Physically structured adversarial patch inspired by natural leaves multiply angles deceives infrared detectors

Abstract

Researching infrared adversarial attacks is crucial for ensuring the safe deployment of security-sensitive systems reliant on infrared object detectors. However, current research on infrared adversarial attacks mainly focuses on pedestrian detection tasks. Due to the complex shape and structure of vehicles and the changing working conditions, adversarial attack in infrared vehicle detection pose challenges like difficult multi-angle attack, poor physical transferability, and weak environmental adaptation. This paper proposed Leaf-like Mask Bar Code (LMBC), a novel adversarial attack method for multi-angle physical black-box attack on infrared detectors. Inspired by natural leaf structures, a mask was designed to restrict the adversarial patch contour. Then, adversarial parameters of the patches (angle, sparsity, and position) were optimized using the Genetic Algorithm with Multi-segment (GAM). Moreover, leaf-like structures in physical adversarial patches were constructed using suitable infrared coating materials. deploying them at multiple angles. Experimental results demonstrated LMBC’s efficacy, paralyzing the infrared vehicle detector with an Average Precision (AP) as low as 33.7% and an average Attack Success Rate (ASR) as high as 92.9% across a distance of 2.4m 4.2 m and angles of 0° 360°. Moreover, LMBC’s adversarial patches transferred to mainstream detectors (e.g., Faster RCNN, Yolov3, etc.) and pedestrian detection tasks.