Adversarial T-shirt!
Evading Person Detectors in A Physical World

Abstract

It is known that deep neural networks (DNNs) are vulnerable to adversarial attacks. The so-called physical adversarial examples deceive DNN-based decision makers by attaching adversarial patches to real objects. However, most of the existing works on physical adversarial attacks focus on static objects such as glass frames, stop signs and images attached to cardboard. In this work, we propose Adversarial T-shirts, a robust physical adversarial example for evading person detectors even if it could undergo non-rigid deformation due to a moving person’s pose changes. To the best of our knowledge, this is the first work that models the effect of deformation for designing physical adversarial examples with respect to non-rigid objects such as T-shirts. We show that the proposed method achieves 74% and 57% attack success rates in the digital and physical worlds respectively against YOLOv2. In contrast, the state-of-the-art physical attack method to fool a person detector only achieves 18% attack success rate. Furthermore, by leveraging min-max optimization, we extend our method to the ensemble attack setting against two object detectors YOLO-v2 and Faster R-CNN simultaneously.

frame 5 frame 30 frame 60 frame 90 frame 120 frame 150 pattern   Ours (digital)
adversarial T-shirt   Ours (physical):
Adversarial T-shirt   Affine (non-TPS)
adversarial T-shirt   Baseline physical attack

Figure 1: Evaluation of the effectiveness of adversarial T-shirts to evade person detection by YOLOv2. Each row corresponds to a specific attack method while each column except the last one shows an individual frame in a video. The last column shows the adversarial patterns applied to the T-shirts. At each frame, there are two persons, one of whom wears the adversarial T-shirt. First row: digital adversarial T-shirt generated using TPS. Second row: physical adversarial T-shirt generated using TPS. Third row: physical adversarial T-shirt generated using affine transformation (namely, in the absence of TPS). Fourth row: T-shirt with physical adversarial patch considered in [30] to evade person detectors.

1 Introduction

The vulnerability of deep neural networks (DNNs) against adversarial attacks (namely, perturbed inputs deceiving DNNs) has been found in applications spanning from image classification to speech recognition [18, 33, 35, 6, 32, 2]. Early works studied adversarial examples only in the digital space. Recently, some works showed that it is possible to create adversarial perturbations on physical objects and fool DNN-based decision makers under a variety of real-world conditions [28, 13, 1, 14, 25, 7, 30, 5, 21]. The design of physical adversarial attacks helps to evaluate the robustness of DNNs deployed in real-life systems, e.g., autonomous vehicles and surveillance systems. However, most of the studied physical adversarial attacks encounter two limitations: a) the physical objects are usually considered being static, and b) the possible deformation of adversarial pattern attached to a moving object (e.g., due to pose change of a moving person) is commonly neglected. In this paper, we propose a new type of physical adversarial attack, adversarial T-shirt, to evade DNN-based person detectors when a person wears the adversarial T-shirt; see the second row of Fig. 1 for illustrative examples.

Related work

Most of the existing physical adversarial attacks are generated against image classifiers and object detectors. In [28], a face recognition system is fooled by a real eyeglass frame designed under a crafted adversarial pattern. In [13], a stop sign is misclassified by adding black or white stickers on it against the image classification system. In [21], an image classifier is fooled by placing a crafted sticker at the lens of a camera. In [1], a so-called Expectation over Transformation (EoT) framework was proposed to synthesize adversarial examples robust to a set of physical transformations such as rotation, translation, contrast, brightness, and random noise. Compared to attacking image classifiers, generating physical adversarial attacks against object detectors is more involved. For example, the adversary is required to mislead the bounding box detector of an object when attacking YOLOv2 [26] and SSD [24]. A well-known success of such attacks in the physical world is the generation of adversarial stop sign [14], which deceives state-of-the-art object detectors such as YOLOv2 and Faster R-CNN [27].

The most relevant approach to ours is the work of [30], which demonstrates that a person can evade a detector by holding a cardboard with an adversarial patch. However, such a physical attack restricts the adversarial patch to be attached to a rigid carrier (namely, cardboard), and is different from our setting here where the generated adversarial pattern is directly printed on a T-shirt. We show that the attack proposed by [30] becomes ineffective when the adversarial patch is attached to a T-shirt (rather than a cardboard) and worn by a moving person (see the fourth row of Fig. 1). At the technical side, different from [30] we propose a thin plate spline (TPS) based transformer to model deformation of non-rigid objects, and develop an ensemble physical attack that fools object detectors YOLOv2 and Faster R-CNN simultaneously. We highlight that our proposed adversarial T-shirt is not just a T-shirt with printed adversarial patch for clothing fashion, it is a physical adversarial wearable designed for evading person detectors in the real world.

Our work is also motivated by the importance of person detection on intelligent surveillance. DNN-based surveillance systems have significantly advanced the field of object detection [17, 16]. Efficient object detectors such as faster R-CNN [27], SSD [24], and YOLOv2 [26] have been deployed for human detection. Thus, one may wonder whether or not there exists a security risk for intelligent surveillance systems caused by adversarial human wearables, e.g., adversarial T-shirts. However, paralyzing a person detector in the physical world requires substantially more challenges such as low resolution, pose changes and occlusions. The success of our adversarial T-shirt against real-time person detectors offers new insights for designing practical physical-world adversarial human wearables.

Contributions

We summarize our contributions as follows:

• We develop a TPS-based transformer to model the temporal deformation of an adversarial T-shirt caused by pose changes of a moving person. We also show the importance of such non-rigid transformation to ensuring the effectiveness of adversarial T-shirts in the physical world.

