pith. sign in

arxiv: 2606.19736 · v1 · pith:QCYTVGJDnew · submitted 2026-06-18 · 💻 cs.CV

VFACamou: View-Fused Adversarial Camouflage for Environment-Adaptive Physical Evasion

Shihui Yan , Hu Liu , Junyu Shi , Zihui Zhu , Ziqi Zhou , Yufei Song , Youming Geng , Minghui Li
show 1 more author
Shengshan Hu
This is my paper

Pith reviewed 2026-06-26 18:43 UTC · model grok-4.3

classification 💻 cs.CV
keywords adversarial camouflagephysical evasionUV-volume renderingdiffusion-based textureillumination consistencymulti-scale trainingenvironment-adaptive patternsUAV reconnaissance
0
0 comments X

The pith

The VFACamou framework produces wearable adversarial camouflage that remains effective against detectors despite changes in viewpoint, pose, and lighting.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper develops an end-to-end method to generate adversarial camouflage patterns for physical evasion in dynamic environments such as UAV reconnaissance. It addresses the failure of 2D digital perturbations to generalize to real conditions and the impracticality of unnatural textures. The approach combines UV-volume rendering with a diffusion-based texture generator to ensure consistency across scales and conditions. An illumination color consistency estimator aligns the texture with the background, and multi-scale training improves robustness to deformations. If correct, this would enable more practical and natural-looking physical adversarial attacks that hold up under real-world variations.

Core claim

Our method integrates UV-volume rendering with a diffusion-based texture generator, enabling consistent appearance under varying scales, poses, and lighting conditions. To ensure environmental realism, we propose an illumination color consistency estimator that extracts dominant background attributes and guides a natural texture loss to align the generated UV texture with the surrounding environment. A multi-scale dynamic training strategy further enhances robustness against viewpoint shifts and body deformation. Extensive experiments across multiple mainstream detectors demonstrate that our method achieves strong and stable physical attack performance while maintaining high perceptual natur

What carries the argument

UV-volume rendering integrated with a diffusion-based texture generator, guided by an illumination color consistency estimator and multi-scale dynamic training.

If this is right

  • The camouflage maintains stable attack performance under continuous geometric changes and extreme illumination variations.
  • High perceptual naturalness is preserved without introducing unnatural artifacts.
  • Attack effectiveness is demonstrated across multiple mainstream object detectors.
  • The patterns are suitable for wearable deployment in real physical scenarios.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The technique could be extended to other forms of dynamic physical camouflage beyond UAV targets.
  • Constraining diffusion models with volume rendering may provide a template for other 3D-consistent adversarial generations.
  • Effective physical transfer would suggest new ways to close the digital-to-physical gap in adversarial machine learning.
  • Such natural adversarial patterns might prompt the creation of specialized detectors for environmental camouflage.

Load-bearing premise

The illumination color consistency estimator can reliably extract dominant background attributes from real environments so that the UV textures transfer to physical prints without losing effectiveness under uncontrolled lighting and motion.

What would settle it

Print the generated textures on clothing and test detection rates by the target detectors when the wearer moves through real environments with varying poses, viewpoints, and lighting conditions, checking if attack success holds and naturalness is maintained.

Figures

Figures reproduced from arXiv: 2606.19736 by Hu Liu, Junyu Shi, Minghui Li, Shengshan Hu, Shihui Yan, Youming Geng, Yufei Song, Zihui Zhu, Ziqi Zhou.

Figure 1
Figure 1. Figure 1: Visualization of different person detector attacks. We compare our method with AdvYOLO [1], NaturalPatch [2], [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: An overview of our proposed method. We argue that under UAV-based physical observation, effec￾tive adversarial attacks on humans should disrupt the detector’s overall spatial perception of the target rather than merely weakening its classification confidence. Specifically, success￾ful evasion satisfies at least one of the following conditions: • Target disappearance: the detector produces no high￾confidenc… view at source ↗
Figure 3
Figure 3. Figure 3: Physical attack success rates across different detectors [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
read the original abstract

