Pith. sign in

REVIEW 3 major objections 5 minor 35 references

MEC-Patch: Visible-Infrared Cross-Modal Adversarial Attack Driven by Intrinsic Material Emissivity Laws

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that MEC-Patch converts the Stefan-Boltzmann law into a physical patch that fools RGB and infrared detectors across temperature changes.

desk verdict The material-emissivity patch is a genuine new combination, but the temperature-robustness claim is only validated by the same equation it is derived from. read the letter →

arxiv 2608.05634 v1 pith:P3COLSG6 submitted 2026-08-06 cs.MM

Zhixiang Huang , Xinbo Nie , Wenxuan Wang , Lu Yang , Xin Li , Xuelin Qian , Peng Wang This is my paper · ORCID
classification cs.MM
keywords adversarialattackvisible-infraredcross-modalmaterialemissivitymultimodalperceptionStefan-Boltzmannlawevolutionaryoptimizationthermalimagingobjectdetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MEC-Patch aims to show that a physical, passive adversarial patch can fool visible-infrared (RGB plus long-wave infrared) object detectors even when the ambient temperature changes. The paper's core insight is that the infrared radiance of a patch cell is emissivity times a common temperature factor; when the temperature changes, all cells scale together, so the relative contrast between high- and low-emissivity materials is preserved. The authors build the patch as a 'dartboard' of industrial material cells and optimize the discrete arrangement with NSGA-II, using attack success, stealth, and area as objectives. If the claim holds, an attacker needs no heater or cooler, only a fixed arrangement of materials, and the same patch keeps working across seasons and climates.

What carries the argument

The load-bearing identity is the Stefan-Boltzmann law written as a cross-spectral mapping, $I = \mathcal{M}(\epsilon_i \sigma T^4)$, where $\epsilon_i$ is the cell's emissivity, $\sigma$ is the Stefan-Boltzmann constant, $T$ is the surface temperature, and $\mathcal{M}$ maps radiance to the sensor's grayscale. Because the patch is assumed to sit at one uniform temperature, a change in $T$ rescales all cells equally and the ratio of any two cell intensities, $\epsilon_i/\epsilon_j$, is invariant. The patch geometry is a modular 'dartboard' of angular sectors and radial rings whose cells hold discrete material IDs, searched by NSGA-II over attack success, stealth, and area objectives, with a Dynamic Adversarial Resampling (DAR) wrapper that reweights scenes by attack difficulty.

What would settle it

Fabricate a MEC-Patch and record its long-wave infrared image in a controlled scene at two different temperatures, for example 20 °C and 50 °C, while also heating only one half of the patch so that the two halves differ by several degrees; if the measured intensity ratio between a high-emissivity cell and a low-emissivity cell shifts noticeably away from the fixed emissivity ratio, the claimed temperature invariance fails. A complementary field test is to place the patch on a vehicle outdoors on a cold morning and again in the afternoon and check whether the detector's confidence drop persists.

Watch

Extended reading notes

Core claim

The paper's central claim is that cross-modal adversarial robustness can be broken by anchoring the infrared signature to material emissivity rather than temperature. Writing the infrared pixel intensity as $I = \mathcal{M}(\epsilon_i \sigma T^4)$ under local thermal equilibrium, it observes that an ambient temperature change only rescales all cells by the same factor $T^4$, leaving the emissivity-contrast pattern unchanged. It then encodes the patch as a discrete polar 'dartboard' of material cells, each carrying an RGB reflectance and an emissivity value from a 26-material library, and evolves the arrangement with physics-constrained NSGA-II plus a Dynamic Adversarial Resampling strategy. The reported experiments show attack success rates up to 86.1% against YOLO-family and Faster R-CNN detectors on DroneVehicle, LLVIP, and VisDrone, and the ablation study attributes the bulk of the infrared success to the material gene: removing it collapses infrared ASR below 18%.

Load-bearing premise

The temperature-robustness claim rests on the assumption that the entire patch sits at one even temperature and that the infrared signal is dominated by the patch's own heat radiation rather than reflections of the environment, so the infrared image is simply emissivity times a common temperature factor; if the patch heats unevenly or reflections matter, the contrast pattern can change with the environment.

