PhantomPatch: Easy-ignoring Attacks on Object Detectors Using Ghosting Artifacts

Current patches used to attack object detectors are easily noticeable as abnormal. To mitigate this shortcoming, we devise an innovative technique named PhantomPatch, which leverages lens flare phenomena to attack object detectors, particularly in autonomous driving systems. Leveraging transfer-based adversarial examples, this method fools object detectors by projecting deceptive lens flares or ghost images, which are meaningless to people, while the light source looks like nearby light for people. Thus, it is easy to ignore.In this way, we enable a cost-effective approach to manipulate the perception of the vehicle remotely. This strategy harmonizes adversarial patches with projecting image integrity correcting. Firstly, we propose to train a black-box transfer-based adversarial patch to fool the object-detecting system behind the camera. Then, the patch is printed and attached in front of a flashlight, which casts the patch onto the camera, resulting in a ghost image. We maintain the integrity of the image captured by the camera while casting the patch with image loss correction and optical distortion modeling.Our experimental results validate the effectiveness of PhantomPatch in evading existing object detectors such as YOLO V3/V5 and Faster R-CNN. Notably, during nocturnal scenarios, the technique achieves a success rate of 98.2%. Furthermore, our approach addresses limitations of existing methods, like conspicuousness and positional constraints, offering a low-cost and effective technique for adversarial attacks, especially for autonomous vehicles. Code and demo are available at https://github.com/rufus0803/PhantomPatch.