Adversarial camouflage in the physical world remains highly challenging, particularly under UAV reconnaissance where targets undergo continuous geometric changes and extreme illumination variations. Existing methods either optimize 2D digital perturbations that fail to generalize to dynamic viewpoints or produce visually unnatural textures that cannot be deployed in real scenarios. Therefore, we propose an end-to-end framework for adversarial camouflage generation that automatically produces wearable adversarial patterns and maintains stable attack performance in real physical environments with changing viewpoints, poses, and lighting conditions. Our method integrates UV-volume rendering with a diffusion-based texture generator, enabling consistent appearance under varying scales, poses, and lighting conditions. To ensure environmental realism, we propose an illumination color consistency estimator that extracts dominant background attributes and guides a natural texture loss to align the generated UV texture with the surrounding environment. A multi-scale dynamic training strategy further enhances robustness against viewpoint shifts and body deformation. Extensive experiments across multiple mainstream detectors demonstrate that our method achieves strong and stable physical attack performance while maintaining high perceptual naturalness, reducing human detection rates without introducing unnatural artifacts.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 2 minor

Summary. The paper proposes VFACamou, an end-to-end framework for generating wearable adversarial camouflage patterns that remain effective against object detectors under dynamic UAV-like conditions with changing viewpoints, poses, and illumination. The core technical contributions are the integration of UV-volume rendering with a diffusion-based texture generator for consistent appearance, an illumination color consistency estimator that extracts dominant background attributes to guide a natural texture loss, and a multi-scale dynamic training strategy to improve robustness to scale, pose, and deformation. The authors claim that extensive experiments across mainstream detectors demonstrate strong, stable physical attack performance while preserving high perceptual naturalness without unnatural artifacts.

Significance. If the quantitative claims hold after proper validation, the work would address a practically important gap in physical adversarial attacks by improving environmental adaptability and sim-to-real transfer for dynamic targets. The explicit use of diffusion models for texture synthesis and the illumination estimator represent potentially useful technical directions, provided the transfer gap under uncontrolled lighting is measured and shown to be small.

major comments (3)
  1. [Abstract / Experiments] Abstract and Experiments section: the manuscript asserts 'strong and stable physical attack performance' and 'high perceptual naturalness' across multiple detectors yet supplies no attack success rates, baseline comparisons, error bars, or ablation tables, so the central empirical claim cannot be evaluated against the data.
  2. [Method] Method (illumination color consistency estimator): the claim that this module reliably extracts dominant background attributes and enables natural texture alignment is load-bearing for the environmental realism and sim-to-real transfer assertions, but no quantitative color-fidelity metrics, print-to-camera reflectance gaps, or failure cases under lighting deviation from the estimated dominant color are reported.
  3. [Method] Method (UV-volume rendering + diffusion generator): the multi-scale dynamic training is stated to handle viewpoint and body deformation, yet the description does not quantify how well the generated UV textures preserve attack effectiveness after physical printing and under real motion-induced lighting changes, leaving the weakest assumption untested.
minor comments (2)
  1. Define all acronyms (e.g., UV, UAV) on first use and ensure consistent notation for the illumination estimator and texture loss terms throughout the text.
  2. Add a clear diagram or pseudocode for the end-to-end pipeline (UV rendering o diffusion generator o illumination estimator o physical print) to improve readability.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive comments highlighting the need for stronger empirical support. We will revise the manuscript to include the requested quantitative results, metrics, and analyses to better substantiate the claims.

read point-by-point responses

  1. Referee: [Abstract / Experiments] Abstract and Experiments section: the manuscript asserts 'strong and stable physical attack performance' and 'high perceptual naturalness' across multiple detectors yet supplies no attack success rates, baseline comparisons, error bars, or ablation tables, so the central empirical claim cannot be evaluated against the data.

    Authors: We agree that explicit quantitative results are necessary to support the claims of strong and stable performance. In the revised manuscript, we will add tables reporting attack success rates across detectors, baseline comparisons, error bars from repeated trials, and ablation studies on the framework components. revision: yes

  2. Referee: [Method] Method (illumination color consistency estimator): the claim that this module reliably extracts dominant background attributes and enables natural texture alignment is load-bearing for the environmental realism and sim-to-real transfer assertions, but no quantitative color-fidelity metrics, print-to-camera reflectance gaps, or failure cases under lighting deviation from the estimated dominant color are reported.