Editorial extensions

If this is right

  • A single passive patch with no heating element can reportedly reduce detector confidence on three RGB-IR datasets by large margins, with attack success rates between 64.1% and 86.1% depending on detector and dataset.
  • The same patch is claimed to transfer across detector architectures, e.g., 59.9% ASR when optimized on YOLOv11 and tested on Faster R-CNN, because the optimization follows physical laws rather than network-specific gradients.
  • Multi-scenario tests at sunny, snowy, and night scenes keep average attack success around 56.5%, which the paper attributes to the temperature-invariance of emissivity contrast plus the DAR resampling.
  • Ablations indicate that the material gene is the essential component: removing it drops the infrared attack success rate below 18%, while position and shape provide additional but smaller gains.
  • Because the patch is made of discrete material cells with straight cuts and arcs, the design is fabricated with ordinary industrial materials, lowering the practical barrier to physical deployment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Since the same scale-invariance argument applies to any camera whose response is proportional to Planck's law radiance, the approach plausibly extends to mid-wave and short-wave infrared sensors, though the paper only tests long-wave infrared.
  • A defensive countermeasure suggested by the argument is to estimate an emissivity map of the scene and normalize the infrared image by it, or to enforce spatial smoothness in thermal images, which would erode the local contrast pattern the attack needs; the paper does not evaluate such defenses.
  • The uniform-temperature assumption is fragile in the physical world: sunlight, wind, and engine heat will create temperature differences between material cells, so a direct outdoor test of the same patch at two different times of day would be a more demanding validation than the simulations reported.
  • If the material library is expanded to engineered coatings and printable metamaterials with arbitrary emissivity, the attack could become cheaper and visually stealthier, a direction the authors mention only as future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes MEC-Patch, a visible-infrared cross-modal adversarial attack framework that designs physical patches as a discrete arrangement of industrial materials with specified RGB reflectance and thermal emissivity. The infrared appearance is rendered via the Stefan-Boltzmann relation I = M(epsilon * sigma * T^4), and the central claim is that because ambient temperature T acts only as a global scale factor, the relative emissivity-induced contrast, and hence the adversarial pattern, remains robust across temperature variations. The patch parameters (position, elliptical shape, dartboard material layout) are optimized with a physics-constrained NSGA-II algorithm, augmented by a Dynamic Adversarial Resampling (DAR) strategy for multi-scene generalization. Experiments on DroneVehicle, LLVIP, and VisDrone report higher ASR than random patches, TOUAP, UNIAP, and CDU-Patch across YOLOv3/v5/v8/v11 and Faster R-CNN, with additional transferability and multi-scenario evaluations.

Significance. If the physical claims were supported, the paper would offer a principled, passive alternative to active temperature-control attacks against RGB-IR detectors, with a novel discrete-material optimization framework and a useful material library. The optimization pipeline and the use of emissivity as a design variable are interesting and could be a solid systems contribution. However, the paper's headline property of temperature-robustness is not independently validated: the simulator uses the same equation from which the property is derived, so the experiments cannot falsify the physical assumption. The real-world applicability therefore remains unsubstantiated, and the significance of the contribution depends on whether the authors can provide evidence from a more faithful physical model or actual IR measurements.

