The reviewed record of science sign in
Pith

arxiv: 2607.06485 · v1 · pith:S5J3OP5M · submitted 2026-07-07 · cs.CV · cs.AI

AirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models

Cong Su , Jiaju Han , Xuemeng Sun , Chengyin Hu , Qike Zhang , Jiujiang Guo , Yiwei Wei , Jiahuan Long This is my paper

Reviewed by Pith T0 review T1 audit T2 compute T3 formal T4 kernel 2026-07-08 04:11 UTCglm-5.2pith:S5J3OP5Mrecord.jsonopen to challenge →

classification cs.CV cs.AI
keywords modelsadversarialattackperturbationvlmsairflowairflowattackclip
0
0 comments X

The pith

One thermal-airflow pattern fools 11 infrared vision-language models

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper introduces AirflowAttack, the first adversarial attack designed specifically for infrared remote-sensing vision-language models. The authors synthesize a single, input-agnostic perturbation patterned after thermal airflow turbulence—the kind of temperature-driven air mixing that naturally degrades long-range thermal imaging. A lightweight generator with only 325 trainable parameters produces this perturbation, optimized on one surrogate CLIP model using a confidence-reduction loss and an airflow-correlation regularizer. The resulting pattern transfers without any target-model access to five CLIP backbones (achieving 48.5% mean attack success rate on zero-shot scene classification, versus 27.7–37.0% for four IR-specific physical baselines) and to six downstream VLMs across four tasks, cutting scene-classification accuracy by up to 38.2%. The paper also documents a modality-specific failure mode: some VLMs become more confident in their infrared analysis under attack, interpreting the synthetic airflow texture as genuine thermal evidence such as temperature gradients and convection signatures. Ablations reveal that the airflow prior improves physical plausibility of the perturbation at no measurable cost to attack success, but that attack efficacy is almost entirely driven by the confidence loss rather than by the airflow structure itself.

Core claim

The central object is a universal adversarial perturbation for infrared imagery that is parameterized through a fixed thermal-airflow prior field combined with a learnable low-dimensional residual (a 32×32 latent plus one scalar amplitude). This compact parameterization—325 values total, optimized for 800 steps on a single surrogate CLIP—produces a perturbation that transfers across architectures with different pretraining data and encoders, achieving 94.4–98.8% nearest-caption flip rates across five CLIP backbones. The paper claims that IR-trained models converge to similar representations of thermal texture, which a physically structured perturbation can exploit more effectively than uncor

What carries the argument

The perturbation is constructed as δ = clip(ε·tanh(a·P + r·R)⊙G, −ε, ε), where P is a fixed unit-normalized airflow prior field, R is a blurred upsampled 32×32 learnable residual, G is a soft spatial gate derived from the prior, a is a learnable amplitude, and r=0.60 is a fixed residual scale. Optimization minimizes a confidence-ratio loss (driving the surrogate CLIP's probability of its clean top-1 prediction downward) weighted at 8.0, plus an airflow-correlation loss (one minus spatial Pearson correlation between the gated perturbation and the prior) weighted at 1.0. The L∞ budget is ε=100/255. The entire optimization updates only z∈R^{32×32} and a scalar logit ρ, using AdamW for 800 steps

If this is right

  • IR remote-sensing VLMs deployed in security-critical settings (surveillance, disaster monitoring, military reconnaissance) are vulnerable to a single precomputed perturbation that requires no per-image or per-target-model optimization, meaning an adversary needs only one surrogate model and one GPU for minutes to compromise an entire ecosystem of downstream systems.
  • The IR-cue confabulation effect—where models become more confident in incorrect thermal analysis—represents a failure mode with no RGB analog, suggesting that IR-specific adversarial training and detection methods are needed rather than porting RGB defenses directly.
  • The finding that domain-specialized models (RemoteCLIP, GeoRSCLIP) are more vulnerable than general-purpose CLIP implies that remote-sensing pretraining may amplify sensitivity to exactly the thermal-texture features this attack exploits, creating a robustness-accuracy trade-off in domain adaptation.
  • The attack's concentration on global scene identity rather than localized object recognition suggests that IR VLMs encode scene-level semantics through distributed thermal-texture representations that are structurally fragile, pointing to where defensive interventions should focus.

Load-bearing premise

The paper attributes the attack's transferability to the airflow prior encoding domain-general thermal features, but the ablation shows the airflow loss contributes negligibly to attack success (47.9% with vs. 48.0% without). The transferability may instead stem from the low-dimensional generator parameterization and the confidence loss optimized on the surrogate, rather than from the physical airflow structure. The baseline comparison excludes unstructured digital universal扰

What would settle it

Run the same generator architecture and optimization with a random (non-airflow) fixed prior field replacing P, keeping the identical confidence loss, L∞ budget, and parameter count. If ASR and transfer rates remain comparable, the airflow prior is not the driver of transferability. Additionally, compare against an unstructured pixel-space UAP optimized with the same confidence loss and L∞ constraint to isolate whether perturbation structure or perturbation magnitude plus optimization is what matters.

Figures

Figures reproduced from arXiv: 2607.06485 by Chengyin Hu, Cong Su, Jiahuan Long, Jiaju Han, Jiujiang Guo, Qike Zhang, Xuemeng Sun, Yiwei Wei.