• We propose a general optimization framework for design of adversarial T-shirts in both single-detector and multiple-detector settings.

• We conduct experiments in both digital and physical worlds and show that the proposed adversarial T-shirt achieves 74% and 57% attack success rates respectively when attacking YOLOv2. By contrast, the physical adversarial patch [30] printed on a T-shirt only achieves 18% attack success rate. Some of our results are highlighted in Fig. 1.

2 Modeling Deformation of A Moving Object by Thin Plate Spline Mapping

In this section, we begin by reviewing some existing transformations required in the design of physical adversarial examples. We then elaborate on the Thin Plate Spline (TPS) mapping we adopt in this work to model the possible deformation encountered by a moving and non-rigid object.

Let $𝐱$ be an original image (or a video frame), and $t(\cdot )$ be the physical transformer. The transformed image $𝐳$ under $t$ is given by

$𝐳=t(𝐱).$ (1)

Existing transformations.

In [1], the parametric transformers include scaling, translation, rotation, brightness and additive Gaussian noise; see details in [1, Appendix D]. In [23], the geometry and lighting transformations are studied via parametric models. Other transformations including perspective transformation, brightness adjustment, resampling (or image resizing), smoothing and saturation are considered in [29, 9]. All the existing transformations are included in our library of physical transformations. However, they are not sufficient to model the cloth deformation caused by pose change of a moving person. For example, the second and third rows of Fig. 1 show that adversarial T-shirts designed against only existing physical transformations yield low attack success rates.

(a) (b) (c) (d)

Figure 2: Generation of TPS. (a) and (b): Two frames with checkerboard detection results. (c): Anchor point matching process between two frames (d): Real-world close deformation in (b) versus the synthesized TPS transformation (right plot).

TPS transformation for cloth deformation.

A person’s movement can result in significantly and constantly changing wrinkles (aka deformations) in her clothes. This makes it challenging to develop an adversarial T-shirt effectively in the real world. To circumvent this challenge, we employ TPS mapping [4] to model the cloth deformation caused by human body movement. TPS has been widely used as the non-rigid transformation model in image alignment and shape matching [19]. It consists of an affine component and a non-affine warping component. We will show that the non-linear warping part in TPS can provide an effective means of modeling cloth deformation for learning adversarial patterns of non-rigid objects.

TPS learns a parametric deformation mapping from an original image $𝐱$ to a target image $𝐳$ through a set of control points with given positions. Let $𝐩:=(\varphi ,\psi )$ denote the 2D location of an image pixel. The deformation from $𝐱$ to $𝐳$ is then characterized by the displacement of every pixel, namely, how a pixel at ${𝐩}^{(x)}$ on image $𝐱$ changes to the pixel on image $𝐳$ at ${𝐩}^{(z)}$, where ${\varphi }^{(z)}={\varphi }^{(x)}+{\mathrm{\Delta }}_{\varphi }$ and ${\psi }^{(z)}={\psi }^{(x)}+{\mathrm{\Delta }}_{\psi }$, and ${\mathrm{\Delta }}_{\varphi }$ and ${\mathrm{\Delta }}_{\psi }$ denote the pixel displacement on image $𝐱$ along $\varphi$ direction and $\psi$ direction, respectively.

Given a set of $n$ control points with locations ${\{{\widehat{𝐩}}_i^{(x)}:=({\widehat{\varphi }}_i^{(x)},{\widehat{\psi }}_i^{(x)})\}}_{i=1}^n$ on image $𝐱$, TPS provides a parametric model of pixel displacement when mapping ${𝐩}^{(x)}$ to ${𝐩}^{(z)}$ [8]

$\mathrm{\Delta }({𝐩}^{(x)};𝜽)=$ $a_0+a_1{\varphi }^{(x)}+a_2{\psi }^{(x)}+{\displaystyle \sum _{i=1}^n}{c}_{i}U({\Vert {\widehat{𝐩}}_i^{(x)}-{𝐩}^{(x)}\Vert }_2),$ (2)

where $U(r)=r^2\log (r)$ and $𝜽=[𝐜;𝐚]$ are the TPS parameters, and $\mathrm{\Delta }({𝐩}^{(x)};𝜽)$ represents the displacement along either $\varphi$ or $\psi$ direction.

Moreover, given the locations of control points on the transformed image $𝐳$ (namely, ${\{{\widehat{𝐩}}_i^{(z)}\}}_{i=1}^n$), TPS resorts to a regression problem to determine the parameters $𝜽$ in (2). The regression objective is to minimize the distance between ${\{{\mathrm{\Delta }}_{\varphi }({𝐩}_i^{(x)};{𝜽}_{\varphi })\}}_{i=1}^n$ and ${\{{\widehat{\mathrm{\Delta }}}_{\varphi ,i}:={\widehat{\varphi }}_i^{(z)}-{\widehat{\varphi }}_i^{(x)}\}}_{i=1}^n$ along the $\varphi$ direction, and the distance between ${\{{\mathrm{\Delta }}_{\psi }({𝐩}_i^{(x)};{𝜽}_{\psi })\}}_{i=1}^n$ and ${\{{\widehat{\mathrm{\Delta }}}_{\psi ,i}:={\widehat{\psi }}_i^{(z)}-{\widehat{\psi }}_i^{(x)}\}}_{i=1}^n$ along the $\psi$ direction, respectively. Thus, TPS (2) is applied to coordinate $\varphi$ and $\psi$ separately (corresponding to parameters ${𝜽}_{\varphi }$ and ${𝜽}_{\psi }$). The regression problem can be solved by the following linear system of equations [10]

