{"id":"defeebaf-1a5c-4af3-9443-07784767a8d3","arxiv_id":"2607.23292","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A jointly optimized gradient-mask plus band-aid patch reportedly bypasses visible-infrared fused face detectors with >90% attack success in both digital and physical settings.","lead":"VIPatch is a physical adversarial patch built from a gradient-colored face mask and a band-aid that is designed to defeat face detectors using both visible-light and thermal-infrared cameras. The paper reports attack success rates above 90% in digital and real-world tests, which would put widely used thermal screening and surveillance systems at risk if the results reproduce.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central claim is unsupported: no actual visual-infrared fused detector is ever evaluated; Eq. (1) optimizes per-modality losses separately, and Tables 2-6 report only single-modality ASRs, so the >90% results do not demonstrate defeat of a fused system.","rationale":"The reader's weakest assumption—that no true visual-infrared fused detector is evaluated—is exactly the load-bearing gap I identify. The paper's strongest claim (over 90% ASR against fused face detection) requires evidence against an actual fusion mechanism, but the optimization objective (Eq. 1) is two independent per-modality losses, and all tables report single-modality detectors with the other modality's detector held fixed. The 'Fused' labels in Tables 5–6 appear to refer to the jointly optimized patch, not a fusion architecture. This is an external-validity problem, not an internal inconsistency: the attack may still be effective against AND-style fusion that requires both modalities to fail, but it is untested against OR-style or score-fusion systems commonly used to improve robustness. The proposed late-fusion OR test is a concrete, minimal check that would settle whether the physical claim transfers. The missing held-out split is a secondary concern that could be addressed by reporting subject-level train/test separation. These are addressable issues, so the reader's CONDITIONAL verdict remains appropriate.","tokens_in":15975,"tokens_out":5108,"duration_ms":52066,"concrete_test":"Implement a late-fusion detector that returns a face if either the visual or the infrared detector (the exact models in Tables 2–3) has a detection above its operating threshold—i.e., OR/max-score fusion. Measure VIPatch's physical ASR under the same protocol (same participants, angles, distances, lighting) against this fused detector. If the attack no longer achieves near-100% ASR (or drops well below the per-modality averages), the central fused-detector claim is falsified. Additionally, report a held-out subject split (e.g., optimize on 100 subjects, test on the remaining 42) and verify ASR does not collapse when subjects are disjoint.","verdict_should_be":"UNCHANGED","load_bearing_attack":"VIPatch's central claim—that a single physical patch defeats visual-infrared fused face detection—is not supported by the evaluation. The threat-model optimization (Eq. 1) is two independent arg mins over σ_v and σ_i, with no fusion function f_fused(X_v, X_i) anywhere in the formulation. In 'Digital Domain Attack', visible detectors are tested 'while holding the other modality's detector fixed' (TFW for visual; YOLOv8-Face for infrared), and Tables 2–4 report per-modality ASRs. Tables 5–6 label a 'Fused' column, but that column appears to denote the jointly optimized VIPatch evaluated on a single-modality detector, not an actual fusion architecture. No early-fusion, score-fusion, or decision-fusion face detector is defined, trained, or attacked. Consequently, the >90% ASR establishes that the patch causes simultaneous false negatives in two independent per-modality detectors under the tested conditions. A deployed fusion system using OR/max-score fusion, cross-modal consistency checks, or even a single correct detection from either modality could still detect the face, invalidating the physical-world claim. Additionally, the evaluation split (subjects/trials used for DE optimization vs. testing) is not reported, so it is unclear whether the same subjects appear in both phases, which would further inflate ASR. This is a correctness/validity gap, not an internal contradiction.