{"id":"ad6e3672-4d97-475b-baf6-a7a861d641ef","arxiv_id":"2412.01440","paper_version":5,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"BadPatch generates naturalistic, customizable adversarial patches for evading person detectors using incomplete diffusion optimization, and it introduces the AdvT-shirt-1K physical-world dataset.","lead":"The paper introduces BadPatch, a method that uses diffusion models to make natural-looking, customizable adversarial patches that can hide people from object detectors. If it works, it offers a practical way to evade surveillance systems and provides a physical-world dataset for studying defenses.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The naturalness claim is not validated: CLIP similarity is used both to select epsilon and to measure success, and no baseline is compared on it, so the central 'naturalistic' contribution rests on an unvalidated metric.","rationale":"The reader's CONDITIONAL verdict is fair. I would not treat Eq. (9) as the most load-bearing gap: while the U-Net-gradient bypass is heuristic, the white-box rows of Table 1 show the approximate gradient reliably descends the detector loss, otherwise large gaps over random patches would not appear. The more fragile part of the central claim is naturalness. BadPatch's contribution over AdvPatch and AdvYOLO is precisely that patches are naturalistic and customizable, yet the only quantitative naturalness evidence is CLIP similarity computed after choosing epsilon=0.5 using that same metric in Section 4.4. No baseline is measured on this metric, and the hyperparameter selection is on the evaluation metric itself, making the reported similarity optimistic. Naturalness is also a perceptual property; CLIP similarity can be high for stylized patches that humans find clearly artificial. A blinded human preference test with matched baselines is the minimal check that would settle whether the central naturalness claim lands. This does not invalidate the attack-effectiveness results or the dataset; it only means acceptance should remain conditional on non-circular naturalness evidence.","tokens_in":13951,"tokens_out":8010,"duration_ms":75632,"concrete_test":"Run a two-alternative forced-choice human study with at least 20 raters: for each of the 9 reference images, show the reference and side-by-side same-size patches (BadPatch vs. NPAP/D2D/AdvYL), and ask which is more natural and which better matches the reference. Also report CLIP similarity for all baselines, not only BadPatch, and select epsilon on a held-out naturalness split. If BadPatch is not preferred over existing naturalistic baselines, the central claim of natural appearance is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"BadPatch's central value proposition is that its patches are naturalistic, but the paper's only quantitative naturalness evidence is CLIP similarity between generated patches and GPT-4o-generated text descriptions of the reference image. This metric is the same one used in Section 4.4 to select the perturbation constraint epsilon=0.5, so the reported naturalness of the final patches is partly an artifact of selecting the hyperparameter on the evaluation metric. Moreover, no baseline method (AdvPatch, NPAP, D2D, AdvART) is scored on this metric, so 'naturalistic' is never compared against existing approaches. CLIP similarity can be high for stylized or artificial-looking images, and the paper relies on unblinded example images rather than a perceptual study. The gradient approximation in Eq. (9) is indeed unproven, but the white-box ASR results in Table 1 provide empirical evidence that the approximate descent direction works; the naturalness claim has no comparable empirical support.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents BadPatch, a diffusion-based method for generating naturalistic and customizable adversarial patches for person detectors. The pipeline maps a reference image into the latent space via Null-text inversion, optimizes the latent vector at an intermediate timestep T/2 through an Incomplete Diffusion Optimization (IDO) procedure, and uses an IoU-based detection loss together with mask control to produce patches of various shapes. Experiments on the INRIA dataset report attack success rates and average precision across 11 object detectors, along with cross-dataset evaluations on MPII, COCO, and a self-collected set, plus ablations and a newly captured physical T-shirt dataset, AdvT-shirt-1K, containing 1,131 images. The central claims are that BadPatch achieves attack performance