DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses
Chaoxiang He, Xiaojing Ma, Bin Benjamin Zhu, Yimiao Zeng, Hanqing Hu, Xiaofan Bai, Hai Jin, Dongmei Zhang · 2024
Adversarial patch attacks are among the most practical adversarial attacks.Recent efforts focus on providing a certifiable guarantee on correct predictions in the presence of white-box adversarial patch attacks.In this paper, we propose DorPatch, an effective adversarial patch attack to evade both certifiably robust defenses and empirical defenses.DorPatch employs group lasso on a patch's mask, image dropout, density regularization, and structural loss to generate a fully optimized, distributed, occlusion-robust, and inconspicuous adversarial patch that can be deployed in physical-world adversarial patch attacks.Our extensive experimental evaluation with both digitaldomain and physical-world tests indicates that DorPatch can effectively evade PatchCleanser [64], the state-of-the-art certifiable defense, and empirical defenses against adversarial patch attacks.More critically, mispredicted results of adversarially patched examples generated by DorPatch can receive certification from PatchCleanser, producing a false trust in guaranteed predictions.DorPatch achieves state-of-the-art attacking performance and perceptual quality among all adversarial patch attacks.DorPatch poses a significant threat to real-world applications of DNN models and calls for developing effective defenses to thwart the attack.