Pith. sign in

REVIEW 4 major objections 7 minor 64 references

BadPatch: Diffusion-Based Generation of Physical Adversarial Patches

T0 review · 4 major / 7 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Diffusion-based BadPatch generates naturalistic, customizable adversarial patches that achieve attack success comparable to state-of-the-art non-naturalistic patches, and introduces the AdvT-shirt-1K physical adversarial T-shirt dataset.

desk verdict A solid diffusion-based patch attack with a genuinely useful new dataset, but the naturalistic claim rests on a metric the authors also used to tune the method. read the letter →

arxiv 2412.01440 v5 pith:ZENVB4RZ submitted 2024-12-02 cs.CV

Zhixiang Wang , Xingjun Ma , Yu-Gang Jiang This is my paper · ORCID
classification cs.CV
keywords adversarialpatchesdiffusionmodelsphysicalattackspersondetectionevasionNull-textinversionIoU-DetectionlossAdvT-shirt-1Knaturalisticpatch
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes BadPatch, a diffusion-based method for generating physical adversarial patches that look natural and can be customized from a user-supplied reference image. Its central claim is that these naturalistic patches achieve attack success rates comparable to state-of-the-art non-naturalistic patches, while preserving enough of the reference image's semantics to avoid looking like obvious attacks. To support the claim, the authors build AdvT-shirt-1K, a physical dataset of 1,131 photos of people wearing printed adversarial T-shirts across indoor and outdoor scenes, and show the patches reduce detection accuracy on several modern detectors. The practical upshot is that a person could evade surveillance person detectors while wearing a visually ordinary, personally chosen design on a T-shirt.

What carries the argument

The load-bearing mechanism is Incomplete Diffusion Optimization (IDO): the reference image is inverted to a noise latent at the halfway timestep $z_{T/2}$ with optimized null-text embeddings, and adversarial gradients are applied to that latent rather than to the image or to the full 50-step trajectory. A mask controls the patch shape, background pixels are replaced with a solid color before inversion, and an IoU-Detection loss masks out detections that do not overlap the patch. The paper also relies on a gradient approximation from Eq. (9) that bypasses U-Net gradients, reducing memory use; the incomplete trajectory is what keeps semantic content intact.

What would settle it

Print a BadPatch-generated patch and a same-shape random-color patch on identical T-shirts, photograph the same person at fixed distances and angles in both indoor and outdoor light, and run YOLOv5s on the photos; if the BadPatch shirt does not reduce detection mAP below the random-shirt baseline under these controlled conditions, the paper's physical-world effectiveness claim is falsified.

Watch

Extended reading notes

Core claim

BadPatch treats adversarial patch generation as an optimization of the latent vector at an intermediate diffusion timestep rather than optimizing pixels or a full denoising trajectory. Starting from a reference image, Null-text inversion maps the image to a latent vector, then Incomplete Diffusion Optimization updates that vector against an IoU-Detection loss that targets only detections overlapping the patch region. The update is constrained to a small $L_\infty$ ball and uses an approximate gradient that skips the U-Net's backpropagation, so the procedure stays within a 25-step denoising path and keeps the generated patch semantically close to the reference. The paper reports attack success rates that rival or exceed earlier unnatural patches, and introduces AdvT-shirt-1K as the first physical adversarial T-shirt dataset.

Load-bearing premise

The optimization relies on the approximate gradient in Eq. (9), which skips the U-Net's gradient contribution, being a valid descent direction, and on a 25-step denoising path preserving enough of the reference image's semantic content.