major comments (3)
  1. [Sec. 3.1, Sec. 3.3, Eq. (4)] The central temperature-robustness claim is derived from the rendering equation I = M(epsilon_i * sigma * T^4) and then evaluated in a simulator that uses exactly that equation (Algorithm 1, line 12; Sec. 3.3). This makes the multi-scenario results in Table 3 unable to falsify the physical assumption; they demonstrate self-consistency of the model, not physical-world robustness. The paper dismisses reflection and solar terms in Sec. 3.1 with the assertion that 'self-emission remains dominant,' but for the low-emissivity materials in Table 5 (aluminum foil epsilon = 0.04, polished brass epsilon = 0.06), the reflected term (1 - epsilon) times the environmental radiance is an order of magnitude larger than the emitted term for typical outdoor environments; the assertion needs a quantitative radiative-transfer analysis or real measurements to be load-bearing.
  2. [Sec. 3.1 and Sec. 3.3, Eq. (4)] The assumption that all patch materials are at a single uniform temperature T, and that T is the ambient temperature, ignores surface energy balance. Different emissivity sectors also have different solar absorptance and will reach different equilibrium temperatures T_i, so the rendered signal is epsilon_i * sigma * T_i^4, and the relative contrast is not invariant to environment. The paper's appeal to 'local thermal equilibrium' (Sec. 3.3) does not resolve this, because equilibrium is radiative and convective, not a single T for all sectors. Without an energy-balance model or measurements, the claimed stability across sunny, snowy, and night scenes in Table 3 is not established.
  3. [Sec. 4.3, Table 3] The multi-scenario experiments are generated with the same simplified rendering pipeline (Eq. 4), so they do not test the effects that the paper itself identifies as neglected in 'full radiative transfer' (Sec. 3.1): reflected environmental radiance, solar loading, and non-uniform material temperatures. Therefore the high ASR in Table 3 cannot be interpreted as evidence that the patch is robust to ambient temperature variations in the physical world. A test that could falsify the assumption would be a physics-based IR renderer that includes L = tau[epsilon L_bb(T_surf) + (1 - epsilon)L_env] + L_atm with per-material T_surf from an energy balance, or real LWIR measurements of the patch under different ambient conditions.
minor comments (5)
  1. [Sec. 2.2] There is a duplicated sentence: 'We therefore focus our comparisons on the most relevant and reproducible baselines under consistent physical constraints. Therefore, we focus our comparisons...' appears twice in the same paragraph.
  2. [Table 1] The table header uses 'ViSDrone' while the text consistently refers to 'VisDrone'; the capitalization should be made uniform.
  3. [Sec. 3.3 and Table 5] The text states that polished aluminum has epsilon approximately 0.15, but Table 5 lists aluminum foil at 0.04 and anodized aluminum at 0.25; the numerical values should be reconciled or the statement clarified.
  4. [Sec. 4.2 and 4.3] All reported results are single ASR values without confidence intervals or multiple seeds. Given the stochastic nature of NSGA-II and DAR, reporting variance or repeated runs would strengthen the comparisons.
  5. [Sec. 3.4, Eqs. (7) and (8)] The text references 'Eq. (8)' before the equation is displayed, and the numbering order of the scene-error and weight-update equations is confusing; consider reordering or clarifying the cross-reference.

Circularity Check

1 steps flagged · score 6.0 of 10

Temperature-robustness is an algebraic consequence of the paper's own rendering equation, and the multi-scene simulator uses that same equation; the physical claim is therefore not independently tested.

  1. self definitional [Section 3.1 and Section 3.3 (Eq. 4); Algorithm 1 line 12; Section 4.3 Table 3]
    "Under thermodynamic equilibrium, the infrared pixel intensity I is derived by: I=M(𝜖 𝑖·𝜎𝑇 4)(4) ... under a fixed emissivity distribution, ambient temperature variations induce consistent global scaling while preserving relative emissivity-induced contrast. ... Render(R vis,R ir) via RGB mapping and I=M(𝜖 𝑖𝜎𝑇 4);"

    Eq. (4) defines IR intensity as ε_iσT^4 with a single global T, so the relative intensity of any two patch cells is I_i/I_j = ε_i/ε_j, independent of T. The claimed temperature-robustness is precisely this ratio. The multi-scenario evaluation (Table 3) and the rendering loop (Algorithm 1) synthesize infrared images with exactly this operator, so the experiments instantiate the property rather than test it. Section 3.1 acknowledges 'full radiative transfer includes environmental and solar reflections' but dismisses these terms with the assertion that self-emission dominates; no quantitative comparison is given. The physical claim therefore reduces to the paper's own model choice.

full rationale

The paper's optimization framework (NSGA-II, DAR, dartboard encoding) and the reported ASR values against YOLO/Faster-RCNN detectors are not circular: those results depend on actual detector weights and are non-trivial. The circularity is confined to the advertised physics claim. The abstract and Section 1 'reveal' that fixed emissivity distributions preserve relative contrast under ambient temperature changes; this is a direct algebraic consequence of Eq. (4), and the experiments in Section 4.3 are rendered by the same Eq. (4) according to Algorithm 1. The paper's own Section 3.3 states 'Our formulation assumes local thermal equilibrium' and Section 3.1 states self-emission dominates over reflections, but these load-bearing assumptions are never validated against a full radiance model (e.g., L = τ[εL_bb(T_surf)+(1−ε)L_env]+L_atm with per-sector surface temperatures). For low-emissivity materials in the paper's own Table 5 (ε=0.04–0.25), reflected environmental radiance would dominate the emitted term, so the 'cold' signatures are not intrinsic. Because the simulator uses the simplified model, Table 3 cannot provide independent evidence for temperature robustness. There are no load-bearing self-citations; the only physics reference is a standard textbook. The limitations section (F) mentions fabrication tolerances and library size but does not list the reflection or non-uniform-temperature limitations, so the manuscript itself does not disclose this gap. Overall, the central physical claim is partially circular: it is forced by the chosen rendering equation, while the attack optimization itself retains independent content.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the Stefan-Boltzmann law (standard physics), several domain assumptions about thermal equilibrium and self-emission dominance, and an unspecified sensor mapping M(·). The material library and DAR hyperparameters are design choices that influence the reported success rates but are not derived. No new physical entities are introduced.