    Authors: The illumination estimator is key to environmental alignment. We will incorporate quantitative color-fidelity metrics (such as CIE Delta E), analysis of print-to-camera reflectance differences, and discussion of failure cases under lighting deviations in the revised method and experiments sections. revision: yes

  3. Referee: [Method] Method (UV-volume rendering + diffusion generator): the multi-scale dynamic training is stated to handle viewpoint and body deformation, yet the description does not quantify how well the generated UV textures preserve attack effectiveness after physical printing and under real motion-induced lighting changes, leaving the weakest assumption untested.

    Authors: We acknowledge that additional quantification of post-printing and motion-induced performance is needed to validate the sim-to-real transfer. The revision will include new experiments measuring attack effectiveness on physically printed textures under real dynamic lighting and motion conditions. revision: yes

Circularity Check

0 steps flagged

No circularity detected; derivation is self-contained

full rationale

The provided abstract and description outline a proposed end-to-end framework using UV-volume rendering, a diffusion-based texture generator, an illumination color consistency estimator, a natural texture loss, and multi-scale dynamic training. No equations, fitted parameters renamed as predictions, self-citations, uniqueness theorems, or ansatzes are quoted or described that would reduce any claim to its own inputs by construction. The central claims rest on the integration of these components for physical attack performance, with no visible self-definitional loops or load-bearing reductions to prior author work. This is the expected outcome for a methods paper whose novelty is asserted through architectural choices rather than mathematical derivation.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only review provides no equations, training details, or explicit assumptions, so the ledger cannot be populated with concrete free parameters, axioms, or invented entities.

pith-pipeline@v0.9.1-grok · 5738 in / 1059 out tokens · 20708 ms · 2026-06-26T18:43:47.390169+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

45 extracted references · 8 canonical work pages · 5 internal anchors

  1. [1]

    Fooling automated surveil- lance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedem ´e, “Fooling automated surveil- lance cameras: adversarial patches to attack person detection,” inPro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    2019

  2. [2]

    Naturalistic physical adversarial patch for object detectors,

    Y .-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, and W.-H. Cheng, “Naturalistic physical adversarial patch for object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7848–7857

    2021

  3. [3]

    Adversarial tex- ture for fooling person detectors in the physical world,

    Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, and X. Hu, “Adversarial tex- ture for fooling person detectors in the physical world,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 13 307–13 316

    2022

  4. [4]

    Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,

    Z. Hu, W. Chu, X. Zhu, H. Zhang, B. Zhang, and X. Hu, “Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 975–16 984

    2023

  5. [5]

    Uv-attack: Physical-world adversarial attacks for person detection via dynamic-nerf-based uv mapping,

    Y . Li, K. Liang, and B. Xiao, “Uv-attack: Physical-world adversarial attacks for person detection via dynamic-nerf-based uv mapping,”arXiv preprint arXiv:2501.05783, 2025

    work page arXiv 2025

  6. [6]

    A survey of object detection for uavs based on deep learning,

    G. Tang, J. Ni, Y . Zhao, Y . Gu, and W. Cao, “A survey of object detection for uavs based on deep learning,”Remote Sensing, vol. 16, no. 1, p. 149,

  7. [7]

    Available: https://www.mdpi.com/2072-4292/16/1/149

    [Online]. Available: https://www.mdpi.com/2072-4292/16/1/149

    2072

  8. [8]

    Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” inAdvances in Neural Information Processing Systems (NeurIPS), 2015, pp. 91–99. [Online]. Available: https://arxiv.org/abs/1506.01497

    work page internal anchor Pith review Pith/arXiv arXiv 2015

  9. [9]

    Vision Meets Drones: A Challenge

    D. Du, P. Zhu, L. Wen, X. Bian, H. Lin, Q. Hu, T. Peng, J. Zheng, X. Wang, and Y . Zhang, “The visdrone dataset for object detection and tracking from aerial images,” inProceedings of the European Conference on Computer Vision (ECCV), 2018, pp. 733–749. [Online]. Available: https://arxiv.org/abs/1804.07437

