Adversarial Examples for Vehicle Detection With Projection Transformation

Unmanned aerial vehicle (UAV) imaging object detection systems based on deep neural networks are vulnerable to adversarial patch attacks. However, existing UAV image adversarial patch generation methods mainly target flat digital images, neglecting the adjustments to the adversarial patch morphology brought about by changes in the imaging projection matrix in a 3-D physical environment. This leads to adaptability issues with the attack patches, where changes in the UAV’s observation angle might cause dynamic variations in the vehicle target’s position and size, such geometric instability means that preset attack patches may no longer be applicable. To address these issues, this article proposes an adversarial patch generation method based on a projection transformation model, which we call projective-patch attack. To tackle the adaptability problem of the attack patches, we employ an adversarial patch relocation strategy, adjusting the preset adversarial patch’s morphology, size, and positioning on the target vehicle through the projection transformation model to ensure omnidirectional adaptability at different angles and altitudes. We then train an adversarial patch using data captured from specific vehicle targets in multiple scenarios to enhance its attack universality across various real-world aerial photography scenarios. Results from the vanishing attack experiments show that our method enhanced the attack success rate (ASR) against YOLOv3 by 37.62% and 19.95% on the UAV and VisDrone datasets, respectively, compared to the baseline. For the Faster R-CNN detector, the success rates increased by 11.63% and 14.76%. Additionally, we investigated the transferability of projection patches and their attack performance at different sizes and angles, with our adversarial examples consistently performing well.