{"id":"e9bfb493-5f9e-43bf-9843-908e299d61b8","arxiv_id":"2501.08258","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Adversarial patches can be trained and applied entirely in the physical world through a projector-camera feedback loop, avoiding the transferability loss of printed stickers.","lead":"Adversarial machine learning usually creates attack images on a computer, then prints them as stickers, which often stop working in the real world. This paper instead trains the attack in the physical world: a projector beams a patch onto an object, a camera watches, and the patch is updated repeatedly until the detector misses the object.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim rests on unverified optimizability and a confounded baseline: PAPLA's PL-PA results are not compared against a same-projection DL-PA or a random-projection control, so the observed confidence reductions may stem from projector illumination rather than from E2E physical learning.","rationale":"Reader's weakest assumption (optimizability of the closed loop) is important, and my concern overlaps with it but sharpens the test. The strongest claim is that PL-PA 'eliminates the transferability issue' and that learning success implies attack success (Section III-A3). The paper's evidence for this is the PL-PA confidence reductions in Section V and the transferability tables (IV, V), but the experimental design does not isolate the physical-learning mechanism. In every PL-PA condition, the patch is learned and tested in the same physical setup, so the patch is optimized for that exact geometry and lighting; this is scene overfitting, not a general solution to digital-to-physical transfer. More importantly, the DL-PA baseline uses a printed sticker, while PL-PA uses a projector with up to 6000 ANSI lumens, a much stronger visual perturbation. Section V-C reports PL-PA's average L2 norm as about four times DL-PA's, and the projector changes the whole scene illumination, not just the patch area. Without a control projecting a random patch of matched brightness, the observed evasion could be a trivial brightness or occlusion effect. The 'noisy learning' in the outdoor experiments (Section V-E) and the distance dependence of Section IV-A2 (median reduction 0.65% at 0.5 m vs 76.53% at 1.5 m) further suggest sensitivity to setup rather than robust adversarial optimization. I therefore recommend keeping the CONDITIONAL verdict, with the condition being the addition of these control experiments and explicit registration and gradient handling. This is not a claim of dishonesty; the paper honestly lists limitations, but the central claim is underdetermined by the reported evidence.","tokens_in":19021,"tokens_out":6219,"duration_ms":61592,"concrete_test":"Run PAPLA under identical geometry and illumination in three conditions: (1) PL-PA as described; (2) DL-PA where a patch learned digitally on the same detector is projected with the same projector and output brightness; (3) a control projecting a random or blank pattern with matched mean brightness. If condition (1) does not significantly outperform condition (3), or condition (2) matches condition (1), the effect is attributable to projection brightness or coverage rather than E2E physical learning. Additionally, for the optimizability claim, record the projected patch location in the camera frame and compute the misalignment between that physical location and the patch location assumed by the attack; if the error is more than a few pixels, the gradient updates are misdirected.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section III-B1 instructs to 'update the patch pixels iteratively using the chosen attack' (DPatch or NAP) but omits the three pieces needed for that update to be meaningful in a physical loop: registration of the projected patch in the camera frame, a gradient path across the non-differentiable projector-camera transfer, and synchronization between projection, capture, and update. The digital attacks assume a known patch location and a differentiable image input; without explicit calibration, the gradient updates may not correspond to the physical patch's appearance. The reported confidence drops are therefore not shown to be caused by learned adversarial structure. The comparison uses a printed sticker for DL-PA and a high-power projector (6000 ANSI lumens) for PL-PA, and the PL-PA images have average L2 norm 26,295.67 versus 6,606.05 for DL-PA (Section V-C), so brightness or coverage alone could explain much of the difference. No random-projection or same-modality DL-PA baseline is reported, leaving the central claim that physical learning 'eliminates the transferability issue' unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PAPLA, a framework that adapts digital patch attacks (DPatch and NAP) to run end-to-end in the physical domain: a patch is projected onto a static target object, the scene is captured with a camera, and the patch pixels are updated iteratively using the chosen digital attack. The authors compare this physical-learning/physical-application (PL-PA) setting against digital-learning/digital-application (DL-DA) and digital-learning/physical-application (DL-PA, printed sticker) baselines, report factor analyses over projector strength, ambient light, distance, angle, and surface color, and present outdoor demonstrations against a parked car and a stop sign. The central claim is that, under specific conditions, performing adversarial learning in the physical domain eliminates the digital-to-physical transferability issue and ensures evasion.","tokens_in":19183,"tokens_out":3373,"duration_ms":36352,"significance":"If the central claim were established, PAPLA would be a notable new capability for physical adversarial attacks, with a clear security implication for camera-based perception systems. The paper's strengths include