(3)

where the $(i,j)$th element of $𝐊\in {ℝ}^{n\times n}$ is given by $K_{ij}=U({\Vert {\widehat{𝐩}}_i^{(x)}-{\widehat{𝐩}}_j^{(x)}\Vert }_2)$, the $i$th row of $𝐏\in {ℝ}^{n\times 3}$ is given by $P_i=[1,{\widehat{\varphi }}_i^{(x)},{\widehat{\psi }}_i^{(x)}]$, and the $i$th elements of ${\widehat{𝚫}}_{\varphi }\in {ℝ}^n$ and ${\widehat{𝚫}}_{\psi }\in {ℝ}^n$ are given by ${\widehat{\mathrm{\Delta }}}_{\varphi ,i}$ and ${\widehat{\mathrm{\Delta }}}_{\psi ,i}$, respectively.

Non-trivial application of TPS

The difficulty of implementing TPS for design of adversarial T-shirts exists from two aspects: 1) How to determine the set of control points? And 2) how to obtain positions $\{{\widehat{𝐩}}_i^{(x)}\}$ and $\{{\widehat{𝐩}}_i^{(z)}\}$ of control points aligned between a pair of video frames $𝐱$ and $𝐳$?

To address the first question, we print a checkerboard on a T-shirt and use the camera calibration algorithm [15, 34] to detect points at the intersection between every two checkerboard grid regions. These successfully detected points are considered as the control points of one frame. Fig. 2-(a) shows the checkerboard-printed T-shirt, together with the detected intersection points. Since TPS requires a set of control points aligned between two frames, the second question on point matching arises. The challenge lies in the fact that the control points detected at one video frame are different from those at another video frame (e.g., due to missing detection). Fig. 2-(a) v.s. (b) provides an example of point mismatch. To address this issue, we adopt a 2-stage procedure, coordinate system alignment followed by point aliment, where the former refers to conducting a perspective transformation from one frame to the other, and the latter finds the matched points at two frames through the nearest-neighbor method. We provide an illustrative example in Fig. 2-(c). We refer readers to Appendix A for more details about our method.

3 Generation of Adversarial T-shirt: An Optimization Perspective

In this section, we begin by formalizing the problem of adversarial T-shirt and introducing notations used in our setup. We then propose to design a universal perturbation used in our adversarial T-shirt to deceive a single object detector. We lastly propose a min-max (robust) optimization framework to design the universal adversarial patch against multiple object detectors.

Figure 3: Overview of the pipeline to generate adversarial T-shirts. First, the video frames containing a person whom wears the T-shirt with printed checkerboard pattern are used as training data. Second, the universal adversarial perturbation (to be designed) applies to the cloth region by taking into account different kinds of transformations. Third, the adversarial perturbation is optimized through problem (7) by minimizing the largest bounding-box probability belonging to the ‘person’ class. The optimization procedure is performed as a closed loop through back-propagation.

Let $𝒟:={\{{𝐱}_i\}}_{i=1}^M$ denote $M$ video frames extracted from one or multiple given videos, where ${𝐱}_i\in {ℝ}^d$ denotes the $i$th frame. Let $𝜹\in {ℝ}^d$ denote the universal adversarial perturbation applied to $𝒟$. The adversarial T-shirt is then characterized by $M_{c,i}\circ 𝜹$, where $M_{c,i}\in {\{0,1\}}^d$ is a bounding box encoding the position of the cloth region to be perturbed at the $i$th frame, and $\circ$ denotes element-wise product. The goal of adversarial T-shirt is to design $𝛅$ such that the perturbed frames of $𝒟$ are mis-detected by object detectors.

Fooling a single object detector.

We generalize the Expectation over Transformation (EoT) method in [3] for design of adversarial T-shirts. Note that different from the conventional EoT, a transformers’ composition is required for generating an adversarial T-shirt. For example, a perspective transformation on the bounding box of the T-shirt is composited with an TPS transformation applied to the cloth region.

Let us begin by considering two video frames, an anchor image ${𝐱}_0$ (e.g., the first frame in the video) and a target image ${𝐱}_i$ for $i\in [M]$. Given the bounding boxes of the person ($M_{p,0}\in {\{0,1\}}^d$) and the T-shirt ($M_{c,0}\in {\{0,1\}}^d$) at ${𝐱}_0$, we apply the perspective transformation from ${𝐱}_0$ to ${𝐱}_i$ to obtain the bounding boxes $M_{p,i}$ and $M_{c,i}$ at image ${𝐱}_i$. In the absence of physical transformations, the perturbed image ${𝐱}_i^{\prime }$ with respect to (w.r.t.) ${𝐱}_i$ is given by

${𝐱}_i^{\prime }=\underset{\text{A}}{\underbrace{(\mathrm{𝟏}-M_{p,i})\circ {𝐱}_i}}+\underset{\text{B}}{\underbrace{M_{p,i}\circ {𝐱}_i}}-\underset{\text{C}}{\underbrace{M_{c,i}\circ {𝐱}_i}}+\underset{\text{D}}{\underbrace{M_{c,i}\circ 𝜹}},$ (4)

where the term $A$ denotes the background region outside the bouding box of the person, the term $B$ is the person-bounded region, the term $C$ erases the pixel values within the bounding box of the T-shirt, and the term $D$ is the newly introduced additive perturbation. In (4), the prior knowledge on $M_{p,i}$ and $M_{c,i}$ is acquired by person detector and manual annotation, respectively. Without taking into account physical transformations, Eq. (4) simply reduces to the conventional formulation of adversarial example $(1-M_{c,i})\circ {𝐱}_i+M_{c,i}\circ 𝜹$.