Figure 1
Figure 1. Figure 1: Overview of AirflowAttack. A lightweight generator Gθ maps a low-dimensional latent code to a single-channel thermal-airflow perturbation, optimized on a surrogate IR-finetuned CLIP model under an L∞ ≤ ε constraint using a confidence loss Lconf and an airflow-correlation loss Lair. The resulting perturbation transfers, without target￾model access, to five CLIP backbones and six VLMs across four vision-lang… view at source ↗
Figure 2
Figure 2. Figure 2: Qualitative zero-shot scene classification under AirflowAttack on six IR images. Top row (green): clean inputs correctly classified by the surrogate CLIP model. Bottom row (red): the same images with the universal thermal-airflow perturbation, now misclassified as unrelated categories. The faint, coherent airflow-like texture flips top-1 predictions while preserving human-recognizable scene content. deploy… view at source ↗
Figure 3
Figure 3. Figure 3: Effect of AirflowAttack on VLM captioning and visual question answering. Under attack, models produce more generic captions and confabulate thermal cues (temperature gradients, convection signatures) absent from the clean image, illustrating the IR-cue paradox quantified in Tab. 4. vive Bonferroni correction (p < 0.0028), and GeoChat survives FDR. The per￾turbation systematically misleads models about scen… view at source ↗
Figure 4
Figure 4. Figure 4: Attention shift under AirflowAttack. Top row: clean model attention (Grad￾CAM) with the correct top-1 scene prediction; bottom row: attention on the same images under the perturbation, with the flipped adversarial prediction. The airflow perturbation redirects the model’s spatial attention away from scene-defining content, driving the top-1 class change that ASR (Tab. 1) measures. 20 40 60 80 100 120 140 1… view at source ↗
Figure 5
Figure 5. Figure 5: Optimization ablations on OpenAI-CLIP-B32 (validation set). (a) ASR rises monotonically with the perturbation budget ε across all five backbones; the dashed line marks our reference ε = 100. (b) ASR converges by ∼800 steps and is stable thereafter, indicating robustness to early stopping. the two configurations driven primarily by the airflow prior (no-conf and fixed￾prior) reach only 39.5% and 38.5%. This… view at source ↗
Figure 6
Figure 6. Figure 6: Loss-composition and spatial-position ablations on OpenAI-CLIP-B32 (valida￾tion set). (a) ASR (bars) is driven by the confidence loss, while airflow correlation (line) rises as the airflow prior is weighted more heavily. (b) ASR when the perturbation is restricted to one image region: covering the full image is most effective, followed by the right and center regions that hold scene-defining content. (42.3… view at source ↗
read the original abstract

Vision-language models (VLMs) are increasingly deployed on infrared (IR) remote sensing imagery in security-critical settings, yet their adversarial robustness remains unexamined. We present AirflowAttack, to our knowledge the first adversarial attack for IR remote-sensing VLMs and the first to weaponize thermal-airflow turbulence as the perturbation prior. A lightweight generator synthesizes a single input-agnostic perturbation regularized toward physically plausible airflow patterns. Optimized on one surrogate CLIP model, it attains a mean zero-shot scene-classification attack success rate (ASR, the fraction of samples whose top-1 class changes) of 48.5% across five diverse CLIP backbones, far exceeding four IR-specific physical baselines (27.7--37.0%). Applied to six state-of-the-art VLMs, it cuts scene-classification accuracy by up to 38.2% relative, yet paradoxically makes some models more confident in their IR analysis, confabulating the perturbation as genuine thermal evidence such as temperature gradients and convection. Ablations show the airflow prior raises physical plausibility at no measurable cost to attack success. Together with a benchmark spanning eleven models and four tasks, these findings expose critical vulnerabilities in the rapidly expanding IR VLM ecosystem.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

3 major / 6 minor

Summary. This paper introduces AirflowAttack, a universal adversarial perturbation for infrared remote-sensing vision-language models that parameterizes the perturbation through a generator combining a fixed thermal-airflow prior field with a low-dimensional learnable residual. The perturbation is optimized on a single surrogate CLIP model (OpenAI-CLIP-B32) using a confidence loss and an airflow-correlation loss, then transferred without target-model access to five CLIP backbones and six VLMs across four tasks. The paper reports 48.5% mean ASR across CLIP backbones, significant scene-classification degradation on VLMs, and a paradoxical increase in IR-cue confidence on some models. The benchmark spans eleven models and four tasks, and ablations examine perturbation strength, loss components, spatial position, and hyperparameter sensitivity.