the breadth of the empirical study (81 controlled runs in the factor analysis, multiple target objects and detectors, and outdoor demonstrations), the honest enumeration of limitations in Section VI, and the explicit comparison of three learning/application scenarios. However, the evidence as presented does not yet isolate the effect of end-to-end physical learning: the main comparison is confounded by application medium and illumination, and the learning loop itself is not specified at the level needed to show that gradient-based optimization is actually taking place through the physical channel.","major_comments":[{"comment":"The central PL-PA versus DL-PA comparison is confounded. In Section V-A1, PL-PA uses a 6000 ANSI lumen projector while DL-PA uses a printed sticker, and Section V-C reports an average L2 norm of 26,295.67 for PL-PA versus 6,606.05 for DL-PA. The two conditions therefore differ simultaneously in the learning domain, the application medium, and the amount of scene-level illumination. Without a same-modality control in which a digitally learned patch is projected with the same projector at the same brightness, or a random-projection control with matched illumination and coverage, the observed confidence reductions cannot be attributed to end-to-end physical learning rather than to brightness, contrast, or accidental occlusion. This is load-bearing for the abstract's claim that E2E physical learning 'eliminates the transferability issue.'","section":"Section V-A and V-C"},{"comment":"The paper does not specify the mechanism that makes the physical learning loop optimizable. Section III-B1 says to 'capture the physical scene' and 'update the patch pixels iteratively using the chosen attack,' but DPatch and NAP are digital attacks that assume a differentiable input image and a known patch location and mask. The manuscript does not explain how the projected patch is registered in each camera frame, how gradients are obtained across the non-differentiable projector-camera channel (including projector transfer function, surface reflectance, and camera ISP), or how projection, capture, and update are synchronized. Without these details, the reported convergence is not established as adversarial optimization; a non-adversarial effect of the projected light could produce the same qualitative results.","section":"Section III-B1"},{"comment":"The statement 'ensuring the success of the learning process to imply the success of the attack' is definitional rather than empirical. If learning and application occur in the same physical loop, then a patch that reduces confidence in that loop is, by construction, successful in that loop. The interesting question is whether the learned patch transfers to reasonable variations in viewpoint, distance, and illumination. The paper's own Section IV-A results show strong sensitivity to distance (median reduction 0.65% at 0.5 m versus 76.53% at 1.5 m), and Section VI lists multiple constraints. The claim that PAPLA 'eliminates' the transferability issue therefore overstates what the evidence supports.","section":"Section III-A3"},{"comment":"The transferability evaluation compares PL-PA patches with DL-DA patches, not with DL-PA patches, even though the paper's headline comparison is PL-PA versus DL-PA. Tables IV and V report average confidence differences of 52.4% versus 39.1% for NAP and 35.6% versus 19.8% for DPatch, but the DL-DA baseline is not the physical-application baseline used in Sections V-A and V-B. To support the claim that physical learning improves cross-detector transferability relative to the current practice of printed stickers, the paper should compare PL-PA patches against DL-PA patches in the same transferability protocol.","section":"Section V-D"},{"comment":"The main evaluation reports single confidence scores without error bars or repeated trials, despite the paper's own Table III showing substantial pixel-level noise between consecutive captures of the same scene in controlled conditions (average L0 of 78.26%). Given that noise level, a point estimate from one or a few frames is insufficient to establish that the observed confidence differences are stable. The paper should report means and variances over multiple runs for the headline PL-PA versus DL-PA comparisons, as is already done for the surface-color analysis in Section IV-B.","section":"Sections V-A2, V-B2, and Table III"}],"minor_comments":[{"comment":"Insight 10 contains a typo: 'highly effected' should be 'highly affected.'","section":"Section IV-B2"},{"comment":"The text repeatedly writes 'ANOV A' instead of 'ANOVA.'","section":"Section IV-A2"},{"comment":"The setup text says 'identical parameters in each scenario' but then specifies different distances and patch sizes per target object; the sentence should be reworded to say the parameters were identical across scenarios for a given target object.","section":"Section V-A1"},{"comment":"The L0 percentages are reported without a threshold definition; since L0 normally counts nonzero pixel differences, the reader cannot tell whether a one-unit pixel change counts as a difference. A threshold or a reference to the code would make these tables reproducible.","section":"Tables II and III"},{"comment":"Reference [48] attributes RetinaNet to 'T.-Y. Ross and G. Dollár'; the correct first author is Tsung-Yi Lin. Please correct the citation.