# Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World

**Authors:** Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, Xianglong Liu  
**arXiv:** [2103.01050](https://arxiv.org/abs/2103.01050)  
**Date:** 2021-03-01  
**Summary page:** https://www.summarizepaper.com/en/paper/2103.01050v1/

## Key points

- Deep learning models are vulnerable to adversarial examples
- Physical adversarial examples pose a greater threat to practical deep learning systems
- Existing works in this area have generated weak and visually suspicious adversarial perturbations in the physical world that lack transferability across different models
- The authors propose a Dual Attention Suppression (DAS) attack method to address these limitations
- DAS attack generates visually-natural physical adversarial camouflages with strong transferability by suppressing both model and human attention
- DAS attack involves distracting the model's shared attention patterns from target regions to non-target regions, generating transferable adversarial camouflages
- Exploiting human visual attention focusing on salient items, such as suspicious distortions, DAS generates visually-natural camouflages correlated to scenario context
- The proposed method is evaluated through extensive experiments in digital and physical worlds using up-to-date models like Yolo-V5
- Results demonstrate that the DAS attack outperforms state-of-the-art methods in generating effective adversarial camouflages
- This paper contributes to advancing research on physical adversarial examples by leveraging attention mechanisms and recognition processes' intrinsic characteristics

## Summary

The paper discusses the vulnerability of deep learning models to adversarial examples and focuses on physical adversarial examples, which pose a greater threat to practical deep learning systems. Existing works in this area have generated weak adversarial perturbations in the physical world that lack transferability across different models and appear visually suspicious. To address these limitations, the authors propose a Dual Attention Suppression (DAS) attack method that generates visually-natural physical adversarial camouflages with strong transferability by suppressing both model and human attention. The DAS attack approach involves generating transferable adversarial camouflages by distracting the model's shared attention patterns from the target regions to non-target regions. Additionally, the authors exploit the fact that human visual attention focuses on salient items, such as suspicious distortions. By evading human-specific bottom-up attention, they generate visually-natural camouflages that are correlated to the scenario context. The proposed method is evaluated through extensive experiments in both digital and physical worlds for classification and detection tasks using up-to-date models like Yolo-V5. The results demonstrate that the DAS attack outperforms state-of-the-art methods in terms of generating effective adversarial camouflages. Overall, this paper contributes to advancing research on physical adversarial examples by leveraging attention mechanisms and intrinsic characteristics of recognition processes to generate visually-natural and highly transferable adversarial camouflages.