Next, we consider three main types of physical transformations: a) TPS transformation $t_{\mathrm{TPS}}\in {𝒯}_{\mathrm{TPS}}$ applying to the adversarial perturbation $𝜹$ for modeling the effect of cloth deformation, b) physical color transformation $t_{\mathrm{color}}$ which converts digital colors to those printed and visualized in the physical world, and c) conventional physical transformation $t\in 𝒯$ applying to the region within the person’s bounding box, namely, $(M_{p,i}\circ {𝐱}_i-M_{c,i}\circ {𝐱}_i+M_{c,i}\circ 𝜹)$. Here ${𝒯}_{\mathrm{TPS}}$ denotes the set of possible non-rigid transformations, $t_{\mathrm{color}}$ is given by a regression model learnt from the color spectrum in the digital space to its printed counterpart, and $𝒯$ denotes the set of commonly-used physical transformations, e.g., scaling, translation, rotation, brightness, blurring and contrast. A modification of (4) under different sources of transformations is then given by

${𝐱}_i^{\prime }=$ $t_{\mathrm{env}}\left(\text{A}+t\left(\text{B}-\text{C}+t_{\mathrm{color}}\left(M_{c,i}\circ t_{\mathrm{TPS}}\left(𝜹+\mu 𝐯\right)\right)\right)\right)$ (5)

for $t\in 𝒯$, $t_{\mathrm{TPS}}\in {𝒯}_{\mathrm{TPS}}$, and $𝐯\sim 𝒩(0,1)$. In (5), the terms A, B and C have been defined in (4), and $t_{\mathrm{env}}$ denotes a brightness transformation to model the environmental brightness condition. In (5), $\mu 𝐯$ is an additive Gaussian noise that allows the variation of pixel values, where $\mu$ is a given smoothing parameter and we set it as $0.03$ in our experiments such that the noise realization falls into the range $[-0.1,0.1]$. The randomized noise injection is also known as Gaussian smoothing [11], which makes the final objective function smoother and benefits the gradient computation during optimization.

The prior work, e.g., [28, 12], established a non-printability score (NPS) to measure the distance between the designed perturbation vector and a library of printable colors acquired from the physical world. The commonly-used approach is to incorporate NPS into the attack loss through regularization. However, irt becomes non-trivial to find a proper regularization parameter, and the nonsmoothness of NPS makes optimization for the adversarial T-shirt difficult. To circumvent these challenges, we propose to model the color transformer $t_{\mathrm{color}}$ using a quadratic polynomial regression. The detailed color mapping is showed in Appendix B.

With the aid of (5), the EoT formulation to fool a single object detector is cast as

(7)

where $f$ denotes an attack loss for misdetection, $g$ is the total-variation norm that enhances perturbations’ smoothness [14], and $\lambda >0$ is a regularization parameter. We further elaborate on our attack loss $f$ in problem (7). In YOLOv2, a probability score associated with a bounding box indicates whether or not an object is present within this box. Thus, we specify the attack loss as the largest bounding-box probability over all bounding boxes belonging to the ‘person’ class. For Faster R-CNN, we attack all bounding boxes towards the class ‘background’. The more detailed derivation on the attack loss is provided in Appendix C. Fig. 3 presents an overview of our approach to generate adversarial T-shirts.

Min-max optimization for fooling multiple object detectors.

Unlike digital space, the transferability of adversarial attacks largely drops in the physical environment, thus we consider a physical ensemble attack against multiple object detectors. It was recently shown in [31] that the ensemble attack can be designed from the perspective of min-max optimization, and yields much higher worst-case attack success rate than the averaging strategy over multiple models. Given $N$ object detectors associated with attack loss functions ${\{f_i\}}_{i=1}^N$, the physical ensemble attack is cast as

(9)

where $𝐰$ are known as domain weights that adjust the importance of each object detector during the attack generation, $𝒫$ is a probabilistic simplex given by $𝒫=\{𝐰|{\mathrm{𝟏}}^T𝐰=1,𝐰\ge \mathrm{𝟎}\}$, $\gamma >0$ is a regularization parameter, and ${\varphi }_i(𝜹):=\frac{1}{M}{\sum }_{i=1}^M{𝔼}_{t\in 𝒯,t_{\mathrm{TPS}}\in {𝒯}_{\mathrm{TPS}}}\left[f({𝐱}_i^{\prime })\right]$ following (7). In (9), if $\gamma =0$, then the adversarial perturbation $𝜹$ is designed over the maximum attack loss (worst-case attack scenario) since ${\text{maximize}}_{𝐰\in 𝒫}{\sum }_{i=1}^N{w}_i{\varphi }_i(𝜹)={\varphi }_{i^{\ast }}(𝜹)$, where $i^{\ast }=argma{x}_i{\varphi }_i(𝜹)$ at a fixed $𝜹$. Moreover, if $\gamma \to \mathrm{\infty }$, then the inner maximization of problem (9) implies $𝐰\to \mathrm{𝟏}/N$, namely, an averaging scheme over $M$ attack losses. Thus, the regularization parameter $\gamma$ in (9) strikes a balance between the max-strategy and the average-strategy.

