Adversarial YOLO: Defense Human Detection Patch Attacks
via Detecting Adversarial Patches

Generally speaking, there are currently two main solutions to patch attacks in human detection systems. The difference is whether we put the patch in the background [14] or on the objects of interest [6]. Considering that environmental factors are difficult to control in actual scenarios, the method of placing patches on the object is more in line with the needs of the application. Therefore, we use the method proposed in [14] to attack the object detection model YOLOv2.

First, we review the one-stage detection system YOLOv2 architecture. YOLOv2 divides a single frame image into multiple grids, and predicts bounding boxes for each grid cell. Assuming that there are $n$ classes to be identified, each bounding box can be written as an $(n+5)$ dimensional vector, as shown below:

where $\hat{X}$ and $\hat{Y}$ represent the center of the bounding box. $W$ and $H$ represent the width and height predicted relative to the whole image. $P_{obj}$ is the confidence score that represents the intersection over union (IOU) between the predicted box and any ground truth box, and $n$ conditional class probabilities $P_{cls_{i}}$ are conditioned on the grid cell containing an object.

To attack the above model, the method [14] considers the following mathematical formulation of finding an adversarial patch:

where $\mathcal{D}$ is a distribution over samples, $T$ ia s distribution over patch transformations, and $A$ is a patch application function that transforms the patch $\delta$ with $t$ and applies the result to the image $x$ by masking the appropriate pixels. The loss function $J(A(\delta,x,t),y)$ consists of three parts, as shown below:

The first item here is non-printable fraction denoted as $J_{nps}$ that represents how well the colours in the patch can be represented by a common printer. The second item, $J_{tv}$, is the total variation value of the image, which makes the patch color transition smooth and more natural. The third $J_{obj}$ represents the probability that the detector will detect a person, and we want this value to be as small as possible. We assume that people happen to be $cls_{i}$, then, there are three choices for $J_{obj}$ , namely, $P_{obj}$, $P_{cls_{i}}$ and $P_{obj}P_{cls_{i}}$. In [14], experiments are conducted on these three loss functions, and it is found that $P_{obj}$ has the strongest attack effect. In this paper, we set $J_{obj}=P_{obj}$ to generate patches.

The attack proposed in [14] can generate a rectangular patch, which can be printed out and taped to people’s chest during the attack. Thus, the accuracy of the detector in identifying a person can be greatly reduced, making the detector unable to identify the presence of a person, as shown in Figure 1(a). This type of attack in the physical world is inexpensive and highly threatening, so it is imperative to formulate corresponding defense strategies.

Motivated by the fact that object detection model YOLOv2 can recognize overlapping objects, in this paper, we develop an Ad-YOLO model that can recognize adversarial patches as a new category and restore the original object information. Additionally, to achieve better defense, we construct a new dataset, Inria-Patch, to assist in training the Ad-YOLO model.

Dataset We leverage both the 2007+2012 [1] Pascal VOC dataset and the YOLOv2 model for the human detection task. In the construction of the Inria-Patch dataset, we first train the YOLOv2 neural network on VOC 2007+2012 training set and name it $Model_{0}$ and then, use the attack [14] to generate adversarial patches on the Inria dataset, denoted as $patch_{0}$. Next, $patch_{0}$ are randomly added to the Inria dataset to retrain YOLOv2 with VOC 2007+2012 training set, and we obtain the new model $Model_{1}$. We carry out a total of three cycles and obtain a series of models: $M_{0}$, $M_{1}$, $M_{2}$, $M_{3}$. For the abpve four models, many more adversarial patches can be generated with the same attack method. Figure 4 shows the process for constructing the Inria-Patch dataset. For each model, five attacks with different initial values are performed, and there are a total of 20 attacks to generate adversarial patches. In the training process of each attack, 10 patches are taken out at the same step length interval, and 200 patches are obtained in total. Some patches are shown in Figure 3. Among these patches, 160 patches are used to train Ad-YOLO, which form the dataset P0, and the remaining 40 patches form the dataset P1. For convenience, we list some simple notations, as shown in Table 1.

Implementation details. In the training of the above models, the Adam optimizer is used with a learning rate of 0.01. In the training of adversarial patches, the default optimizer is Adam, and the learning rate is initialized as 0.03 and decays by a factor of 0.1 every 50 epochs.

All of our experiments are conducted on a computer cluster with 2 Intel Xeon E5-2650 v4 CPU cores, 128 GB RAM, and 8 NVIDIA Tesla V100 16 GB GPUs. Training each $Model_{i}$ and our Ad-YOLO requires four GPUs for four days, and training each patch requires one GPU for one day.

