@inproceedings{oai:ipsj.ixsq.nii.ac.jp:00240843,
 author = {岡野, 真空 and 伊藤, 康一 and 西垣, 正勝 and 大木, 哲史 and Masora, Okano and Koichi, Ito and Masakatsu, Nishigaki and Tetsushi, Ohki},
 book = {コンピュータセキュリティシンポジウム2024論文集},
 month = {Oct},
 note = {本論文では，顔検出器を攻撃対象としたRemote Adversarial Patch（RAP）の攻撃実現性について議論する．顔検出器を攻撃対象としたRAPは，一般物体検出器を攻撃対象とした場合と比較して次のような困難な点が存在する．(1)様々なスケールの物体が検出対象であり，特に小さな顔については検出の根拠となる特徴量の畳み込み量が少なく，推論結果に影響を及ぼす範囲の制約が大きい．(2) 2クラス分類問題であるため，クラス間の特徴のギャップが大きく，推論結果を別クラスへ誘導する攻撃が困難である．本論文では，それぞれの問題に対して，新たなパッチの配置方法と損失関数を提案する．生成されたパッチは多クラス物体検出器に対するRAP生成手法を顔検出器に転用したものと比較して，優れた検出妨害効果を示した．, This paper discusses the attack feasibility of Remote Adversarial Patch (RAP) targeting face detectors. RAP targeting face detectors has the following difficulties compared to RAP targeting general object detectors. (1) Objects of various scales are targets for detection, and especially for small faces, the amount of convolution of features to be used as the basis for detection is small, and the range of influence on the inference results is highly restricted. (2) Also, since this is a two-class classification problem, the feature gaps between classes are large, making it difficult to attack the inference results by guiding them to another class. In this paper, we propose a new patch placement method and loss function for each problem. The patches targeting the proposed face detector showed superior detection obstruct effects compared to the patches targeting the general object detector.},
 pages = {711--718},
 publisher = {情報処理学会},
 title = {顔検出器を攻撃対象としたRemote Adversarial Patchの検討},
 year = {2024}
}