4 Experiments

In this section, we demonstrate the effectiveness of our approach (we call advT-TPS) for design of the adversarial T-shirt by comparing it with $2$ attack baseline methods, a) adversarial patch to fool YOLOv2 proposed in [30] and its printed version on a T-shirt (we call advPatch), and b) the variant of our approach in the absence of TPS transformation, namely, ${𝒯}_{\mathrm{TPS}}=\mathrm{\varnothing }$ in (5) (we call advT-Affine). We examine the convergence behavior of proposed algorithms as well as its Attack Success Rate (ASR) in both digital and physical worlds. We clarify our algorithmic parameter setting in Appendix D.

Prior to detailed illustration, we briefly summarize the attack performance of our proposed adversarial T-shirt. When attacking YOLOv2, our method achieves 74% ASR in the digital world and 57% ASR in the physical world, where the latter is computed by averaging successfully attacked video frames over all different scenarios (i.e., indoor, outdoor and unforeseen scenarios) listed in Table 2. When attacking Faster R-CNN, our method achieves 61% and 47% ASR in the digital and the physical world, respectively. By contrast, the baseline advPatch only achieves around 25% ASR in the best case among all digital and physical scenarios against either YOLOv2 or Faster R-CNN (e.g., 18% against YOLOv2 in the physical case).

4.1 Experimental Setup

Data collection.

We collect two datasets for learning and testing our proposed attack algorithm in digital and physical worlds. The training dataset contains $40$ videos ($2003$ video frames) from $4$ different scenes: one outdoor and three indoor scenes. each video takes $5$-$10$ seconds and was captured by a moving person wearing a T-shirt with printed checkerboard. The desired adversarial pattern is then learnt from the training dataset. The test dataset in the digital space contains $10$ videos captured under the same scenes as the training dataset. This dataset is used to evaluate the attack performance of the learnt adversarial pattern in the digital world. In the physical world, we customize a T-shirt with the printed adversarial pattern learnt from our algorithm. Another $24$ test videos (Section 4.3) are then collected at a different time capturing two or three persons (one of them wearing the adversarial T-shirt) walking a) side by side or b) at different distances. An additional control experiment in which actors wearing adversarial T-shirts walk in an exaggerated way is conducted to introduce large pose changes in the test data. In addition, we also test our adversarial T-shirt by unforeseen scenarios, where the test videos involve different locations and different persons which are never covered in the training dataset. All videos were taken using an iPhone X and resized to 416 $\times$ 416. In Table A2 of the Appendix F, we summarize the collected dataset under all circumstances.

Object detectors.

We use two state-of-the-art object detectors: Faster R-CNN [27] and YOLOv2 [26] to evaluate our method. These two object detectors are both pre-trained on COCO dataset [22] which contains 80 classes including ‘person’. The detection minimum threshold are set as 0.7 for both Faster R-CNN and YOLOv2 by default. The sensitivity analysis of this threshold is performed in Fig. A4 Appendix D.

4.2 Adversarial T-shirt in the digital world

Convergence performance of our proposed attack algorithm.

In Fig. 4, we show ASR against the epoch number used by our proposed algorithm to solve problem (7). Here the success of our attack at one testing frame is required to meet two conditions, a) misdetection of the person who wears the adversarial T-shirt, and b) successful detection of the person whom dresses a normal cloth. As we can see, the proposed attack method covnerges well for attacking both YOLOv2 and Faster R-CNN. We also note that attacking Faster R-CNN is more difficult than attacking YOLOv2. Furthermore, if TPS is not applied during training, then ASR drops around $30\%$ compared to our approach by leveraging TPS.

Figure 4: ASR v.s. epoch numbers against YOLOv2 (left) and Faster R-CNN (right).

ASR of adversarial T-shirts in various attack settings.

We perform a more comprehensive evaluation on our methods by digital simulation. Table 1 compares the ASR of adversarial T-shirts generated w/ or w/o TPS transformation in 4 attack settings: a) single-detector attack referring to adversarial T-shirts designed and evaluated using the same object detector, b) transfer single-detector attack referring to adversarial T-shirts designed and evaluated using different object detectors, c) ensemble attack (average) given by (9) but using the average of attack losses of individual models, and d) ensemble attack (min-max) given by (9). As we can see, it is crucial to incorporate TPS transformation in the design of adversarial T-shirts: without TPS, the ASR drops from 61% to 34% when attacking faster R-CNN and drops from 74% to 48% when attacking YOLOv2 in the single-detector attack setting. We also note that the transferability of single-detector attack is weak in all settings. And faster R-CNN is consistently more robust than YOLOv2, similar to the results in Fig. 4. Compared to our approach and advT-Affine, the baseline method advPatch yields the worst ASR when attacking a single detector. Furthermore, we evaluate the effectiveness of the proposed min-max ensemble attack (9). As we can see, when attacking faster R-CNN, the min-max ensemble attack significantly outperforms its counterpart using the averaging strategy, leading to $15\%$ improvement in ASR. This improvement is at the cost of $7\%$ degradation when attacking YOLOv2.