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  10. [10]

    Darkhash: A data-free backdoor attack against deep hashing,

    Z. Zhou, M. Deng, Y . Song, H. Zhang, W. Wan, S. Hu, M. Li, L. Y . Zhang, and D. Yao, “Darkhash: A data-free backdoor attack against deep hashing,”IEEE Transactions on Information Forensics and Security, 2025

    2025

  11. [11]

    Badhash: Invisible backdoor attacks against deep hashing with clean label,

    S. Hu, Z. Zhou, Y . Zhang, L. Y . Zhang, Y . Zheng, Y . He, and H. Jin, “Badhash: Invisible backdoor attacks against deep hashing with clean label,” inProceedings of the 30th ACM International Conference on Multimedia (ACM MM’22), 2022, pp. 678–686

    2022

  12. [12]

    Mars: A malignity-aware backdoor defense in federated learning,

    W. Wan, Y . Ning, Z. Huang, C. Hong, S. Hu, Z. Zhou, Y . Zhang, T. Zhu, W. Zhou, and L. Y . Zhang, “Mars: A malignity-aware backdoor defense in federated learning,” inProceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS’25), 2025

    2025

  13. [13]

    Detector collapse: Backdooring object detection to catastrophic overload or blindness,

    H. Zhang, S. Hu, Y . Wang, L. Y . Zhang, Z. Zhou, X. Wang, Y . Zhang, and C. Chen, “Detector collapse: Backdooring object detection to catastrophic overload or blindness,” inProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence (IJCAI’24), 2024

    2024

  14. [14]

    Test-time backdoor detection for object detection models,

    H. Zhang, Y . Wang, S. Yan, C. Zhu, Z. Zhou, L. Hou, S. Hu, M. Li, Y . Zhang, and L. Y . Zhang, “Test-time backdoor detection for object detection models,” inProceedings of the Computer Vision and Pattern Recognition Conference (CVPR’25), 2025, pp. 24 377–24 386

    2025

  15. [15]

    Trojanrobot: Backdoor attacks against robotic manipulation in the physical world,

    X. Wang, H. Pan, H. Zhang, M. Li, S. Hu, Z. Zhou, L. Xue, P. Guo, Y . Wang, W. Wanet al., “Trojanrobot: Backdoor attacks against robotic manipulation in the physical world,”arXiv e-prints, pp. arXiv–2411, 2024

    2024

  16. [16]

    Unlearnable 3d point clouds: Class-wise transformation is all you need,

    X. Wang, M. Li, W. Liu, H. Zhang, S. Hu, Y . Zhang, Z. Zhou, and H. Jin, “Unlearnable 3d point clouds: Class-wise transformation is all you need,” inProceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS’24), vol. 37, 2024, pp. 99 404–99 432

    2024

  17. [17]

    Detecting and corrupting convolution-based unlearnable exam- ples,

    M. Li, X. Wang, Z. Yu, S. Hu, Z. Zhou, L. Zhang, and L. Y . Zhang, “Detecting and corrupting convolution-based unlearnable exam- ples,” inProceedings of the AAAI Conference on Artificial Intelligence (AAAI’25), vol. 39, no. 17, 2025, pp. 18 403–18 411

    2025

  18. [18]

    Eclipse: Expunging clean-label indiscriminate poisons via sparse diffusion purification,

    X. Wang, S. Hu, Y . Zhang, Z. Zhou, L. Y . Zhang, P. Xu, W. Wan, and H. Jin, “Eclipse: Expunging clean-label indiscriminate poisons via sparse diffusion purification,” inEuropean Symposium on Research in Computer Security. Springer, 2024, pp. 146–166

    2024

  19. [19]

    Spa-vlm: Stealthy poisoning attacks on rag-based vlm,

    L. Yu, Y . Zhang, Z. Zhou, Y . Wu, W. Wan, M. Li, S. Hu, P. Xiaobing, and J. Wang, “Spa-vlm: Stealthy poisoning attacks on rag-based vlm,” arXiv preprint arXiv:2505.23828, 2025

    work page arXiv 2025

  20. [20]