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents VIPatch, a physical adversarial patch attack intended to defeat visual-infrared fused face detection. The patch combines a gradient-color face mask and a band-aid sticker; the mask colors and sticker pose are optimized with differential evolution using only the detector confidence as a black-box signal, under expectation-over-transformation and color-harmonization constraints. The authors report digital attack success rates above 90% for several visible-light and infrared face detectors, and physical ASRs in the same range. An ablation shows that optimizing the two modalities jointly and combining mask plus band-aid improves ASR. The central claim, however, is that one physical accessory defeats visual-infrared fused detection; the evaluation does not include any actual fused detector and does not document a held-out split.","tokens_in":16359,"tokens_out":5930,"duration_ms":57107,"significance":"If confirmed, this is a potentially important security contribution: a natural-looking mask and band-aid would bypass the combined visual/thermal face detectors used in access and temperature-screening systems. Strengths of the paper include its joint visual-infrared patch formulation, the use of physical constraints and EOT, the physical fabrication with a real thermal camera, and the clear ablation evidence that joint optimization matters. The paper is less convincing on its headline claim because no fusion architecture is ever exercised, and no train/test separation is reported. The contribution is publishable in principle, but the evaluation needs substantial additional work before the claimed threat against fused face detection can be accepted.","major_comments":[{"comment":"Eq. (1) is the core optimization, but it contains no fusion function: it is two independent arg mins over sigma_v and sigma_i with per-modality detectors f_v and f_i. Tables 2 and 3 likewise report visible-only and infrared-only ASRs; Tables 5 and 6 use \"Fused\" to mean jointly optimized patches evaluated on one modality, not an actual fusion model. The paper therefore does not demonstrate that VIPatch defeats a visual-infrared fused detector. A fusion system using OR/max-score fusion, cross-modal consistency, or a single modality that still detects would invalidate the physical-world claim. Please either implement and attack true early/score/decision fusion models, or reframe the claims to per-modality detectors.","section":"Threat Model, Eq. (1)"},{"comment":"The evaluation never states whether the SPEAKINGFACES images used during DE optimization are disjoint from the images used to compute ASR. Without a subject-disjoint split, the reported >90% ASR could be partly an artifact of optimizing and testing on the same data. Please report the split, the number of queries consumed per run, and ASR variability (e.g., over subjects or bootstraps).","section":"Experiment Setup / Evaluation Split"},{"comment":"Fig. 6 reports physical ASR for visual detectors only, and Table 4 reports physical ASR for infrared detectors only. There is no physical experiment in which visible and infrared streams are captured simultaneously and evaluated by a fused detector. Thus the conclusion that \"VIPatch reliably bypasses the target models in the physical world\" is not supported for the fused system that is the paper's stated target.","section":"Physical Domain Attack"},{"comment":"The ablation text states that \"jointly optimizing over the visual-infrared fused detectors raises the ASR.\" Given Eq. (1), these experiments optimize over two separate detectors, not a fused one. The term \"fused\" is misleading and propagates the unsupported central claim. Rename the columns to \"joint two-modality optimization\" and treat the absence of a test-time fusion rule as a limitation.","section":"Ablation Study, Tables 5-6"}],"minor_comments":[{"comment":"The crossover equation and its surrounding text disagree: the prose says the mutation vector replaces the original when rand > gamma_c, while Eq. (4) appears to assign the parent vector in that case. Please align equation and text.","section":"Eq. (4)"},{"comment":"Physical ASRs are quoted to two decimals without confidence intervals, number of subjects, or per-trial variability. A 600-frame video can produce a point estimate, but not the precision claimed. Please report trial counts and variance.","section":"Physical Domain Attack, Fig. 6"},{"comment":"The paper claims the patches are \"unobtrusive to human observers,\" but no human perceptual study or quantitative stealth metric (e.g., user study, detection-rate test) is reported. Please either add such an evaluation or soften the claim to \"visually harmonized by design.\"","section":"Abstract / Stealthiness"},{"comment":"Notation and reference hygiene should be cleaned: e.g., \"Mogface\" vs \"MogFace,\" \"d link\" as an author name, duplicated URLs, and the unexpanded table color legend.