To make yourself invisible with Adversarial Semantic Contours

Modern object detectors are vulnerable to adversarial examples, which may bring risks real-world applications. The sparse attack is an important task which, compared with the popular perturbation on whole image, needs select potential pixels that generally regularized by ℓ0-norm constraint, and simultaneously optimize corresponding texture. non-differentiability of ℓ0 norm brings challenges many works attacking detection adopted manually-designed patterns address them, meaningless independent objects, therefore lead relatively poor performance. In this paper, we propose Adversarial Semantic Contour (ASC), MAP estimate a Bayesian formulation deceived prior contour. contour effectively reduces search space pixel selection improves introducing more semantic bias. Extensive experiments demonstrate ASC can corrupt prediction 9 modern different architectures (e.g., one-stage, two-stage Transformer) modifying fewer than 5% area in COCO white-box scenario around 10% those black-box scenario. We further extend datasets for autonomous driving systems verify effectiveness. conclude cautions about being common weakness various architecture care needed applying them safety-sensitive scenarios.