Adversarial patches undermine the reliability of optical flow predictions when placed in arbitrary scene locations. Therefore, they pose a realistic threat to real-world motion detection and its downstream applications. Potential remedies are defense strategies that detect and remove adversarial patches, but their influence on the underlying motion prediction has not been investigated. In this paper, we thoroughly examine the currently available detect-and-remove defenses ILP and LGS for a wide selection of state-of-the-art optical flow methods, and illuminate their side effects on the quality and robustness of the final flow predictions. In particular, we implement defense-aware attacks to investigate whether current defenses are able to withstand attacks that take the defense mechanism into account. Our experiments yield two surprising results: Detect-and-remove defenses do not only lower the optical flow quality on benign scenes, in doing so, they also harm the robustness under patch attacks for all tested optical flow methods except FlowNetC. As currently employed detect-and-remove defenses fail to deliver the promised adversarial robustness for optical flow, they evoke a false sense of security. The code is available at https://github.com/cv-stuttgart/DetectionDefenses.

翻译：对抗补丁在任意场景位置放置时，会破坏光流预测的可靠性，因此对现实世界中的运动检测及其下游应用构成切实威胁。潜在补救措施是检测并移除对抗补丁的防御策略，但这些策略对底层运动预测的影响尚未得到研究。本文针对多种先进光流方法，全面评估当前可用的检测-移除防御方法ILP与LGS，揭示其对最终光流预测质量与鲁棒性的副作用。特别地，我们通过实现防御感知攻击，探究现有防御能否抵御考虑防御机制的恶意攻击。实验得出两项出人意料的结果：检测-移除防御不仅会降低良性场景下的光流质量，还会削弱所有测试光流方法（FlowNetC除外）在补丁攻击下的鲁棒性。由于当前采用的检测-移除防御未能为光流预测提供承诺的对抗鲁棒性，反而引发了虚假的安全感。代码参见https://github.com/cv-stuttgart/DetectionDefenses。