Significance. The paper addresses a genuinely underexplored area: adversarial robustness of IR remote-sensing VLMs. The comprehensive benchmark across five CLIP backbones and six VLMs on a dedicated IR test set is a valuable contribution. The IR-cue confabulation finding (models interpreting the perturbation as genuine thermal evidence) is a novel and operationally relevant observation. The generator parameterization is lightweight (325 parameters) and the experimental protocol includes multiple-comparison correction. The qualitative attention-map analysis provides useful mechanistic insight. However, the central novelty claim—that thermal-airflow structure is the key driver of transferability—is not adequately supported by the paper's own evidence, as detailed below.

major comments (3)
  1. §3, central framing claim: The paper states that 'physically interpretable thermal patterns—unlike arbitrary pixel noise—exploit domain-specific feature representations and transfer more effectively across architectures.' However, the paper's own ablation (Fig. 6a, §4.5) shows the airflow prior loss L_air has negligible effect on ASR (47.9% full vs. 48.0% no-air, a 0.1-point difference at n=416). The paper acknowledges this and reframes L_air as 'cost-free physical plausibility,' but the central framing in §3 and the contributions list still present airflow structure as the key innovation. This mismatch between framing and evidence is load-bearing because the paper's novelty claim rests on airflow structure being the differentiator. The authors should either provide evidence that airflow structure (not just the confidence loss and low-dimensional parameterization) drives transferability,
  2. §4.1, Baselines: The paper explicitly excludes unstructured digital UAPs ('We deliberately restrict the comparison to IR-specific physical attacks'), claiming the loss-component ablation addresses whether perturbation structure matters. However, the loss-component ablation does not isolate this question. Per Eq. (5) and Appendix A.1, even with w_air=0, the perturbation is δ = clip(ε·tanh(a·P + r·R)⊙G, −ε, ε), where P (the airflow prior) and G (the spatial gate derived from P) remain structurally embedded in the generator. The 'no-air' ablation removes only the correlation loss, not the architectural prior. To test whether airflow structure vs. generic low-dimensional perturbation at the same ε budget drives the results, a comparison against an unstructured pixel-space UAP (or a generator without the P-anchored architecture) optimized with the same L_conf, same ε=100, same 800 steps, and
  3. §3.3 vs. Appendix A.6 and Table D.4: The main text states η=0.055 and loss weights α=8, β=2, while Appendix A.6 and Table D.4 state η=0.095 and w_conf=8, w_air=1. These inconsistencies affect reproducibility and should be reconciled. Given that the ablations in §4.5 are sensitive to these values, it is important to clarify which configuration produced the reported results.
minor comments (6)
  1. §2.1: Reference [16] (arXiv:2604.03117, April 2026) describes 'universal adversarial patches for infrared vision-language models,' which substantially overlaps with the paper's claim to be 'the first adversarial attack for IR remote-sensing VLMs.' The paper mentions this work only in passing. The authors should clarify precisely what is novel relative to [16]—e.g., digital vs. physical patch, airflow prior vs. learned patch, input-agnostic vs. input-specific.
  2. Table 3: The captioning results show very small and non-monotonic differences across methods. The paper acknowledges that ROUGE-L understates degradation, but the table as presented makes it difficult to assess whether AirflowAttack is actually the strongest captioning attack. Consider adding a semantic metric or reporting the LLM-as-Judge results (Appendix C) in the main table.
  3. Table 4, Object F1 row: AirflowAttack does not consistently outperform the physical baselines on object recognition (e.g., 28.60 on Qwen2.5-VL vs. 28.12 for Thermal Drift). The paper is commendably honest about this, but the abstract's claim of cutting 'scene-classification accuracy by up to 38.2% relative' could be misread as broader degradation. Consider qualifying the abstract to specify scene classification rather than general VLM performance.
  4. Fig. 1 caption: The learning rate is listed as 0.095 in the figure but 0.055 in §3.3. This should be corrected to match the actual value used.
  5. Appendix D.4: The paper uses an unpaired two-proportion test for paired data and notes this is 'conservative relative to an exact paired (McNemar) test.' This is a reasonable choice, but the paper should briefly state the direction of conservatism (i.e., that it inflates p-values, making significant results more credible, not less).
  6. §4.5, Fig. 6a: The 'fixed-prior' and 'no-conf' configurations are mentioned but their exact definitions (which loss weights are set to zero) are only specified in Appendix A.6. A brief inline definition would improve readability of the main-text ablation discussion.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for a careful and constructive review. The referee raises three major points: (1) a mismatch between the central framing claim—that airflow structure drives transferability—and the ablation evidence showing negligible ASR impact from the airflow prior loss; (2) the absence of an unstructured pixel-space UAP baseline to isolate whether airflow structure versus generic low-dimensional perturbation drives results; and (3) hyperparameter inconsistencies between the main text and appendix. We agree with all three points and will revise accordingly. Specifically, we will (a) reframe the paper's contributions to accurately reflect that the confidence loss and low-dimensional parameterization are the primary drivers of attack efficacy, with the airflow prior providing physical plausibility at no measurable ASR cost; (b) add an unstructured pixel-space UAP baseline and a P-anchored-architecture-ablated generator comparison under identical optimization settings; and (c) reconcile the hyperparameter discrepancies. We believe these revisions substantively strengthen the paper.

read point-by-point responses

  1. Referee: §3, central framing claim: The paper states that 'physically interpretable thermal patterns—unlike arbitrary pixel noise—exploit domain-specific feature representations and transfer more effectively across architectures.' However, the paper's own ablation (Fig. 6a, §4.5) shows the airflow prior loss L_air has negligible effect on ASR (47.9% full vs. 48.0% no-air, a 0.1-point difference at n=416). The paper acknowledges this and reframes L_air as 'cost-free physical plausibility,' but the central framing in §3 and the contributions list still present airflow structure as the key innovation. This mismatch between framing and evidence is load-bearing because the paper's novelty claim rests on airflow structure being the differentiator. The authors should either provide evidence that airflow structure (not just the confidence loss and low-dimensional parameterization) drives transferability,

