{"id":"f8cddc50-a0a0-4dd2-9398-0f5088585f77","arxiv_id":"2608.04559","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"A black-box physical attack that optimizes pure-color patch positions and colors with differential evolution, guided by finite-difference key-region localization, outperforms Bbox-Att on three remote sensing detectors.","lead":"ColorFD attacks remote sensing object detectors by placing a few solid-color paper patches on aircraft and optimizing their positions and colors with an evolutionary search that uses only the detector's outputs. It beats the tested black-box patch baseline and roughly matches white-box attacks, with a small physical test on toy aircraft models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported ASR gains over Bbox-Att are single-run point estimates from a stochastic DE optimizer; without repeated-seed variance, the claimed 20–35 pp margins cannot be assessed.","rationale":"The reader's weakest_assumption concerns finite-difference probing reliability on Faster R-CNN. That is a genuine weakness, and the paper's own results show key-region guidance reducing ASR from 95.09 to 88.21 on Faster R-CNN. However, the central comparison against Bbox-Att does not depend on guidance succeeding: even unguided ColorFD outperforms Bbox-Att by large margins, and on Faster R-CNN the strongest result is the unguided variant. The more load-bearing condition for the paper's headline claim is that the reported point estimates are stable under the stochastic DE optimization. The authors explicitly acknowledge run-to-run variability, yet provide no variance information anywhere. Without repeated-seed experiments, a reader cannot distinguish a robust method from a favorable draw. A secondary concern, noted in Section V.B.2 and Algorithm 3, is that the common-feature heatmap is constructed from the same 306 dual-engine jet instances later used for evaluation in Table II/IV, which would overstate that variant's performance; but this affects only the common-feature contribution, not the core Bbox-Att comparison. The paper otherwise contains useful architectural detail and internally consistent tables, and the physical experiment is appropriately described as a controlled feasibility check. I therefore keep the conditional verdict rather than moving to accept or reject: the method may be strong, but the stochastic repeatability and fair comparison condition must be satisfied before the central claim is fully supported.","tokens_in":17250,"tokens_out":5665,"duration_ms":57002,"concrete_test":"Rerun ColorFD (unguided, key-region, and common-feature variants) and Bbox-Att on the same 100-image DIOR aircraft subset with at least 10 independent DE seeds each, using identical seeds for the random-number stream where possible. Report mean and 95% confidence intervals for ASR and AP50 on each detector, and record how many images required multiple optimization attempts. If the ColorFD-vs-Bbox-Att margin exceeds the combined standard error on every detector, the central claim survives; if the margins are within noise, the claim must be weakened.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that ColorFD 'consistently outperforms' Bbox-Att and matches white-box baselines rests entirely on the point estimates in Tables I–IV. Differential Evolution is explicitly stochastic (Eq. 7 uses random individuals r1/r2/r3; Eq. 8 samples r_j from U(0,1)), and Section VI.B admits that the stochastic nature of DE causes 'performance variability across different runs' and that 'for certain samples, multiple optimization attempts are required to achieve satisfactory results.' Yet no experiment reports a standard deviation, confidence interval, number of seeds, or any paired statistical comparison. Every ASR/AP50 in Tables I–IV and the sensitivity plots appears to be a single run. If run-to-run variance is comparable to the reported differences—e.g., key-region guidance improves ASR by only 7.37 pp on YOLOv3u and the ColorFD-vs-Bbox-Att margin is 35.38 pp on YOLOv3u, 37.10 pp on YOLOv5u, and 38.58 pp on Faster R-CNN for the unguided variant—the headline advantage could be an artifact of favorable seeds. Because both ColorFD and Bbox-Att are stochastic, a lack of repeated runs is load-bearing for the paper's primary empirical claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ColorFD, a black-box physical adversarial patch attack for remote sensing object detectors. Perturbations are modeled as multiple pure-color square patches whose positions and colors are jointly optimized by Differential Evolution (DE) using only the detector's returned detection results. The method contributes a target-wise fitness and selection mechanism for multi-target attacks, a finite-difference-based key-region localization procedure, and a common-feature category prior to constrain the search space. Experiments on a DIOR-based aircraft subset compare ColorFD against the black-box method Bbox-Att and the white-box methods AP-PA and BADEI on YOLOv3u, YOLOv5u, and Faster R-CNN, and a small physical deployment study with four target models is reported.","tokens_in":17538,"tokens_out":4787,"duration_ms":42286,"significance":"If the reported results hold, ColorFD would offer a practical query-only attack that outperforms the tested black-box baseline and matches or exceeds strong white-box baselines on some detectors. The pure-color patch representation is physically simple, and the target-wise fitness/selection mechanism is well motivated for multi-target optimization. The finite-difference probing idea is interesting and the paper provides clear algorithmic descriptions (Algorithms 1-3). The main limitation is that the empirical evidence is currently based on single-run point estimates from a stochastic optimizer and a qualitative physical study, so the significance of the claims is conditional on additional repeated-run experiments and more thorough physical evaluation.","major_comments":[{"comment":"All ASR and AP50 values are single-run point estimates of a stochastic DE optimizer: Eq. (7) uses randomly selected individuals r1, r2, r3, and Eq. (8) samples r_j from U(0,1). Section VI.B explicitly admits that 'the stochastic nature of the DE-based black-box optimization leads to performance variability across different runs' and that 'for certain samples, multiple optimization attempts are required to achieve satisfactory results.' No standard deviation, confidence interval, number of seeds, or paired statistical test is reported for any experiment. The central claim in Section V.B.3 that ColorFD 'consistently outperforms the tested black-box attack method' rests on point-estimate margins of 35.38, 37.10, and 38.58 percentage points over Bbox-Att (computed from Table III), which cannot be assessed without repeated runs. Please report means and standard deviations over at least 5-10 independent runs and include paired statistical comparisons (e.g., Wilcoxon signed-rank tests) for the main head-to-head results.","section":"Tables I-IV and Section VI.B"},{"comment":"The key-region guidance, a central contribution, decreases attack performance on Faster R-CNN: ASR drops from 95.09% (unguided) to 88.21% (key-region) and AP50 worsens from 0.0169 to 0.0974. The paper attributes this to the unavailability of RPN information in a black-box setting, but this explanation is a hypothesis rather than a verified mechanism. Because the finite-difference probe is the basis of the guidance, the current evidence shows that the key-region strategy is not generally architecture-agnostic. The statement in V.B.1 that key-region guidance 'consistently outperforms both the unguided variant and noise-based baselines on one-stage detectors' is carefully scoped, but the contribution would be stronger if the paper either characterized the architectural conditions under which the probe is reliable or proposed an alternative probing signal that works for two-stage detectors.","section":"Section V.B.1 and Table I"},{"comment":"The common-feature heatmap is constructed from the same 306 dual-engine wing-mounted jet instances that are later used for evaluation in Table IV. This means the category-level prior is not independent of the test set: the attack is evaluated on the very instances that defined the prior. To support the claim that common-feature guidance provides 'generalizable priors' (Section V.B.2), the heatmap should be built on a disjoint training split or a separate set of instances not used in the reported attack evaluation. Otherwise, the reported gains from common-feature guidance may overestimate performance on unseen aircraft.","section":"Section V.B.2 and Algorithm 3"},{"comment":"The physical-world experiment is purely qualitative: no ASR or AP50 is reported for the physical images, only four target models are used, the camera is fixed, and Section VI.B admits that 'significant shifts in viewpoint, scale, or camera position can disrupt the alignment between patches and critical target regions.' The sentence 'ColorFD effectively suppresses YOLOv5u detections for all evaluated aircraft targets under the tested imaging conditions' describes four favorable images, not a demonstration of digital-to-physical transferability. Please provide quantitative physical-world metrics (e.g., detection rate before/after patch placement) and at least a few variations in viewing conditions, or explicitly scope the physical claim as a preliminary case study.","section":"Section V.C"}],"minor_comments":[{"comment":"The set B_t is used but not explicitly defined; please define it as the set of predicted bounding boxes of the same class as the target.","section":"Eq. (4)"},{"comment":"In lines 4-9, it is unclear whether the response map M accumulates the maximum over colors or the sum of finite-difference responses; please clarify the aggregation rule.","section":"Algorithm 2"},{"comment":"The bar charts would benefit from error bars even if the tables do not report them; adding error bars or seed counts would directly address the main reproducibility concern.","section":"Fig. 3 and Fig. 7"},{"comment":"There are minor copyediting issues, such as inconsistent capitalization in references (e.g., '[5] ... CVPR Workshops' vs '[6] ... arXiv preprint') and informal phrasing like 'the proposed method possesses robust attack capabilities even within a black-box setting'; please revise for consistency and precision.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The core idea is timely and within the scope of TCSVT, and the algorithmic contributions are clearly presented. The main risk is that the empirical claims are currently supported by single-run stochastic optimization results and a thin physical study; both are fixable within a revision. I would require repeated-seed experiments with statistical comparisons, an independent common-feature prior, and quantitative physical-world metrics before acceptance. The Faster R-CNN degradation under key-region guidance should be analyzed more deeply or the claim appropriately scoped."