Robust Dpatch Targeted Attack Implementation Question

[omerHof]

Hello,
I have a hard time understanding the RobustDPatch targeted attack implementation of ART.
My goal is to create a patch that cause the object detection model to classify it according to a given target label.

For example, given a data set that contains three classes (zebra, human, and dog), based on 'physical-world patch from Lee & Kolter' paper, I'm interested in producing a patch that given the zebra as the target label will cause the model to classify the patch as a zebra and ignore all other objects in the frame.

Based on the documentation of this attack, there is no option to enter the target label itself (unlike the ART implementation of the original Dpatch attack) only a Boolean value that indicates whether the attack is targeted or not.

Hence a few questions:

1. Based on the example above what is the correct way to use the RobustDpatch target attack implementation?
2. Which samples of the dataset the generate function needs to receive in order to performed a successful targeted attack?
   a. Only the samples without the their labels (classification + bounding boxes)?
   b. A specific class (the target class) along with their labels?

What am I'm missing here?

Thank's!
Omer

[beat-buesser]

Hi @omerHof These are good questions because the two attacks have slightly different patterns.

1. Set RobustDpatch(targeted=True, ...) and provide target labels to y in method generate.
2. The samples to argument x of method generate, the labels of the dataset are not needed for the targeted attack.

[omerHof]

Thanks!
I will give it a try and update about the results.