Adversarial attacks are valuable for evaluating the robustness of deep learning models. Existing attacks are primarily conducted on the visible light spectrum (e.g., pixel-wise texture perturbation). However, attacks targeting texture-free X-ray images remain underexplored, despite the widespread application of X-ray imaging in safety-critical scenarios such as the X-ray detection of prohibited items. In this paper, we take the first step toward the study of adversarial attacks targeted at X-ray prohibited item detection, and reveal the serious threats posed by such attacks in this safety-critical scenario. Specifically, we posit that successful physical adversarial attacks in this scenario should be specially designed to circumvent the challenges posed by color/texture fading and complex overlapping. To this end, we propose X-adv to generate physically printable metals that act as an adversarial agent capable of deceiving X-ray detectors when placed in luggage. To resolve the issues associated with color/texture fading, we develop a differentiable converter that facilitates the generation of 3D-printable objects with adversarial shapes, using the gradients of a surrogate model rather than directly generating adversarial textures. To place the printed 3D adversarial objects in luggage with complex overlapped instances, we design a policy-based reinforcement learning strategy to find locations eliciting strong attack performance in worst-case scenarios whereby the prohibited items are heavily occluded by other items. To verify the effectiveness of the proposed X-Adv, we conduct extensive experiments in both the digital and the physical world (employing a commercial X-ray security inspection system for the latter case). Furthermore, we present the physical-world X-ray adversarial attack dataset XAD.

翻译：对抗性攻击对于评估深度学习模型的鲁棒性具有重要价值。现有攻击主要集中于可见光谱领域（例如像素级纹理扰动），然而，尽管X射线成像在安全关键场景（如违禁物品检测）中广泛应用，针对无纹理X射线图像的攻击研究仍相对不足。本文率先开启针对X射线违禁物品检测的对抗性攻击研究，揭示了此类攻击在该安全关键场景中构成的严重威胁。具体而言，我们认为，在此场景下成功的物理对抗攻击需专门设计，以规避颜色/纹理褪色及复杂重叠带来的挑战。为此，我们提出X-Adv方法，生成可物理打印的金属物体，使其作为对抗性媒介，在放置于行李中时能够欺骗X射线检测器。为解决颜色/纹理褪色问题，我们开发了一种可微转换器，通过利用替代模型的梯度直接生成具有对抗性形状的3D可打印物体，而非直接生成对抗性纹理。为在存在复杂重叠实例的行李中放置打印的3D对抗物体，我们设计了一种基于策略的强化学习策略，以寻找在受限条件下（即违禁物品被其他物品严重遮挡时）能够产生强攻击性能的位置。为验证所提X-Adv的有效性，我们在数字世界和物理世界（后者采用商用X射线安检系统）中进行了大量实验。此外，我们还构建了物理世界X射线对抗攻击数据集XAD。