Ilina Olga, Tereshonok Maxim, Ziyadinov Vadim
Science and Research Department, Moscow Technical University of Communications and Informatics, 111024 Moscow, Russia.
J Imaging. 2025 Jan 17;11(1):26. doi: 10.3390/jimaging11010026.
Object detection in images is a fundamental component of many safety-critical systems, such as autonomous driving, video surveillance systems, and robotics. Adversarial patch attacks, being easily implemented in the real world, provide effective counteraction to object detection by state-of-the-art neural-based detectors. It poses a serious danger in various fields of activity. Existing defense methods against patch attacks are insufficiently effective, which underlines the need to develop new reliable solutions. In this manuscript, we propose a method which helps to increase the robustness of neural network systems to the input adversarial images. The proposed method consists of a Deep Convolutional Neural Network to reconstruct a benign image from the adversarial one; a Calculating Maximum Error block to highlight the mismatches between input and reconstructed images; a Localizing Anomalous Fragments block to extract the anomalous regions using the Isolation Forest algorithm from histograms of images' fragments; and a Clustering and Processing block to group and evaluate the extracted anomalous regions. The proposed method, based on anomaly localization, demonstrates high resistance to adversarial patch attacks while maintaining the high quality of object detection. The experimental results show that the proposed method is effective in defending against adversarial patch attacks. Using the YOLOv3 algorithm with the proposed defensive method for pedestrian detection in the INRIAPerson dataset under the adversarial attacks, the mAP50 metric reaches 80.97% compared to 46.79% without a defensive method. The results of the research demonstrate that the proposed method is promising for improvement of object detection systems security.
图像中的目标检测是许多安全关键系统的基本组成部分，如自动驾驶、视频监控系统和机器人技术。对抗性补丁攻击在现实世界中易于实施，能对基于神经网络的最先进目标检测器进行有效的对抗。它在各个活动领域都构成了严重威胁。现有的针对补丁攻击的防御方法效果不佳，这凸显了开发新的可靠解决方案的必要性。在本论文中，我们提出了一种有助于提高神经网络系统对输入对抗性图像鲁棒性的方法。所提出的方法包括一个深度卷积神经网络，用于从对抗性图像重建良性图像；一个计算最大误差模块，用于突出输入图像和重建图像之间的不匹配；一个定位异常片段模块，用于使用图像片段直方图的孤立森林算法提取异常区域；以及一个聚类和处理模块，用于对提取的异常区域进行分组和评估。所提出的基于异常定位的方法在保持目标检测高质量的同时，对对抗性补丁攻击具有很高的抗性。实验结果表明，所提出的方法在防御对抗性补丁攻击方面是有效的。在对抗攻击下，将所提出的防御方法与YOLOv3算法用于INRIAPerson数据集中的行人检测时，mAP50指标达到80.97%，而没有防御方法时为46.79%。研究结果表明，所提出的方法在提高目标检测系统安全性方面具有前景。
