Black-box adversarial patch attacks using differential evolution against aerial imagery object detectors

Abstract

Adversarial patch attacks are commonly used to attack aerial imagery object detectors. However, most existing methods are designed for white-box settings, which are impractical in real world scenarios. In this work, we propose a novel framework for black-box adversarial patch attacks against aerial imagery object detectors using differential evolution (DE). Specifically, we first introduce a new dimensionality reduction strategy to address the high-dimensionality curse in DE optimization problems. Then, we design three universal fitness functions to help DE to select better individuals within a limited computational budget. Finally, we conduct extensive experiments on the Dataset for Object Detection in Aerial images (DOTA) against You Only Look Once (YOLOv3, YOLOv4), and Faster Region-based Convolutional Network (Faster R-CNN), utilizing attack success rate (ASR) and average precision (AP) to quantitatively evaluate the attack efficiency. Results on YOLOv3 for the plane category indicate that our proposed strategy achieves at least a 20.97% improvement in ASR compared to existing dimensionality reduction schemes. Moreover, experiments conducted on detectors with different architectures reveal inconsistent adversarial robustness across categories. To the best of our knowledge, this is the first work to explore the use of DE in black-box adversarial patch attacks against aerial imagery object detectors. Our code has been released at https://github.com/tang-agui/Bbox-Att-Detector.