We first conduct a series of analyses on the performance of Ad-YOLO for object detection. Table 2 demonstrates the mAP and per-class AP for YOLOv2 ($Model_{0}$) and Ad-YOLO on VOC 2007 test set. One can observe that variations in AP with each category introduced by Ad-YOLO are moderate. In the average sense, Ad-YOLO scores $72.35\%$, with a negligible decrease of $0.70\%$ from YOLOv2.

Next, we check the effectiveness of Ad-YOLO for detecting persons on I1. As shown in Figure 6, Ad-YOLO reduces AP from $88.13\%$ for YOLOv2 to $86.91\%$, thus resulting in a $1.21\%$ decrease. In addition, patch detection for Ad-YOLO is measured on the I1-P1 dataset, and the AP reaches $83.91\%$.

Then, we seek to demonstrate the generalization of Ad-YOLO to unseen adversarial patches or persons. To this end, we evaluate a broader set of combinations of adversarial patches dataset with Inria dataset and study the effect of changing factors that are seen or unseen on the results. Table 3 shows the comparison of Ad-YOLO’AP in 4 combination cases. Specifically, Case I0-P0 is the result of the training process of Ad-YOLO and the performance is slightly better the other cases. The case I1-P0 reflects our Ad-YOLO’s generalization to detect persons under seen patch attacks. In this case, Ad-YOLO achieves relatively good results, with AP reaching $78.70\%$. When facing attacks of unknown adversarial patches, in case I0-P1, Ad-YOLO can still defend the attack, and the identification accuracy of the persons reaches $78.63\%$. In the case I1-P1, the attacks and scenarios Ad-YOLO faces are both unknown, and Ad-YOLO can also successfully defend against patch attacks in this case, reaching $77.82\%$, which is the lowest value in the four cases but meets its most difficult objective conditions.

Figure 5 is the display of defense in the case I1-P1. Our Ad-YOLO can simultaneously identify person and patch information under various circumstances. However, as shown in Figure 5(c), when a patch overlaps with others, Ad-YOLO may fail to detect patch information but does not affect human detection. The better results are also shown in Figure 5(b) and Figure 5(c) when the patch does not overlap in the case of one or more than one person. In Figure 5(d) shows a more complicated scenarios with more people and overlapping relationship. We can see all persons are successfully detected.

To summarize, Ad-YOLO matches the property of detectability that a qualified defense should have. On one hand, Ad-YOLO shows a powerful strength in detecting persons on the Inria dataset without severe impact on mAP for Pascal VOC dataset. On the other hand, Ad-YOLO shows good generalization to different scenes and persons.

The second battery of experiments seek to demonstrate the defense of Ad-YOLO against white-box attacks together with physical-world attacks, and the results show that Ad-YOLO meets the requirement for robustness.

Adversarial training approach is one of the most widely used defense method to effectively reinforce the model’s robustness to resist the adversarial attacks of white-box in classification problems, but it is rarely used in object detection problems. This part compares and shows the outstanding points of our Ad-YOLO and adversarial training method in object detection problems. In the process of developing the patch dataset, we obtain a series of adversarial train models $M_{i},i=1,2,3$ and corresponding adversarial patches $Patch_{i},i=0,1,2$ generated by white-box attacks.

Table 4 presents the results comparing the effectiveness of Ad-YOLO on P0 dataset and against white-box attacks to adversarial training models. In line with expectations, adversarial training models can improve the robustness to resist adversarial attack, while the clean AP decreases. However, the effect and cost of upgrading are obviously much worse than that of classification, it shows about $23\%-28\%$ increase in white-box attacks but with $1\%-2\%$ decrease in clean AP. In addition, we can see that the best performance in terms of adversarial robustness in adversarial training models is achieved by $Model_{3}$ when facing the white-box attack, but the result AP $61.65\%$ is still far worse than Ad-YOLO with AP $80.31\%$. Our Ad-YOLO has increased robustness by around $46\%$ but at the cost of $1.4\%$ clean AP decrease. On the basis of such a significant improvement, the drop of clean AP of Ad-YOLO is negligible compared to the original model ($Model_{0}$).

Ad-YOLO not only yields a significantly more robust detector, but also requires very little computing resources. As we know adversarial training methods need to alternate iterative training against attack patches and model parameters, this requires several times the computational cost of normal training and cannot be parallelized. Contrast with that, Ad-YOLO needs to be implemented to prepare the patch dataset which can be easily obtained by parallel training. Besides, compared with the normal training, the network structure and core training process of Ad-YOLO have no essential increase. Thus Ad-YOLO can performs great improvement in AP facing adversarial attacks (around $46\%$ increase), with negligible cost of clean AP ($1.4\%$ decrease) and the same computational cost as normal training (significant advantages over adversarial training).