arxiv: 2511.09829 · v3 · submitted 2025-11-13 · 💻 cs.AI

Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systems

Jiahuan Long , Tingsong Jiang , Hanqing Liu , Chao Ma , Weien Zhou , Yang Yang , Wen Yao This is my paper

Pith reviewed 2026-05-17 23:00 UTC · model grok-4.3

classification 💻 cs.AI

keywords adversarial clothingthermochromic dyesAI surveillance evasiondual-modal adversarial patternsprivacy protectionphysical adversarial attacksheat-activated fabric

0 comments p. Extension

The pith

A heat-activated shirt can switch to hidden adversarial patterns that evade AI surveillance in visible and infrared light.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper proposes clothing that looks like an ordinary black T-shirt but uses thermochromic dyes and embedded heaters to reveal adversarial patterns on demand. These patterns are intended to disrupt AI detection systems across both visible and infrared modalities without constant conspicuous appearance. Physical tests show the texture activates in 50 seconds and maintains over 80 percent success against real-world surveillance. If the approach works as described, it supplies a practical, user-controlled option for privacy protection amid widespread AI monitoring.

Core claim

The authors establish that thermochromic dyes integrated with flexible heating units in fabric create a dual-modal adversarial wearable. The garment remains visually normal until heated, at which point it generates patterns that achieve rapid activation within 50 seconds and an adversarial success rate above 80 percent across diverse real-world surveillance environments, as shown in physical experiments.

What carries the argument

The thermally activated dual-modal adversarial clothing that conceals effective patterns behind a default black appearance until embedded heating units trigger thermochromic dyes to reveal them.

If this is right

Users obtain on-demand control to deploy privacy protection only when needed rather than wearing always-visible patterns.
The single garment simultaneously counters detection in both visible-light and infrared surveillance systems.
Activation completes in 50 seconds, supporting use in changing real-time situations.
The reported success rate holds across multiple distinct surveillance environments in the experiments.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Similar thermochromic activation could be applied to other everyday items such as jackets or bags for wider coverage options.
Surveillance AI might require new training to spot abrupt visual changes in clothing as a potential evasion signal.
Multi-temperature versions could allow selection among several distinct adversarial patterns on the same garment.

Load-bearing premise

The activated patterns remain robust against real-world variations in lighting, viewing angles, camera qualities, and without the clothing change itself being detected by observers or systems.

What would settle it

Physical trials that record an adversarial success rate below 80 percent when the activated clothing is viewed under changed lighting conditions or from different angles would falsify the central performance claim.

Figures

Figures reproduced from arXiv: 2511.09829 by Chao Ma, Hanqing Liu, Jiahuan Long, Tingsong Jiang, Weien Zhou, Wen Yao, Yang Yang.

**Figure 1.** Figure 1: Comparisons of representative adversarial patch attacks. (a) shows that most prior adversarial patches are singlemodal (RGB or infrared) and always-on in everyday settings, making them more noticeable in real-world scenarios. (b) presents that our adversarial patch attack achieves dual-modal visible-infrared deception, and support controllable activation in the real world. tions such as smart city monit… view at source ↗

**Figure 2.** Figure 2: Effect and structure of the thermally activated adversarial clothing. (a) Before activation, the wearer is detected by visibleand infrared-spectrum detectors; after activation, the adversarial pattern emerges and degrades the detection. (b) Layered structure of the clothing (top to bottom): thermochromic layer, adversarial patch layer, heating layer, and fabric substrate. When the heating layer raises the… view at source ↗

**Figure 4.** Figure 4: Design of the temperature-controlled heating pad. (a) Algorithmically optimized polygonal shapes. (b) Silicone pads fabricated according to these shapes. (c) Digital temperature controller. (d) Thickness of the heating pad (∼1 mm); (e) Visual examples of heating pads under infrared imaging. ture controller, offering a controllable temperature range of 20–70 ◦C (see [PITH_FULL_IMAGE:figures/full_fig_p004… view at source ↗

**Figure 5.** Figure 5: Overview of the proposed dual-modal patch training framework. (a) Shape update against infrared detector. Starting from an initial geometric template, we optimize the patch shape to evade the infrared-spectrum detector by adjusting the number of vertices and the polar coordinates (radius, angle). (b) Texture update against an visible-spectrum detector. Given the optimized shape, we further update the patch… view at source ↗

