Adversarial Patch Attacks Against Aerial Imagery Object Detectors Based on Interpretable Guidance

Although image recognition and classification methods based on deep neural networks (DNNs) have accomplished remarkable achievements in the domain of computer vision, more and more research in recent years has shown that these models may have vulnerabilities that can be easily exploited by attackers, leading to incorrect output results. Especially in the realm of object detection, the incorporation of meticulously crafted patches onto images can potentially deceive DNN-based detectors, resulting in erroneous output outcomes. These patches can be carefully designed to greatly interfere with and mislead the output results of deep neural networks. These misleading output results may lead to serious security issues and losses, so it is becoming increasingly important to study and strengthen the robustness and security of DNNs based target detectors. However, previous methods did not consider the interpretability of the model, and this paper proposes a new mothed to adversarial patch attacks. First, we employ the model interpretable algorithm Grad-CAM to obtain the patch's location within the model's region of interest for the target. Subsequently, we calculate the precise patch placement and apply it accordingly. Following that, we utilize a loss function to optimize patch, ensuring its effectiveness. The experimental results obtained from the DOTA dataset indicate that our proposed method effectively degrades the performance of the target detection model. Secondly, we conducted experiments to improve the transferability of adversarial patches across different models, and verified that using patches to cover the regions of interest in the model improves the transferability of patches.