# AT-BOD: An Adversarial Attack on Fool DNN-Based Blackbox Object Detection Models
## 2 Background
### Adversarial Attacks  
Adversarial attacks are techniques that generate adversarial examples capable of fooling machine learning models to make the wrong decisions by modifying the original input and adding well-constructed perturbations. In the adversarial threat models, there are three main types of adversarial attacks: Whitebox, Gray-box and Blackbox. The three threat models differ according on how much an adversary knows about the target network. Whitebox is when adversaries have prior knowledge and full access to the target model. They are aware of the concrete architecture, all of the parameters, weights configurations, and probably even the training details. Hence, they can tailor attacks and generate adversarial examples. In the Gray-box attack, adversaries have access of the target model structure but lacks access to its weights. In this threat model, the adversary can create adversarial examples using the same architecture of the target model. Under the Blackbox model, an adversary does not have access to the structure or parameters of the target network. Instead, it can query the results of the DL victim model to find predictions for particular inputs. The transfer learning is used to apply Blackbox attack [26; 27]. Adversarial examples can be formed as follows:  
Let \(f(x)\) be a DNN such that \((x)=W^{T}x\) where \(x\) is the input sample with label \(y\), and \(W\) is the model weights with high dimensionality. An input sample \(x^{\prime}\) is considered as an adversarial example of sample \(x\) if \(x^{\prime}\) is very close to \(x\) under a distance \(\delta\) with a constrained value \(\varepsilon\) such that \(f(x^{\prime})\
eq y\). In this type of attack, an adversary is assumed to have no prior knowledge of the model's internal structure but can access the output confidence score or label for a given input sample. The most successful and used method in this type of attack is the transferability of adversarial examples generated by another model. Transferability is when an input that can be adversarial to a model \(f^{\prime}\), it possibly can be adversarial to another model \(f\) too, where \(f\) and \(f^{\prime}\) share the same training data [27]. [PERSON] et al. [28] used data augmentation based on the Jacobian method generating new input samples to train a network iteratively. They performed a Whitebox attack on a chosen \(f^{\prime}\) model and used the generated and successful adversarial example to perform a Blackbox attack on another model \(f\). [PERSON] et al. targeted five classifiers using Blackbox attack, logistic regression, SVM, decision trees, k-nn, NNs, and ensemble networks. Adversarial examples generated by NNs-based classifiers have a high transferability. The ensemble networks have good transferability too, where [PERSON] et al. [29] performed a Blackbox attack by training several different classifiers to generate adversarial examples that work on an ensemble network. They were able to create transferable targeted and untargeted adversarial examples. The gradient estimators or query-based searches are other attack approaches whereby oracle queries are used to determine a small number of pixels that are vulnerable to change and result in a significant change in the target confidence score [30] or by estimating the gradient of the victim model by calculating the difference between the real and adversarial losses [31; 32]. All of the the attacks mentioned above use small perturbations that are mostly imperceptible for human sight. Adversarial patches are another type of attack that adds perturbations but in a restricted segment of the input sample. The adversarial patches are locally placed in the input image and able to fool DNNs models. [PERSON] et al. [33] used this trick to add crafted eyeglasses and attach them to face images, which was capable of fooling a CNN model based on VGG architecture for face recognition. The authors were able to apply the attack on the physical world by printing the perturbed eyeglass frames using a 3D printer.