free parameters (4)
  • Sensor mapping M(·)
    The function mapping radiance to digital infrared intensity is never specified. Temperature-robustness requires M to preserve relative contrast under global scaling, but no evidence is given for this.
  • Patch area ratio = 30%
    Selected from a sensitivity scan (Figure 8) as the point where ASR exceeds 70%; the choice directly affects reported ASR.
  • Material library = 20-26 materials with tabulated ε and RGB values
    The set of materials and their emissivity/color values are curated from databases rather than derived; the attack depends on this selection.
  • DAR hyperparameters = α=0.9, K=5, N=3, population=60, generations=80
    Chosen without sensitivity analysis; they affect convergence and the reported cross-scene robustness.
assumptions (5)
  • standard math Stefan-Boltzmann law: j = ε σ T^4
    Used in Eq. (2) and (4) to model thermal radiation from material surfaces.
  • domain assumption Local thermal equilibrium and uniform surface temperature
    Section 3.3 states 'Our formulation assumes local thermal equilibrium' and claims stable contrast across −20 to 50 C.
  • domain assumption Self-emission dominates over reflected IR radiation when T_obj > T_env
    Section 3.1 asserts self-emission remains dominant under typical driving conditions.
  • domain assumption Emissivity is effectively constant over wavelength and temperature
    Materials are assigned single ε values; temperature dependence is dismissed as weak via Fresnel and Kirchhoff laws (Section 3.3).
  • domain assumption Sensor mapping M is contrast-preserving under global scaling
    The temperature robustness argument requires that a global multiplicative change in radiance leaves relative intensity differences intact in digital counts; the form of M is not validated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MEC-Patch: Visible-Infrared Cross-Modal Adversarial Attack Driven by Intrinsic Material Emissivity Laws." pith.science (2026). https://pith.science/paper/P3COLSG6

@misc{pith2026260805634,
  author       = {Pith},
  title        = {Pith review of: MEC-Patch: Visible-Infrared Cross-Modal Adversarial Attack Driven by Intrinsic Material Emissivity Laws},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P3COLSG6}},
  note         = {Machine review of arXiv:2608.05634}
}
read the original abstract

With the widespread deployment of visible-infrared multimodal perception systems in safety-critical domains such as autonomous driving, evaluating their cross-modal adversarial robustness has become increasingly vital. However, existing approaches exhibit significant limitations in approximating the intrinsic laws of imaging. Most studies either focus on a single modality, failing to bypass cross-modal verification, or simplify infrared modeling into heuristic pixel-intensity distributions, neglecting the impact of ambient temperature fluctuations on adversarial stability. To bridge this gap, this paper proposes MEC-Patch, a cross-modal adversarial attack framework driven by intrinsic physical laws. By leveraging the Stefan-Boltzmann Law, we establish a physics-grounded cross-spectral mapping that explicitly links material emissivity to thermal radiation. Building on this formulation, we reveal that, under a fixed emissivity distribution, ambient temperature variations induce consistent global scaling while preserving relative emissivity-induced contrast. We exploit this property to construct temperature-robust adversarial perturbations whose discriminative patterns remain stable in the infrared modality, thereby fundamentally mitigating environmental sensitivity. Furthermore, we employ the physics-constrained NSGA-II algorithm to synergistically optimize the material-distribution-based patch parameters effective across both modalities, while enhancing generalization through a Dynamic Adversarial Resampling (DAR) strategy. Experimental results demonstrate that MEC-Patch effectively deceives state-of-the-art multimodal detectors and exhibits high robustness within high-fidelity, physically-consistent, and multi-scene simulation environments. This research provides a physical-law-driven perspective for the security assessment of multimodal perception systems.

