Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores

2025-05-13

AI Summary

This work addresses real-world physical-domain adversarial patch attacks against AI-powered automated checkout systems in fully unmanned stores. It systematically investigates the disruptive effects of three attack types—hiding, creation, and tampering—on YOLO-family object detection models. A novel loss function is proposed, leveraging color histogram similarity across target classes, and a first-of-its-kind physical attack evaluation metric is introduced, centered on bounding-box offset. The study further reveals that ambient shadows significantly enhance black-box attack efficacy. Evaluated on an RGB-camera-based physical testbed with real merchandise, digital attacks achieve >92% success rates, while physical interference reaches ≥68%; incorporating shadows boosts black-box success to 41.3%. Crucially, mainstream real-time defenses are shown to fail catastrophically under dynamic illumination. The work establishes a reproducible evaluation framework for AI security in cashierless retail and delivers critical insights into practical attack surfaces and defense limitations.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Ad search and search for Web retail
• Security and Privacy: Large-scale security measurements

Abstract

The advent of convenient and efficient fully unmanned stores equipped with artificial intelligence-based automated checkout systems marks a new era in retail. However, these systems have inherent artificial intelligence security vulnerabilities, which are exploited via adversarial patch attacks, particularly in physical environments. This study demonstrated that adversarial patches can severely disrupt object detection models used in unmanned stores, leading to issues such as theft, inventory discrepancies, and interference. We investigated three types of adversarial patch attacks -- Hiding, Creating, and Altering attacks -- and highlighted their effectiveness. We also introduce the novel color histogram similarity loss function by leveraging attacker knowledge of the color information of a target class object. Besides the traditional confusion-matrix-based attack success rate, we introduce a new bounding-boxes-based metric to analyze the practical impact of these attacks. Starting with attacks on object detection models trained on snack and fruit datasets in a digital environment, we evaluated the effectiveness of adversarial patches in a physical testbed that mimicked a real unmanned store with RGB cameras and realistic conditions. Furthermore, we assessed the robustness of these attacks in black-box scenarios, demonstrating that shadow attacks can enhance success rates of attacks even without direct access to model parameters. Our study underscores the necessity for robust defense strategies to protect unmanned stores from adversarial threats. Highlighting the limitations of the current defense mechanisms in real-time detection systems and discussing various proactive measures, we provide insights into improving the robustness of object detection models and fortifying unmanned retail environments against these attacks.

Problem

• Analyzes adversarial patch attacks on AI-based unmanned store systems
• Evaluates attack effectiveness using new bounding-box-based metrics
• Assesses robustness in black-box scenarios and proposes defenses

Innovation

• Novel color histogram similarity loss function
• Bounding-boxes-based metric for attack impact
• Black-box scenario robustness assessment