    Authors: The referee is correct. The current framing in §3 and the contributions list overstates the role of airflow structure as the driver of transferability, and this is not supported by our own ablation evidence. We will revise the manuscript to address this mismatch in three concrete ways. First, we will rewrite the key-insight sentence in §3 to accurately characterize the mechanism: the confidence loss and low-dimensional generator parameterization are the primary drivers of attack efficacy and transferability, while the airflow prior provides physical plausibility (correlation 0.844→0.893) at no measurable ASR cost. Second, we will revise the contributions list to present the airflow prior as a design choice that enhances physical interpretability rather than as the central novelty driving transferability. Third, we will add a sentence in §4.5 explicitly acknowledging the framing-evidence tension and the revision. We note that the paper does already state in §4.5 that 'L_conf is the primary driver of attack efficacy, while L_air governs physical plausibility' and in the Conclusion that 'attack strength is primarily driven by the confidence loss, whereas the airflow prior improves physical plausibility with negligible ASR cost'—but the referee is right that these caveats do not propagate to §3 and the contributions list, which is where readers form their initial impression. We will fix this. We also note that the IR-cue confabulation finding (models interpreting the perturbation as genuine thermal evidence) does provide some evidence that the airflow structure has domain-specific semantic effects distinct from generic noise, but this is a downstream VLM behavior finding, not evidence that airflow structure drives CLIP transferability. We will be careful not to conflate the revision: yes

  2. Referee: §4.1, Baselines: The paper explicitly excludes unstructured digital UAPs ('We deliberately restrict the comparison to IR-specific physical attacks'), claiming the loss-component ablation addresses whether perturbation structure matters. However, the loss-component ablation does not isolate this question. Per Eq. (5) and Appendix A.1, even with w_air=0, the perturbation is δ = clip(ε·tanh(a·P + r·R)⊙G, −ε, ε), where P (the airflow prior) and G (the spatial gate derived from P) remain structurally embedded in the generator. The 'no-air' ablation removes only the correlation loss, not the architectural prior. To test whether airflow structure vs. generic low-dimensional perturbation at the same ε budget drives the results, a comparison against an unstructured pixel-space UAP (or a generator without the P-anchored architecture) optimized with the same L_conf, same ε=100, same 800 steps,

    Authors: The referee is absolutely correct. Our 'no-air' ablation removes only the L_air correlation loss but retains the airflow prior P and the P-derived spatial gate G in the generator architecture (Eq. 5), so it does not isolate whether the P-anchored structure versus a generic low-dimensional perturbation drives the results. The referee's analysis of the generator parameterization is accurate. We will add two new baseline comparisons under identical optimization settings (L_conf, ε=100, 800 steps, same surrogate): (1) an unstructured pixel-space UAP optimized directly in pixel space with the same confidence loss and L∞ budget, and (2) a generator variant without the P-anchored architecture—i.e., a low-dimensional latent decoded through the same transposed-convolution pipeline but without the airflow prior P or the P-derived gate G. These comparisons will directly test whether the airflow-anchored architecture provides benefits beyond generic low-dimensional optimization at the same budget. We will report these results in a revised §4.1 and §4.5. If the unstructured UAP matches or exceeds AirflowAttack's ASR, we will state plainly that the airflow architecture's value lies in physical plausibility rather than attack efficacy. If the P-anchored generator outperforms the unstructured variant, that would constitute the evidence the referee rightly asks for. Either outcome will strengthen the paper. We acknowledge that this is a genuine gap in the current manuscript and that our claim that the loss-component ablation 'addresses whether perturbation structure matters' is incorrect for the reasons the referee identifies. revision: yes

  3. Referee: §3.3 vs. Appendix A.6 and Table D.4: The main text states η=0.055 and loss weights α=8, β=2, while Appendix A.6 and Table D.4 state η=0.095 and w_conf=8, w_air=1. These inconsistencies affect reproducibility and should be reconciled. Given that the ablations in §4.5 are sensitive to these values, it is important to clarify which configuration produced the reported results.

    Authors: The referee is correct, and we apologize for these inconsistencies. The values in Table D.4 and Appendix A.6 (η=0.095, w_conf=8, w_air=1) are the ones that produced all reported results. The main text values (η=0.055, α=8, β=2) reflect an earlier configuration that was not fully reconciled when the paper was assembled. Specifically: (1) The learning rate η=0.095 with 30-step warmup and cosine decay (as stated in Algorithm A.1 and Table D.4) is the correct value used in all experiments. The value η=0.055 in §3.3 is incorrect. (2) The loss weights are w_conf=8 and w_air=1 (as in Table D.4 and Appendix A.6), not α=8, β=2 as stated in §3.3. The β=2 value is wrong; the airflow prior weight is 1.0. (3) The hyperparameter sensitivity sweep in §4.5 ('ASR is stable in the 47.5–48.5% range for η∈[0.04,0.07], optimal at η=0.055') was conducted around the wrong reference value and will be re-run around η=0.095. We will correct all instances in the main text to match Table D.4 and Appendix A.6, re-run the hyperparameter sensitivity ablation around the correct η, and update the reported sensitivity range accordingly. If any ASR values change as a result of using the correct hyperparameters in the sensitivity sweep, we will update those figures. We note that the main ASR results in Table 1 and all VLM results were produced with the correct configuration (η=0.095, w_conf=8, w_air=1), so those numbers are unaffected. revision: yes

