SSIM-Based Autoencoder Modeling to Defeat Adversarial Patch Attacks

Object detection systems are used in various fields such as autonomous vehicles and facial recognition. In particular, object detection using deep learning networks enables real-time processing in low-performance edge devices and can maintain high detection rates. However, edge devices that operate...

Full description

Saved in:
Bibliographic Details
Published in:Sensors (Basel, Switzerland) Switzerland), 2024-10, Vol.24 (19), p.6461
Main Authors: Lee, Seungyeol, Hong, Seongwoo, Kim, Gwangyeol, Ha, Jaecheol
Format: Article
Language:English
Subjects:
adversarial patch attack
Algorithms
autoencoder
Autonomous vehicles
Biometry
Costs
Data compression
Deep learning
Detectors
Driverless cars
object detection
Sensors
structural similarity index measure
Traffic control
YOLO
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Object detection systems are used in various fields such as autonomous vehicles and facial recognition. In particular, object detection using deep learning networks enables real-time processing in low-performance edge devices and can maintain high detection rates. However, edge devices that operate far from administrators are vulnerable to various physical attacks by malicious adversaries. In this paper, we implement a function for detecting traffic signs by using You Only Look Once (YOLO) as well as Faster-RCNN, which can be adopted by edge devices of autonomous vehicles. Then, assuming the role of a malicious attacker, we executed adversarial patch attacks with Adv-Patch and Dpatch. Trying to cause misdetection of traffic stop signs by using Adv-Patch and Dpatch, we confirmed the attacks can succeed with a high probability. To defeat these attacks, we propose an image reconstruction method using an autoencoder and the Structural Similarity Index Measure (SSIM). We confirm that the proposed method can sufficiently defend against an attack, attaining a mean Average Precision (mAP) of 91.46% even when two adversarial attacks are launched.
ISSN:1424-8220
1424-8220
DOI:10.3390/s24196461