Figures

Figures reproduced from arXiv: 2608.05634 by the authors.

Figure 1
Figure 1. Comparison of cross-scene attack robustness. Tem [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the MEC-Patch framework. The system consists of three synergetic modules: (1) Unified Genotype [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Qualitative visualization of detection results on clean images with adversarial patches. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Qualitative visualization of detection results across [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Parameterized shape space. Varying semi-axis pa [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 7
Figure 7. Figure 7: Convergence curves comparing the DAR strat [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 8
Figure 8. Figure 8: ASR under different patch area ratios [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: ASR across different confidence thresholds. [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: Material-level cross-modal response. Visible ap [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Extended attack visualizations of MEC-Patch across diverse scenes. [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 27 canonical work pages

  1. [1]

    Mazen Abdelfattah, Kaiwen Yuan, Z Jane Wang, and Rabab Ward. [n. d.]. Adver- sarial attacks on camera-lidar models for 3d car detection. In 2021 IEEE. InRSJ International Conference on Intelligent Robots and Systems (IROS). 2189–2194

    work page 2021

  2. [2]

    Yexin Duan, Jialin Chen, Xingyu Zhou, Junhua Zou, Zhengyun He, Jin Zhang, Wu Zhang, and Zhisong Pan. 2021. Learning coated adversarial camouflages for object detectors.arXiv preprint arXiv:2109.00124(2021)

    work page Pith review arXiv 2021

  3. [3]

    Wencheng Han, Hao Li, Maoguo Gong, Yue Wu, AK Qin, Lining Xing, and Yu Zhou. 2025. Evolutionary multiobjective cross-spectral adversarial attacks with synergistic patches.IEEE Transactions on Systems, Man, and Cybernetics: Systems (2025)

    work page 2025

  4. [4]

    Chengyin Hu, Weiwen Shi, Wen Yao, Tingsong Jiang, Ling Tian, and Wen Li

    work page

  5. [5]

    Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai- Lung Hua, and Wen-Huang Cheng. 2021. Naturalistic physical adversarial patch for object detectors. InProceedings of the IEEE/CVF international conference on computer vision. 7848–7857

    work page 2021

  6. [6]

    Zhiyang Hu, Xing Yang, Jiwen Zhao, Haoqi Gao, Haoli Xu, Hua Mu, and Yangyang Wang. 2024. Physically structured adversarial patch inspired by natural leaves multiply angles deceives infrared detectors.Journal of King Saud University- Computer and Information Sciences36, 6 (2024), 102122

    work page 2024

  7. [7]

    J Jia, X Liu, and Y Yang. 2025. From Vulnerability to Robustness: A Survey of Patch Attacks and Defenses in Computer Vision.Electronics14, 23 (2025), 4553

    work page 2025

  8. [8]

    Xinyu Jia, Chuang Zhu, Minzhen Li, Wenqi Tang, and Wenli Zhou. 2021. LLVIP: A visible-infrared paired dataset for low-light vision.arXiv preprint arXiv:2108.10831 (2021). ICCV Workshop

    arXiv 2021

Show all 35 references
  1. [9]

    Glenn Jocher et al . 2020. YOLOv5 by Ultralytics.GitHub repository(2020). https://github.com/ultralytics/yolov5

    2020

  2. [10]

    Glenn Jocher, Ayush Chaurasia, and Jing Qiu. 2023. YOLOv8 by Ultralytics. GitHub repository(2023). https://github.com/ultralytics/ultralytics

    2023

  3. [11]

    2024.Ultralytics YOLO11

    Glenn Jocher and Jing Qiu. 2024.Ultralytics YOLO11. https://github.com/ ultralytics/ultralytics

    2024

  4. [12]

    Taeho Kim, Hyo Jin Lee, and Yong Man Ro. 2022. MAP: Multispectral adver- sarial patch to attack person detection. InICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 4853–4857

    2022

  5. [13]

    X Liu, Y Wang, L Zhang, et al. 2024. Paa-Tee: A Practical Adversarial Attack on Thermal Infrared Detectors with Temperature and Pose Adaptability. In2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 952–959

    2024

  6. [14]

    Xin Liu, Huan Yang, Ziwei Liu, Lingxi Song, Hongyang Li, and Yiran Chen. 2020. Dpatch: An adversarial patch attack on object detectors. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2849–2858

    2020

  7. [15]

    Jiahuan Long, Wen Yao, Tingsong Jiang, Jiacheng Hou, Shuai Jia, Junqi Wu, Xiaoya Zhang, Xiaohu Zheng, and Chao Ma. 2025. Cdupatch: Color-driven universal adversarial patch attack for dual-modal visible-infrared detectors. In Proceedings of the 33rd ACM International Conference...