Table 1: The ASR ($\%$) of adversarial T-shirts generated from our approach, advT-Affine and the baseline advPatch under digital-world.

method model target transfer ensemble(average) ensemble(min-max) advPatch[30] 22% 10% N/A N/A advT-Affine Faster R-CNN 34% 11% 16% 32% advT-TPS(ours) 61% 10% 32% 47% advPatch[30] 24% 10% N/A N/A advT-Affine YOLOv2 48% 13% 31% 27% advT-TPS(ours) 74% 13% 60% 53%

4.3 Adversarial T-shirt in the physical world

We next evaluate our method in the physical world. First, we generate an adversarial pattern by solving problem (7) against YOLOv2 and Faster R-CNN, following Section 4.2. We then print the adversarial pattern on a white T-shirt, leading to the adversarial T-shirt. For fair comparison, we also print adversarial patterns generated by the advPatch [30] and advT-Affine in Section 4.2 on white T-shirts of the same style. It is worth noting that different from evaluation by taking static photos of physical adversarial examples, our evaluation is conducted at a more practical and challenging setting. That is because we record videos to track a moving person wearing adversarial T-shirts, which could encounter multiple environment effects such as distance, deformation of the T-shirt, poses and angles of the moving person.

In Table 2, we compare our method with advPatch and advT-Affine under $3$ specified scenarios, including the indoor, outdoor, and unforeseen scenarios, together with the overall case of all scenarios. We observe that our method achieves 64% ASR (against YOLOv2), which is much higher than advT-Affine (39%) and advPatch (19%) in the indoor scenario. Compared to the indoor scenario, evading person detectors in the outdoor scenario becomes more challenging. The ASR of our approach reduces to 47% but outperforms advT-Affine (36%) and advPatch (17%). This is not surprising since the outdoor scenario suffers more environmental variations such as lighting change. Even considering the unforeseen scenario, we find that our adversarial T-shirt is robust to the change of person and location, leading to 48% ASR against Faster R-CNN and 59% ASR against YOLOv2. Compared to the digital results, the ASR of our adversarial T-shirt drops around $10\%$ in all tested physical-world scenarios; see specific video frames in Fig. A5.

Table 2: The ASR ($\%$) of adversarial T-shirts generated from our approach, advT-Affine and advPatch under different physical-world scenes.

method model indoor outdoor new scenes average ASR advPatch[30] 15% 16% 12% 14% advT-Affine Faster R-CNN 27% 25% 25% 26% advT-TPS(ours) 50% 42% 48% 47% advPatch[30] 19% 17% 17% 18% advT-Affine YOLOv2 39% 36% 34% 37% advT-TPS(ours) 64% 47% 59% 57%

4.4 Ablation Study

In this section, we conduct more experiments for better understanding the robustness of our adversarial T-shirt against various conditions including angles and distances to camera, camera view, person’s pose, and complex scenes that include crowd and occlusion. Since the baseline method (advPatch) performs poorly in most of these scenarios, we focus on evaluating our method (advT-TPS) against advT-Affine using YOLOv2. We refer readers to Appendix E for details on the setup of our ablation study.

Angles and distances to camera.

In Fig. 5, we present ASRs of advT-TPS and advT-Affine when the actor whom wears the adversarial T-shit at different angles and distances to the camera. As we can see, advT-TPS works well within the angle ${20}^{\circ }$ and the distance $4$m. And advT-TPS consistently outperforms advT-Affine. We also note that ASR drops significantly at the angle ${30}^{\circ }$ since it induces occlusion of the adversarial pattern. Further, if the distance is greater than $7$m, the pattern cannot clearly be seen from the camera.

Figure 5: Average ASR v.s. different angles (left) and distance (right).

Human Pose.

In Table 3 (left), we evaluate the effect of pose change on advT-TPS, where videos are taken for an actor with some distinct postures including crouching, siting and running in place; see Fig. 6 for specific examples. To alleviate other latent effects, the camera was made to look straight at the person at a fixed distance of about $1\sim 2$m away from the person. As we can see, advT-TPS consistently outperforms advT-Affine. However, it is worth noting that the sitting posture remains challenging for both methods as the larger occlusion is the worse ASR is. To delve into this problem, Fig. A6 presents how well our adversarial T-shirt can handle occlusion by partially covering the T-shirt by hand. Not surprisingly, both advT-Affine and advT-TPS may fail when occlusion becomes quite large. Thus, occlusion is still an interesting problem for physical adversaries.

Complex scenes.

In Table 3 (right), we test our adversarial T-shirt in several complex scenes with cluttered backgrounds, including a) an office with multiple objects and people moving around; b) a parking lot with vehicles and pedestrians; and c) a crossroad with busy traffic and crowd. We observe that compared to advT-Affine, advT-TPS is reasonably effective in complex scenes without suffering a significant loss of ASR. Compared to the other factors such as camera angle and occlusion, cluttered background and even crowd are probably the least of a concern for our approach. This is explainable, as our approach works on object proposals directly to suppress the classifier.

crouching sitting running advT-Affine advT-TPS

Figure 6: Some video frames of person who wears adversarial T-shirt generated by advT-Affine (first row) and advT-TPS (second row) with different poses.

Table 3: The ASR ($\%$) of adversarial T-shirts generated from our approach, advT-Affine and advPatch under different physical-world scenarios.

crouching siting running advT-Affine 27% 26% 52% advT-TPS 53% 32% 63%   office parking lot crossroad advT-Affine 69% 53% 51% advT-TPS 73% 65% 54%

Figure 7: The person who wear our adversarial T-shirt generate by TPS in three complex scenes: office, parking lot and crossroad.

5 Conclusion

In this paper, we propose Adversarial T-shirt, the first successful adversarial wearable to evade detection of moving persons. Since T-shirt is a non-rigid object, its deformation induced by a person’s pose change is taken into account when generating adversarial perturbations. We also propose a min-max ensemble attack algorithm to fool multiple object detectors simultaneously. We show that our attack against YOLOv2 can achieve 74% and 57% attack success rate in the digital and physical world, respectively. By contrast, the advPatch method can only achieve 24% and 18% ASR. Based on our studies, we hope to provide some implications on how the adversarial perturbations can be implemented in physical worlds.

