Double adversarial attack against license plate recognition system

Xianyi CHEN; Jun GU; Kai YAN; Dong JIANG; Linfeng XU; Zhangjie FU

doi:10.11959/j.issn.2096-109x.2023034

您当前的位置：

首页 >

文章列表页 >

Double adversarial attack against license plate recognition system

Papers | 更新时间：2024-06-03

- Double adversarial attack against license plate recognition system
- Chinese Journal of Network and Information Security Vol. 9, Issue 3, Pages: 16-27(2023)
- 作者机构：
  
  1. 南京信息工程大学数字取证教育部工程研究中心，江苏南京 210044
  2. 综合业务网理论及关键技术国家重点实验室（西安电子科技大学），陕西西安 710126
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023034
  CLC： TP393
- Online First：2023-06，
  
  Published：25 June 2023
- 稿件说明：
移动端阅览
Xianyi CHEN, Jun GU, Kai YAN, et al. Double adversarial attack against license plate recognition system[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 16-27.
DOI：

Xianyi CHEN, Jun GU, Kai YAN, et al. Double adversarial attack against license plate recognition system[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 16-27. DOI： 10.11959/j.issn.2096-109x.2023034.

摘要

使用深度神经网络的人工智能系统面对对抗样本的攻击表现出极大的脆弱性。因此，在基于深度神经网络的车牌识别系统（LPR，license plate recognition）场景下，提出针对车牌识别系统的双重对抗攻击（DAA，double adversarial attack）方法。通过添加对抗补丁到车牌的图案位置，使LPR的目标检测子系统不能检测到车牌类；通过在车牌号上添加不规则的单连通区域扰动斑点以模拟自然形成的铁锈、污渍等，使 LPR 的车牌号识别子系统产生误识别。针对车牌研究设计不同形状的对抗补丁、不同颜色的对抗斑点，以此产生对抗车牌，并迁移到物理世界中。实验结果表明，设计出的对抗样本既不会被人眼所察觉，也能够欺骗车牌识别系统，如EasyPR，在物理世界中的攻击成功率能够达到99%。关于LPR的对抗攻击及深度学习的脆弱性研究，对提高车牌识别模型的鲁棒性具有积极促进意义。

Abstract

Recent studies have revealed that deep neural networks (DNN) used in artificial intelligence systems are highly vulnerable to adversarial sample-based attacks.To address this issue

a dual adversarial attack method was proposed for license plate recognition (LPR) systems in a DNN-based scenario.It was demonstrated that an adversarial patch added to the pattern location of the license plate can render the target detection subsystem of the LPR system unable to detect the license plate class.Additionally

the natural rust and stains were simulated by adding irregular single-connected area random points to the license plate image

which results in the misrecognition of the license plate number.or the license plate research

different shapes of adversarial patches and different colors of adversarial patches are designed as a way to generate adversarial license plates and migrate them to the physical world.Experimental results show that the designed adversarial samples are undetectable by the human eye and can deceive the license plate recognition system

such as EasyPR.The success rate of the attack in the physical world can reach 99%.The study sheds light on the vulnerability of deep learning and the adversarial attack of LPR

and offers a positive contribution toward improving the robustness of license plate recognition models.

关键词

Keywords

references

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv Preprint arXiv:13126199 , 2013 .

潘文雯 , 王新宇 , 宋明黎 , 等 . 对抗样本生成技术综述 [J ] . 软件学报 , 2020 , 31 ( 1 ): 67 - 81 .

PAN W W , WANG X Y , SONG M L , et al . Survey on generating adversarial examples [J ] . Journal of Software , 2020 , 31 ( 1 ): 67 - 81 .

马钰锡 , 张全新 , 谭毓安 , 等 . 面向智能攻击的行为预测研究 [J ] . 软件学报 , 2020 , 32 ( 5 ): 1526 - 1546 .

MA Y Xi , ZHANG Q X , TAN Y A , et al . Research on behavior-prediction for intelligent attacks [J ] . Journal of Software , 2020 , 32 ( 5 ): 1526 - 1546 .

陈晋音 , 沈诗婧 , 苏蒙蒙 , 等 . 车牌识别系统的黑盒对抗攻击 [J ] . 自动化学报 , 2021 , 47 ( 1 ): 121 - 135 .

CHEN J Y , SHEN S J , SU M M , et al . Black-box adversarial attack on license plate recognition system [J ] . Acta Automatica Sinica , 2021 , 47 ( 1 ): 121 - 135 .

BIGGIO B , CORONA I , MAIORCA D , et al . Evasion attacks against machine learning at test time [C ] // Machine Learning and Knowledge Discovery in Databases:European Conference,ECML PKDD 2013,Prague,Czech Republic , 2013 : 387 - 402 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . arXiv Preprint arXiv:14126572 , 2014 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FROSSARD P . Deepfool:a simple and accurate method to fool deep neural networks [C ] // Proceedings of the IEEE conference on computer vision and pattern recognition,Las Vegas,America , 2016 : 2574 - 2582 .

CARLINI N , WAGNER D . Towards evaluating the robustness of neural networks [C ] // 2017 ieee symposium on security and privacy (sp),San Jose,CA,USA , 2017 : 39 - 57 .

BROWN T B , MANÉ D , ROY A , et al . Adversarial patch [J ] . arXiv Preprint arXiv:171209665 , 2017 .