comparable to state-of-the-art non-naturalistic patches while maintaining a natural appearance, and that AdvT-shirt-1K is the first physical adversarial T-shirt dataset.","tokens_in":14151,"tokens_out":6835,"duration_ms":59681,"significance":"If the claims are fully validated, BadPatch would be a practical advance: it offers a customizable, reference-image-driven pipeline and a physical dataset that can support future defense research. The strengths of the manuscript include a systematic evaluation across a wide range of detectors, a released codebase and dataset, and a careful decomposition of the pipeline with ablations on the perturbation constraint, loss function, trajectory length, mask control, and iterative optimization. The main gaps are the lack of a like-for-like comparison with baseline methods in the headline experiment table, an insufficiently validated naturalness claim, and a thin quantitative evaluation of the physical dataset. These gaps are load-bearing for the paper's two central contributions, so they need to be addressed before the claims can be accepted as stated.","major_comments":[{"comment":"The headline comparison is not like-for-like. Every BadPatch row (P1–P11) is a white-box attack optimized against the detector in the corresponding column, whereas all baselines (PA–PF) are transfer attacks trained once on YLv2 or YLv4t and then evaluated across detectors, as indicated by the table footnote. The claimed 'highest ASR' and the specific 10.1% improvement over AdvYL on YOLOv4-tiny are therefore partly an artifact of the training protocol rather than of patch quality. To support the central attack-performance claim, the authors should either retrain all baselines white-box for each target detector, or report all methods in a common transfer setting (e.g., train on YLv4 and test on all detectors), and qualify the claims accordingly.","section":"Table 1 / §4.2"},{"comment":"The naturalness evidence is not adequate and is partially circular. The CLIP similarity used to evaluate natural appearance in Figure 4 and Table 3 is the same criterion used in Section 4.4 to select the perturbation constraint ϵ=0.5, so the high CLIP similarity of the final patches is expected by construction. Moreover, no competing method (AdvYL, T-SEA, NPAP, D2D, AdvART) is scored on this metric, and no human perceptual study is reported. Since 'naturalistic' is the paper's central value proposition, the authors should compare CLIP similarity across all baseline patch methods, report a perceptual study (e.g., forced-choice or Likert ratings), or provide an independent image-quality metric, so that the claim of improved naturalness is not an artifact of the selection procedure.","section":"§4.4"},{"comment":"The derivation of the optimization gradient is not justified. Equation (9) claims a chain-rule expansion for the gradient of the loss with respect to z_{T/2}, but it drops the Jacobians of the U-Net denoising steps εθ and replaces them with a product of scalar coefficients. These Jacobians are generally not negligible, so it is not obvious that the resulting vector is a valid descent direction for the attack loss. The white-box ASR results in Table 1 give empirical evidence that the approximation is useful, but the paper should either provide a formal argument for why the approximation behaves as a descent direction, or include an ablation comparing Eq. (9) with the exact gradient (e.g., using gradient checkpointing on a reduced setting). As written, the IDO step is not fully reproducible from the text alone.","section":"Eq. (9) / §3.2"},{"comment":"The physical-world claim for AdvT-shirt-1K is not quantitatively established. Section 4.5 reports only the detection performance of YOLOv5s under varying confidence thresholds (right side of Figure 8) and does not compare against clean T-shirts, other patch methods, or other detectors, nor does it report ASR or AP numbers for the nine printed designs. To support the claim that BadPatch works in physical settings, the authors should report ASR/AP for the printed adversarial T-shirts versus a clean control, ideally with a comparison to a baseline patch method under the same capture conditions.","section":"§4.5"}],"minor_comments":[{"comment":"The typesetting of Eq. (9) is garbled: the square-root symbols and the product structure are not readable as written. Please restate the approximate gradient in a clean, unambiguous form.","section":"Eq. (9)"},{"comment":"In the 'Collected' row of Table 2, the AP entry under T-SEA appears as '8' rather than a decimal