Patch-based physical attacks have increasingly aroused concerns. However, most existing methods focus on obscuring targets captured on the ground, and some of these methods are simply extended to deceive aerial detectors. They smear the targeted objects in the physical world with the elaborated adversarial patches, which can only slightly sway the aerial detectors' prediction and with weak attack transferability. To address the above issues, we propose to perform Contextual Background Attack (CBA), a novel physical attack framework against aerial detection, which can achieve strong attack efficacy and transferability in the physical world even without smudging the interested objects at all. Specifically, the targets of interest, i.e. the aircraft in aerial images, are adopted to mask adversarial patches. The pixels outside the mask area are optimized to make the generated adversarial patches closely cover the critical contextual background area for detection, which contributes to gifting adversarial patches with more robust and transferable attack potency in the real world. To further strengthen the attack performance, the adversarial patches are forced to be outside targets during training, by which the detected objects of interest, both on and outside patches, benefit the accumulation of attack efficacy. Consequently, the sophisticatedly designed patches are gifted with solid fooling efficacy against objects both on and outside the adversarial patches simultaneously. Extensive proportionally scaled experiments are performed in physical scenarios, demonstrating the superiority and potential of the proposed framework for physical attacks. We expect that the proposed physical attack method will serve as a benchmark for assessing the adversarial robustness of diverse aerial detectors and defense methods.

翻译：基于补丁的物理攻击日益引发关注。然而，现有方法大多聚焦于遮蔽地面捕获的目标，部分方法被简单扩展以欺骗航空探测器。这些方法利用精心设计的对抗补丁涂抹物理世界中的目标对象，但仅能轻微影响航空探测器的预测结果，且攻击迁移性较弱。针对上述问题，我们提出上下文背景攻击（CBA），这是一种针对航空检测的新型物理攻击框架，即使完全不污损感兴趣目标，也能在物理世界中实现强攻击效能与迁移性。具体而言，我们将感兴趣目标（即航空图像中的飞机）作为掩膜来遮盖对抗补丁。通过优化掩膜区域外的像素，使生成的对抗补丁紧密覆盖检测所依赖的关键上下文背景区域，从而赋予对抗补丁在真实世界中更鲁棒且更具迁移性的攻击能力。为进一步提升攻击性能，我们在训练过程中强制对抗补丁位于目标外部，使得补丁内外被检测的感兴趣目标均能积累攻击效能。因此，精心设计的补丁可同时对补丁内外的目标产生稳固的欺骗效果。我们在物理场景中开展了大规模比例缩放实验，验证了所提框架在物理攻击中的优越性与潜力。我们期望该物理攻击方法能作为评估各类航空探测器与防御方法对抗鲁棒性的基准。