Results of the summarizing process for the arXiv paper: 2103.08860v1

The security of object detection systems has become a major concern due to the rise of adversarial patch attacks. These attacks involve manipulating pixels in a specific area of an object, making them particularly effective against human detection systems. Existing defense mechanisms against patch attacks are primarily designed for image classification problems and struggle to defend against attacks on human detection systems. To address this issue, we propose a new defense strategy called Ad-YOLO, which is an efficient and effective plug-in component for the YOLO detection system. Ad-YOLO introduces a patch class into the YOLO architecture, allowing it to directly detect both objects of interest and adversarial patches with minimal impact on inference time. Our approach is the first defense strategy specifically targeted at human detection attacks. To evaluate the performance of Ad-YOLO, we conducted experiments using the YOLOv2 baseline. In order to improve Ad-YOLO's ability to detect various types of patches, we utilized an adversarial training process to create a patch dataset called Inria-Patch based on the Inria dataset. We then trained Ad-YOLO using a combination of Pascal VOC, Inria, and Inria-Patch datasets. The results demonstrate that Ad-YOLO outperforms YOLOv2 when facing white-box patch attacks, achieving an average precision (AP) of 80.31% for persons compared to 33.93% AP for YOLOv2 with only a slight drop of 0.70% mean average precision (mAP) on the VOC 2007 test set. Furthermore, we also evaluated Ad-YOLO's performance against physical world attacks to showcase its excellent generalization ability compared to YOLOv2. In conclusion, our proposed defense strategy - Ad-YOLO - effectively addresses the challenge posed by adversarial patch attacks in human detection systems by achieving superior performance compared to existing methods and demonstrating strong generalization capabilities.

• - Security of object detection systems is a major concern due to adversarial patch attacks
• - Existing defense mechanisms struggle to defend against attacks on human detection systems
• - Ad-YOLO is a new defense strategy specifically targeted at human detection attacks
• - Ad-YOLO is an efficient and effective plug-in component for the YOLO detection system
• - Ad-YOLO introduces a patch class into the YOLO architecture to detect both objects of interest and adversarial patches
• - Ad-YOLO outperforms YOLOv2 in white-box patch attacks, achieving 80.31% average precision (AP) for persons compared to 33.93% AP for YOLOv2
• - Ad-YOLO has only a slight drop of 0.70% mean average precision (mAP) on the VOC 2007 test set compared to YOLOv2
• - Ad-YOLO demonstrates excellent generalization ability compared to YOLOv2 in physical world attacks

Key points 1. People are worried about the safety of systems that can detect objects because they can be tricked by fake patches. 2. The current ways to protect these systems struggle to defend against attacks on human detection. 3. Ad-YOLO is a new defense strategy made specifically to protect against attacks on human detection. 4. Ad-YOLO is a part that can be added to the YOLO detection system and it works well and fast. 5. Ad-YOLO can find both objects of interest and fake patches in the YOLO system. Definitions - Security: Making sure something is safe from harm or danger. - Object detection: Finding and recognizing things, like people or objects, in pictures or videos. - Adversarial patch: A fake image or mark that can trick an object detection system into seeing something that isn't there. - Defense mechanisms: Ways to protect against attacks or harm. - Efficient: Working well without wasting time or energy. - Effective: Doing what it's supposed to do and working well. - Plug-in component: Something extra that can be added to a bigger system to make it work better or do more things. - Architecture: The way something is designed and put together, like a building or a computer program. - Average precision (AP): A measure of how accurate an object detection system is at finding things correctly in different situations. - Mean average precision (mAP): An average measure of how accurate an object detection system is

Ad-YOLO: A Defense Strategy for Adversarial Patch Attacks on Human Detection Systems

In recent years, the security of object detection systems has become a major concern due to the rise of adversarial patch attacks. These attacks involve manipulating pixels in a specific area of an object, making them particularly effective against human detection systems. Existing defense mechanisms against patch attacks are primarily designed for image classification problems and struggle to defend against attacks on human detection systems. To address this issue, researchers at Inria have proposed a new defense strategy called Ad-YOLO that is specifically targeted at human detection attacks.

What is Ad-YOLO?

Ad-YOLO is an efficient and effective plug-in component for the YOLO (You Only Look Once) detection system. It introduces a patch class into the YOLO architecture, allowing it to directly detect both objects of interest and adversarial patches with minimal impact on inference time. This makes it an ideal solution for defending against patch attacks as it can quickly identify any malicious patches present in an image without significantly slowing down processing time or accuracy.

How Does Ad-YOLO Work?

To evaluate the performance of Ad-YOLO, researchers conducted experiments using the YOLOv2 baseline model as their starting point. They then improved its ability to detect various types of patches by utilizing an adversarial training process to create a patch dataset called Inria-Patch based on the Inria dataset. Finally, they trained Ad-YOLO using a combination of Pascal VOC, Inria, and Inria-Patch datasets in order to further improve its accuracy and generalization capabilities when facing white box patch attack scenarios such as physical world ones where malicious patches may be present but not necessarily known beforehand.

Results

The results demonstrate that Ad-YOLO outperforms YOLOv2 when facing white box patch attacks, achieving an average precision (AP) of 80.31% for persons compared to 33.93% AP for Y