Hardening RGB-D object recognition systems against adversarial patch attacks

• Published in: Information sciences 2023-12, Vol.651, p.119701, Article 119701
• Main Authors: Zheng, Yang, Demetrio, Luca, Cinà, Antonio Emanuele, Feng, Xiaoyi, Xia, Zhaoqiang, Jiang, Xiaoyue, Demontis, Ambra, Biggio, Battista, Roli, Fabio
• Format: Article
• Language: English
• Subjects: Adversarial examples; Adversarial machine learning; Adversarial patch; Detector; Object recognition system; RGB-D
• ISSN: 0020-0255; 1872-6291
• DOI: 10.1016/j.ins.2023.119701

RGB-D object recognition systems improve their predictive performances by fusing color and depth information, outperforming neural network architectures that rely solely on colors. While RGB-D systems are expected to be more robust to adversarial examples than RGB-only systems, they have also been proven to be highly vulnerable. Their robustness is similar even when the adversarial examples are generated by altering only the original images' colors. Different works highlighted the vulnerability of RGB-D systems; however, there is a lacking of technical explanations for this weakness. Hence, in our work, we bridge this gap by investigating the learned deep representation of RGB-D systems, discovering that color features make the function learned by the network more complex and, thus, more sensitive to small perturbations. To mitigate this problem, we propose a defense based on a detection mechanism that makes RGB-D systems more robust against adversarial examples. We empirically show that this defense improves the performances of RGB-D systems against adversarial examples even when they are computed ad-hoc to circumvent this detection mechanism, and that is also more effective than adversarial training. •We assess the performance of a state-of-art system for object detection based on color and depth features.•We explain why RGB features are more vulnerable to attacks than depth features.•We develop a defense against adversarial examples.