Appendix

In the supplement, we provide details on the thin plate spline (TPS) transformation, the formulation of attack loss, the setting of algorithmic parameters, and the additional experiments of the adversarial T-shirt in the physical world.

Appendix A How to construct TPS transformation?

frame 1 in Fig.2a	frame 2 in Fig.2b

Figure A1: Four manually annotated corner points (blue) used to generate the bounding box of cloth region at frame $i$, namely, $M_{c,i}$. And $8\times 16$ anchor points (red) on the checkerboard used to generate TPS transformation $t_{\mathrm{TPS}}$ between two video frames.

We first manually annotate four corner points (see blue markers in Figure A1) to conduct a perspective transformation between two frames at different time instants. This perspective transformation is used to align the coordinate system of anchor points used for TPS transformation between two frames.

Ideally, the checkerboard detection tool [15, 34] always outputs a grid of corner points detected. In most cases, it can locate all the $8\times 16$ points on the checkerboard perfectly, so no additional effort is needed to establish the point correspondences between two images. In the case when there are corner points missing in the detection, we use the following method to match two images. We perform a point matching procedure (see Algorithm 1) to align the anchor points (see red markers in Figure A1) detected by the checkerboard detection tool. The data matching procedure selects the set of matched anchor points used for constructing TPS transformation.

Algorithm 1 Constructing TPS transformation

1:Input: Given original image ${𝐱}_1$ (frame 1) with $r_1\times c_1$ anchor points, each of which has coordinate ${𝐩}^{(1)}[i,j]$, where $i\in [r_1]$, $j\in [c_1]$ and $[n]$ denotes the integer set $\{1,2,\mathrm{\dots },n\}$, target image ${𝐱}_2$ (frame 2) with $r_2\times c_2$ anchor points, each of which has coordinate ${𝐩}^{(2)}[i,j]$, where $i\in [r_2]$ and $j\in [c_2]$, distance tolerance $ϵ>0$, and empty vectors ${\widetilde{𝐩}}^{(1)}$ and ${\widetilde{𝐩}}^{(2)}$.

2:Output: Matched $r\times c$ anchor points ${\widetilde{𝐩}}^{(1)}[i,j]$ versus ${\widetilde{𝐩}}^{(2)}[i,j]$ for $i\in [r]$ and $j\in [c]$, and TPS transformation $t_{\mathrm{TPS}}$ from ${𝐱}_1$ to ${𝐱}_2$.

3:for $(i,j)\in [r_1]\times [c_1]$ do

4: given ${𝐩}^{(1)}[i,j]$ in ${𝐱}_1$, find the candidate of matching point ${𝐩}^{(2)}[i^{\prime },j^{\prime }]$ by nearest neighbor in ${𝐱}_2$,

5: if ${\Vert {𝐩}^{(1)}[i,j]-{𝐩}^{(2)}[i^{\prime },j^{\prime }]\Vert }_2\le ϵ$ then

6: matching ${𝐩}^{(1)}[i,j]$ with ${𝐩}^{(2)}[i^{\prime },j^{\prime }]$, and adding them into ${\widetilde{𝐩}}^{(1)}$ and ${\widetilde{𝐩}}^{(2)}$ respectively,

7: end if

8:end for

9:build TPS transformation $t_{\mathrm{TPS}}$ by solving Eq. (2) given ${\widetilde{𝐩}}^{(1)}$ and ${\widetilde{𝐩}}^{(2)}$.

Appendix B Color transformation

As shown in Figure A2, we generate the training dataset to map a digital color palette to the same one printed on a T-shirt. With the aid of $960$ color cell pairs. We learn the weights of the quadratic polynomial regression by minimizing the mean squared error of the predicted physical color (with the digital color in Figure A2(a) as input) and the ground-truth physical color provided in Figure A2(b). Once the color transformer $t_{\mathrm{color}}$ is learnt, we then incorporate it into (5).

(a)	(b)	(c)

Figure A2: Physical color transformation. (a): The digital color map (b): The printed color map on a T-shirt (captured by the camera of iPhone X). (c): The predicted transformation from (a) via the learnt polynomial regression.

Appendix C Formulation of attack loss

There are two possible options to formulate the attack loss $f$ to fool person detectors. First, $f$ is specified as the misclassification loss, commonly-used in most of previous works. The goal is to misclassify the class ‘person’ to any other incorrect class. However, our work consider a more advanced disappearance attack, which enforces the detector even not to draw the bounding box of the object ‘person’. For YOLOv2, we minimize the confidence score of all bounding boxes corresponding to the class ‘person’. For Faster R-CNN, we attack all bounding boxes towards the class ‘background’. Let ${𝐱}_i^{\prime }$ be a perturbed video frame, the attack loss in (6) is then given by