EYKHOLT K , EVTIMOV I , FERNANDES E , et al . Robust physical-world attacks on deep learning visual classification [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 1625 - 1634 .

ATHALYE A , ENGSTROM L , ILYAS A , et al . Synthesizing robust adversarial examples [C ] // International Conference on Machine Learning . 2018 : 284 - 293 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FAWZI O , et al . Universal adversarial perturbations [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2017 : 1765 - 1773 .

TSAI T , YANG K , HO T Y , et al . Robust adversarial objects against deep learning models [C ] // Proceedings of the AAAI Conference on Artificial Intelligence,Hilton New York Midtown , 2020 : 954 - 962 .

CHEN S T , CORNELIUS C , MARTIN J , et al . Shapeshifter:Robust physical adversarial attack on faster R-CNN object detector [C ] // Machine Learning and Knowledge Discovery in Databases:European Conference,ECML PKDD 2018,Dublin,Ireland , 2018 : 52 - 68 .

REN S , HE K , GIRSHICK R , et al . Faster R-CNN:Towards real-time object detection with region proposal networks [J ] . Advances in Neural Information Processing Systems , 2015 ,28.

REDMON J , FARHADI A . YOLO9000:better,faster,stronger [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2017 : 7263 - 7271 .

THYS S , VAN R W , GOEDEMÉ T . Fooling automated surveillance cameras:adversarial patches to attack person detection [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops . 2019 .

XU K , ZHANG G , LIU S , et al . Adversarial t-shirt! evading person detectors in a physical world [C ] // Computer Vision–ECCV 2020:16th European Conference . 2020 : 665 - 681 .

KAZIAKHMEDOV E , KIREEV K , MELNIKOV G , et al . Real-world attack on MTCNN face detection system [C ] // 2019 International Multi-Conference on Engineering,Computer and Information Sciences (SIBIRCON) . 2019 : 422 - 427 .

HUANG L , GAO C , ZHOU Y , et al . Universal physical camouflage attacks on object detectors [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2020 : 720 - 729 .

ZHU X , LI X , LI J , et al . Fooling thermal infrared pedestrian detectors in real world using small bulbs [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . 2021 : 3616 - 3624 .

HU Y C T , KUNG B H , TAN D S , et al . Naturalistic physical adversarial patch for object detectors [C ] // Proceedings of the IEEE/CVF International Conference on Computer Vision . 2021 : 7848 - 7857 .

HU Z , HUANG S , ZHU X , et al . Adversarial texture for fooling person detectors in the physical world [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,New Orleans Ernest N . 2022 : 13307 - 13316 .

WANG J , LIU A , YIN Z , et al . Dual attention suppression attack:Generate adversarial camouflage in physical world [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2021 : 8565 - 8574 .

DU A , CHEN B , CHIN T J , et al . Physical adversarial attacks on an aerial imagery object detector [C ] // Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision,New Orleans Ernest N . 2022 : 1796 - 1806 .

WANG D , JIANG T , SUN J , et al . Fca:Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . , 2022 : 2414 - 2422 .

REDMON J , FARHADI A . Yolov3:An incremental improvement [J ] . arXiv Preprint arXiv:180402767 , 2018 .

SURYANTO N , KIM Y , KANG H , et al . Dta:Physical camouflage attacks using differentiable transformation network [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2022 : 15305 - 15314 .

BOCHKOVSKIY A , WANG C Y , LIAO H Y M . Yolov4:Optimal speed and accuracy of object detection [J ] . arXiv Preprint arXiv:200410934 , 2020 .

PURKAIT P , ZHAO C , ZACH C . SPP-Net:Deep absolute pose regression with synthetic views [J ] . arXiv Preprint arXiv:171203452 , 2017 .

LIU S , QI L , QIN H , et al . Path aggregation network for instance segmentation [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2018 : 8759 - 8768 .

PARISI R , DI CLAUDIO E D , LUCARELLI G , et al . Car plate recognition by neural networks and image processing [C ] // 1998 IEEE International Symposium on Circuits and Systems (ISCAS) . 1998 : 195 - 198 .

QIAN Y , MA D , WANG B , et al . Spot evasion attacks:Adversarial examples for license plate recognition systems with convolutional neural networks [J ] . Computers ＆ Security , 2020 ,95:101826.

KWON H , BAEK J W . Adv-plate attack:adversarially perturbed plate for license plate recognition system [J ] . Journal of Sensors , 2021 , 2021 : 1 - 10 .

WANG C Y , LIAO H Y M , WU Y H , et al . CSPNet:A new backbone that can enhance learning capability of CNN [C ] // Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops : 390 - 391 .

Views

214

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Adversarial detection based on feature invariant in license plate recognition systems

Survey of optical-based physical domain adversarial attacks and defense

Adversarial patch defense algorithm based on PatchTracker

Survey on vertical federated learning: algorithm, privacy and security

RSA-based image recognizable adversarial attack method

Related Author

HUANG Zheng

QIU Weidong

ZHANG Haochen

TANG Peng

ZHU Xiaoyu

GUO Haifeng

ZHENG Haibin

ZHAO Xiaoming

Related Institution

School of Cyber Science and Engineering, Shanghai Jiao Tong University

Institute of Cyberspace Security, Zhejiang University of Technology

College of Information Engineering, Zhejiang University of Technology

College of Computer and Cyber Security, Fujian Normal University

Digital Fujian Institute of Big Data Security Technology

⁰