Adversarial Attacks on Deep Learning Visual Object Detectors: Optimization and Evaluation of Physical Attack Vectors using YOLOv4

Adversarial attacks refer to an intentional manipulation of the visual input of a deep neural network (DNN). Such a modification can be aligned as an adversarial perturbation able to provoke critical failures of a detection model. Recent research has shown that DNNs are vulnerable against such adversarial attacks, especially in the field of digital attacks. In this work, to demonstrate the threat of adversarial attacks in a non-digital, real-world autonomous driving setting, an optimization pipeline is implemented to generate physical attacks. As the target model, the YOLOv4 algorithm model is chosen to validate the results based on a state-of-the-art object detector. The proposed method improves the success rate of attacks by using an adapted adversarial loss to increase the amount of information during training. In the customized optimization function of this work, several cost terms, including vector distance norms, total-variation loss, and grey-scale loss, are defined to shape the design of the attack. The combination and outbalancing of these terms result in inconspicuous adversarial attacks. Experiments are conducted to validate the approach. The adversarial attacks generated by this approach successfully reduce the confidence by more than 50% in a real indoor and outdoor testing scenes.