value; this should be corrected (e.g., 8.0 or 8.6).","section":"Table 2"},{"comment":"The text states that patches are trained using YOLOv4 with various methods, but Table 1's footnote says NPAP and D2D were trained on YLv4t. Please clarify whether Table 2 is based on models retrained on YOLOv4 or on the same transfer patches used in Table 1.","section":"§4.3"},{"comment":"Algorithm 1 applies the target mask to the generated patch in the image space (line 13) but optimizes the latent vector with a downsampled mask (line 16). The interaction between these two mask applications should be described more explicitly.","section":"Algorithm 1"},{"comment":"Figure 2 is dense and the text labels are difficult to read. Please enlarge the figure and clarify the flow from reference image to latent optimization to final patch.","section":"Figure 2"},{"comment":"The IoU threshold t in the loss function of Eq. (5) is not given a value in the experimental setup. State the value used for t, since it directly affects the loss.","section":"Eq. (5)"},{"comment":"The claim that AdvT-shirt-1K is 'the first physical adversarial T-shirt dataset' should be scoped carefully. The paper itself cites Xu et al. (2020) [60], which also uses physical adversarial T-shirts; if that work released images, the claim should be qualified (e.g., 'first public large-scale dataset' or 'first dataset with over a thousand images').","section":"Abstract / §4.5"}],"recommendation":"major_revision","confidential_remarks":"The core idea is promising and the dataset is a useful resource, but the comparison fairness in Table 1 and the circular naturalness metric are the two main blocking issues. The gradient approximation in Eq. (9) also needs stronger justification or empirical validation for the method section to be sound. If the authors retrain baselines in a comparable protocol and provide independent naturalness evidence, the paper would be a strong candidate for acceptance. Please also verify the 'first physical adversarial T-shirt dataset' claim against existing work before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The useful news first: BadPatch is a real advance in the patch-attack toolkit. The specific combination of null-text inversion, incomplete diffusion optimization, the IoU-detection loss, and mask-based customization is new, and the AdvT-shirt-1K dataset (1,131 physical images, 9 designs, diverse scenes) is a practical contribution that the community can build on. The attack performance claims are largely backed by the tables: broad detector coverage, ablations on loss, trajectory length, and mask control, and the iterative optimization result is honest about the naturalness tradeoff. The white-box results show the method works, and the cross-dataset transfer numbers are competitive. The soft spots are real but not fatal. The biggest one is the naturalness evidence. The paper uses CLIP similarity between GPT-4o descriptions and generated patches both to pick epsilon in Section 4.4 and to claim natural appearance, and no baseline method is scored on that metric. So the central value proposition, that these patches are naturalistic, is not actually validated against existing patches. A perceptual study or even a simple forced-choice comparison would fix this. This is the main issue to address before relying on the claim. Second, Table 1 mixes white-box patches trained on the target model with transfer baselines, so the claim of highest attack success rate is overbroad. The numbers are still meaningful, but the comparison is apples-to-oranges in places. No error bars either, which matters when the margins are a few percent. The gradient approximation in Eq. (9) is unproven, as the reader notes, but Table 1 gives empirical evidence the approximate descent direction works. So I see that as a minor theoretical gap, not a load-bearing flaw. I also could not access the code from the link in the abstract, which is a shame because reproducibility would help a lot here. Overall, the attack effectiveness side holds up; the naturalness side needs more careful evidence. This paper deserves a serious referee. I would send it to review, with the expectation of a major revision focused on the naturalness evaluation and a cleaner comparison protocol. I would cite it for the dataset and the method, and I would bring it to a reading group to discuss what counts as naturalistic in this literature.","headline":"A solid diffusion-based patch attack with a genuinely useful new dataset, but the naturalistic claim rests on a metric the authors also used