**Figure 6.** Figure 6: Comparison of attack success rates (ASR) for various adversarial patch methods on infrared and visible datasets. Columns from left to right: T-SEA [28], AdvYOLO [52], CAP [58], FDA [11], AdvTexture [26], AdvCloak [63], our RGB patch, AdvIC [24], AdvIB [23], AIP [61], HIC-IR [67], Bulb [68], our infrared patch. It shows that our dual-modal patch achieves the highest attack success rate compared to other rep… view at source ↗

**Figure 7.** Figure 7: Real-world testing in diverse AI surveillance scenarios, including indoor room, shopping mall, and outdoor street. This demonstrates that our adversarial method achieves effective dual-modal evasion on both visible and infrared detectors across diverse scenarios. Refer to Supplementary Materials for video demos. 0s 30s 50s [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗

**Figure 9.** Figure 9: The activation temperature of the adversarial clothing. (a) Dye color density vs. temperature: The dye undergoes a sharp transition from colored to transparent between 28-30 ºC. TGA indicates that the microcapsules lose protective capability above 200 ºC. (b) Heating-cooling curves: The thermochromic material exhibits a thermal hysteresis of 3 ºC. lustrate an outdoor street surveillance scenario. In this … view at source ↗

**Figure 10.** Figure 10: Real-world testing of patch effectiveness under diverse angles and distances. It demonstrates that our clothing maintains attack effectiveness within varying physical conditions. was achieved within 50 s. This rapid response ensures reliable RGB texture activation for visible-spectrum deception while simultaneously altering thermal textures for infraredspectrum deception, thereby achieving privacy prote… view at source ↗

read the original abstract

Adversarial patches have emerged as a popular privacy-preserving approach for resisting AI-driven surveillance systems. However, their conspicuous appearance makes them difficult to deploy in real-world scenarios. In this paper, we propose a thermally activated adversarial wearable designed to ensure adaptability and effectiveness in complex real-world environments. The system integrates thermochromic dyes with flexible heating units to induce visually dynamic adversarial patterns on clothing surfaces. In its default state, the clothing appears as an ordinary black T-shirt. Upon heating via an embedded thermal unit, hidden adversarial patterns on the fabric are activated, allowing the wearer to effectively evade detection across both visible and infrared modalities. Physical experiments demonstrate that the adversarial wearable achieves rapid texture activation within 50 seconds and maintains an adversarial success rate above 80\% across diverse real-world surveillance environments. This work demonstrates a new pathway toward physically grounded, user-controllable anti-AI systems, highlighting the growing importance of proactive adversarial techniques for privacy protection in the age of ubiquitous AI surveillance.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

This paper shows a workable idea for clothing that hides adversarial patterns until heated to activate them against visible and IR surveillance, but the experimental support is too thin to judge how well it actually works.

read the letter

The main point is that the authors built a T-shirt that looks ordinary until you turn on embedded heaters, at which point thermochromic dyes reveal patterns meant to fool both regular cameras and thermal ones. Activation takes about 50 seconds and they report over 80% success in real-world tests. That on-demand control is the actual advance over the static patches that came before it, since those were always visible and therefore less practical for everyday use. The dual-modal coverage is a reasonable engineering choice given how surveillance systems often combine the two sensors. They frame the work clearly as a privacy tool the wearer can switch on when needed, which is a direct response to the conspicuousness problem in earlier physical adversarial work. The soft spot is the experimental section. The abstract gives the headline numbers but skips the basics: which detectors were used, how success was scored, how many trials happened, what the non-adversarial baseline looked like, or any error bars. Without those details it is hard to know whether the 80% figure reflects real robustness or just the conditions they happened to test. Questions about lighting changes, viewing angles, and whether the sudden pattern shift itself becomes noticeable are also left open. This is the kind of paper that would interest people working on physical attacks and wearable privacy defenses. A reader already following adversarial patches or anti-surveillance tech could pick up the concept and the activation trick, but they would need the full methods and data to decide if the results are reliable. I would send it for peer review. The idea is concrete enough to be worth referee time, and the main fixes would be adding the missing experimental protocol and some robustness checks rather than rethinking the whole approach.

