Fooling Computer Vision Classifiers with Adversarial Examples

The U.S. Navy is interested in realizing physical robust adversarial examples that fool computer vision classifiers and the counter defenses to such technology. There is a need to identify effective techniques to change the physical appearance of objects in such a way to cause computer vision classifiers to misclassify those objects. A set of techniques must be identified and tested against multiple state-of-the-art classifiers (for black-box effectiveness) using images from multiple viewpoints around the target object (for physical robustness). In the Phase I feasibility study Lynntech was able to manipulate state-of-the-art CV classifiers. We can synthesize targeted, untargeted and invisibility adversarial attack patterns for real-world printed patches on a vehicle of interest for a range of relevant viewpoints. Our technique uses a victim set composed of multiple renderings, along with a set of different backgrounds, and advanced data augmentation transformations to synthesize robust physical adversarial examples. It is also resistant to printer infidelity and patch placement variability. Importantly, we conducted a successful field test of adversarial patches applied to a vehicle and evaluated with a series of drone flyovers. Our Phase II effort will mature this technology to apply to different vehicles, work against different classifiers, and develop counter defenses.