Physical Adversarial Attacks Against Aerial Object Detection With Feature-Aligned Expandable Textures

Physical adversarial attacks in aerial object detection have gained significant attention. Existing adversarial patches exhibit subpar visual effects and encounter limitations when transitioning from digital to physical spaces, restricting applicability in real-world scenarios. To address these challenges, we propose an adversarial texture generation method based on background texture design. This method selectively covers the background environment without interfering with the target surface. We also explore the translational invariance of fully convolutional networks to decouple adversarial textures from shapes, allowing adversarial textures to be arbitrarily expanded during use. The areas where adversarial textures are placed are designated as the “detection failure zone,” rendering the detector ineffective regardless of the aircraft’s position within this zone. This significantly enhances the practicality of the adversarial texture. To improve its concealment, we align the features of the adversarial textures with those of the original image using a pretrained VGG network, ensuring a consistent style and color tone with the background environment. Additionally, we employ a discriminator to further control the visual effects of the adversarial samples, ensuring effective concealment. Furthermore, we simulate the real environment in digital space using operations like affine transformations and Gaussian blur to transfer adversarial textures seamlessly from digital to physical space. This allows for the integration of adversarial textures into real environments without compromising their effectiveness. Experimental results demonstrate the effectiveness and consistent styling of the proposed adversarial texture in real-world environments, showing robustness against environmental changes, weather conditions, and viewing angles.

I. Introduction

Object detection stands as a pivotal technology extensively utilized in safety-critical scenarios, including industrial control and aerospace, especially in remote sensing [1]. Integrating deep neural networks (DNNs) into object detection has resulted in a substantial enhancement of detection accuracy [2], [3], [4], [5], [6]. Nevertheless, the intrinsic vulnerability of DNNs introduces novel challenges to the dependability and security of object detection methodologies grounded in this technology [7], [8], [9], [10], [11], [12]. Research on novel adversarial attack algorithms establishes a foundational framework for enhancing the adversarial robustness of DNNs and offers insights into their susceptibility to adversarial samples [10], [13], [14], [15], [16].