to tune the method.","tokens_in":691,"tokens_out":1459,"would_cite":true,"duration_ms":23529,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Diffusion-based BadPatch generates naturalistic, customizable adversarial patches that achieve attack success comparable to state-of-the-art non-naturalistic patches, and introduces the AdvT-shirt-1K physical adversarial T-shirt dataset.","keywords":["adversarial patches","diffusion models","physical attacks","person detection evasion","Null-text inversion","IoU-Detection loss","AdvT-shirt-1K","naturalistic adversarial patch"],"falsifier":"Print a BadPatch-generated patch and a same-shape random-color patch on identical T-shirts, photograph the same person at fixed distances and angles in both indoor and outdoor light, and run YOLOv5s on the photos; if the BadPatch shirt does not reduce detection mAP below the random-shirt baseline under these controlled conditions, the paper's physical-world effectiveness claim is falsified.","tokens_in":13721,"feed_emoji":"👕","tokens_out":4930,"duration_ms":41781,"temperature":0.7,"pith_summary":"The paper proposes BadPatch, a diffusion-based method for generating physical adversarial patches that look natural and can be customized from a user-supplied reference image. Its central claim is that these naturalistic patches achieve attack success rates comparable to state-of-the-art non-naturalistic patches, while preserving enough of the reference image's semantics to avoid looking like obvious attacks. To support the claim, the authors build AdvT-shirt-1K, a physical dataset of 1,131 photos of people wearing printed adversarial T-shirts across indoor and outdoor scenes, and show the patches reduce detection accuracy on several modern detectors. The practical upshot is that a person could evade surveillance person detectors while wearing a visually ordinary, personally chosen design on a T-shirt.","feed_headline":"Natural-looking T-shirt patches evade person detectors","feed_subtitle":"Diffusion-based BadPatch turns any reference photo into a wearable print that fools YOLO, DETR and Faster R-CNN.","key_machinery":"The load-bearing mechanism is Incomplete Diffusion Optimization (IDO): the reference image is inverted to a noise latent at the halfway timestep $z_{T/2}$ with optimized null-text embeddings, and adversarial gradients are applied to that latent rather than to the image or to the full 50-step trajectory. A mask controls the patch shape, background pixels are replaced with a solid color before inversion, and an IoU-Detection loss masks out detections that do not overlap the patch. The paper also relies on a gradient approximation from Eq. (9) that bypasses U-Net gradients, reducing memory use; the incomplete trajectory is what keeps semantic content intact.","core_discovery":"BadPatch treats adversarial patch generation as an optimization of the latent vector at an intermediate diffusion timestep rather than optimizing pixels or a full denoising trajectory. Starting from a reference image, Null-text inversion maps the image to a latent vector, then Incomplete Diffusion Optimization updates that vector against an IoU-Detection loss that targets only detections overlapping the patch region. The update is constrained to a small $L_\\infty$ ball and uses an approximate gradient that skips the U-Net's backpropagation, so the procedure stays within a 25-step denoising path and keeps the generated patch semantically close to the reference. The paper reports attack success rates that rival or exceed earlier unnatural patches, and introduces AdvT-shirt-1K as the first physical adversarial T-shirt dataset.","pith_inferences":["The approximate gradient in Eq. (9) effectively treats the diffusion U-Net as a fixed feature extractor; if that approximation is sound, similar latent-space attacks could be mounted with other generative priors, and the method may extend to video or multi-view attacks.","The CLIP-similarity measure used to choose the perturbation budget could double as a cheap automated screening tool for patch naturalness in future adversarial-patch datasets.","Since the paper's physical photos were collected over six months while the method was still being refined, the dataset's reported evasion rates likely reflect an upper bound achievable with careful printing and photography; re-testing with standardized printing would reveal how much margin remains.","A defense that detects patches by semantic inconsistency between the patch region and its text description, as measured by CLIP, would directly target the