Referee Report

2 major / 2 minor

Summary. The manuscript proposes a thermally activated dual-modal adversarial wearable that combines thermochromic dyes with embedded flexible heating units. The garment appears as an ordinary black T-shirt in its default state; upon heating, hidden adversarial patterns activate to evade AI detection in both visible-light and infrared modalities. Physical experiments are reported to demonstrate texture activation within 50 seconds and an adversarial success rate exceeding 80% across diverse real-world surveillance environments.

Significance. If the experimental results are substantiated, the work provides a practical advance in user-controllable adversarial clothing for privacy protection. It integrates materials science (thermochromic activation) with adversarial machine learning to address the conspicuousness problem of static patches while adding dual-modal (visible + IR) coverage. The emphasis on rapid, on-demand activation and real-world testing represents a concrete step toward deployable anti-surveillance systems.

major comments (2)

Physical Experiments section: the central claim of >80% adversarial success rate and 50-second activation lacks any description of experimental protocol, including number of trials, specific object detectors or surveillance pipelines tested, definition of success (person detection failure vs. identity misclassification), environmental controls, or baseline comparisons with non-adversarial clothing. Without these details the quantitative headline result cannot be evaluated for robustness or reproducibility.
Physical Experiments section: no information is given on how robustness to real-world variations (lighting, viewing angles, camera quality) was quantified or whether the activated patterns were tested against potential human detection of the clothing change itself, leaving the weakest assumption unaddressed in the reported results.

minor comments (2)

Abstract: the phrase 'diverse real-world surveillance environments' is used without enumeration of the specific conditions or locations tested.
The manuscript would benefit from a dedicated related-work subsection contrasting the proposed thermal activation with prior static adversarial patches and other dynamic camouflage approaches.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their constructive feedback on our manuscript. We appreciate the emphasis on experimental rigor and have revised the Physical Experiments section to provide the requested details on protocols, robustness testing, and controls.

read point-by-point responses

Referee: Physical Experiments section: the central claim of >80% adversarial success rate and 50-second activation lacks any description of experimental protocol, including number of trials, specific object detectors or surveillance pipelines tested, definition of success (person detection failure vs. identity misclassification), environmental controls, or baseline comparisons with non-adversarial clothing. Without these details the quantitative headline result cannot be evaluated for robustness or reproducibility.

Authors: We agree that the original manuscript provided insufficient detail on the experimental protocol to allow full evaluation of the reported results. In the revised version, we have substantially expanded the Physical Experiments section with a complete protocol description, including the number of trials performed, the specific object detectors and surveillance pipelines evaluated, the definition of success used, environmental controls applied, and direct baseline comparisons against non-adversarial clothing. revision: yes
Referee: Physical Experiments section: no information is given on how robustness to real-world variations (lighting, viewing angles, camera quality) was quantified or whether the activated patterns were tested against potential human detection of the clothing change itself, leaving the weakest assumption unaddressed in the reported results.

Authors: We acknowledge that robustness to real-world variations and the potential for human observers to notice the clothing change were not adequately addressed. The revised manuscript now includes quantitative analysis of performance under varied lighting, angles, and camera qualities, along with observations regarding human detectability of the activation process in the tested conditions. revision: yes

Circularity Check

0 steps flagged

No circularity: claims rest on physical experiments without derivations or self-referential fits

full rationale

The paper describes a hardware system (thermochromic dyes + heating units) and validates it via reported physical experiments showing 50-second activation and >80% success rate. No equations, parameter fitting, predictions derived from inputs, or self-citation chains appear in the provided text or abstract. The central result is an empirical measurement against external real-world conditions rather than a closed mathematical loop, satisfying the self-contained benchmark criterion.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim depends on the practical behavior of thermochromic materials under embedded heating and the transferability of digital adversarial patterns to physical fabric in real environments; these are treated as domain assumptions without independent evidence supplied in the abstract.

axioms (1)

domain assumption Thermochromic dyes integrated into fabric can reversibly change appearance upon controlled heating without damaging the material or revealing the mechanism to casual observers.
Invoked to support the default black T-shirt appearance and on-demand activation.

invented entities (1)