Editorial extensions

If this is right

  • A single printed T-shirt can hide a person from a range of detectors, with the strongest reported effects on YOLOv3, YOLOv4-tiny, YOLOv5s, YOLOv7-tiny, YOLOv10s, YOLOv12s, Faster R-CNN, DETR and RT-DETR.
  • Because patches start from a reference image, the same framework can produce a family of visually distinct adversarial designs rather than a fixed square pattern.
  • AdvT-shirt-1K gives future defense work a benchmark with real printed patches and ground-truth person and patch boxes, rather than only simulated pastings.
  • The IoU-Detection loss makes training less dependent on complete bounding-box annotations, since only detections overlapping the patch receive gradient signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The approximate gradient in Eq. (9) effectively treats the diffusion U-Net as a fixed feature extractor; if that approximation is sound, similar latent-space attacks could be mounted with other generative priors, and the method may extend to video or multi-view attacks.
  • The CLIP-similarity measure used to choose the perturbation budget could double as a cheap automated screening tool for patch naturalness in future adversarial-patch datasets.
  • Since the paper's physical photos were collected over six months while the method was still being refined, the dataset's reported evasion rates likely reflect an upper bound achievable with careful printing and photography; re-testing with standardized printing would reveal how much margin remains.
  • A defense that detects patches by semantic inconsistency between the patch region and its text description, as measured by CLIP, would directly target the optimization objective BadPatch uses to stay natural.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper presents BadPatch, a diffusion-based method for generating naturalistic and customizable adversarial patches for person detectors. The pipeline maps a reference image into the latent space via Null-text inversion, optimizes the latent vector at an intermediate timestep T/2 through an Incomplete Diffusion Optimization (IDO) procedure, and uses an IoU-based detection loss together with mask control to produce patches of various shapes. Experiments on the INRIA dataset report attack success rates and average precision across 11 object detectors, along with cross-dataset evaluations on MPII, COCO, and a self-collected set, plus ablations and a newly captured physical T-shirt dataset, AdvT-shirt-1K, containing 1,131 images. The central claims are that BadPatch achieves attack performance comparable to state-of-the-art non-naturalistic patches while maintaining a natural appearance, and that AdvT-shirt-1K is the first physical adversarial T-shirt dataset.

Significance. If the claims are fully validated, BadPatch would be a practical advance: it offers a customizable, reference-image-driven pipeline and a physical dataset that can support future defense research. The strengths of the manuscript include a systematic evaluation across a wide range of detectors, a released codebase and dataset, and a careful decomposition of the pipeline with ablations on the perturbation constraint, loss function, trajectory length, mask control, and iterative optimization. The main gaps are the lack of a like-for-like comparison with baseline methods in the headline experiment table, an insufficiently validated naturalness claim, and a thin quantitative evaluation of the physical dataset. These gaps are load-bearing for the paper's two central contributions, so they need to be addressed before the claims can be accepted as stated.

