pith. sign in

arxiv: 2606.17711 · v1 · pith:QCWXERY4new · submitted 2026-06-16 · 💻 cs.CV · cs.AI

Structured Adversarial Camouflage via Voronoi Diagrams

Jens Bayer , Stefan Becker , David M\"unch , Michael Arens , J\"urgen Beyerer This is my paper

Pith reviewed 2026-06-27 01:30 UTC · model grok-4.3

classification 💻 cs.CV cs.AI
keywords adversarial camouflageVoronoi diagramsperson detectionstructured patternsblack-box attackprintable palettesYOLO detectors
0
0 comments X

The pith

Adversarial Voronoi camouflage created by optimizing seed-point locations under fixed palettes significantly reduces person detection performance and transfers across detectors.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper aims to establish that structured adversarial patterns can be generated efficiently by moving only seed points within a fixed printable color palette using soft assignment in a Voronoi diagram. This avoids the computational cost and visual obviousness of pixel-wise patches while producing splinter-like camouflage. When applied at the garment level on person images, the method produces clear drops in COCO-style average precision. The resulting attack remains effective on out-of-domain backgrounds and across multiple YOLO detector versions, pointing to black-box robustness. Repainting with alternate palettes largely removes the effect, indicating a tight link between the generated structure and the chosen colors.

Core claim

Adversarial Voronoi camouflage optimizes only seed-point locations under fixed palettes with soft assignment to generate structured patterns; when applied via segmentation masks to garments, this yields significant AP@[.5:.95] drops on person detection, transfers to new backgrounds and detector families, and loses effectiveness when the palette is changed.

What carries the argument

Voronoi diagram formed by soft assignment of seed-point locations to a fixed palette; the optimization moves only the locations to create the adversarial structure without extra regularization.

If this is right

  • Garment-level application through segmentation masks produces larger AP drops than naive whole-image placement.
  • The attack remains effective when backgrounds are drawn from a different distribution and when the detector is switched to other YOLO versions.
  • Replacing the palette with a new set of colors largely eliminates the performance degradation.
  • Small changes to individual colors within the palette produce only limited further degradation.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same seed-location optimization could be tested on additional object categories such as vehicles to check whether the structure-palette coupling generalizes.
  • Defenses might be designed around detecting unnatural Voronoi cell boundaries or palette mismatches in input images.
  • Physical deployment would require calibration experiments to confirm that printed colors match the digital palette closely enough to preserve the attack.

Load-bearing premise

Optimizing seed-point locations under a fixed palette with soft assignment is enough to create effective structured camouflage.

What would settle it

Apply the optimized Voronoi pattern to a held-out set of person images and measure whether average precision for detection remains statistically unchanged from the unperturbed baseline.

Figures

Figures reproduced from arXiv: 2606.17711 by David M\"unch, Jens Bayer, J\"urgen Beyerer, Michael Arens, Stefan Becker.

Figure 1
Figure 1. Figure 1: An optimized Voronoi patch with the corresponding seed points (red crosses). Due to the soft assignment, [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Example image of the InriaPerson dataset and the 3DPeople dataset. Due to the lack of cloth segmentation [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Five of the thirteen available color palettes that are used for the evaluation. The color values are adopted [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Experiment 3.2: The transferability matrix of different network architectures and the five selected palettes [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Experiment 4.1: Patches are optimized with the palette at the x-axis and evaluated with colors of the palette [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Experiment 4.2.: Impact on the AP for changes in hue, value, and saturation using the forest spring palette [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
read the original abstract

