Vision-based perception modules are increasingly deployed in many applications, especially autonomous vehicles and intelligent robots. These modules are being used to acquire information about the surroundings and identify obstacles. Hence, accurate detection and classification are essential to reach appropriate decisions and take appropriate and safe actions at all times. Current studies have demonstrated that "printed adversarial attacks", known as physical adversarial attacks, can successfully mislead perception models such as object detectors and image classifiers. However, most of these physical attacks are based on noticeable and eye-catching patterns for generated perturbations making them identifiable/detectable by human eye or in test drives. In this paper, we propose a camera-based inconspicuous adversarial attack (\textbf{AdvRain}) capable of fooling camera-based perception systems over all objects of the same class. Unlike mask based fake-weather attacks that require access to the underlying computing hardware or image memory, our attack is based on emulating the effects of a natural weather condition (i.e., Raindrops) that can be printed on a translucent sticker, which is externally placed over the lens of a camera. To accomplish this, we provide an iterative process based on performing a random search aiming to identify critical positions to make sure that the performed transformation is adversarial for a target classifier. Our transformation is based on blurring predefined parts of the captured image corresponding to the areas covered by the raindrop. We achieve a drop in average model accuracy of more than $45\%$ and $40\%$ on VGG19 for ImageNet and Resnet34 for Caltech-101, respectively, using only $20$ raindrops.

翻译：基于视觉的感知模块越来越多地部署于各类应用中，尤其是自动驾驶车辆与智能机器人。这些模块用于获取周围环境信息并识别障碍物，因此准确检测与分类对于在所有情况下做出正确决策及采取适当安全行动至关重要。当前研究表明，"打印对抗攻击"（即物理对抗攻击）能够成功误导目标检测器与图像分类器等感知模型。然而，大多数物理攻击生成的扰动模式显著且引人注目，使其容易被人类肉眼或测试驾驶过程识别。本文提出一种基于摄像头的隐蔽对抗攻击（\textbf{AdvRain}），能够欺骗摄像头感知系统使其对同一类别的所有目标失效。与基于掩码的伪天气攻击（需访问底层计算硬件或图像内存）不同，本攻击通过模拟自然天气条件（即雨滴）效果实现，可将雨滴效果打印在透明贴纸上，并外置于摄像头镜头。为此，我们提出基于随机搜索的迭代过程，旨在识别关键位置以确保对目标分类器执行对抗性变换。该变换通过模糊图像中对应雨滴覆盖区域的预定义部分实现。仅使用20个雨滴，本方法即可使VGG19在ImageNet上的平均模型精度下降超过45%，并使Resnet34在Caltech-101上的精度下降超过40%。