major comments (4)
  1. [Table 1 / §4.2] The headline comparison is not like-for-like. Every BadPatch row (P1–P11) is a white-box attack optimized against the detector in the corresponding column, whereas all baselines (PA–PF) are transfer attacks trained once on YLv2 or YLv4t and then evaluated across detectors, as indicated by the table footnote. The claimed 'highest ASR' and the specific 10.1% improvement over AdvYL on YOLOv4-tiny are therefore partly an artifact of the training protocol rather than of patch quality. To support the central attack-performance claim, the authors should either retrain all baselines white-box for each target detector, or report all methods in a common transfer setting (e.g., train on YLv4 and test on all detectors), and qualify the claims accordingly.
  2. [§4.4] The naturalness evidence is not adequate and is partially circular. The CLIP similarity used to evaluate natural appearance in Figure 4 and Table 3 is the same criterion used in Section 4.4 to select the perturbation constraint ϵ=0.5, so the high CLIP similarity of the final patches is expected by construction. Moreover, no competing method (AdvYL, T-SEA, NPAP, D2D, AdvART) is scored on this metric, and no human perceptual study is reported. Since 'naturalistic' is the paper's central value proposition, the authors should compare CLIP similarity across all baseline patch methods, report a perceptual study (e.g., forced-choice or Likert ratings), or provide an independent image-quality metric, so that the claim of improved naturalness is not an artifact of the selection procedure.
  3. [Eq. (9) / §3.2] The derivation of the optimization gradient is not justified. Equation (9) claims a chain-rule expansion for the gradient of the loss with respect to z_{T/2}, but it drops the Jacobians of the U-Net denoising steps εθ and replaces them with a product of scalar coefficients. These Jacobians are generally not negligible, so it is not obvious that the resulting vector is a valid descent direction for the attack loss. The white-box ASR results in Table 1 give empirical evidence that the approximation is useful, but the paper should either provide a formal argument for why the approximation behaves as a descent direction, or include an ablation comparing Eq. (9) with the exact gradient (e.g., using gradient checkpointing on a reduced setting). As written, the IDO step is not fully reproducible from the text alone.
  4. [§4.5] The physical-world claim for AdvT-shirt-1K is not quantitatively established. Section 4.5 reports only the detection performance of YOLOv5s under varying confidence thresholds (right side of Figure 8) and does not compare against clean T-shirts, other patch methods, or other detectors, nor does it report ASR or AP numbers for the nine printed designs. To support the claim that BadPatch works in physical settings, the authors should report ASR/AP for the printed adversarial T-shirts versus a clean control, ideally with a comparison to a baseline patch method under the same capture conditions.
minor comments (7)
  1. [Eq. (9)] The typesetting of Eq. (9) is garbled: the square-root symbols and the product structure are not readable as written. Please restate the approximate gradient in a clean, unambiguous form.
  2. [Table 2] In the 'Collected' row of Table 2, the AP entry under T-SEA appears as '8' rather than a decimal value; this should be corrected (e.g., 8.0 or 8.6).
  3. [§4.3] The text states that patches are trained using YOLOv4 with various methods, but Table 1's footnote says NPAP and D2D were trained on YLv4t. Please clarify whether Table 2 is based on models retrained on YOLOv4 or on the same transfer patches used in Table 1.
  4. [Algorithm 1] Algorithm 1 applies the target mask to the generated patch in the image space (line 13) but optimizes the latent vector with a downsampled mask (line 16). The interaction between these two mask applications should be described more explicitly.
  5. [Figure 2] Figure 2 is dense and the text labels are difficult to read. Please enlarge the figure and clarify the flow from reference image to latent optimization to final patch.
  6. [Eq. (5)] The IoU threshold t in the loss function of Eq. (5) is not given a value in the experimental setup. State the value used for t, since it directly affects the loss.
  7. [Abstract / §4.5] The claim that AdvT-shirt-1K is 'the first physical adversarial T-shirt dataset' should be scoped carefully. The paper itself cites Xu et al. (2020) [60], which also uses physical adversarial T-shirts; if that work released images, the claim should be qualified (e.g., 'first public large-scale dataset' or 'first dataset with over a thousand images').

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: attack derivation is independently benchmarked; only mild CLIP-based naturalness selection and non-load-bearing self-citations.

full rationale

BadPatch's derivation chain is self-contained and does not reduce to its own inputs. The pipeline maps a reference image to a latent via DDIM inversion and Null-text inversion, then optimizes the intermediate latent z_{T/2} with an IoU-Detection loss under an L_inf constraint, and decodes the result with Stable Diffusion. None of these steps defines the output in terms of the reported attack metric; the gradient approximation in Eq. (9) is borrowed from prior work [11] (not by the present authors) and is empirically supported by white-box and transfer ASR results. Attack performance is compared against external baselines (AdvYL, T-SEA, NPAP, D2D, DAP, AdvART) on INRIA, MPII, COCO, and collected images, so the central effectiveness claim is not self-referential. The only mild issue is in Section 4.4: the constraint epsilon = 0.5 is selected using CLIP similarity between generated patches and GPT-4o-generated descriptions, and CLIP similarity is later reported as evidence of naturalness (e.g., Table 3, Figure 6). This is hyperparameter selection on the evaluation metric rather than a fitted-parameter prediction, so it weakens the naturalness evidence but does not make the derivation circular. The paper also contains a few minor self-citations ([38], [49], [56]) in related work and background lists, but none is load-bearing for the method's validity. The physical dataset AdvT-shirt-1K is presented as a resource and demonstration, not as a proof that presupposes the attack's success. Accordingly, no circular step meets the strict standard of an equation reducing by construction or a fitted parameter renamed as a prediction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on pre-trained Stable Diffusion and detectors, plus several empirical heuristics: the gradient approximation, the CLIP-based naturalness proxy, and the choice of epsilon and trajectory length. These are not derived from first principles, and the paper does not quantify their sensitivity. No new physical entities are introduced.

