Abstract: The object detection algorithm, which constitutes one of the components of UAV visual recognition systems, is susceptible to adversarial attacks. In particular, the threat posed by physical adversarial attacks is greater. In response to the poor performance of current physical adversarial attack methods in UAV object detection scenes, a scale-adaptive physical adversarial attack method is proposed. A patch-adaptive module is designed to enable the scaling of patches by utilizing the actual size of the object, thereby adapting to the multi-scale variations of the target. An optimization function is designed for multi-scale and multi-object attacks, the average maximum prediction scores of different feature layers in the detection network is integrated with the loss of object disappearance attack in the TOG algorithm. Multiple physical enhancement transformations are adopted to improve the physical robustness of the adversarial patch. Multi-scale vehicle data is collected using UAV to optimize patches. In the digital domain, the average attack success rate of adversarial patch is 81.4%. In the physical domain, the average attack success rate of physical patches within a height range of 20 to 65 meters is 42.6%. The results show that the SAPA method outperforms existing method in terms of attack effectiveness and robustness.

Key words: object detection, adversarial sample generation, UAV recognition, adversarial patch attack

摘要： 构成无人机视觉识别系统组成之一的目标检测算法容易遭受对抗攻击，尤其是物理对抗攻击的威胁更大。针对当前物理对抗攻击方法在无人机目标检测场景中攻击效果较差的问题，提出一种尺度自适应的物理对抗攻击方法——SAPA。设计补丁自适应模块，利用目标真实尺寸构造掩码对补丁进行缩放，以适应目标的多尺度变化。设计针对多尺度、多目标攻击的优化函数，将检测网络不同特征层的最大预测分数与TOG算法中目标消失攻击的损失结合。采用多种物理增强变换提升对抗补丁的物理鲁棒性。使用无人机采集多尺度车辆数据对补丁进行优化。在数字域中，对抗补丁的平均攻击成功率为81.4%。在物理域中，对抗补丁在20 m~65 m高度的平均攻击成功率为42.6%。结果表明，SAPA方法在攻击效果和鲁棒性方面优于现有方法。

关键词: 目标检测, 对抗样本生成, 无人机识别, 对抗补丁攻击