Pixel-wise adversarial patches are computationally heavy and often visually detectable, limiting utility in security-critical systems. We present adversarial Voronoi camouflage that optimizes only seed-point locations under fixed, printable palettes using a soft assignment, producing structured, splinter camouflage-like patterns without additional regularization. Evaluated on person detection with COCO-style AP@[.5:.95], naive placement (Inria -> COCO) performs comparably bad, while garment-level application via segmentation mask (3DPeople) results in a significant AP drop. The attack transfers to out-of-domain backgrounds and across detector families (YOLOv9/10/11/12), indicating robustness in black-box settings. Repainting with different palettes largely nullifies the effect, and single-color tweaks show limited tolerance (<=0.17), highlighting a structure-palette coupling. The parameter-efficient, palette-constrained design improves visual plausibility while degrading real-time detector performance. Physical validation and color calibration are left for future work. Code: https://github.com/JensBayer/Voronoi This paper was originally presented at the International Conference on Military Communication and Information Systems (ICMCIS), organized by the Information Systems Technology (IST) Scientific and Technical Committee, IST-224-RSY - the ICMCIS, held in Bath, United Kingdom, 12-13 May 2026.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The manuscript proposes adversarial Voronoi camouflage, which optimizes only seed-point locations under fixed printable palettes via soft assignment to generate structured, splinter-like patterns without extra regularization. On person detection with COCO-style AP@[.5:.95], it reports that naive placement performs poorly while garment-level application on 3DPeople yields a significant AP drop; the attack transfers to out-of-domain backgrounds and YOLOv9–12 detectors, is nullified by repainting, and shows limited tolerance to single-color tweaks (≤0.17). Physical validation and color calibration are deferred.

Significance. If the quantitative results and transfer claims hold with proper controls, the parameter-efficient, palette-constrained design could offer a more visually plausible alternative to pixel-wise patches for degrading real-time detectors, with the structure-palette coupling providing a falsifiable prediction.

major comments (2)
  1. [Abstract] Abstract: the claim of transfer 'across detector families (YOLOv9/10/11/12)' is not supported, as these are successive versions within the same one-stage YOLO lineage; no detectors from other families (e.g., Faster R-CNN, DETR) are mentioned, weakening the black-box robustness conclusion.
  2. [Abstract] Abstract: the central effectiveness claims ('significant AP drop', transfer results) are stated without any numerical AP values, error bars, baseline comparisons, or ablation data, making it impossible to assess whether the soft-assignment optimization under fixed palettes is load-bearing or merely dataset-specific.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback on the abstract. We address the two major comments point-by-point below and will revise the manuscript accordingly.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the claim of transfer 'across detector families (YOLOv9/10/11/12)' is not supported, as these are successive versions within the same one-stage YOLO lineage; no detectors from other families (e.g., Faster R-CNN, DETR) are mentioned, weakening the black-box robustness conclusion.

    Authors: We agree that YOLOv9–YOLOv12 constitute successive versions within the same detector family rather than distinct families. Our experiments demonstrate transfer across these iterative YOLO models, which still constitutes evidence of robustness to version-specific changes. We will revise the abstract to replace 'across detector families (YOLOv9/10/11/12)' with 'across successive YOLO detector versions (YOLOv9/10/11/12)' and will qualify the black-box claim to reflect the tested scope, without claiming broader family-level transfer. revision: yes

  2. Referee: [Abstract] Abstract: the central effectiveness claims ('significant AP drop', transfer results) are stated without any numerical AP values, error bars, baseline comparisons, or ablation data, making it impossible to assess whether the soft-assignment optimization under fixed palettes is load-bearing or merely dataset-specific.

    Authors: We acknowledge that the abstract presents the effectiveness claims qualitatively without numerical support. The full manuscript reports specific COCO-style AP@[.5:.95] values, comparisons against naive placement, and results on 3DPeople with garment-level application. We will revise the abstract to include the key quantitative results (e.g., the observed AP drop magnitude and transfer performance) and a brief reference to the baseline comparison to make the claims verifiable from the abstract alone. revision: yes

Circularity Check

0 steps flagged

No significant circularity; empirical results independent of inputs

full rationale

The paper describes an optimization procedure (seed-point locations under fixed palettes with soft assignment) and reports empirical AP drops on 3DPeople garments plus transfer to YOLO variants. No equations, fitted parameters renamed as predictions, or self-citations appear in the provided text that would reduce the reported performance metrics to a definitional identity or tautology. The method is presented as a direct construction whose effectiveness is measured externally via detection benchmarks, making the derivation self-contained against external evaluation.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only review yields no explicit free parameters, axioms, or invented entities; optimization of seed points is mentioned without stated constraints or loss terms.

pith-pipeline@v0.9.1-grok · 5780 in / 970 out tokens · 22459 ms · 2026-06-27T01:30:01.989396+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

19 extracted references

  1. [1]

    camogen.http://www.happyponyland.net/camogen.php, Accessed: 2023-09-01

    2023

  2. [2]