Circularity Check

0 steps flagged

No significant circularity: the attack is optimized on a surrogate and evaluated on held-out targets; the airflow prior is fixed and its negligible contribution is openly reported

full rationale

The paper's central ASR claim is not circular. The perturbation is optimized on one surrogate (OpenAI-CLIP-B32) using a confidence loss targeting the surrogate's own clean top-1 prediction, then evaluated on five held-out CLIP backbones and six VLMs without target-model access. The airflow prior P is precomputed and fixed throughout optimization (Appendix A.2: 'precomputed once... fixed throughout optimization'), not fitted to target outputs. The confidence loss (Eq. 1 / Appendix A.5) targets the surrogate's clean top-1 class, not ground-truth labels or target-model outputs, so ASR measures genuine prediction flips on held-out models. The ablation in Sec. 4.5 transparently shows L_air has negligible effect on ASR (47.9% with vs. 48.0% without), and the paper explicitly reframes the airflow prior as 'cost-free physical plausibility' rather than an attack-strength driver. While the reader correctly notes that the 'no-air' ablation does not fully isolate whether airflow structure vs. low-dimensional parameterization drives transferability (since the generator architecture still uses P and G even with w_air=0), this is a concern about experimental design completeness, not circularity. No step in the derivation chain reduces to its inputs by construction. There are no self-citations forming a load-bearing chain, no fitted parameter renamed as prediction, and no definition that presupposes its conclusion. The paper is self-contained against external benchmarks (five CLIP backbones, six VLMs, four IR-specific baselines).

Axiom & Free-Parameter Ledger

11 free parameters · 4 axioms · 2 invented entities

The ledger captures the 325 trainable parameters (z, ρ) plus the fixed prior P and gate G, along with hyperparameters selected via ablation. The airflow prior P is the key invented entity; its physical plausibility is asserted via correlation with synthetic templates, not validated against real turbulence. The domain assumption that IR models share thermal representations is supported empirically by transfer rates but not independently proven.

free parameters (11)
  • z (residual latent) = 32×32 matrix, optimized
    The low-dimensional residual grid that controls coarse airflow adjustments. Optimized during attack generation. 1024 values.
  • ρ (amplitude logit) = scalar, optimized
    Controls the global amplitude a = 0.85 + 0.30·sigmoid(ρ). Optimized during attack generation. 1 value.
  • ε (L∞ budget) = 100/255
    Perturbation magnitude constraint. Set by the authors as the reference configuration.
  • r (residual scale) = 0.60
    Ratio of perturbation energy through the residual pathway vs. the prior. Determined through ablation.
  • α / w_conf = 8.0
    Weight of the confidence loss. Determined through ablation.
  • β / w_air = 1.0 (main text says 2)
    Weight of the airflow prior loss. Determined through ablation. Discrepancy between main text (β=2) and appendix (w_air=1).
  • η (learning rate) = 0.055 (main text) / 0.095 (appendix)
    AdamW learning rate. Discrepancy between main text and appendix.
  • T (optimization steps) = 800
    Number of PGD steps. Selected based on convergence ablation.
  • d (latent dimension) = 32
    Dimension of the residual latent grid. Selected via hyperparameter sweep.
  • γ (gate threshold) = 0.01
    Soft-threshold parameter for the spatial gate.
  • P (airflow prior field) = precomputed, fixed
    A single fixed thermal-airflow field generated via randomized heat kernel convolution. Precomputed once and held fixed during optimization.
axioms (4)
  • domain assumption IR-trained models converge to similar representations of thermal patterns, enabling cross-model transfer of physically structured perturbations.
    Invoked in Sec. 3.4 and Appendix B to explain why the perturbation transfers. The paper provides empirical evidence (transfer rates) but no independent proof of this representational convergence.
  • domain assumption The airflow prior, generated via randomized heat kernel convolution, represents physically plausible thermal airflow turbulence.
    Invoked in Sec. 3.2 and Appendix A.2. The prior is a synthetic field; its physical plausibility is asserted, not independently validated against real atmospheric turbulence measurements.
  • ad hoc to paper The L∞ budget of ε=100/255 is a realistic perturbation magnitude for IR remote-sensing scenarios.
    Set in Sec. 3.1. The paper acknowledges the attack is digital-only and physical realizability remains undemonstrated (Appendix B).
  • ad hoc to paper The unpaired two-proportion test is a conservative substitute for the exact paired (McNemar) test.
    Invoked in Sec. 4.1. The authors state this is conservative, but using an unpaired test on paired data is a methodological error that could misstate significance.
invented entities (2)
  • Airflow prior field P no independent evidence
    purpose: A fixed single-channel thermal-airflow pattern used to anchor the perturbation toward physically plausible turbulence.
    Generated synthetically via randomized heat kernel convolution. No comparison to measured atmospheric turbulence data is provided. The ablation shows it does not measurably affect ASR, only physical plausibility correlation (0.844→0.893).
  • Spatial gate G no independent evidence
    purpose: A soft mask derived from the prior that concentrates perturbation energy on structured regions.
    An architectural component of the generator. Its effectiveness is tested via spatial-position ablation (Fig. 6b) but not independently validated as corresponding to any physical phenomenon.

