Deep neural networks have been demonstrated to be vulnerable to adversarial attacks: subtle perturbation can completely change the prediction result. Existing adversarial attacks on object detection focus on attacking anchor-based detectors, which may not work well for anchor-free detectors. In this paper, we propose the first adversarial attack dedicated to anchor-free detectors. It is a category-wise attack that attacks important pixels of all instances of a category simultaneously. Our attack manifests in two forms, sparse category-wise attack (SCA) and dense category-wise attack (DCA), that minimize the $L_0$ and $L_\infty$ norm-based perturbations, respectively. For DCA, we present three variants, DCA-G, DCA-L, and DCA-S, that select a global region, a local region, and a semantic region, respectively, to attack. Our experiments on large-scale benchmark datasets including PascalVOC, MS-COCO, and MS-COCO Keypoints indicate that our proposed methods achieve state-of-the-art attack performance and transferability on both object detection and human pose estimation tasks.

翻译：深度神经网络已被证明易受对抗攻击影响：微小的扰动即可完全改变预测结果。现有针对目标检测的对抗攻击主要聚焦于基于锚点的检测器，但难以有效作用于无锚检测器。本文提出首个专门针对无锚检测器的对抗攻击方法，这是一种类别级攻击，能同时攻击同一类别所有实例的重要像素。该攻击以两种形式呈现：稀疏类别级攻击（SCA）和密集类别级攻击（DCA），分别最小化基于$L_0$和$L_\infty$范数的扰动。针对DCA，我们提出三种变体：DCA-G、DCA-L和DCA-S，分别攻击全局区域、局部区域和语义区域。在PascalVOC、MS-COCO及MS-COCO Keypoints等大规模基准数据集上的实验表明，本文方法在目标检测与人体姿态估计任务中均达到最优攻击性能与可迁移性。