Enhancing robustness of person detection: A universal defense filter against adversarial patch attacks

Abstract

Person detection is one of the most popular object detection applications, and has been widely used in safety-critical systems such as autonomous driving. However, recent studies have revealed that person detectors are vulnerable to physically adversarial patch attacks and may suffer detection failure. Data-side defense is an effective approach to address this issue, owing to its low computational cost and ease of deployment. However, existing data-side defenses have limited effectiveness in resisting adaptive patch attacks. To overcome this challenge, we propose a new data-side defense, called Universal Defense Filter (UDFilter). UDFilter covers the input images with an equal-size defense filter to weaken the negative impact of adversarial patches. The defense filter is generated using a self-adaptive learning algorithm that facilitates iterative competition between adversarial patch and defense filter, thus bolstering UDFilter’s ability to defense adaptive attacks. Furthermore, to maintain the clean performance, we propose a plug-and-play Joint Detection Strategy (JDS) during the model testing phase. Extensive experiments have shown that UDFilter can significantly enhance robustness of person detection against adversarial patch attacks. Moreover, UDFilter does not result in a discernible reduction in the model’s clean performance.