Demystifying Adversarial Patch Attacks and Defenses in the Physical World

Overview

Adversarial patch attacks have become one of the most ubiquitous and urgent threats to state-of-the-art computer vision systems that are widely deployed in real-world platforms, such as critical surveillance cameras and autonomous vehicles. Specifically, these attacks are launched by embedding adversarial perturbations into small and purposely located patches, allowing the adversary to directly disrupt or mislead model predictions in digital and physical environments, such as hiding and altering target objects to evade vision-based detection systems.

In this talk, I will reveal the prior knowledge in adversarial patches by characterizing the causality, generation, and effectiveness, and illustrate the perturbations through modelling and visualization. Specifically, I will introduce a series of adversarial patch attacks in face recognition systems and autonomous driving cars that adopt diverse mechanisms to generate the patches and successfully spoof various systems in real-world scenarios. Then, I will present our recent studies in developing a zero-shot and patch-agnostic defense framework that can detect, localize, and purify adversarial patches and restore original images while outperforming existing defense solutions.