free parameters (3)
  • perturbation constraint epsilon = 0.5
    Selected in Section 4.4 as the value that balances ASR and CLIP similarity, which is a proxy for naturalness.
  • incomplete diffusion timestep T/2 = 25 steps
    Chosen via ablation in Section 4.4 (Figure 6) as the trajectory length that best balances attack success and semantic consistency.
  • IoU threshold t in detection loss = not reported
    Hyperparameter in Eq. (5) that filters detections by overlap with ground truth; the paper does not state its value, so reproduction requires guessing.
assumptions (5)
  • domain assumption Stable Diffusion v1.4 with Null-text inversion can reconstruct a reference image closely enough to preserve its semantics.
    The method relies on near-perfect reconstruction (Section 3.1, Eq. (3)).
  • ad hoc to paper The gradient approximation skipping U-Net gradients is a valid descent direction for the attack loss.
    Introduced in Section 3.2, Eq. (9), to save memory; no convergence guarantee is given.
  • ad hoc to paper CLIP similarity between GPT-4o text descriptions and generated patches reflects visual naturalness or stealthiness.
    Used in Section 4.4 to select epsilon and to measure natural appearance; no human study validates this proxy.
  • domain assumption The IoU-Detection loss, with ground-truth annotations, accurately measures the detector's vulnerability.
    The loss in Eq. (5) assumes ground-truth box quality and detector output reliability.
  • standard math DDIM inversion is approximately reversible, allowing the latent to be optimized along the trajectory.
    Standard property of DDIM sampling used in Eq. (1) and Section 3.1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadPatch: Diffusion-Based Generation of Physical Adversarial Patches." pith.science (2026). https://pith.science/paper/ZENVB4RZ

@misc{pith2026241201440,
  author       = {Pith},
  title        = {Pith review of: BadPatch: Diffusion-Based Generation of Physical Adversarial Patches},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZENVB4RZ}},
  note         = {Machine review of arXiv:2412.01440}
}
read the original abstract

Physical adversarial patches printed on clothing can enable individuals to evade person detectors, but most existing methods prioritize attack effectiveness over stealthiness, resulting in aesthetically unpleasing patches. While generative adversarial networks and diffusion models can produce more natural-looking patches, they often fail to balance stealthiness with attack effectiveness and lack flexibility for user customization. To address these limitations, we propose BadPatch, a novel diffusion-based framework for generating customizable and naturalistic adversarial patches. Our approach allows users to start from a reference image (rather than random noise) and incorporates masks to create patches of various shapes, not limited to squares. To preserve the original semantics during the diffusion process, we employ Null-text inversion to map random noise samples to a single input image and generate patches through Incomplete Diffusion Optimization (IDO). Our method achieves attack performance comparable to state-of-the-art non-naturalistic patches while maintaining a natural appearance. Using BadPatch, we construct AdvT-shirt-1K, the first physical adversarial T-shirt dataset comprising over a thousand images captured in diverse scenarios. AdvT-shirt-1K can serve as a useful dataset for training or testing future defense methods.

Figures

Figures reproduced from arXiv: 2412.01440 by the authors.

Figure 1
Figure 1. Example images from our AdvT-shirt dataset, showcas￾ing the performance of BadPatch in various scenarios. domains. Adversarial attacks on vision models can be broadly cat￾egorized into digital attacks [8, 18] and physical attacks [15, 30, 32, 37, 56]. Unlike digital attacks, which introduce imperceptible perturbations in the digital domain, physical attacks manipulate real-world objects or environments to deceive vi… view at source ↗
Figure 2
Figure 2. An overview of the proposed BadPatch generation framework. Overview [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The effect of iterative generation (showing accumulated [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The effect of optimization constraint ϵ on latent vectors. patch training setting. As shown in [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Comparison of two loss functions. Left: training loss; Right: attack performance. Shape Impact Here, we investigate the impact of patch shapes, as used for Pm and Pn in [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: The effects of diffusion trajectories with different lengths [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: The impact of target mask on adversarial patch opti [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Left: The distribution of the images in AdvT-shirt-1K. Right: The detection performance of YOLOv5s on AdvT-shirt-1K under different confidence thresholds. 5. Conclusion In this work, we proposed a novel diffusion-based ad￾versarial patch generation method BadPatch to g…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

64 extracted references · 34 canonical work pages

  1. [1]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ah- mad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 ,

    arXiv

  2. [2]