Thermally activated dual-modal adversarial wearable no independent evidence
purpose: To provide user-controllable privacy protection against AI surveillance in visible and infrared modalities.
The complete system is introduced and tested in the paper; no external falsifiable evidence outside the reported experiments is given.

pith-pipeline@v0.9.0 · 5480 in / 1286 out tokens · 53660 ms · 2026-05-17T23:00:57.346344+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

70 extracted references · 70 canonical work pages · 3 internal anchors

[1]

https://enterprise.dji.com/matrice-4-series

DJI Matrice 4T. https://enterprise.dji.com/matrice-4-series. 5

work page
[2]

Understanding policy and technical aspects of ai-enabled smart video surveillance to address public safety.Computational Urban Science, 3(1):21, 2023

Babak Rahimi Ardabili, Armin Danesh Pazho, Ghazal Alinezhad Noghre, Christopher Neff, Sai Datta Bhaskararayuni, Arun Ravindran, Shannon Reid, and Hamed Tabkhi. Understanding policy and technical aspects of ai-enabled smart video surveillance to address public safety.Computational Urban Science, 3(1):21, 2023. 1

work page 2023
[3]

Synthesizing robust adversarial examples

Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. InInter- national conference on machine learning (ICML), 2018. 4

work page 2018
[4]

Irena Barkane. Questioning the eu proposal for an artificial intelligence act: The need for prohibitions and a stricter ap- proach to biometric surveillance.Information Polity, 27(2): 147–162, 2022. 1

work page 2022
[5]

European union artificial intelli- gence act: A guide, 2025

Bird & Bird LLP. European union artificial intelli- gence act: A guide, 2025. https://www.twobirds.com/- /media/new-website-content/pdfs/capabilities/artificial- intelligence/european-union-artificial-intelligence-act- guide.pdf. 2

work page 2025
[6]

Adversarial Patch

Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch.arXiv:1712.09665,

work page internal anchor Pith review Pith/arXiv arXiv
[7]

Duke University Press, 2015

Simone Browne.Dark matters: On the surveillance of black- ness. Duke University Press, 2015. 1

work page 2015
[8]

End-to- end object detection with transformers

Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to- end object detection with transformers. InEuropean confer- ence on computer vision (ECCV), 2020. 5

work page 2020
[9]

M. Chang. Countermeasures: The need for new legislation to govern biometric technologies in the uk, 2022. Ada Lovelace Institute Report. 1

work page 2022
[10]

Shape matters: deformable patch attack

Zhaoyu Chen, Bo Li, Shuang Wu, Jianghe Xu, Shouhong Ding, and Wenqiang Zhang. Shape matters: deformable patch attack. InEuropean conference on computer vision (ECCV), 2022. 2

work page 2022
[11]

Full-distance evasion of pedestrian detec- tors in the physical world.Advances in Neural Information Processing Systems (NeurIPS), 2024

Zhi Cheng, Zhanhao Hu, Yuqiu Liu, Jianmin Li, Hang Su, and Xiaolin Hu. Full-distance evasion of pedestrian detec- tors in the physical world.Advances in Neural Information Processing Systems (NeurIPS), 2024. 6

work page 2024
[12]

Histograms of oriented gra- dients for human detection

Navneet Dalal and Bill Triggs. Histograms of oriented gra- dients for human detection. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), pages 886–893, 2005. 5, 6

work page 2005
[13]

Utah, colorado and other states lead groundbreaking ai legislation in the u.s., 2024

Davis+Gilbert LLP. Utah, colorado and other states lead groundbreaking ai legislation in the u.s., 2024. 2

work page 2024
[14]

Artificial intelligence act, 2024

European Parliament and the Council. Artificial intelligence act, 2024. Official EU Legislation Portal. 2

work page 2024
[15]

Eu legislation in progress, 2024

European Parliamentary Research Service. Eu legislation in progress, 2024. https://epthinktank.eu/eu-legislation-in- progress/. 2

work page 2024
[16]

https://adversarialfashion.com

Adversarial Fashion. https://adversarialfashion.com. 2

work page
[17]

