Over the last decade, deep neural networks have achieved state of the art in computer vision tasks. These models, however, are susceptible to unusual inputs, known as adversarial examples, that cause them to misclassify or otherwise fail to detect objects. Here, we provide evidence that the increasing success of adversarial attacks is primarily due to increasing their size. We then demonstrate a method for generating the largest possible adversarial patch by building a adversarial pattern out of repeatable elements. This approach achieves a new state of the art in evading detection by YOLOv2 and YOLOv3. Finally, we present an experiment that fails to replicate the prior success of several attacks published in this field, and end with some comments on testing and reproducibility.

It's a well-established fact that object- and face-detecting algorithms are vulnerable to adversarial attack, as evidenced by a 2014 study conducted by researchers at Google and New York University. That's to say the models can be deceived by specially crafted patches attached to real-world targets. Most research in adversarial attacks involves rigid objects like glass frames, stop signs, or cardboard. But scientists at Northeastern University and the MIT-IBM Watson AI Lab propose what they are calling an "adversarial" T-shirt, one with a printed image that evades person-detectors even when it's deformed by a wearer's changing pose. In a preprint paper, they claim it manages to achieve up to 79% and 63% success rates in digital and physical worlds, respectively, against the popular YOLOv2 model.

It's a well-established fact that object- and face-detecting algorithms are vulnerable to adversarial attack, as evidenced by a 2014 study conducted by researchers at Google and New York University. That's to say the models can be deceived by specially-crafted patches attached to real-world targets. Most research in adversarial attacks involves rigid objects like glass frames, stop signs, or cardboard. But scientists at Northwestern University and the MIT-IBM Watson AI Lab propose what they call an'adversarial' T-shirt, a t-shirt with a printed adversarial example that evades person detectors even when it's deformed by a wearer's changing pose. In a preprint paper, they claim that it manages to achieve up to 79% and 63% attack success rates in digital and physical worlds, respectively, against the popular YOLOv2 model.

It is known that deep neural networks (DNNs) could be vulnerable to adversarial attacks. The so-called physical adversarial examples deceive DNN-based decision makers by attaching adversarial patches to real objects. However, most of the existing works on physical adversarial attacks focus on static objects such as glass frame, stop sign and image attached to a cardboard. In this work, we proposed adversarial T-shirt, a robust physical adversarial example for evading person detectors even if it suffers from deformation due toa moving person's pose change. To the best of our knowledge, the effect of deformation is first modeled for designing physical adversarial examples with respect to non-rigid objects such as T-shirts. We show that the proposed method achieves 79% and 63% attack success rates in digital and physical worlds respectively against YOLOv2. In contrast, the state-of-the-art physical attack method to fool a person detector only achieves 27% attack success rate. Furthermore, by leveraging min-max optimization, we extend our method to the ensemble attack setting against object detectors YOLOv2 and Faster R-CNN simultaneously.