    2d human pose estimation: New benchmark and state of the art analysis

    Mykhaylo Andriluka, Leonid Pishchulin, Peter Gehler, and Bernt Schiele. 2d human pose estimation: New benchmark and state of the art analysis. In CVPR, pages 3686–3693,

    work page

  3. [3]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In ICML, pages 284–293. PMLR, 2018. 2

    work page 2018

  4. [4]

    Blended diffusion for text-driven editing of natural images

    Omri Avrahami, Dani Lischinski, and Ohad Fried. Blended diffusion for text-driven editing of natural images. In CVPR, pages 18208–18218, 2022. 2

    2022

  5. [5]

    Yolov4: Optimal speed and accuracy of object detection

    Alexey Bochkovskiy, Chien-Yao Wang, and Hong- Yuan Mark Liao. Yolov4: Optimal speed and accuracy of object detection. arXiv preprint arXiv:2004.10934, 2020. 5

    arXiv 2004

  6. [6]

    Adversarial patch

    Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017. 2

    arXiv 2017

  7. [7]

    End- to-end object detection with transformers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End- to-end object detection with transformers. In ECCV, pages 213–229. Springer, 2020. 5

    work page 2020

  8. [8]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 1

    2017

Show all 64 references
  1. [9]

    Deepdriving: Learning affordance for direct percep- tion in autonomous driving

    Chenyi Chen, Ari Seff, Alain Kornhauser, and Jianxiong Xiao. Deepdriving: Learning affordance for direct percep- tion in autonomous driving. In ICCV, pages 2722–2730,

  2. [10]

    Natural adversarial patch generation method based on latent diffu- sion model

    Xianyi Chen, Fazhan Liu, Dong Jiang, and Kai Yan. Natural adversarial patch generation method based on latent diffu- sion model. arXiv preprint arXiv:2312.16401, 2023. 2

    2023 arXiv

  3. [11]

    Content-based unrestricted ad- versarial attack

    Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-based unrestricted ad- versarial attack. NeurIPS, 36, 2024. 1, 2, 4

    2024

  4. [12]

    Histograms of oriented gra- dients for human detection

    Navneet Dalal and Bill Triggs. Histograms of oriented gra- dients for human detection. In CVPR, pages 886–893. Ieee,

  5. [13]

    Diffusion mod- els beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion mod- els beat gans on image synthesis. NeurIPS, 34:8780–8794,

  6. [14]

    Tnt attacks! universal naturalis- tic adversarial patches against deep neural network systems

    Bao Gia Doan, Minhui Xue, Shiqing Ma, Ehsan Abbasnejad, and Damith C Ranasinghe. Tnt attacks! universal naturalis- tic adversarial patches against deep neural network systems. IEEE TIFS, 17:3816–3830, 2022. 2

    2022

  7. [15]

    Robust physical-world attacks on machine learning models

    Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Ta- dayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust physical-world attacks on machine learning models. arXiv preprint arXiv:1707.08945 , 2(3):4,

    arXiv

  8. [16]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In CVPR, pages 1625– 1634, 2018. 1

    2018

  9. [17]

    Generative adversarial nets

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. NeurIPS, 27,

  10. [18]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1

    2014 arXiv

  11. [19]

    Advart: Adversarial art for camouflaged object detection attacks

    Amira Guesmi, Ioan Marius Bilasco, Muhammad Shafique, and Ihsen Alouani. Advart: Adversarial art for camouflaged object detection attacks. In ICIP, pages 666–672. IEEE,

  12. [20]

    Dap: A dynamic adversarial patch for evading person detectors

    Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In ICCV, pages 24595–24604, 2024. 6

    2024

  13. [21]

    Prompt-to-prompt im- age editing with cross attention control

    Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompt im- age editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022. 2

    2022 arXiv

  14. [22]

    Classifier-free diffusion guidance

    Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598, 2022. 3

    2022 arXiv

  15. [23]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. NeurIPS, 33:6840–6851, 2020. 1

    2020

  16. [24]

    Nat- uralistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun- Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Nat- uralistic physical adversarial patch for object detectors. In CVPR, pages 7848–7857, 2021. 1, 2, 6

    2021

  17. [25]

    T-sea: Transfer-based self-ensemble attack on object detection

    Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-sea: Transfer-based self-ensemble attack on object detection. In CVPR, pages 20514–20523, 2023. 6

    2023

  18. [26]

