Adversarial Attacks on Faster R-CNN: Design and Ablation Study

Abstract

Most adversarial attack methods focus on image classifiers rather than the other more common models deployed in security-critical applications. This work focuses on the design of the attack on the object detection model, Faster Region-based Convolutional Neural Network (Faster R-CNN). To this end, we first formulate adversarial attacks against Faster R-CNN as a multi-objective optimisation problem. Second, we apply Projected Gradient Descent (PGD) to solve the defined optimisation problem. In addition, we conduct an ablation study on the loss terms of the adversarial attacks’ objective function. Finally, the proposed attack is evaluated on the object detection task MSCOCO2017. Our experimental results show that attacking the Fast R-CNN submodule or attacking both Fast R-CNN and backbone network submodules leads to the best attack results at our widely selected evaluation metrics, and our best attack can reduce the detection accuracy mAP@[.5, .95] by 17.4%.