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper does not release code or detailed calibration data for the projector-camera loop, which limits reproducibility and makes it difficult to verify whether the loop actually optimizes through the physical channel. The topic is within scope for a computer vision venue, and the outdoor demonstrations are compelling, but the confounded baseline and underspecified loop mechanism need to be addressed before the central claim can be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing to know: the paper's core idea—running the patch optimization loop in the physical domain via a projector-camera feedback loop—is genuinely new and is demonstrated in controlled lab settings and an outdoor demo. The authors deserve credit for an honest limitations section: static objects, line-of-sight, surface color dependence, noisy learning, and visual conspicuousness are all acknowledged. The 81-run factor analysis (projector strength, ambient light, distance, angle) is a reasonable empirical sweep.\n\nThe central claim, however, is not isolated by the experiments. The main comparison PL-PA vs DL-PA varies both learning domain and application medium: projector versus printed sticker. There is no digital-learning plus projector-application baseline, and no random-projection control. The L2 numbers make the worry concrete: PL-PA images have average L2 of ~26k versus ~6.6k for DL-PA, which means the projector is dumping a lot of light on the scene. A bright illumination could reduce detector confidence without any learned adversarial structure. Without a same-modality control, the observed gains cannot be attributed to E2E physical learning.\n\nThe stress-test note's second point is also fair. The paper says 'update the patch pixels iteratively using the chosen attack' but leaves out registration, gradient flow across the non-differentiable projector-camera channel, and synchronization. DPatch and NAP assume a known patch location and a differentiable input. The outdoor learning curves show fluctuations and an overall downward trend, so something is iterating, but the mechanism is underspecified and reproducibility is low without code or data.\n\nThe abstract also overclaims: 'eliminates the transferability issue and ensures evasion.' The reported confidences include stop sign at 0.39 and car at 0.16–0.59, which are not evasions. The limitations section is measured, but the abstract promises more than the results show.\n\nBottom line: this is a promising attack modality with an interesting idea and an honest caveat list, but the key comparison is confounded and the loop needs specification. It deserves a serious referee because the novelty is real and the confound is fixable with a digital-learning/projector-application baseline and a random-projection control. I would cite it as evidence that projector-in-the-loop patch learning is feasible, with a caveat about attribution.","headline":"Genuinely new projector-in-the-loop attack, but the PL-PA vs DL-PA comparison is confounded by medium, and the loop mechanics are underspecified.","tokens_in":19750,"tokens_out":2953,"would_cite":true,"duration_ms":28240,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial patches can be learned and applied entirely in the physical world using a projector-camera loop.","keywords":["adversarial patches","physical-domain attacks","object detection evasion","projector-based attacks","transferability","end-to-end learning","PAPLA","deep learning security"],"falsifier":"Run PAPLA on a static object while holding all environmental factors fixed, and record the detector's confidence after every iteration; if the confidence does not fall over iterations, or if the final projected patch is no better than the same patch evaluated digitally on a clean frame, then the claim that physical learning eliminates the transferability problem fails in that setting.","tokens_in":18788,"feed_emoji":"📽️","tokens_out":8256,"duration_ms":71934,"temperature":0.7,"pith_summary":"This paper tries to show that the failure of adversarial patches to survive the jump from computer images to the physical world can be avoided by learning the patch in the physical world itself. It introduces PAPLA, a closed loop in which a projector shines the current patch on a static object, a camera photographs the scene, and an ordinary digital patch attack updates the patch from that photograph before the next projection. Across lab and outdoor tests, this physical learning–physical application route lowered object-detector confidence far more than the standard print-a-digital-patch route, and in an outdoor test it drove a parked car's detection confidence from 0.95 to 0 and a stop sign's from 0.95 to 0.39. The claim is explicitly conditional: it holds for static objects with a suitable projection surface and line of sight, and it trades away image quality, producing more visible distortion than printed stickers.","feed_headline":"Projector loop trains adversarial patches in the physical world","feed_subtitle":"Learning and applying the patch in the same scene removes the digital-to-physical drop that breaks printed stickers","key_machinery":"The machinery is the PAPLA closed loop: project the current patch onto the target, capture the scene with a camera, feed that frame into an existing digital patch attack to update the patch pixels, then repeat, and finally project the optimized patch as the attack. The load-bearing property is that learning and application share the same physical channel, so projector color response, surface color, ambient light, and camera viewpoint enter the optimization rather than appearing as a mismatch after training. The paper also relies on the standard digital attacks it wraps, DPatch and NAP, as the update rule that turns each camera frame into the next patch.","core_discovery":"PAPLA's central claim is that when patch learning and application both happen in the physical domain, the transferability problem disappears: success of the learning process implies success of the attack in that scene. The evidence is comparative: digitally learned patches that dropped YOLOv3 and Faster R-CNN confidence to about 0.55 and 0.77 when applied digitally only brought them down to 0.88 and 0.93 when printed as stickers, while the same attacks converted to physical learning drove confidence