AB-VIP: Attack Method Using Brightness Information for Visibility Improvement of Adversarial Perturbations on the NMS Algorithm

As with classification models, object detection models are vulnerable to adversarial attacks. In particular, adversarial attacks on key components of object detection models such as Region Proposal Network (RPN) and Non-Maximum Suppression (NMS) algorithms have recently been highlighted. As a representative adversarial attack method targeting the NMS algorithm, PhantomSponges disrupts the normal operation of the NMS algorithm by using universal perturbations. However, since PhantomSponges focuses solely on the attack success rate, the adversarial examples it generates are visually noticeable. In this paper, we propose a simple yet effective attack method called Attack method using Brightness Information for Visibility Improvement(AB-VIP), to address the limitation of adversarial attack methods targeting the NMS algorithm. To improve the invisibility of adversarial examples, the proposed method adjusts universal perturbation using the brightness information of each target image. From the experimental results under various conditions, we demonstrate that the proposed method improves the invisibility of the existing NMS-targeted attack method while maintaining a high attack success rate. When applying the proposed method, the SSIM metric improved by 13.23%, while the L2 metric decreased by 66.23%.