optimization objective BadPatch uses to stay natural."],"forward_implications":["A single printed T-shirt can hide a person from a range of detectors, with the strongest reported effects on YOLOv3, YOLOv4-tiny, YOLOv5s, YOLOv7-tiny, YOLOv10s, YOLOv12s, Faster R-CNN, DETR and RT-DETR.","Because patches start from a reference image, the same framework can produce a family of visually distinct adversarial designs rather than a fixed square pattern.","AdvT-shirt-1K gives future defense work a benchmark with real printed patches and ground-truth person and patch boxes, rather than only simulated pastings.","The IoU-Detection loss makes training less dependent on complete bounding-box annotations, since only detections overlapping the patch receive gradient signal."],"supporting_citations":[{"why":"Supplies the per-timestep null-text embedding optimization that BadPatch uses to preserve reference semantics during inversion.","marker":"[41]"},{"why":"Supplies the DDIM inversion and sampling recurrence that maps images to latents and back for the incomplete diffusion process.","marker":"[50]"},{"why":"Provides the Stable Diffusion backbone whose latent space is optimized by BadPatch.","marker":"[46]"},{"why":"Defines the common detection loss that BadPatch replaces with IoU-Detection loss, and provides the AdvYOLO baseline.","marker":"[51]"},{"why":"Provides the GAN-based naturalistic patch baseline NPAP that BadPatch compares against and improves upon.","marker":"[24]"},{"why":"Supplies the technique of bypassing U-Net gradients that BadPatch adopts in its approximate gradient Eq. (9).","marker":"[11]"},{"why":"Provides the INRIA person dataset used for training and evaluating the patches.","marker":"[12]"}],"fun_headline_variants":["BadPatch: natural patches that fool YOLO and DETR","Turn any photo into an adversarial T-shirt patch with BadPatch","Naturalistic adversarial patches: BadPatch beats detectors","BadPatch: stealthy patches that look natural, evade detection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The optimization relies on the approximate gradient in Eq. (9), which skips the U-Net's gradient contribution, being a valid descent direction, and on a 25-step denoising path preserving enough of the reference image's semantic content.","fun_headline_variants_meta":{"raw":{"variants":["BadPatch: natural patches that fool YOLO and DETR","Turn any photo into an adversarial T-shirt patch with BadPatch","Naturalistic adversarial patches: BadPatch beats detectors","BadPatch: stealthy patches that look natural, evade detection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000329,"raw_usage":{"total_tokens":1813,"prompt_tokens":901,"completion_tokens":912,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":517,"completion_tokens_details":{"reasoning_tokens":842}},"tokens_in":517,"tokens_out":912,"duration_ms":8865,"temperature":1.0,"reasoning_tokens":842,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T04:22:37.068771+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Print a BadPatch-generated patch and a same-shape random-color patch on identical T-shirts, photograph the same person at fixed distances and angles in both indoor and outdoor light, and run YOLOv5s on the photos; if the BadPatch shirt does not reduce detection mAP below the random-shirt baseline under these controlled conditions, the paper's physical-world effectiveness claim is falsified.","supporting_citations":[{"cited_title":"High-resolution image syn- thesis with latent diffusion models","cited_arxiv_id":null,"evidence_quote":"Provides the Stable Diffusion backbone whose latent space is optimized by BadPatch."},{"cited_title":"Fool- ing automated surveillance cameras: adversarial patches to attack person detection","cited_arxiv_id":null,"evidence_quote":"Defines the common detection loss that BadPatch replaces with IoU-Detection loss, and provides the AdvYOLO baseline."},{"cited_title":"Nat- uralistic physical adversarial patch for object detectors","cited_arxiv_id":null,"evidence_quote":"Provides the GAN-based naturalistic patch baseline NPAP that BadPatch compares against and improves upon."},{"cited_title":"Content-based unrestricted ad- versarial attack","cited_arxiv_id":null,"evidence_quote":"Supplies the technique of bypassing U-Net gradients that BadPatch adopts in its approximate gradient Eq. (9)."},{"cited_title":"Histograms of oriented gra- dients for human detection","cited_arxiv_id":null,"evidence_quote":"Provides the INRIA person dataset used for training and evaluating the patches."}],"review_version":1}