pith-pipeline@v1.1.0-glm · 30989 in / 3560 out tokens · 616788 ms · 2026-07-08T04:11:23.720632+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

52 extracted references · 52 canonical work pages · 9 internal anchors

  1. [1]

    In: International confer- ence on machine learning

    Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: International confer- ence on machine learning. pp. 274–283. PMLR (2018)

    work page 2018

  2. [2]

    Bai, S., Chen, K., Liu, X., Wang, J., Ge, W., Song, S., Dang, K., Wang, P., Wang, S., Tang, J., Zhong, H., Zhu, Y., Yang, M., Wan, J., Ding, W., Fu, Z., Xu, Y., Ye, J., Zhang, X., Xie, T., Cheng, Z., Zhang, H., Yang, Z., Xu, H., Lin, J.: Qwen2.5-vl technical report (2025)

    work page 2025

  3. [3]

    IEEE Transactions on Geoscience and Remote Sensing 49, 2924–2935 (2011)

    Bouali, M., Ladjal, S.: Toward optimal destriping of modis data using a unidirec- tional variational model. IEEE Transactions on Geoscience and Remote Sensing 49, 2924–2935 (2011)

    work page 2011

  4. [4]

    Sensors16, 1890 (2016)

    Boutemedjet,A.,Deng,C.,Zhao,B.:Robustapproachfornonuniformitycorrection in infrared focal plane array. Sensors16, 1890 (2016)

    work page 2016

  5. [5]

    Adversarial Patch

    Brown, T.B., Mané, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial patch. arXiv preprint arXiv:1712.09665 (2017)

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  6. [6]

    IEEE Transactions on Information Forensics and Security (2026)

    Cao, Y., Li, Y., Liang, K., Xiao, B.: Enhancing targeted adversarial attacks on large vision-language models via intermediate projector. IEEE Transactions on Information Forensics and Security (2026)

    work page 2026

  7. [7]

    In: 2017 IEEE Symposium on Security and Privacy (SP)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 39–57. IEEE (2017)

    work page 2017

  8. [8]

    IEEE Transactions on Geo- science and Remote Sensing60, 1–19 (2022)

    Cheng, Q., Huang, H., Xu, Y., Zhou, Y., Li, H., Wang, Z.: Nwpu-captions dataset and mlca-net for remote sensing image captioning. IEEE Transactions on Geo- science and Remote Sensing60, 1–19 (2022)

    work page 2022

  9. [9]

    In: Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition

    Cherti, M., Beaumont, R., Wightman, R., Wortsman, M., Ilharco, G., Gordon, C., Schuhmann, C., Schmidt, L., Jitsev, J.: Reproducible scaling laws for contrastive language-image learning. In: Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition. pp. 2818–2829 (2023)

    work page 2023

  10. [10]

    In: International conference on machine learning

    Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International conference on machine learning. pp. 2206–2216. PMLR (2020)

    work page 2020

  11. [11]

    In: 2025 7th International Conference on Software Engi- neering and Computer Science (CSECS)

    Dai, Q., Yang, X., Gao, H., Mu, H.: A survey of physical adversarial attacks against infrared target detection. In: 2025 7th International Conference on Software Engi- neering and Computer Science (CSECS). pp. 1–5. IEEE (2025)

    work page 2025

  12. [12]

    Advances in neural information processing systems36, 49250–49267 (2023)

    Dai, W., Li, J., Li, D., Tiong, A., Zhao, J., Wang, W., Li, B., Fung, P.N., Hoi, S.: Instructblip: Towards general-purpose vision-language models with instruction tuning. Advances in neural information processing systems36, 49250–49267 (2023)

    work page 2023

  13. [13]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 9185–9193 (2018)

    work page 2018

  14. [14]

    AdvHaze: Adversarial Haze Attack

    Gao, R., Guo, Q., Juefei-Xu, F., Yu, H., Feng, W.: Advhaze: Adversarial haze attack. arXiv preprint arXiv:2104.13673 (2021) 16 C. Su et al

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  15. [15]

    Explaining and Harnessing Adversarial Examples

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  16. [16]

    Revealing Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

    Hu, C., Dong, Y., Guo, Y., Chen, X., Wu, J., Long, J., Wei, Y., Jiang, T., Yao, W.: Revealing physical-world semantic vulnerabilities: Universal adversarial patches for infrared vision-language models. arXiv preprint arXiv:2604.03117 (2026)

    work page internal anchor Pith review Pith/arXiv arXiv 2026

  17. [17]

    Neural networks178, 106459 (2024)

