Mitigating Surrogate Bias in Black-Box Pedestrian Attacks via Mask-Based Gradient Backpropagation

This article studies transfer-based black-box pedestrian attacks in traffic scenes, where an attacker aims to deceive a target model by generating malicious examples using a surrogate model. The goal is to craft adversarial examples that can be misdetected by the target model, even though the attacker has limited knowledge about the target model’s architecture and parameters. However, the contribution of adversarial transferability to improved attack performance may be weakened due to possible differences in model architectures and training datasets between the surrogate model and the target model (referred to as “surrogate bias”). To mitigate this challenging issue, we propose a black-box attack method by developing an adversarial patch generator based on a novel mask-based gradient backpropagation (MGB) method. The core innovation of this article lies in the proposed MGB method, which combines random mask augmentation and weighted gradient backpropagation to enhance adversarial transferability, along with a mask regularization (MR) technique that stabilizes the patch distribution, improving attack robustness. Innovatively, MGB leverages the random mask augmentation combined with weighted gradient backpropagation to craft the adversarial patch, encouraging the model to learn more transferability patterns of the crafted patch. Furthermore, to mitigate the challenging variance shift issue raised by random masks between the training and testing phases, we propose an MR method to penalize large value updates in the patch, effectively stabilizing the learned distribution of the adversarial patch. Extensive experiments conducted on the classical benchmark demonstrate that our proposed attacking method has achieved superior attacking performance against multiple mainstream detectors and pedestrian datasets.