Carnegie Endowment for International Peace Washington, DC, 2019

Steven Feldstein.The global expansion of AI surveillance. Carnegie Endowment for International Peace Washington, DC, 2019. 1

work page 2019
[18]

https://oem.flir.com/

FLIR Thermal Datasets. https://oem.flir.com/. 5, 6

work page
[19]

https://www.capable.design

A Clothing for Data Privacy. https://www.capable.design. 2

work page
[20]

Physpatch: A physically realizable and transferable adversarial patch attack for multi- modal large language models-based autonomous driving sys- tems.arXiv:2508.05167, 2025

Qi Guo, Xiaojun Jia, Shanmin Pang, Simeng Qin, Lin Wang, Ju Jia, Yang Liu, and Qing Guo. Physpatch: A physically realizable and transferable adversarial patch attack for multi- modal large language models-based autonomous driving sys- tems.arXiv:2508.05167, 2025. 2

work page arXiv 2025
[22]

Reap: A large-scale realistic adversarial patch bench- mark

Nabeel Hingun, Chawin Sitawarin, Jerry Li, and David Wag- ner. Reap: A large-scale realistic adversarial patch bench- mark. InProceedings of the IEEE/CVF International Con- ference on Computer Vision (ICCV), 2023. 2

work page 2023
[23]

Adversarial infrared blocks: A multi-view black-box attack to thermal infrared detectors in physical world.Neural Networks, 175: 106310, 2024

Chengyin Hu, Weiwen Shi, Tingsong Jiang, Wen Yao, Ling Tian, Xiaoqian Chen, Jingzhi Zhou, and Wen Li. Adversarial infrared blocks: A multi-view black-box attack to thermal infrared detectors in physical world.Neural Networks, 175: 106310, 2024. 6

work page 2024
[24]

Adversarial infrared curves: An attack on infrared pedestrian detectors in the physical world.Neural networks, 178:106459, 2024

Chengyin Hu, Weiwen Shi, Wen Yao, Tingsong Jiang, Ling Tian, Xiaoqian Chen, and Wen Li. Adversarial infrared curves: An attack on infrared pedestrian detectors in the physical world.Neural networks, 178:106459, 2024. 6

work page 2024
[25]

Two-stage optimized unified adversarial patch for attacking visible-infrared cross-modal detectors in the physical world.Applied Soft Computing, 171:112818,

Chengyin Hu, Weiwen Shi, Wen Yao, Tingsong Jiang, Ling Tian, and Wen Li. Two-stage optimized unified adversarial patch for attacking visible-infrared cross-modal detectors in the physical world.Applied Soft Computing, 171:112818,

work page
[26]

Adversarial texture for fooling person detectors in the physical world

Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), 2022. 5, 6

work page 2022
[27]

Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling

Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling. InProceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, 2023. 2

work page 2023
[28]

T-sea: Transfer-based self-ensemble attack on object detection

Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-sea: Transfer-based self-ensemble attack on object detection. InProceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition (CVPR), pages 20514–20523, 2023. 6

work page 2023
[29]

Towards transferable targeted 3d adversarial attack in the physical world

Yao Huang, Yinpeng Dong, Shouwei Ruan, Xiao Yang, Hang Su, and Xingxing Wei. Towards transferable targeted 3d adversarial attack in the physical world. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2

work page 2024
[30]

Ai-driven behavior bio- metrics framework for robust human activity recognition in surveillance systems.Engineering Applications of Artificial Intelligence, 127:107218, 2024

Altaf Hussain, Samee Ullah Khan, Noman Khan, Moham- mad Shabaz, and Sung Wook Baik. Ai-driven behavior bio- metrics framework for robust human activity recognition in surveillance systems.Engineering Applications of Artificial Intelligence, 127:107218, 2024. 1

work page 2024
[31]

Iou attack: Towards temporally coherent black-box adver- sarial attack for visual object tracking

Shuai Jia, Yibing Song, Chao Ma, and Xiaokang Yang. Iou attack: Towards temporally coherent black-box adver- sarial attack for visual object tracking. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021. 2

work page 2021
[32]

Exploring frequency adversar- ial attacks for face forgery detection

Shuai Jia, Chao Ma, Taiping Yao, Bangjie Yin, Shouhong Ding, and Xiaokang Yang. Exploring frequency adversar- ial attacks for face forgery detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022. 2

work page 2022
[33]