    Hu, C., Shi, W., Yao, W., Jiang, T., Tian, L., Chen, X., Li, W.: Adversarial infrared curves: An attack on infrared pedestrian detectors in the physical world. Neural networks178, 106459 (2024)

    work page 2024

  18. [18]

    Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., Madry, A.: Adversarial examplesarenotbugs,theyarefeatures.Advancesinneuralinformationprocessing systems32(2019)

    work page 2019

  19. [19]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Kuckreja, K., Danish, M.S., Naseer, M., Das, A., Khan, S., Khan, F.S.: Geochat: Grounded large vision-language model for remote sensing. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 27831– 27840 (2024)

    work page 2024

  20. [20]

    Generating Transferrable Adversarial Examples via Local Mixing and Logits Optimization for Remote Sensing Object Recognition

    Liu, C., Wang, H., Zhu, B., Ding, P., Zheng, Z., Xu, T., Han, Z., Wang, J.: Gen- erating transferrable adversarial examples via local mixing and logits optimization for remote sensing object recognition. arXiv preprint arXiv:2509.07495 (2025)

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  21. [21]

    IEEE Transactions on Geoscience and Remote Sensing62, 1–16 (2024)

    Liu, F., Chen, D., Guan, Z., Zhou, X., Zhu, J., Ye, Q., Fu, L., Zhou, J.: Remoteclip: A vision language foundation model for remote sensing. IEEE Transactions on Geoscience and Remote Sensing62, 1–16 (2024)

    work page 2024

  22. [22]

    Liu, H., Li, C., Li, Y., Li, B., Zhang, Y., Shen, S., Lee, Y.J.: Llavanext: Improved reasoning, ocr, and world knowledge (2024)

    work page 2024

  23. [23]

    Advances in neural information processing systems36, 34892–34916 (2023)

    Liu, H., Li, C., Wu, Q., Lee, Y.J.: Visual instruction tuning. Advances in neural information processing systems36, 34892–34916 (2023)

    work page 2023

  24. [24]

    IEEE Transactions on Geoscience and Remote Sensing 56(4), 2183–2195 (2017)

    Lu, X., Wang, B., Zheng, X., Li, X.: Exploring models and data for remote sensing image caption generation. IEEE Transactions on Geoscience and Remote Sensing 56(4), 2183–2195 (2017)

    work page 2017

  25. [25]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  26. [26]

    In: Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision

    Mao, Z., Chimitt, N., Chan, S.H.: Accelerating atmospheric turbulence simulation via learned phase-to-space transform. In: Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision. pp. 14759–14768 (2021)

    work page 2021

  27. [27]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1765–1773 (2017)

    work page 2017

  28. [28]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Pang, C., Weng, X., Wu, J., Li, J., Liu, Y., Sun, J., Li, W., Wang, S., Feng, L., Xia, G.S., et al.: Vhm: Versatile and honest vision language model for remote sensing image analysis. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, pp. 6381–6388 (2025)

    work page 2025

  29. [29]

    In: Proceedings of the 2017 ACM on Asia conference on computer and communications security

    Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., Swami, A.: Prac- tical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security. pp. 506–519 (2017)

    work page 2017

  30. [30]

    In: International conference on machine learning

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: International conference on machine learning. pp. 8748–8763. PmLR (2021)

    work page 2021

  31. [31]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Schlarmann, C.,Hein, M.:On theadversarialrobustness ofmulti-modal foundation models. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 3677–3685 (2023) Thermal-Airflow Attack against IR Remote Sensing VLMs 17

    work page 2023

  32. [32]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Schmalfuss, J., Mehl, L., Bruhn, A.: Distracting downpour: Adversarial weather attacks for motion estimation. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 10106–10116 (2023)

    work page 2023

  33. [33]

    Intriguing properties of neural networks

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

    work page internal anchor Pith review Pith/arXiv arXiv 2013

  34. [34]

    Applied Soft Computing174, 112981 (2025)

    Tiliwalidi, K., Hu, C., Lu, G., Jia, M., Shi, W.: Advgrid: a multi-view black- box attack on infrared pedestrian detectors in the physical world. Applied Soft Computing174, 112981 (2025)

    work page 2025

  35. [35]

    In: Proceedings of the AAAI Conference on Artificial Intelligence

    Wang, Z., Prabha, R., Huang, T., Wu, J., Rajagopal, R.: Skyscript: A large and semantically diverse vision-language dataset for remote sensing. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 38, pp. 5805–5813 (2024)

    work page 2024

  36. [36]

    In: Proceedings of the AAAI conference on artificial intelligence

    Wei, H., Wang, Z., Jia, X., Zheng, Y., Tang, H., Satoh, S., Wang, Z.: Hotcold block: Fooling thermal infrared detectors with a novel wearable design. In: Proceedings of the AAAI conference on artificial intelligence. vol. 37, pp. 15233–15241 (2023)

    work page 2023

  37. [37]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Wei, X., Yu, J., Huang, Y.: Physically adversarial infrared patches with learnable shapes and locations. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 12334–12342 (2023)

    work page 2023

  38. [38]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Xie, C., Zhang, Z., Zhou, Y., Bai, S., Wang, J., Ren, Z., Yuille, A.L.: Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 2730–2739 (2019)

    work page 2019

  39. [39]