    Universal physical camouflage attacks on object detectors

    Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In CVPR, pages 720–729, 2020. 1, 2

    2020

  19. [27]

    Connecting the digital and phys- ical world: Improving the robustness of adversarial attacks

    Steve TK Jan, Joseph Messou, Yen-Chen Lin, Jia-Bin Huang, and Gang Wang. Connecting the digital and phys- ical world: Improving the robustness of adversarial attacks. In AAAI, pages 962–969, 2019. 2

    2019

  20. [28]

    ultralytics/yolov5, 2020

    Glenn Jocher, Alex Stoken, Jirka Borovec, NanoCode012, ChristopherSTAN, Liu Changyu, Laughing, tkianai, Adam Hogan, lorenzomammana, yxNONG, AlexWang1900, Lau- rentiu Diaconu, Marc, wanghaoyang0106, ml5ah, Doug, Francisco Ingham, Frederik, Guilhen, Hatovix, Jake Poznan- ski, Ji...

    2020

  21. [29]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 ,

    arXiv

  22. [30]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In Artificial in- telligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018. 1, 2

    2018

  23. [31]

    Patch of invisibility: Natural- istic black-box adversarial attacks on object de-tectors.arXiv preprint arXiv:2303.04238, 2023

    Raz Lapid and Moshe Sipper. Patch of invisibility: Natural- istic black-box adversarial attacks on object de-tectors.arXiv preprint arXiv:2303.04238, 2023. 2

    2023

  24. [32]

    Capgen: An environment-adaptive generator of adversarial patches

    Chaoqun Li, Zhuodong Liu, Huanqian Yan, and Hang Su. Capgen: An environment-adaptive generator of adversarial patches. arXiv preprint arXiv:2412.07253, 2024. 1

    2024 arXiv

  25. [33]

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICML, pages 12888–12900. PMLR, 2022. 5

    2022

  26. [34]

    Diffusion to confusion: Naturalistic ad- versarial patch generation based on diffusion model for ob- ject detector

    Shuo-Yen Lin, Ernie Chu, Che-Hsien Lin, Jun-Cheng Chen, and Jia-Ching Wang. Diffusion to confusion: Naturalistic ad- versarial patch generation based on diffusion model for ob- ject detector. arXiv preprint arXiv:2307.08076, 2023. 1, 2, 6

    2023 arXiv

  27. [35]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In ECCV, pages 740–755. Springer, 2014. 5

    2014

  28. [36]

    Beware of road markings: A new adversarial patch attack to monocular depth estimation

    Hangcheng Liu, Zhenhu Wu, Hao Wang, Xingshuo Han, Shangwei Guo, Tao Xiang, and Tianwei Zhang. Beware of road markings: A new adversarial patch attack to monocular depth estimation. NeurIPS, 37:67689–67711, 2025. 1

    2025

  29. [37]

    Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection

    Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chel- lappa, and Soheil Feizi. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In CVPR, pages 14973–14982, 2022. 1

    2022

  30. [38]

    Safety at scale: A comprehensive sur- vey of large model safety

    Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, et al. Safety at scale: A comprehensive sur- vey of large model safety. arXiv preprint arXiv:2502.05206,

    arXiv

  31. [39]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018. 2

    2018

  32. [40]

    Deep learning for healthcare: review, opportunities and challenges

    Riccardo Miotto, Fei Wang, Shuang Wang, Xiaoqian Jiang, and Joel T Dudley. Deep learning for healthcare: review, opportunities and challenges. Briefings in bioinformatics, 19 (6):1236–1246, 2018. 1

    2018

  33. [41]

    Null-text inversion for editing real images using guided diffusion models

    Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In CVPR, pages 6038–6047,

  34. [42]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. In ICML, pages 8748–8763. PMLR, 2021. 7

    2021

  35. [43]

    Hierarchical text-conditional image gener- ation with clip latents

    Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image gener- ation with clip latents. arXiv preprint arXiv:2204.06125, 1 (2):3, 2022. 2

    2022 arXiv

  36. [44]

    Yolov3: An incremental improvement

    Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018. 5

    2018 arXiv

  37. [45]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. NeurIPS, 28, 2015. 5

    2015

  38. [46]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. In CVPR, pages 10684– 10695, 2022. 1, 2, 5