    Towards reliable forgetting: A survey on machine unlearning verification,

    L. Xue, S. Hu, W. Lu, Y . Shen, D. Li, P. Guo, Z. Zhou, M. Li, Y . Zhang, and L. Y . Zhang, “Towards reliable forgetting: A survey on machine unlearning verification,”ACM Computing Surveys, 2026

    2026

  21. [21]

    Darksam: Fooling segment anything model to segment nothing,

    Z. Zhou, Y . Song, M. Li, S. Hu, X. Wang, L. Y . Zhang, D. Yao, and H. Jin, “Darksam: Fooling segment anything model to segment nothing,” inProceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS’24), 2024

    2024

  22. [22]

    Vanish into thin air: Cross-prompt universal adversarial attacks for sam2,

    Z. Zhou, Y . Hu, Y . Song, Z. Li, S. Hu, L. Y . Zhang, D. Yao, L. Zheng, and H. Jin, “Vanish into thin air: Cross-prompt universal adversarial attacks for sam2,” inProceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS’25), 2025

    2025

  23. [23]

    Advedm: Fine-grained adversarial attack against vlm-based embodied agents,

    Y . Wang, h. Zhang, P. Hewen, Z. Zhou, X. Wang, P. Guo, l. Xue, S. Hu, M. Li, L. Y . Zhang, and Yao, “Advedm: Fine-grained adversarial attack against vlm-based embodied agents,” inProceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS’25), 2025

    2025

  24. [24]

    Pb-uap: Hybrid universal adversarial attack for image segmentation

    Y . Song, Z. Zhou, M. Li, X. Wang, M. Deng, W. Wan, S. Hu, and L. Y . Zhang, “Pb-uap: Hybrid universal adversarial attack for image segmentation.” inProceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP’25), 2025

    2025

  25. [25]

    Transferable adversarial facial images for privacy protection,

    M. Li, J. Wang, H. Zhang, Z. Zhou, S. Hu, and X. Pei, “Transferable adversarial facial images for privacy protection,” inProceedings of the 32nd ACM International Conference on Multimedia (ACM MM’24), 2024, pp. 10 649–10 658

    2024

  26. [26]

    Segtrans: Transferable adversarial examples for segmentation models,

    Y . Song, Z. Zhou, Q. Lu, H. Zhang, Y . Hu, L. Xue, S. Hu, M. Li, and L. Y . Zhang, “Segtrans: Transferable adversarial examples for segmentation models,”IEEE Transactions on Multimedia, 2025

    2025

  27. [27]

    Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning,

    Z. Zhou, S. Hu, M. Li, H. Zhang, Y . Zhang, and H. Jin, “Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning,” inProceedings of the 32nd ACM International Conference on Multimedia (MM’23), 2023, pp. 6311–6320

    2023

  28. [28]

    Securely fine-tuning pre-trained encoders against adversarial examples,

    Z. Zhou, M. Li, W. Liu, S. Hu, Y . Zhang, W. Wan, L. Xue, L. Y . Zhang, D. Yao, and H. Jin, “Securely fine-tuning pre-trained encoders against adversarial examples,” inProceedings of the 2024 IEEE Symposium on Security and Privacy (SP’24), 2024

    2024

  29. [29]

    Breaking barriers in physical-world adversarial examples: Improving robustness and transferability via robust feature,

    Y . Wang, Y . Chou, Z. Zhou, H. Zhang, W. Wan, S. Hu, and M. Li, “Breaking barriers in physical-world adversarial examples: Improving robustness and transferability via robust feature,” inProceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI’25), 2025

    2025

  30. [30]

    When light- ing deceives: Exposing vision-language models’ illumination vulner- ability through illumination transformation attack,

    H. Liu, S. Ruan, Y . Huang, S. Zhao, and X. Wei, “When light- ing deceives: Exposing vision-language models’ illumination vulner- ability through illumination transformation attack,”arXiv preprint arXiv:2503.06903, 2025

    work page arXiv 2025

  31. [31]

    YOLOv3: An Incremental Improvement

    J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” arXiv preprint arXiv:1804.02767, 2018

