Physical Adversarial Background Patch Against Aerial Object Detection Based on Pareto Efficiency

For adversarial attacks on aerial image object detection, some physical background attack methods have been proposed and demonstrated excellent performance. However, most of the methods restrict the protected object to a fixed area, and changes in the position and size of the object can affect the effectiveness of the attack. In addition, the size of the background is only related to the size of the object, without considering any reduction in the background area. To alleviate these issues, this paper proposes a novel adversarial background patch generation strategy, which generates an adversarial background patch where aircrafts parked at any position within it remain undetected. Besides we also aim to make the size of the background as small as possible to improve the concealment of the attack and reduce the economic cost. Specifically, a series of adversarial images are generated by placing the aircraft at random angles and positions on the adversarial background patch. Then, a novel background patch optimization strategy is proposed, which enhances the occlusion robustness of the adversarial background patch by weighting the adversarial loss of each image in the batch based on adversarial difficulty. In addition, this paper proposes a novel area loss for achieving optimal area size, which is used to reduce the cost of producing the patch. Finally, a multi-objective optimization method based on Pareto efficiency is introduced for balancing two conflicting losses, the adversarial loss and the area loss. Experimental results show that the adversarial background patches generated by this method have excellent attack effects in both digital and physical attacks, exhibiting strong occlusion robustness. In addition of that, the adversarial background patches generated by this method achieve effective attacks in a smaller area and reduce the physical implementation cost.