Natural Adversarial Attacks

We study robust, efficient, and stealthy attacks on object detector types of classifiers. Such adversarial attacks are meant to suppress the correct classification of objects in a real world scenario, in our case the classification of road signs by a self-driving car. In this scenario, we need to design a physical attack, e.g. in the form of adding a sticker that looks natural (like an algae patina or marks left by a bird), so that it does not arouse suspicion, but reliably suppresses the classification during an approach without being affected by minor changes in brightness or distance. We show that such an attack can be achieved against a known network, applying a multi-phase approach to successively learn how to place and mildly adjust bird marks to robustly and effectively fool Yolo while retaining a natural look.