes, or displacements, in the patch frames overtime are then modeled simply as a regression problem (since we only need to predict the TPS parameters for future frames).

然后，將補丁幀超時中的這些變化或位移簡單地建模為回歸問題(因為我們只需要預測未來幀的TPS參數)。

生成T恤圖案： (Generating the T-shirt Pattern:)

The said pattern is just an adversarial example — a patch that acts against the purpose of the object detector. The authors use the Expectation Over Transformation (EOT) algorithm which helps in generating such adversarial examples over a given transformation distribution.

所述模式僅是一個對抗性示例-違反目標檢測器目的的補丁。 作者使用轉換期望(EOT)算法 ，該算法有助于在給定的轉換分布上生成此類對抗性示例。

Here, the transformation distribution is made up of the TPS transformations since we want to replicate the real-time wrinkling, minor twisting, and changes in the contours of the fabric.

在這里，變換分布由TPS變換組成，因為我們要復制實時起皺，較小的扭曲以及織物輪廓的變化。

From [1]: Modeling the effects of cloth deformation.來自[1]：對布料變形的影響進行建模。

Along with TPS transformation they also use physical color transformation and conventional physical transformation within the person’s bounding box. Thus, this gives rise to the equation that models pixel values for the perturbed image.

除了TPS轉換，他們還使用人的邊界框內的物理顏色轉換和常規物理轉換。 因此，這引起了為被擾動的圖像建模像素值的方程式。

The EOT formulation based on all these complex formulations can finally compute the attack loss and work towards fooling the object detector.

基于所有這些復雜公式的EOT公式最終可以計算出攻擊損失并努力欺騙對象檢測器。

The explanation of the procedure, in its most simplified form, so far is for single object detectors. The authors have also proposed a strategy for multiple object detectors that involves applying min-max optimization to the single object detector equation.

迄今為止，該過程以其最簡化的形式針對單個對象檢測器進行了說明。 作者還提出了一種用于多目標檢測器的策略，該策略涉及將最小-最大優化應用于單個目標檢測器方程。

最后： (Finally:)

The results after training and testing on their own dataset are impressive.

經過對自己的數據集進行訓練和測試后，結果令人印象深刻。

From [1]. Results after generating a custom adversarial patch on the author’s dataset從[1]開始。 在作者的數據集上生成自定義對抗補丁后的結果

And the use of TPS shows great improvement too:

TPS的使用也顯示出巨大的改進：

From [1]. Results from different poses compared using TPS (second row) and without TPS (first row)從[1]開始。 使用TPS(第二行)和不使用TPS(第一行)比較不同姿勢的結果

未來是什么樣子的： (What the future holds:)

• In an article by the Northeastern University, Xue Lin, one of the authors of [1], clarified that their goal isn’t to create a T-shirt in order to furtively go unnoticed by the detectors.

  [1]的作者之一薛林在東北大學的一篇文章中澄清說，他們的目標不是制造T恤以偷偷摸摸地被探測器發現。

“The ultimate goal of our research is to design secure deep-learning systems, … But the first step is to benchmark their vulnerabilities.” — Xue Lin

“我們研究的最終目標是設計安全的深度學習系統，但是，第一步是對它們的漏洞進行基準測試。” 薛林

• Certainly the authors realise the great scope of improvement in their results and mention that further research will be done to achieve it.
  當然，作者意識到結果的巨大改進范圍，并提到將進行進一步的研究以實現這一目標。

Photo by Sebastian Molina fotografía on Unsplash 塞巴斯蒂安·莫利納 ( Sebastian Molina)攝影： Unsplash

Thank you for reading all the way through! You can reach out to me on LinkedIn for any messages, thoughts, or suggestions.

感謝您一直閱讀！ 您可以在LinkedIn上與我聯系，以獲取任何消息，想法或建議。

翻譯自: https://towardsdatascience.com/avoiding-detection-with-adversarial-t-shirts-bb620df2f7e6

檢測對抗樣本

總結

以上是生活随笔為你收集整理的检测对抗样本_避免使用对抗性T恤进行检测的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。