Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling
Abstract
This paper discusses the attack feasibility of Remote Adversarial Patch (RAP) targeting face detectors. RAP targeting face detectors has the following difficulties compared to RAP targeting general object detectors. (1) Objects of various scales are targets for detection, and especially for small faces, the amount of convolution of features to be used as the basis for detection is small, and the range of influence on the inference results is highly restricted. (2) Also, since this is a two-class classification problem, the feature gaps between classes are large, making it difficult to attack the inference results by guiding them to another class. In this paper, we propose a new patch placement method and loss function for each problem. The patches targeting the proposed face detector showed superior detection obstruct effects compared to the patches targeting the general object detector.