Neuron Attribution-Based Attacks Fooling Object Detectors

In this work, we propose a neural attribution-based attack (NAA) to improve the transferability of adversarial examples, aiming at deceiving object detectors with different backbones or architectures. To measure the neuron attribution (importance) for a CNN layer of detector, we sum the classification scores of all positive proposal boxes to calculate the integrated attention (IA), then get the neuron attribution matrix via element-wise multiplying IA with the feature difference between the clean image be attacked and a black image. Considering that the summation may bias importance values of some neurons, a mask is designed to drop out some neurons. The proposed loss calculated from the rest of neurons is minimized to generated adversarial examples. Since our attack disturbs the upstream feature outputs, it effectively disorders the outputs of downstream tasks, such as box regression and classification, and finally fool the detector. Extensive experiments on PASCAL VOC and COCO dataset demonstrate that our method achieves better transferability compared to the state-of-the-arts.