    Bayer, S

    J. Bayer, S. Becker, D. Münch, and M. Arens. Network transferability of adversarial patches in real-time object detection. In H. Bouma, Y . Yitzhaky, R. Prabhu, and H. J. Kuijf, editors,Artif. Intell. Secur. Def. Appl. II, page 33. SPIE, nov 2024. 9 Structured adv. Camouflage via V oronoi DiagramsA PREPRINT

    2024

  3. [3]

    Chakraborty, M

    A. Chakraborty, M. Alam, V . Dey, A. Chattopadhyay, and D. Mukhopadhyay. A survey on adversarial attacks and defences.CAAI Trans. Intell. Technol., 6(1):25–45, 2021

    2021

  4. [4]

    Dalal and B

    N. Dalal and B. Triggs. Histograms of Oriented Gradients for Human Detection. InCVPR, volume 1, pages 886–893. IEEE, 2005

    2005

  5. [5]

    R. Duan, X. Ma, Y . Wang, J. Bailey, A. K. Qin, and Y . Yang. Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles. InCVPR, pages 997–1005. IEEE, jun 2020

    2020

  6. [6]

    Y . Duan, J. Chen, X. Zhou, J. Zou, Z. He, J. Zhang, W. Zhang, and Z. Pan. Learning Coated Adversarial Camou- flages for Object Detectors. InIJCAI, pages 891–897. International Joint Conferences on Artificial Intelligence Organization, jul 2022

    2022

  7. [7]

    Karras, M

    T. Karras, M. Aittala, S. Laine, E. Härkönen, J. Hellsten, J. Lehtinen, and T. Aila. Alias-free generative adver- sarial networks.Advances in neural information processing systems, 34:852–863, 2021

    2021

  8. [8]

    J. Kim, H. Yang, and S.-Y . Oh. Camouflaged Adversarial Patch Attack on Object Detector.KIMST, 26(1):44–53, feb 2023

    2023

  9. [9]

    J. Li, J. Zhang, S. J. Maybank, and D. Tao. Bridging composite and real: towards end-to-end deep image matting. IJCV, 130(2):246–266, 2022

    2022

  10. [10]

    T. Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick. Microsoft COCO: Common objects in context.LNCS, 8693 LNCS(PART 5):740–755, 2014

    2014

  11. [11]

    Loshchilov and F

    I. Loshchilov and F. Hutter. Decoupled weight decay regularization.7th International Conference on Learning Representations, ICLR 2019, 2019

    2019

  12. [12]

    Z. Peng, J. Chen, Z. Shi, and Z. Zou. Physical Adversarial Camouflage Generation in Optical Remote Sensing Images.IEEE Transactions on Information Forensics and Security, 20:6308–6323, 2025

    2025

  13. [13]

    Pumarola, J

    A. Pumarola, J. Sanchez, G. Choi, A. Sanfeliu, and F. Moreno-Noguer. 3DPeople: Modeling the Geometry of Dressed Humans. InICCV, 2019

    2019

  14. [14]

    Van der Burg, A

    E. Van der Burg, A. Toet, P. Perone, and M. A. Hogervorst. A Convolutional Neural Network as a Potential Tool for Camouflage Assessment.Appl. Sci., 15(9), 2025

    2025

  15. [15]

    Y . Wang, Z. Fang, Y . fei Zheng, Z. Yang, W. Tong, and T. yong Cao. Dual Attribute Adversarial Camouflage toward camouflaged object detection.Defence Technology, 22:166–175, 2023

    2023

  16. [16]

    H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang. Physical Adversarial Attack Meets Computer Vision: A Decade Survey.IEEE Trans. Pattern Anal. Mach. Intell., 46(12):9797–9817, 2024

    2024

  17. [17]

    Z. Wu, S. N. Lim, L. S. Davis, and T. Goldstein. Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors.Lect. Notes Comput. Sci., 12349 LNCS:1–17, 2020

    2020

  18. [18]

    K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P. Y . Chen, Y . Wang, and X. Lin. Adversarial T-Shirt! Evading Person Detectors in a Physical World.LNCS), 12350 LNCS:665–681, 2020

    2020

  19. [19]

    X. Zhu, Z. Hu, S. Huang, J. Li, and X. Hu. Infrared Invisible Clothing: Hiding from Infrared Detectors at Multiple Angles in Real World. InCVPR, pages 13307–13316. IEEE, jun 2022. 10

    2022