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  32. [32]

    Erosion attack for adversarial training to enhance semantic segmenta- tion robustness,

    Y . Song, Z. Zhou, M. Deng, Y . Hu, S. Hu, M. Li, and L. Y . Zhang, “Erosion attack for adversarial training to enhance semantic segmenta- tion robustness,” inProceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP’26), 2026

    2026

  33. [33]

    Transferable Physical-World Adversarial Patches Against Pedestrian Detection Models

    S. Yan, Z. Zhou, Y . Song, Y . Hu, M. Li, and S. Hu, “Transferable physical-world adversarial patches against pedestrian detection models,” arXiv preprint arXiv:2604.22552, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  34. [34]

    Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving

    Z. Zhu, Z. Zhou, Y . Wang, L. Xue, M. Li, and S. Hu, “Trans- ferable physical-world adversarial patches against object detection in autonomous driving,”arXiv preprint arXiv:2604.23105, 2026

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  35. [35]

    Downstream-agnostic adversarial examples,

    Z. Zhou, S. Hu, R. Zhao, Q. Wang, L. Y . Zhang, J. Hou, and H. Jin, “Downstream-agnostic adversarial examples,” inProceedings of the 2023 IEEE/CVF International Conference on Computer Vision (ICCV’23), 2023, pp. 4345–4355

    2023

  36. [36]

    Numbod: A spatial-frequency fusion attack against object detectors,

    Z. Zhou, B. Li, Y . Song, S. Hu, W. Wan, L. Y . Zhang, D. Yao, and H. Jin, “Numbod: A spatial-frequency fusion attack against object detectors,” inProceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI’25), 2025

    2025

  37. [37]

    Adv3d: Generating 3d adversarial examples for 3d object detection in driving scenarios with nerf,

    L. Li, Q. Lian, and Y . Chen, “Adv3d: Generating 3d adversarial examples for 3d object detection in driving scenarios with nerf,” 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pp. 10 813–10 820, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:261530011

    2024

  38. [38]

    Neural body: Implicit neural representations with structured latent codes for novel view synthesis of dynamic humans,

    S. Peng, Y . Zhang, Y . Xu, Q. Wang, Q. Shuai, H. Bao, and X. Zhou, “Neural body: Implicit neural representations with structured latent codes for novel view synthesis of dynamic humans,” inCVPR, 2021

    2021

  39. [39]

    Fast r-cnn,

    R. Girshick, “Fast r-cnn,” inProceedings of the IEEE international conference on computer vision, 2015, pp. 1440–1448

    2015

  40. [40]

    Mask r-cnn,

    K. He, G. Gkioxari, P. Doll ´ar, and R. Girshick, “Mask r-cnn,” 2018

    2018

  41. [41]

    Focal loss for dense object detection,

    T.-Y . Lin, P. Goyal, R. Girshick, K. He, and P. Doll ´ar, “Focal loss for dense object detection,” 2018

    2018

  42. [42]

    Ssd: Single shot multibox detector,

    W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, “Ssd: Single shot multibox detector,” inComputer Vision– ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part I 14. Springer, 2016, pp. 21–37

    2016

  43. [43]

    Ultralytics YOLO,

    G. Jocher, A. Chaurasia, and J. Qiu, “Ultralytics YOLO,” https://github. com/ultralytics/ultralytics, 2023

    2023

  44. [44]

    Yolov9: Learning what you want to learn using programmable gradient information,

    C.-Y . Wang, I.-H. Yeh, and H.-Y . M. Liao, “Yolov9: Learning what you want to learn using programmable gradient information,” inEuropean Conference on Computer Vision (ECCV) 2024, Lecture Notes in Com- puter Science, ser. Lecture Notes in Computer Science, A. Leonardis, E. Ricci, S. Roth, O. Russakovsky, T. Sattler, and G. Varol, Eds., vol. 15089. Spring...

    2024

  45. [45]

    Fcos: Fully convolutional one- stage object detection,

    Z. Tian, C. Shen, H. Chen, and T. He, “Fcos: Fully convolutional one- stage object detection,” 2019

    2019