Llvip: A visible-infrared paired dataset for low-light vision

Xinyu Jia, Chuang Zhu, Minzhen Li, Wenqi Tang, and Wenli Zhou. Llvip: A visible-infrared paired dataset for low-light vision. InProceedings of the IEEE/CVF international con- ference on computer vision (ICCV), 2021. 5, 6

work page 2021
[34]

Yolov5 by ultralytics, https://doi.org/10.5281/zenodo.4154370, 2020

Glenn Jocher et al. Yolov5 by ultralytics, https://doi.org/10.5281/zenodo.4154370, 2020. 5

work page doi:10.5281/zenodo.4154370 2020
[35]

Computer- vision research powers surveillance technology.Nature, pages 1–7, 2025

Pratyusha Ria Kalluri, William Agnew, Myra Cheng, Ken- trell Owens, Luca Soldaini, and Abeba Birhane. Computer- vision research powers surveillance technology.Nature, pages 1–7, 2025. 1

work page 2025
[36]

Microsoft coco: Common objects in context

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision (ECCV), 2014. 5

work page 2014
[37]

Perceptual-sensitive gan for generating adversarial patches

Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. InProceedings of the AAAI conference on artificial intelligence (AAAI), 2019. 2

work page 2019
[38]

Bias-based universal ad- versarial patch attack for automatic check-out

Aishan Liu, Jiakai Wang, Xianglong Liu, Bowen Cao, Chongzhi Zhang, and Hang Yu. Bias-based universal ad- versarial patch attack for automatic check-out. InEuropean conference on computer vision (ECCV), 2020. 2

work page 2020
[39]

Reversible nontoxic thermochromic microcapsules

Bingxin Liu, Alicia Rasines Mazo, Paul A Gurr, and Greg G Qiao. Reversible nontoxic thermochromic microcapsules. ACS applied materials & interfaces, 12(8):9782–9789, 2020. 3

work page 2020
[40]

Eva-vla: Evaluating vision-language-action models’ robustness under real-world physical variations.arXiv:2509.18953, 2025

Hanqing Liu, Jiahuan Long, Junqi Wu, Jiacheng Hou, Huili Tang, Tingsong Jiang, Weien Zhou, and Wen Yao. Eva-vla: Evaluating vision-language-action models’ robustness under real-world physical variations.arXiv:2509.18953, 2025. 2

work page arXiv 2025
[41]

When lighting deceives: Ex- posing vision-language models’ illumination vulnerability through illumination transformation attack.arXiv preprint arXiv:2503.06903, 2025

Hanqing Liu, Shouwei Ruan, Yao Huang, Shiji Zhao, and Xingxing Wei. When lighting deceives: Ex- posing vision-language models’ illumination vulnerability through illumination transformation attack.arXiv preprint arXiv:2503.06903, 2025. 2

work page arXiv 2025
[42]

DPatch: An Adversarial Patch Attack on Object Detectors

Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. Dpatch: An adversarial patch attack on object detectors.arXiv:1806.02299, 2018. 2

work page internal anchor Pith review Pith/arXiv arXiv 2018
[43]

High- temperature, reversible, and robust thermochromic fluores- cence based on rb2mnbr4 (h2o) 2 for anti-counterfeiting.Ad- vanced Materials, 35(35):2301914, 2023

Yang Liu, Gaoyu Liu, Ye Wu, Wenbing Cai, Yue Wang, Shengli Zhang, Haibo Zeng, and Xiaoming Li. High- temperature, reversible, and robust thermochromic fluores- cence based on rb2mnbr4 (h2o) 2 for anti-counterfeiting.Ad- vanced Materials, 35(35):2301914, 2023. 3

work page 2023
[44]

Pap- mot: Exploring adversarial patch attack against multiple ob- ject tracking

Jiahuan Long, Tingsong Jiang, Wen Yao, Shuai Jia, Weijia Zhang, Weien Zhou, Chao Ma, and Xiaoqian Chen. Pap- mot: Exploring adversarial patch attack against multiple ob- ject tracking. InEuropean Conference on Computer Vision (ECCV), 2024. 2

work page 2024
[45]

