DetectorGuard: Provably Securing Object Detectors against Localized
  Patch Hiding Attacks
  State-of-the-art object detectors are vulnerable to localized patch hiding
attacks, where an adversary introduces a small adversarial patch to make
detectors miss the detection of salient objects. The patch attacker can carry
out a physical-world attack by printing and attaching an adversarial patch to
the victim object. In this paper, we propose DetectorGuard as the first general
framework for building provably robust object detectors against localized patch
hiding attacks. DetectorGuard is inspired by recent advancements in robust
image classification research; we ask: can we adapt robust image classifiers
for robust object detection? Unfortunately, due to their task difference, an
object detector naively adapted from a robust image classifier 1) may not
necessarily be robust in the adversarial setting or 2) even maintain decent
performance in the clean setting. To build a high-performance robust object
detector, we propose an objectness explaining strategy: we adapt a robust image
classifier to predict objectness for every image location and then explain each
objectness using the bounding boxes predicted by a conventional object
detector. If all objectness is well explained, we output the predictions made
by the conventional object detector; otherwise, we issue an attack alert.
Notably, 1) in the adversarial setting, we formally prove the end-to-end
robustness of DetectorGuard on certified objects, i.e., it either detects the
object or triggers an alert, against any patch hiding attacker within our
threat model; 2) in the clean setting, we have almost the same performance as
state-of-the-art object detectors. Our evaluation on the PASCAL VOC, MS COCO,
and KITTI datasets further demonstrates that DetectorGuard achieves the first
provable robustness against localized patch hiding attacks at a negligible cost
(<1%) of clean performance.