$\begin{array}{cc}f({𝐱}_i^{\prime })=\underset{j}{\max }\{\max \{p_j({𝐱}_i^{\prime }),\nu \}\cdot {\mathrm{𝟙}}_{|B_j\cap M_{p,i}|>\eta }\},& \end{array}$ (11)

where $p_j({𝐱}_i^{\prime })$ denotes the confidence score of the $j$th bounding box for YOLOv2 or the probability of the ‘person’ class at the $j$th bounding box for Faster R-CNN, $\nu$ is a confidence threshold, the use of $\max \{p_j({𝐱}_i^{\prime }),\nu \}$ enforces the optimizer to minimize the bounding boxes of high probability (greater than $\nu$), $B_j$ is the $j$th bounding box, $M_{p,i}$ is the known bounding box encoding the person’s region, the quantity $|B_j\cap M_{p,i}|$ represents the intersection between $B_j$ and $M_{p,i}$, $|\cdot |$ is the cardinality function, and ${\mathrm{𝟙}}_{|B_j\cap M_{p,i}|>\eta }$ is the indicator function, which returns $1$ if $B_j$ has at least $\eta$-overlapping with $M_{c,i}$, and $0$ otherwise. In Eq.(11), the quantity $\max \{p_j({𝐱}_i^{\prime }),\nu \}\cdot {\mathrm{𝟙}}_{|B_j\cap M_{p,i}|>\eta }$ characterizes the bounding box of our interest with both high probability and large overlapping with $M_{p,i}$. And the eventual loss in Eq.(11) gives the largest probability for detecting a bounding box of the object ‘person’.

Appendix D Hyperparameter setting

When solving Eq. (7), we use Adam optimizer [20] to train 5,000 epochs with the initial learning rate, $1\times {10}^{-2}$. The rate is decayed when the loss ceases to decrease. The regularization parameter $\lambda$ for total-variation norm is set as $3$. In Eq. (9), we set $\gamma$ as 1, and solve the min-max problem by 6000 epochs with the initial learning rate $1\times {10}^{-2}$. In Eq. (5), the details of transformations $t$ are shown in Table A1.

Transformation	Minimum	Maximum
Scale	0.5	2
Brightness	-0.1	0.1
Contrast	0.8	1.2
Random uniform noise	-0.1	0.1
Blurring	average pooling/filter size = 5

Table A1: The conventional transformations $t$ in Eq. (5).

In experiments, we find that the hyperparameter $\lambda$ strikes a balance between the fine-gained perturbation pattern and its smoothness. As we can see in Figure A3, when $\lambda$ is smallest (namely, $\lambda =1$), the perturbation can achieve the best ASR (82% ) against YOLOv2 in the digital space, however when we test the digital pattern in the physical world, the attacking performance drops to 51% (worse than the case of $\lambda =3$) as the non-smooth (sharp) perturbation pattern might not be well captured by a real-world camera. In our experiments, we choose $\lambda =3$ for the best tradeoff between digital and physical results.

$\lambda$	1	3	5
digital	82%	74%	69%
physical	51%	57%	55%

Figure A3: ASR v.s. $\lambda$ against YOLOv2.

For a real-world deployment of a person detector, the minimum detection threshold needs to be empirically determined to obtain a good tradeoff between detection accuracy and false alarm rates. In our physical-word testing, we set the threshold to 0.7 for Faster R-CNN and YOLOv2, at which both of them achieve detection accuracy over 97% on person wearing normal clothing. The sensitivity analysis of this threshold is provided in Figure A4.

Figure A4: The detection accuracy of YOLOV2 and Faster R-CNN under different detection thresholds . ‘Normal’ means the case of persons wearing normal clothing, and ‘adv. T-shirt’ means the case of persons wearing the adversarial T-shirt.

Appendix E Dataset details

In Table A2, we summarize dataset we used in Section 4.2 and 4.3.

Table A2: Summary of our collected dataset in each scenes. The values in the table are presented by number of videos (total number of frames) in each scene, ie, 4 (177) means 4 videos and 177 frames in total.

videos (frames)	indoor			outdoor		overall
	office	elevator	hallway	street1	street2
single-person	4 (177)	4 (135)	4 (230)	4 (225)	4 (240)	20 (1007)
multi-persons	4 (162)	4 (132)	4 (245)	4 (230)	4 (227)	20 (996)
train	6 (245)	6 (180)	6 (335)	6 (344)	6 (365)	30 (1469)
test (digital)	2 (94)	2 (87)	2 (140)	2 (111)	2 (102)	10 (534)
	unseen	elevator	hallway	street3
test (physical)	6 (236)	6 (184)	6 (220)	6 (288)		24 (928)

In Section 4.4 for ablation study on parameter sensitivity and generalization to more complex testing scenarios, we further collected some new test data. Specifically, we considered the scenario of five people (two females and three males) for ablation study and none of them appeared in the original training and testing datasets. We recorded multiple videos by using two cameras (one iPhone X and one iPhone XI) and reported the resulting ASR in average.

Appendix F More experimental results

In Figure A5, we demonstrate our physical-world attack results in two scenarios: a) adversarial T-shirts generated by advT-TPS, advT-Affine and advPatch in an outdoor scenario (the first three rows), b) adversarial T-shirts generated by advT-TPS and advT-Affine in an unseen scenario (at a location never seen in the training dataset). As we can see, our method outperforms affine and baseline. In the absence of TPS, adversarial T-shirts generated by affine and baseline fail in most of cases, implying the importance of TPS to model the T-shirt deformation. When a person whom wears the adversarial T-shirt walks towards the camera, as expected, the detector also becomes easier to be attacked.

  advT-TPS   advT-Affine   advPatch   advT-TPS   advT-Affine

Figure A5: Some testing frames in the physical world using adversarial T-shirt against YOLOv2. All frames are performed by two persons with one wearing the proposed adversarial T-shirt, generated by our method (advT-TPS), advT-Affine and advPatch. The first three rows: an unseen outdoor scenes. The last two rows: an unseen indoor scenes.

advT-Affine			advT-TPS

Figure A6: When advT-Affine and advT-TPS happen occlusion by hand.