    2022

  39. [47]

    Photorealistic text-to-image diffusion models with deep language understanding

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. NeurIPS, 35:36479–36494, 2022. 2

    2022

  40. [48]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In ACM CCS, pages 1528–1540, 2016. 2

    2016

  41. [49]

    A survey of multimodal-guided image editing with text-to-image diffu- sion models

    Xincheng Shuai, Henghui Ding, Xingjun Ma, Rongcheng Tu, Yu-Gang Jiang, and Dacheng Tao. A survey of multimodal-guided image editing with text-to-image diffu- sion models. arXiv preprint arXiv:2406.14555, 2024. 2

    2024 arXiv

  42. [50]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020. 3

    2010 arXiv

  43. [51]

    Fool- ing automated surveillance cameras: adversarial patches to attack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedem ´e. Fool- ing automated surveillance cameras: adversarial patches to attack person detection. In CVPRW, pages 0–0, 2019. 1, 2, 4, 6

    2019

  44. [52]

    Yolov12: Attention-centric real-time object detectors

    Yunjie Tian, Qixiang Ye, and David Doermann. Yolov12: Attention-centric real-time object detectors. arXiv preprint arXiv:2502.12524, 2025. 5

    2025 arXiv

  45. [53]

    Yolov10: Real-time end-to-end object de- tection

    Ao Wang, Hui Chen, Lihao Liu, Kai Chen, Zijia Lin, Jun- gong Han, et al. Yolov10: Real-time end-to-end object de- tection. NeurIPS, 37:107984–108011, 2025. 5

    2025

  46. [54]

    Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors

    Chien-Yao Wang, Alexey Bochkovskiy, and Hong- Yuan Mark Liao. Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors. In CVPR, pages 7464–7475, 2023. 5

    2023

  47. [55]

    A comprehensive survey in llm (-agent) full stack safety: Data, training and deployment

    Kun Wang, Guibin Zhang, Zhenhong Zhou, Jiahao Wu, Miao Yu, Shiqian Zhao, Chenlong Yin, Jinhu Fu, Yibo Yan, Hanjun Luo, et al. A comprehensive survey in llm (-agent) full stack safety: Data, training and deployment. arXiv preprint arXiv:2504.15585, 2025. 1

    2025 arXiv

  48. [56]

    Revisiting adversarial patches for designing camera-agnostic attacks against person detection

    Hui Wei, Zhixiang Wang, Kewei Zhang, Jiaqi Hou, Yuan- wei Liu, Hao Tang, and Zheng Wang. Revisiting adversarial patches for designing camera-agnostic attacks against person detection. NeurIPS, 37:8047–8064, 2025. 1

    2025

  49. [57]

    Transferable adversarial attacks for image and video object detection

    Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641, 2018. 1

    2018 arXiv

  50. [58]

    Making an invisibility cloak: Real world adversarial attacks on object detectors

    Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Gold- stein. Making an invisibility cloak: Real world adversarial attacks on object detectors. In ECCV, pages 1–17. Springer,

  51. [59]

    Adversarial examples for se- mantic segmentation and object detection

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for se- mantic segmentation and object detection. In ICCV, pages 1369–1378, 2017. 1 10

    2017

  52. [60]

    Adversarial t-shirt! evading person detectors in a phys- ical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a phys- ical world. In ECCV, pages 665–681. Springer, 2020. 1

    2020

  53. [61]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability. NeurIPS, 36, 2024. 2

    2024

  54. [62]

    Detrs beat yolos on real-time object detection

    Yian Zhao, Wenyu Lv, Shangliang Xu, Jinman Wei, Guanzhong Wang, Qingqing Dang, Yi Liu, and Jie Chen. Detrs beat yolos on real-time object detection. In CVPR, pages 16965–16974, 2024. 5

    2024

  55. [63]

    Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phe- nomenon

    Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phe- nomenon. In CVPR, pages 15345–15354, 2022. 2

    2022

  56. [64]

    Fooling thermal infrared pedestrian detectors in real world using small bulbs

    Xiaopei Zhu, Xiao Li, Jianmin Li, Zheyao Wang, and Xi- aolin Hu. Fooling thermal infrared pedestrian detectors in real world using small bulbs. In AAAI, pages 3616–3624,

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.