Targeted context attack for object detection

Compared to the untargeted attack, the targeted attack is a more challenging task in the field of adversarial attacks for object detection, because it aims to mislead the detectors to predict certain specific wrong labels rather than arbitrary labels. The existing targeted attack methods are primarily implemented by maximizing the classification score of the target object, resulting in poor attack performance, especially in the case of a large gap between the correct label and the specified wrong label of the victim object. Considering the significant impact of contextual information on object detection, it is difficult to mislabel the victim object to a designated object which has low association with the original context. Therefore, we design a classification network to model the contextual information and propose a Targeted Context Attack method which changes not only the classification score of the victim object itself, but also the score of its context. The extensive experiments on MS COCO and VOC datasets using YOLOv3 and Faster RCNN show that the targeted context attack largely improves the fooling rate of targeted attack for object detection in terms of both white-box and black-box cases, even if the target object is totally dissimilar with the victim object. Specifically, the proposed attack method at most achieves a 21.8% improvement in the fooling rate for attacking YOLOv3.