Robust sam: On the adversarial robustness of vision foundation models

Jiahuan Long, Zhengqin Xu, Tingsong Jiang, Wen Yao, Shuai Jia, Chao Ma, and Xiaoqian Chen. Robust sam: On the adversarial robustness of vision foundation models. InPro- ceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2025. 2

work page 2025
[46]

Cdupatch: Color-driven universal adversarial patch attack for dual-modal visible-infrared detectors

Jiahuan Long, Wen Yao, Tingsong Jiang, Jiacheng Hou, Shuai Jia, Junqi Wu, Xiaoya Zhang, Xiaohu Zheng, and Chao Ma. Cdupatch: Color-driven universal adversarial patch attack for dual-modal visible-infrared detectors. In Proceedings of the 33rd ACM International Conference on Multimedia (ACM MM), 2025. 2, 5

work page 2025
[47]

Artificial intelligence index report 2025.arXiv preprint arXiv:2504.07139, 2025

Nestor Maslej, Loredana Fattorini, Raymond Perrault, Yolanda Gil, Vanessa Parli, Njenga Kariuki, Emily Capstick, Anka Reuel, Erik Brynjolfsson, John Etchemendy, et al. Ar- tificial intelligence index report 2025.arXiv:2504.07139,

work page arXiv 2025
[48]

An ai company scraped billions of photos for facial recognition, 2022

Billy Perrigo. An ai company scraped billions of photos for facial recognition, 2022. 1

work page 2022
[49]

YOLOv3: An Incremental Improvement

Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement.arXiv:1804.02767, 2018. 5

work page internal anchor Pith review Pith/arXiv arXiv 2018
[50]

Faster r-cnn: Towards real-time object detection with region proposal networks.Advances in neural information process- ing systems (NeurIPS), 2015

Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks.Advances in neural information process- ing systems (NeurIPS), 2015. 5

work page 2015
[51]

Jingli Tang, Yichao Wang, Mengjuan He, Liqian Huang, Xueli Wang, and Jianyong Yu. Electrothermochromic fabrics with a single-layer functional coating based on silver nanowires/thermochromic microcapsules/waterborne polyurethane paints.ACS Applied Materials & Interfaces, 16(51):70963–70972, 2024. 3

work page 2024
[52]

Fooling automated surveillance cameras: adversarial patches to at- tack person detection

Simen Thys, Wiebe Van Ranst, and Toon Goedem´e. Fooling automated surveillance cameras: adversarial patches to at- tack person detection. InProceedings of the IEEE/CVF con- ference on computer vision and pattern recognition work- shops (CVPRW), 2019. 2, 5, 6

work page 2019
[53]

The ethical questions that haunt facial-recognition research.Nature, 587(7834):354–359,

Richard Van Noorden. The ethical questions that haunt facial-recognition research.Nature, 587(7834):354–359,

work page
[54]

The ethics of computer vision: an overview in terms of power.AI and Ethics, 4(2):353–362,

Rosalie A Waelen. The ethics of computer vision: an overview in terms of power.AI and Ethics, 4(2):353–362,

work page
[55]

Uni- versal adversarial patch attack for automatic checkout using perceptual and attentional bias.IEEE Transactions on Image Processing, 31:598–611, 2021

Jiakai Wang, Aishan Liu, Xiao Bai, and Xianglong Liu. Uni- versal adversarial patch attack for automatic checkout using perceptual and attentional bias.IEEE Transactions on Image Processing, 31:598–611, 2021. 2

work page 2021
[56]

Dual attention suppression attack: Generate adversarial camouflage in physical world

Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. InPro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition (CVPR), 2021. 2

work page 2021
[57]

Ob- ject detection combining recognition and segmentation

Liming Wang, Jianbo Shi, Gang Song, and I-fan Shen. Ob- ject detection combining recognition and segmentation. In Asian conference on computer vision (ACCV), 2007. 5, 6

work page 2007
[58]

Revisiting adversarial patches for designing camera-agnostic attacks against person detection.Advances in Neural Information Processing Sys- tems (NeurIPS), 2024

Hui Wei, Zhixiang Wang, Kewei Zhang, Jiaqi Hou, Yuan- wei Liu, Hao Tang, and Zheng Wang. Revisiting adversarial patches for designing camera-agnostic attacks against person detection.Advances in Neural Information Processing Sys- tems (NeurIPS), 2024. 2, 6

work page 2024
[59]