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here is my read, for what it is worth. ColorFD is a reasonably honest extension of Bbox-Att: it replaces textured sub-patches with pure-color square patches, adds a target-wise fitness and selection mechanism to DE, and introduces two spatial guidance strategies (finite-difference key-region probing and a category-level common-feature prior). The writing is clear, the baselines are sensible, and the authors openly report a negative result that key-region guidance actually hurts on Faster R-CNN. That candor counts for something.\n\nThe problem is that every headline number in Tables I-IV is a single run of a stochastic DE optimizer. The paper itself says in Section VI.B that DE causes performance variability across runs and that some samples need multiple attempts, yet no standard deviation, seed count, or paired comparison appears anywhere. The reported margins over Bbox-Att are large, roughly 20 to 38 percentage points, so they might survive variance, but \"consistently outperforms\" is not supported by the evidence as it stands. This is the main load-bearing weakness, and it is entirely addressable with repeated-seed experiments.\n\nTwo smaller soft spots. First, the common-feature heatmaps are aggregated from the same 306 aircraft instances used in the subcategory evaluation, so the category prior is not independent of the test set. That likely inflates the common-feature results to some degree. Second, the physical experiment is qualitative: four models, one fixed camera angle, no reported ASR or error analysis. It demonstrates feasibility, not much more.\n\nCredit where it is due. The pure-color parameterization is genuinely simpler for physical deployment. The target-wise selection mechanism is a sensible response to a real multi-target optimization problem. The finite-difference probing idea is clearly described, and the comparison against Bbox-Att, AP-PA, and BADEI under standardized perturbation budgets is more than many attack papers do.\n\nThis paper is for researchers working on adversarial robustness in remote sensing object detection, especially black-box and physical settings. It is a solid niche contribution, but the empirical claims need verification. It deserves a serious referee: the novelty is real and the approach is worth engaging with. Send it to review, with the requirement that authors report repeated-seed runs with variance and ideally release code and data. Without that, the central comparison cannot be assessed.","headline":"ColorFD is a genuinely novel black-box physical attack for aerial detectors, but its headline margins rest on single stochastic runs, and the paper will only be fully convincing after repeated-seed experiments and code release.","tokens_in":18059,"tokens_out":2364,"would_cite":true,"duration_ms":22843,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Black-box attacker erases aircraft with colored patches.","keywords":["adversarial patch","black-box attack","differential evolution","remote sensing object detection","physical adversarial attack","finite-difference probing","object disappearance","pure-color patches"],"falsifier":"Run the digital attack on YOLOv3u and YOLOv5u with key regions replaced by randomly sampled regions of equal size; if random-region guidance matches key-region-guided ASR, the probe is not contributing the reported gain.","tokens_in":17062,"feed_emoji":"🛰️","tokens_out":4151,"duration_ms":34968,"temperature":0.7,"pith_summary":"This paper argues that a black-box attacker, with access only to the detection results returned by a remote sensing object detector, can force aircraft to disappear by optimizing the positions and pure colors of a few small square patches. The optimization is carried out by Differential Evolution, guided by a target-wise fitness signal and by search-space constraints obtained from finite-difference color probing. On YOLOv3u, YOLOv5u, and Faster R-CNN, the method reports attack success rates of 78.87%, 79.61%, and 88.21% with key-region guidance, outperforming the tested black-box patch method and matching or exceeding white-box baselines on two of the three detectors. Physical experiments with printed colored patches under a fixed camera setup show that the attacks transfer from the digital domain to real images. The authors position the method as a practical robustness-evaluation tool for optical remote sensing systems under restricted model access.","feed_headline":"Query-only colored patches erase aircraft from detectors","feed_subtitle":"ColorFD optimizes printed patches from detector outputs alone, beating white-box attacks on remote sensing detectors.","key_machinery":"Differential Evolution with rand-to-best/1 mutation, crossover, and selection operates on individuals that encode each patch as a position (h,w) and color (r,g,b); a target-wise fitness function sums per-target maximum valid detection confidence, and a target-wise selection mechanism exchanges better components per target when the offspring does not improve overall fitness. The search space is constrained by key-region localization, which slides a window across the target box, applies pure colors from a fixed set, records confidence changes as finite-difference responses, and greedily selects the strongest connected component; and by common-feature extraction, which aligns and aggregates key-region heatmaps across instances of a category to yield class-level prior regions. Together these mechanisms reduce the number of DE decision variables and concentrate patches on detector-sensitive regions.","core_discovery":"The paper's central claim is that object-level disappearance in remote sensing detection can be achieved with a query-only black-box attack by representing perturbations as a small set of pure-color square patches and optimizing their positions and