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"I would not reject solely because a true fusion architecture is absent, since a revision could add a score-fusion or decision-fusion baseline and substantially narrow the claim. The more serious issue is the missing train/test split; if the authors cannot provide a subject-disjoint evaluation, the reported ASRs should not be treated as reliable evidence. I recommend requiring that the split be documented and that the fused-system claim be directly tested or explicitly retracted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the new thing here is real — a physical patch that jointly targets visible and thermal face detectors, using a gradient mask plus band-aid, and it reportedly works well across many single-modality detectors. But the paper's central claim is broader than its evaluation. No actual visual-infrared fused detector is ever built or tested. Eq. (1) is two separate arg mins; Tables 5 and 6's 'Fused' column is the jointly optimized patch evaluated against individual visual or IR detectors, not a fusion model. So the >90% ASR demonstrates simultaneous false negatives in two independent per-modality detectors, not defeat of a fused system. That distinction matters: a fusion layer using OR/max-score or cross-modal consistency could still detect the face. This is the load-bearing gap and it is a real one.\n\nWhat is genuinely new: the joint optimization of a natural-looking visual patch and a corresponding thermal block/cold gel band-aid. The ablation supports that joint optimization beats single-modality optimization, and the physical results across angles, distances, and lighting are more thorough than most patch papers. The comparison table is honest about what prior work did — the 'Jointly' column is new. I'd credit that.\n\nWhere the paper is softer than it claims: (1) no fused detector evaluation, mentioned above; (2) no described held-out split — the DE optimizer's query images and the ASR test images may overlap, which could inflate success; (3) stealthiness is asserted but not measured — no human-noticeability study, just design choices; (4) the IR-side mechanism (cold gel under the band-aid) is qualitative; no thermal measurement or ablation isolating it. These are fixable rather than fatal.\n\nWho should read it: people working on physical adversarial patches, multimodal robustness, and face detection security. It is a solid systems-and-evaluation contribution once the claim is scoped properly. I would send it to peer review, but with a clear request to either evaluate a real fusion architecture or revise the title/abstract to say 'simultaneous attacks on visible and thermal detectors.' The split and human-study issues should also be addressed. This paper deserves a serious referee, not a desk reject.","headline":"Genuinely new joint visual+thermal patch attack, but the headline claim overreaches: no fused detector is ever tested, so the >90% ASR proves simultaneous single-modality failures, not defeat of a fusion system.","tokens_in":16823,"tokens_out":1561,"would_cite":true,"duration_ms":15322,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A gradient mask and band-aid can hide faces from visible and thermal cameras at once.","keywords":["adversarial patch","physical attack","visual-infrared fusion","face detection","thermal infrared","black-box attack","stealthiness","differential evolution"],"falsifier":"Run VIPatch's optimized patches against a deployed fused detector that actually combines the two modalities—for example, by requiring detections from both cameras to overlap, or by averaging their confidence—and test on held-out subjects not used in the optimization. If the fusion layer can still detect the face from either modality alone or uses cross-modal spatial consistency, the reported >90% attack success should drop sharply.","tokens_in":15887,"feed_emoji":"🩹","tokens_out":5985,"duration_ms":52982,"temperature":0.7,"pith_summary":"VIPatch is a physical adversarial patch attack aimed at systems that fuse visible-light and thermal-infrared face detection. It uses two everyday-looking accessories—a gradient-color mask and a band-aid sticker—and optimizes both elements jointly across the two image modalities. The paper reports over 90% attack success in digital simulations and in physical tests across distances, angles, and lighting levels, while the patches stay visually unobtrusive. The authors argue this reveals a practical vulnerability in real-world visual-infrared fused face detection systems.","feed_headline":"Gradient mask and band-aid blind thermal and visual face detectors","feed_subtitle":"Attack reports over 90% success hiding faces from both cameras using only ordinary accessories.","key_machinery":"The load-bearing mechanism is the joint optimization of two physical accessories: a face mask whose colors form a vertical gradient, and a band-aid sticker. Mask colors are chosen by Differential Evolution under a harmonic-template color constraint and applied row-by-row with a gradient formula; the band-aid's location and angle are optimized in the same search. Expectation over Transformation injects realistic noise, brightness, and placement perturbations during optimization, and a 3D face model renders the mask and sticker onto facial