Adversarial patch camouflage against aerial detection

Richard den Hollander; Ajaya Adhikari; Ioannis Tolios; Michael van Bekkum; Anneloes Bal; Stijn Hendriks; Maarten Kruithof; Dennis Gross; Nils Jansen; Guillermo Perez; Kit Buurman; Stephan Raaijmakers

doi:10.1117/12.2575907

20 September 2020 Adversarial patch camouflage against aerial detection

Richard den Hollander, Ajaya Adhikari, Ioannis Tolios, Michael van Bekkum, Anneloes Bal, Stijn Hendriks, Maarten Kruithof, Dennis Gross, Nils Jansen, Guillermo Perez, Kit Buurman, Stephan Raaijmakers

Author Affiliations +

Proceedings Volume 11543, Artificial Intelligence and Machine Learning in Defense Applications II; 115430F (2020) https://doi.org/10.1117/12.2575907
Event: SPIE Security + Defence, 2020, Online Only

Abstract

Detection of military assets on the ground can be performed by applying deep learning-based object detectors on drone surveillance footage. The traditional way of hiding military assets from sight is camouflage, for example by using camouflage nets. However, large assets like planes or vessels are difficult to conceal by means of traditional camouflage nets. An alternative type of camouflage is the direct misleading of automatic object detectors. Recently, it has been observed that small adversarial changes applied to images of the object can produce erroneous output by deep learning-based detectors. In particular, adversarial attacks have been successfully demonstrated to prohibit person detections in images, requiring a patch with a specific pattern held up in front of the person, thereby essentially camouflaging the person for the detector. Research into this type of patch attacks is still limited and several questions related to the optimal patch configuration remain open. This work makes two contributions. First, we apply patch-based adversarial attacks for the use case of unmanned aerial surveillance, where the patch is laid on top of large military assets, camouflaging them from automatic detectors running over the imagery. The patch can prevent automatic detection of the whole object while only covering a small part of it. Second, we perform several experiments with different patch configurations, varying their size, position, number and saliency. Our results show that adversarial patch attacks form a realistic alter- native to traditional camouflage activities, and should therefore be considered in the automated analysis of aerial surveillance imagery.

Conference Presentation

Citation Download Citation

Richard den Hollander, Ajaya Adhikari, Ioannis Tolios, Michael van Bekkum, Anneloes Bal, Stijn Hendriks, Maarten Kruithof, Dennis Gross, Nils Jansen, Guillermo Perez, Kit Buurman, and Stephan Raaijmakers "Adversarial patch camouflage against aerial detection", Proc. SPIE 11543, Artificial Intelligence and Machine Learning in Defense Applications II, 115430F (20 September 2020); https://doi.org/10.1117/12.2575907

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available