Infrared Adversarial Patch Generation Based on Reinforcement Learning

Shuangju Zhou, Yang Li (), Wenyi Tan, Chenxing Zhao, Xin Zhou and Quan Pan
Additional contact information
Shuangju Zhou: School of Automation, Northwestern Polytechnical University, Xi’an 710072, China
Yang Li: School of Automation, Northwestern Polytechnical University, Xi’an 710072, China
Wenyi Tan: School of Automation, Northwestern Polytechnical University, Xi’an 710072, China
Chenxing Zhao: School of Automation, Northwestern Polytechnical University, Xi’an 710072, China
Xin Zhou: School of Automation, Northwestern Polytechnical University, Xi’an 710072, China
Quan Pan: School of Automation, Northwestern Polytechnical University, Xi’an 710072, China

Mathematics, 2024, vol. 12, issue 21, 1-15

Abstract: Recently, there has been an increasing concern about the vulnerability of infrared object detectors to adversarial attacks, where the object detector can be easily spoofed by adversarial samples with aggressive patches. Existing attacks employ light bulbs, insulators, and both hot and cold blocks to construct adversarial patches. These patches are complex to create, expensive to produce, or time-sensitive, rendering them unsuitable for practical use. In this work, a straightforward and efficacious attack methodology applicable in the physical realm, wherein the patch configuration is simplified to uniform-sized grayscale patch blocks affixed to the object, is proposed. This approach leverages materials with varying infrared emissivity, which are easy to fabricate and deploy in the real world and can be long-lasting. We use a reinforcement learning approach to gradually optimize the patch generation strategy until the adversarial attack goal is achieved, which supports multi-gray scale patches and explores the effects of patch size and grayscale. The results of our experiments demonstrate the effectiveness of the method. In our configurations, the average accuracy of YOLO v5 in digital space drops from 95.7% to 45.4%, with an attack success rate of 68.3%. It is also possible to spoof the object detector in physical space.

Keywords: infrared image; adversarial attack; patch; reinforcement learning (search for similar items in EconPapers)
JEL-codes: C (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/2227-7390/12/21/3335/pdf (application/pdf)
https://www.mdpi.com/2227-7390/12/21/3335/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jmathe:v:12:y:2024:i:21:p:3335-:d:1505797

Access Statistics for this article

Mathematics is currently edited by Ms. Emma He

More articles in Mathematics from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().