images with plausible geometry. These components bridge the digital-to-physical gap, which is why the optimized patterns survive being printed and worn.","core_discovery":"The paper's central claim is that a single physical accessory set—a printed gradient-color mask worn together with a band-aid—can make a person undetectable to visual-infrared fused face detectors. VIPatch optimizes the mask's gradient color combination and the band-aid's position and angle, all under a color-harmonization constraint so the mask blends into the face, with the band-aid restricted to areas away from the eyes. In the infrared image the mask is modeled as a cold block, simulating the thermal insulation of a real mask. After optimization, the digital patches are printed and placed on the face. Across nine visible-light and seven infrared face detectors, the paper reports average","pith_inferences":["Because the paper optimizes each modality's detector separately and never tests a true fusion layer, the strongest unverified implication is that fusion architectures with cross-modal consistency checks would still fall; testing VIPatch against score-level or feature-level fusion models would settle this.","The infrared attack's high physical success may owe as much to the cold gel's thermal insulation as to the learned sticker pattern; a controlled ablation that swaps the gel for a non-thermal placeholder would identify which factor matters.","The color-harmonization constraint offers a general recipe for stealthy physical patches: restrict adversarial changes to the subspace of natural appearance, which may generalize to other face or person attacks.","Since no held-out identity or image split is reported, the practical claim needs replication on subjects and poses never touched by the Differential Evolution search to rule out overfitting to the evaluation set."],"forward_implications":["Thermal screening and surveillance systems relying on fused visible-infrared face detection could be evaded by ordinary-looking accessories, with no special equipment needed.","The attack transfers across multiple off-the-shelf face detectors despite black-box query-only access, indicating the vulnerability is not model-specific.","Jointly attacking both modalities is essential: optimizing on one modality alone drops success to roughly 61–79%, so defenses must be designed against cross-modal attacks, not per-modality patches.","Physical factors such as distance, angle, and lighting that cripple earlier patch attacks have limited effect here, making physical adversarial patches practical outside tightly controlled camera positions.","The combination of mask and band-aid is stronger than either alone, suggesting that redundant, mutually supporting physical elements can raise attack reliability."],"fun_headline_variants":["Band-aid and gradient mask hide faces from visual-infrared AI","Physical patch fools fused face detectors with a mask and band-aid","90% evasion: gradient mask and band-aid trick thermal and visual sensors","Two accessories blind fused face detectors in the real world","Natural-looking patch defeats visual-infrared face id with a mask and band-aid"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The paper never tests a system that truly fuses the two camera types; it attacks each camera's detector separately and assumes that failing both separately fails the fused system, and it does not report keeping the people it tests separate from the ones used to optimize the patches.","fun_headline_variants_meta":{"raw":{"variants":["Band-aid and gradient mask hide faces from visual-infrared AI","Physical patch fools fused face detectors with a mask and band-aid","90% evasion: gradient mask and band-aid trick thermal and visual sensors","Two accessories blind fused face detectors in the real world","Natural-looking patch defeats visual-infrared face id with a mask and band-aid"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000857,"raw_usage":{"total_tokens":3538,"prompt_tokens":702,"completion_tokens":2836,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":446,"completion_tokens_details":{"reasoning_tokens":2759}},"tokens_in":446,"tokens_out":2836,"duration_ms":18239,"temperature":1.0,"reasoning_tokens":2759,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-31T23:49:51.370060+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run VIPatch's optimized patches against a deployed fused detector that actually combines the two modalities—for example, by requiring detections from both cameras to overlap, or by averaging their confidence—and test on held-out subjects not used in the optimization. If the fusion layer can still detect the face from either modality alone or uses cross-modal spatial consistency, the reported >90% attack success should drop sharply.","supporting_citations":[],"review_version":1}