Out-of-the-box: Black-box Causal Attacks on Object Detectors

• URL: http://arxiv.org/abs/2512.03730v1
• Date: Wed, 03 Dec 2025 12:17:35 GMT
• Title: Out-of-the-box: Black-box Causal Attacks on Object Detectors
• Authors: Melane Navaratnarajah, David A. Kelly, Hana Chockler,
• Abstract summary: This paper presents BlackCAtt, a black-box algorithm and a tool to construct explainable, imperceptible, reproducible, architecture-agnostic attacks on object detectors.<n>BlackCAtt works across different object detectors of different sizes and architectures, treating the detector as a black box.<n>Our approach is 2.7 times better than the baseline in removing a detection, 3.86 times better in changing a detection, and 5.75 times better in triggering new, spurious, detections.
• Score: 4.3331379059769395
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Adversarial perturbations are a useful way to expose vulnerabilities in object detectors. Existing perturbation methods are frequently white-box and architecture specific. More importantly, while they are often successful, it is rarely clear why they work. Insights into the mechanism of this success would allow developers to understand and analyze these attacks, as well as fine-tune the model to prevent them. This paper presents BlackCAtt, a black-box algorithm and a tool, which uses minimal, causally sufficient pixel sets to construct explainable, imperceptible, reproducible, architecture-agnostic attacks on object detectors. BlackCAtt combines causal pixels with bounding boxes produced by object detectors to create adversarial attacks that lead to the loss, modification or addition of a bounding box. BlackCAtt works across different object detectors of different sizes and architectures, treating the detector as a black box. We compare the performance of BlackCAtt with other black-box attack methods and show that identification of causal pixels leads to more precisely targeted and less perceptible attacks. On the COCO test dataset, our approach is 2.7 times better than the baseline in removing a detection, 3.86 times better in changing a detection, and 5.75 times better in triggering new, spurious, detections. The attacks generated by BlackCAtt are very close to the original image, and hence imperceptible, demonstrating the power of causal pixels.

Related papers

• Superpixel Attack: Enhancing Black-box Adversarial Attack with Image-driven Division Areas [1.1417805445492082]
  Adversarial attacks are used to identify small perturbations that can lead to misclassifications.<n>A promising approach to black-box adversarial attacks is to repeat the process of extracting a specific image area and changing the perturbations added to it.<n>We propose applying superpixels instead, which achieve a good balance between color variance and compactness.
  arXiv  Detail & Related papers  (2025-11-29T05:28:52Z)
• Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection [0.0]
  We propose a pixel-based black-box attack called Remember and Forget Pixel Attack using Reinforcement Learning(RFPAR)<n>RFPAR mitigates randomness and avoids patch dependency by leveraging rewards generated through a one-step RL algorithm to perturb perturbed pixels.<n> Experiments on the ImageNet-1K dataset for classification show that RFPAR outperformed state-of-the-art query-based pixel attacks.
  arXiv  Detail & Related papers  (2025-02-10T11:49:41Z)
• Distortion-Aware Adversarial Attacks on Bounding Boxes of Object Detectors [1.3493547928462395]
  We propose a novel method to fool object detectors, expose the vulnerability of state-of-the-art detectors, and promote later works to build more robust detectors to adversarial examples.<n>Our method aims to generate adversarial images by perturbing object confidence scores during training, which is crucial in predicting confidence for each class in the testing phase.<n>To verify the proposed method, we perform adversarial attacks against different object detectors, including the most recent state-of-the-art models like YOLOv8, Faster R-CNN, RetinaNet, and Swin Transformer.
  arXiv  Detail & Related papers  (2024-12-25T07:51:57Z)
• AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuning [93.77763753231338]
  Adversarial Contrastive Prompt Tuning (ACPT) is proposed to fine-tune the CLIP image encoder to extract similar embeddings for any two intermediate adversarial queries. We show that ACPT can detect 7 state-of-the-art query-based attacks with $>99%$ detection rate within 5 shots. We also show that ACPT is robust to 3 types of adaptive attacks.
  arXiv  Detail & Related papers  (2024-08-04T09:53:50Z)
• To Make Yourself Invisible with Adversarial Semantic Contours [47.755808439588094]
  Adversarial Semantic Contour (ASC) is an estimate of a Bayesian formulation of sparse attack with a deceived prior of object contour. We show that ASC can corrupt the prediction of 9 modern detectors with different architectures. We conclude with cautions about contour being the common weakness of object detectors with various architecture.
  arXiv  Detail & Related papers  (2023-03-01T07:22:39Z)
• Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection [89.08832589750003]
  We propose a Parallel Rectangle Flip Attack (PRFA) via random search to avoid sub-optimal detection near the attacked region. Our method can effectively and efficiently attack various popular object detectors, including anchor-based and anchor-free, and generate transferable adversarial examples.
  arXiv  Detail & Related papers  (2022-01-22T06:00:17Z)
• Context-Aware Transfer Attacks for Object Detection [51.65308857232767]
  We present a new approach to generate context-aware attacks for object detectors. We show that by using co-occurrence of objects and their relative locations and sizes as context information, we can successfully generate targeted mis-categorization attacks.
  arXiv  Detail & Related papers  (2021-12-06T18:26:39Z)
• IoU Attack: Towards Temporally Coherent Black-Box Adversarial Attack for Visual Object Tracking [70.14487738649373]
  Adrial attack arises due to the vulnerability of deep neural networks to perceive input samples injected with imperceptible perturbations. We propose a decision-based black-box attack method for visual object tracking. We validate the proposed IoU attack on state-of-the-art deep trackers.
  arXiv  Detail & Related papers  (2021-03-27T16:20:32Z)
• DPAttack: Diffused Patch Attacks against Universal Object Detection [66.026630370248]
  Adversarial attacks against object detection can be divided into two categories, whole-pixel attacks and patch attacks. We propose a diffused patch attack (textbfDPAttack) to fool object detectors by diffused patches of asteroid-shaped or grid-shape. Experiments show that our DPAttack can successfully fool most object detectors with diffused patches.
  arXiv  Detail & Related papers  (2020-10-16T04:48:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.