Adversarial sticker: A stealthy attack method in the physical world.IEEE Trans- actions on Pattern Analysis and Machine Intelligence, 45(3): 2711–2725, 2022

Xingxing Wei, Ying Guo, and Jie Yu. Adversarial sticker: A stealthy attack method in the physical world.IEEE Trans- actions on Pattern Analysis and Machine Intelligence, 45(3): 2711–2725, 2022

work page 2022
[60]

Uni- fied adversarial patch for cross-modal attacks in the physi- cal world

Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. Uni- fied adversarial patch for cross-modal attacks in the physi- cal world. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 4445–4454,

work page
[61]

Physically adver- sarial infrared patches with learnable shapes and locations

Xingxing Wei, Jie Yu, and Yao Huang. Physically adver- sarial infrared patches with learnable shapes and locations. InProceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition (CVPR), 2023. 6

work page 2023
[62]

Infrared adversarial patches with learnable shapes and locations in the physical world.International Journal of Computer Vision, 132(6): 1928–1944, 2024

Xingxing Wei, Jie Yu, and Yao Huang. Infrared adversarial patches with learnable shapes and locations in the physical world.International Journal of Computer Vision, 132(6): 1928–1944, 2024. 2

work page 1928
[63]

Making an invisibility cloak: Real world adversar- ial attacks on object detectors

Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Gold- stein. Making an invisibility cloak: Real world adversar- ial attacks on object detectors. InEuropean Conference on Computer Vision (ECCV), 2020. 5, 6

work page 2020
[64]

Adversarial t-shirt! evading person detectors in a physical world

Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Meng- shu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. InEuropean conference on computer vision (ECCV), 2020. 2

work page 2020
[65]

Physical 3d adversarial attacks against monocular depth estimation in autonomous driving

Junhao Zheng, Chenhao Lin, Jiahao Sun, Zhengyu Zhao, Qian Li, and Chao Shen. Physical 3d adversarial attacks against monocular depth estimation in autonomous driving. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2

work page 2024
[66]

Revisiting adversarial patch defenses on object de- tectors: Unified evaluation, large-scale dataset, and new in- sights

Junhao Zheng, Jiahao Sun, Chenhao Lin, Zhengyu Zhao, Chen Ma, Chong Zhang, Cong Wang, Qian Wang, and Chao Shen. Revisiting adversarial patch defenses on object de- tectors: Unified evaluation, large-scale dataset, and new in- sights. InProceedings of the IEEE/CVF International Con- ference on Computer Vision (ICCV), 2025. 2

work page 2025
[67]

Hiding from infrared detectors in real world with adversarial clothes.Applied Intelligence, 53(23):29537–29555, 2023

Xiaopei Zhu, Zhanhao Hu, Siyuan Huang, Jianmin Li, Xi- aolin Hu, and Zheyao Wang. Hiding from infrared detectors in real world with adversarial clothes.Applied Intelligence, 53(23):29537–29555, 2023. 6

work page 2023
[68]

Hiding from thermal imaging pedestrian detectors in the physical world.Neurocomputing, 564:126923, 2024

Xiaopei Zhu, Xiao Li, Jianmin Li, Zheyao Wang, and Xi- aolin Hu. Hiding from thermal imaging pedestrian detectors in the physical world.Neurocomputing, 564:126923, 2024. 6

work page 2024
[69]

Infrared adversarial car stickers

Xiaopei Zhu, Yuqiu Liu, Zhanhao Hu, Jianmin Li, and Xi- aolin Hu. Infrared adversarial car stickers. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2

work page 2024
[70]

Physical adversarial examples for per- son detectors in thermal images based on 3d modeling.IEEE Transactions on Pattern Analysis and Machine Intelligence,

Xiaopei Zhu, Siyuan Huang, Zhanhao Hu, Jianmin Li, Jun Zhu, and Xiaolin Hu. Physical adversarial examples for per- son detectors in thermal images based on 3d modeling.IEEE Transactions on Pattern Analysis and Machine Intelligence,

work page
[71]

The age of surveillance capitalism

Shoshana Zuboff. The age of surveillance capitalism. In Social Theory Re-Wired, pages 203–213. Routledge, 2023. 1

work page 2023