colors with Differential Evolution. The attack uses only the final detections returned by the detector, without gradients or intermediate features. On the DIOR aircraft subset, key-region-guided ColorFD reaches ASR 78.87% on YOLOv3u, 79.61% on YOLOv5u, and 88.21% on Faster R-CNN, outperforming the DE-based black-box patch baseline Bbox-Att and matching or exceeding the white-box baselines AP-PA and BADEI on YOLOv5u and Faster R-CNN. Physical experiments under a fixed camera setup show printed patches transferring from digital to physical imaging with consistent detection suppression.","pith_inferences":["If the finite-difference probe is noisy for a given architecture, key-region guidance can hurt rather than help; the Faster R-CNN drop from 95.09% to 88.21% is already one instance, so a practical deployment should test unguided DE alongside the guided variant before trusting the probe.","The physical validation is confined to a controlled setup with fixed viewpoint and scale; under variable viewing conditions the patches may misalign with critical regions, so the method's real-world promise likely depends on multi-view robustness training.","Because the patch representation and common-feature extraction are category-agnostic, the same pipeline should transfer to ships, vehicles, and other remote sensing object classes; a direct test would be to run ColorFD on a multi-class subset of DIOR.","The target-wise selection mechanism could be reused in other black-box multi-object problems wherever per-target feedback can be extracted from the model output."],"forward_implications":["A query-only attacker can induce object disappearance on one-stage remote sensing detectors using only the detector's returned boxes and scores, with no access to gradients or intermediate features.","Pure-color patches suffice for strong attacks, making physical deployment as simple as printing and attaching colored paper rather than optimizing pixel-wise textures.","The common-feature variant transfers localized key regions across instances of the same category, reducing query cost relative to per-target key-region localization while keeping competitive attack success rates.","On YOLOv5u and Faster R-CNN, the method matches or exceeds the white-box baselines AP-PA and BADEI under comparable perturbation budgets.","The reported physical experiments support digital-to-physical transfer of the optimized patches under fixed camera position and viewing angle."],"supporting_citations":[{"why":"Supplies the closest DE-based black-box patch attack baseline, Bbox-Att, which ColorFD is compared against.","marker":"[14]"},{"why":"Establishes the zero-order finite-difference query strategy that ColorFD builds on for key-region localization.","marker":"[17]"},{"why":"Provides the DIOR remote sensing object detection dataset used to construct the aircraft test subset.","marker":"[40]"},{"why":"Provides the white-box baseline BADEI that ColorFD matches or exceeds on two detectors.","marker":"[41]"},{"why":"Supplies a related patch attack for remote sensing object detection that uses difference masking and bounding-box drift, positioning ColorFD's contribution.","marker":"[39]"},{"why":"Motivates low-dimensional color-based perturbations via the one-pixel attack for classification.","marker":"[12]"},{"why":"Motivates physical black-box attacks and the feasibility of optimizing perturbations that transfer to real imaging conditions.","marker":"[13]"}],"fun_headline_variants":["Query-only color patches make remote sensors blind","Black-box attack: pure-color squares erase aircraft from detectors","No gradients needed: printed patches defeat aerial detection","ColorFD: query-only patches beat white-box attacks on aerial detectors","Physical adversarial patches: aircraft vanish from satellite view"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The finite-difference color probe, which reads only final detection confidence, must identify regions whose perturbation actually suppresses detection after DE optimization.","fun_headline_variants_meta":{"raw":{"variants":["Query-only color patches make remote sensors blind","Black-box attack: pure-color squares erase aircraft from detectors","No gradients needed: printed patches defeat aerial detection","ColorFD: query-only patches beat white-box attacks on aerial detectors","Physical adversarial patches: aircraft vanish from satellite view"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000642,"raw_usage":{"total_tokens":2949,"prompt_tokens":936,"completion_tokens":2013,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":552,"completion_tokens_details":{"reasoning_tokens":1947}},"tokens_in":552,"tokens_out":2013,"duration_ms":11377,"temperature":1.0,"reasoning_tokens":1947,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T04:13:08.037557+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the digital attack on YOLOv3u and YOLOv5u with key regions replaced by randomly sampled regions of equal size; if random-region guidance matches key-region-guided ASR, the probe is not contributing the reported gain.","supporting_citations":[{"cited_title":"Fooling aerial detectors by background attack via dual-adversarial-induced error identification,","cited_arxiv_id":null,"evidence_quote":"Provides the white-box baseline BADEI that ColorFD matches or exceeds on two detectors."},{"cited_title":"Rfla: A stealthy reflected light adversarial attack in the physical world,","cited_arxiv_id":null,"evidence_quote":"Motivates physical black-box attacks and the feasibility of optimizing perturbations that transfer to real imaging conditions."}],"review_version":2}