Researchers at the Belgian university KU Leuven have demonstrated that a simple color printout will make humans invisible in certain surveillance cameras.
Today’s AI-powered computer-vision systems rely on training Convolutional Neural Network (CNN) to identify different objects by feeding it with a multitude of samples and improving its parameters until it classifies objects correctly. In the paper “Fooling automated surveillance cameras: adversarial patches to attack person detection” published on Arxiv.org, the researchers at the Belgian university KU Leuven used YOLO-2, which stands for You Only Look Once Version 2, a real-time object detection system that uses a single neural network to a full image. This network divides the image into regions and predicts bounding boxes and probabilities for each region.
The researchers at the Belgian university KU Leuven wrote that the output of the network can be swayed to output a completely different result by making only subtle changes to the input of a convolutional neural network. “We did this by optimising an image to minimize different probabilities related to the appearance of a person in the output of the detector,” the researchers wrote. “In our experiments we compared different approaches and found that minimising object loss created the most effective patches.”
The researchers added that they also conducted real-world tests with the color printout and found that it works quite well in hiding persons from surveillance cameras, suggesting that security systems using similar detectors could be vulnerable as well. Matt Harris, Director of Geospatial & Data Analysis in Cultural Resources, meanwhile, said that while YOLO-2 may be fooled by the color printout of the researchers, other AI-powered computer-vision systems like Google Vision API cannot be fooled by simple color printout.
Wiebe Van Ranst, one of the authors, meanwhile told MIT Technology Review, “What our work proves is that it is possible to bypass camera surveillance systems using adversarial patches.” Van Ranst said that they are working on a “patch” that will work not just on YOLO-2 but also on multiple detectors at the same time.