    Xie, P., Bie, Y., Mao, J., Song, Y., Wang, Y., Chen, H., Chen, K.: Chain of attack: On the robustness of vision-language models against transfer-based adversarial at- tacks.In:ProceedingsoftheComputerVisionandPatternRecognitionConference. pp. 14679–14689 (2025)

    work page 2025

  40. [40]

    IEEE Geoscience and Remote Sensing Magazine11(2), 60–85 (2023)

    Xu, Y., Bai, T., Yu, W., Chang, S., Atkinson, P.M., Ghamisi, P.: Ai security for geoscience and remote sensing: Challenges and future trends. IEEE Geoscience and Remote Sensing Magazine11(2), 60–85 (2023)

    work page 2023

  41. [41]

    IEEE Transactions on Geoscience and Remote Sensing60, 1–15 (2022)

    Xu, Y., Ghamisi, P.: Universal adversarial examples in remote sensing: Method- ology and benchmark. IEEE Transactions on Geoscience and Remote Sensing60, 1–15 (2022)

    work page 2022

  42. [42]

    Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V

    Yang, J., Zhang, H., Li, F., Zou, X., Li, C., Gao, J.: Set-of-mark prompting un- leashes extraordinary visual grounding in gpt-4v. arXiv preprint arXiv:2310.11441 (2023)

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  43. [43]

    IEEE Transactions on Geoscience and Remote Sensing60, 1–19 (2021)

    Yuan, Z., Zhang, W., Fu, K., Li, X., Deng, C., Wang, H., Sun, X.: Exploring a fine- grained multiscale method for cross-modal remote sensing image retrieval. IEEE Transactions on Geoscience and Remote Sensing60, 1–19 (2021)

    work page 2021

  44. [44]

    In: Proceedings of the Computer Vision and Pattern Recognition Confer- ence

    Zhang, J., Ye, J., Ma, X., Li, Y., Yang, Y., Chen, Y., Sang, J., Yeung, D.Y.: Any- attack: Towards large-scale self-supervised adversarial attacks on vision-language models. In: Proceedings of the Computer Vision and Pattern Recognition Confer- ence. pp. 19900–19909 (2025)

    work page 2025

  45. [45]

    In: Proceedings of the 30th ACM International Conference on Multimedia

    Zhang, J., Yi, Q., Sang, J.: Towards adversarial attack on vision-language pre- training models. In: Proceedings of the 30th ACM International Conference on Multimedia. pp. 5005–5013 (2022)

    work page 2022

  46. [46]

    IEEE Transactions on Geoscience and Remote Sensing62, 1–23 (2024)

    Zhang, Z., Zhao, T., Guo, Y., Yin, J.: Rs5m and georsclip: A large-scale vision- language dataset and a large vision-language model for remote sensing. IEEE Transactions on Geoscience and Remote Sensing62, 1–23 (2024)

    work page 2024

  47. [47]

    IEEE Transactions on Geoscience and Remote Sensing62, 1–23 (2024) 18 C

    Zhang, Z., Zhao, T., Guo, Y., Yin, J.: Rs5m and georsclip: A large-scale vision- language dataset and a large vision-language model for remote sensing. IEEE Transactions on Geoscience and Remote Sensing62, 1–23 (2024) 18 C. Su et al

    work page 2024

  48. [48]

    Advances in Neural Information Processing Systems36, 54111–54138 (2023)

    Zhao, Y., Pang, T., Du, C., Yang, X., Li, C., Cheung, N.M.M., Lin, M.: On eval- uating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems36, 54111–54138 (2023)

    work page 2023

  49. [49]

    In: Proceedings of the 31st ACM International Conference on Multimedia

    Zhou, Z., Hu, S., Li, M., Zhang, H., Zhang, Y., Jin, H.: Advclip: Downstream- agnostic adversarial examples in multimodal contrastive learning. In: Proceedings of the 31st ACM International Conference on Multimedia. pp. 6311–6320 (2023)

    work page 2023

  50. [50]

    IEEE Transactions on Pattern Analysis and Machine Intelligence35(1), 157–170 (2013)

    Zhu, X., Milanfar, P.: Removing atmospheric turbulence via space-invariant decon- volution. IEEE Transactions on Pattern Analysis and Machine Intelligence35(1), 157–170 (2013)

    work page 2013

  51. [51]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Zhu,X.,Hu,Z.,Huang,S.,Li,J.,Hu,X.:Infraredinvisibleclothing:Hidingfromin- frared detectors at multiple angles in real world. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 13317–13326 (2022)

    work page 2022

  52. [52]

    Zhuang, W., Xie, W., Zhang, Q., Du, X., Lin, Z., Lin, Z., Cai, H., Zhou, J., Fang, Z., Pun, C.m., et al.: Physically-induced atmospheric adversarial perturbations: Enhancing transferability and robustness in remote sensing image classification. arXiv preprint arXiv:2604.14643 (2026) Thermal-Airflow Attack against IR Remote Sensing VLMs 19 A Detailed Metho...

    work page internal anchor Pith review Pith/arXiv arXiv 2026