on tested objects to 0, 0.16, 0.26, and 0.15 in monocular lab settings. In a realistic outdoor run, the parked car's confidence fell from 0.95 to 0 and the stop sign's from 0.95 to 0.39. The paper frames this as a framework, PAPLA, that wraps existing digital attacks such as DPatch and NAP and executes their iterative updates inside a projector-camera loop, with the environmental conditions baked into the optimization.","pith_inferences":["If the loop converges as shown, a static object with a clear line of sight becomes an attack surface for remote light projection, which is a materially different threat model from placing a sticker on the object.","A natural extension the paper leaves implicit is mapping the convergence region of the loop over distance, angle, and projector power; the ANOVA results here suggest distance is the decisive variable and would be the first thing to test.","Because PAPLA wraps off-the-shelf digital attacks rather than defining a new loss, newer digital patch attacks could be dropped into the same loop and could inherit the physical-domain benefit if their update rule tolerates the projector-camera noise.","A testable consequence of the same-channel argument is that the loop's final patch should outperform a digitally optimized patch even when both are projected under identical conditions; the paper's DL-PA baseline uses printed stickers, so a projector-only comparison would isolate the learning-channel effect."],"forward_implications":["If the central claim holds, a practitioner no longer needs to simulate the physical world to attack a static object: pointing a projector and camera at it and running the loop produces a patch that works in that exact scene.","Environmental factors are not equal: distance was the strongest tested factor (median confidence reduction rose from 0.65% at 0.5 m to 76.53% at 1.5 m), lighter projection surfaces worked better, higher-lumen projectors helped, and ambient light had little measured effect in the tested range.","The same physically learned patches also transferred across detectors better on average than digitally learned patches (e.g., average confidence difference 52.4% vs 39.1% for NAP patches, and 35.6% vs 19.8% for DPatch patches), so the benefit is not limited to the detector used during learning.","The method is not universal: moving objects, hollow objects such as bicycles, and setups without line of sight remain the domain where printed patches are preferred, and the physical patches are more visually conspicuous."],"supporting_citations":[{"why":"Supplies the DPatch attack that PAPLA converts to physical learning, including the iterative patch update used in the loop.","marker":"[14]"},{"why":"Supplies the NAP attack used for the second physical-learning evaluation and the surface-color analysis.","marker":"[4]"},{"why":"Provides Robust DPatch, the baseline attack in the motivating experiment showing digital patches lose effect when printed.","marker":"[10]"},{"why":"Establishes the projector-based physical attack threat model that PAPLA extends from application-only to end-to-end learning.","marker":"[37–39, 44]"},{"why":"Provides the implementations of DPatch and Robust DPatch used to generate patches and drive the physical learning loop.","marker":"[45]"},{"why":"YOLOv3, one of the detectors evaluated for transferability and confidence reduction.","marker":"[46]"},{"why":"Faster R-CNN, one of the detectors evaluated and the target of the NAP attack.","marker":"[47]"}],"fun_headline_variants":["Train adversarial patches in the physical world, not digitally","Projector trains adversarial patches in situ","Eliminate digital-to-physical drop with projector-based learning","Physical-domain patch training kills the transferability gap","Projector-camera loop trains patches where they'll be used"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the closed loop actually optimizes: each camera picture of the projected patch has to let the attack software compute pixel updates that make the next projection better at hiding the object, rather than drifting, oscillating, or failing to improve.","fun_headline_variants_meta":{"raw":{"variants":["Train adversarial patches in the physical world, not digitally","Projector trains adversarial patches in situ","Eliminate digital-to-physical drop with projector-based learning","Physical-domain patch training kills the transferability gap","Projector-camera loop trains patches where they'll be used"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000813,"raw_usage":{"total_tokens":3608,"prompt_tokens":1034,"completion_tokens":2574,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":650,"completion_tokens_details":{"reasoning_tokens":2498}},"tokens_in":650,"tokens_out":2574,"duration_ms":18103,"temperature":1.0,"reasoning_tokens":2498,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:28:57.189863+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run PAPLA on a static object while holding all environmental factors fixed, and record the detector's confidence after every iteration; if the confidence does not fall over iterations, or if the final projected patch is no better than the same patch evaluated digitally on a clean frame, then the claim that physical learning eliminates the transferability problem fails in that setting.","supporting_citations":[{"cited_title":"Naturalistic physical ad- versarial patch for object detectors,","cited_arxiv_id":null,"evidence_quote":"Supplies the NAP attack used for the second physical-learning evaluation and the surface-color analysis."},{"cited_title":"Phantom of the adas: Secur- ing advanced driver-assistance systems from split-second phantom attacks,","cited_arxiv_id":null,"evidence_quote":"Provides the implementations of DPatch and Robust DPatch used to generate patches and drive the physical learning loop."}],"review_version":1}