GhostImage: Remote Perception Attacks against Camera-based Image
  Classification Systems
  In vision-based object classification systems imaging sensors perceive the
environment and machine learning is then used to detect and classify objects
for decision-making purposes; e.g., to maneuver an automated vehicle around an
obstacle or to raise an alarm to indicate the presence of an intruder in
surveillance settings. In this work we demonstrate how the perception domain
can be remotely and unobtrusively exploited to enable an attacker to create
spurious objects or alter an existing object. An automated system relying on a
detection/classification framework subject to our attack could be made to
undertake actions with catastrophic results due to attacker-induced
misperception.
  We focus on camera-based systems and show that it is possible to remotely
project adversarial patterns into camera systems by exploiting two common
effects in optical imaging systems, viz., lens flare/ghost effects and
auto-exposure control. To improve the robustness of the attack to channel
effects, we generate optimal patterns by integrating adversarial machine
learning techniques with a trained end-to-end channel model. We experimentally
demonstrate our attacks using a low-cost projector, on three different image
datasets, in indoor and outdoor environments, and with three different cameras.
Experimental results show that, depending on the projector-camera distance,
attack success rates can reach as high as 100% and under targeted conditions.