    2025

  8. [16]

    Joseph Redmon and Ali Farhadi. 2018. YOLOv3: An incremental improvement. arXiv preprint arXiv:1804.02767(2018)

    2018 arXiv

  9. [17]

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. 2015. Faster R-CNN: Towards real-time object detection with region proposal networks.IEEE Trans- actions on Pattern Analysis and Machine Intelligence39, 6 (2015), 1137–1149. doi:10.1109/TPAMI.2016.2577031

    2015

  10. [18]

    Yiming Sun, Bing Cao, Pengfei Zhu, and Qinghua Hu. 2022. Drone-based RGB- Infrared cross-modality vehicle detection via uncertainty-aware learning.IEEE Transactions on Circuits and Systems for Video Technology32, 10 (2022), 6700–6713. doi:10.1109/TCSVT.2022.3168279

    2022

  11. [19]

    Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Harashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. 2022. Dta: Physical camouflage attacks using differentiable transforma- tion network. InProceedings of the IEEE/CVF Conference on Comput...

    2022

  12. [20]

    Naufal Suryanto, Yongsu Kim, Harashta Tatimma Larasati, Hyoeun Kang, Thi- Thu-Huong Le, Yoonyoung Hong, Hunmin Yang, Se-Yoon Oh, and Howon Kim

  13. [21]

    2018.Infrared Thermal Imaging: Fundamentals, Research and Applications(2nd ed.)

    Michael Vollmer and Klaus-Peter Möllmann. 2018.Infrared Thermal Imaging: Fundamentals, Research and Applications(2nd ed.). John Wiley & Sons, Hoboken, NJ

    2018

  14. [22]

    Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xi- aoya Zhang, Wen Yao, and Xiaoqian Chen. 2022. Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. InProceedings of the AAAI conference on artificial intellige...

    2022

  15. [23]

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. 2021. Dual attention suppression attack: Generate adversarial camouflage in physical world. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 8565–8574

    2021

  16. [24]

    Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang, Hanxun Yu, Zhubo Li, Shin’ichi Satoh, Luc Van Gool, and Zheng Wang. 2024. Physical Adversarial Attack Meets Computer Vision: A Decade Survey.IEEE Transactions on Pattern Analysis and Machine Intelligence46, 12 (December 2024), 9797...

    2024 doi

  17. [25]

    Hui Wei, Zibo Wang, Xiaojun Jia, Yinqiang Zheng, and Bin Liu. 2023. Hot- cold block: Fooling thermal infrared detectors with a novel wearable design. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 15233–15241

    2023

  18. [26]

    Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. 2023. Unified adversarial patch for cross-modal attacks in the physical world. InProceedings of the IEEE/CVF International Conference on Computer Vision. 4445–4454

    2023

  19. [27]

    Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. 2024. Unified adversarial patch for visible-infrared cross-modal attacks in the physical world.IEEE Transactions on Pattern Analysis and Machine Intelligence46, 4 (2024), 2348–2363

    2024

  20. [28]

    Xingxing Wei, Jie Yu, and Yao Huang. 2023. Physically adversarial infrared patches with learnable shapes and locations. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 12334–12342

    2023

  21. [29]

    Xinyu Xiang, Qinglong Yan, Hao Zhang, and Jiayi Ma. 2025. Acattack: Adaptive cross attacking rgb-t tracker via multi-modal response decoupling. InProceedings of the Computer Vision and Pattern Recognition Conference. 22099–22108

    2025

  22. [30]

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Wang, Weiyue Lin, Ming Yang, and Pin-Yu Chen. 2020. Adversarial T-shirt! Evading person detectors in a physical world. InEuropean Conference on Computer Vision. Springer, 665–681

    2020

  23. [31]

    Yu Zhang, Zhiqiang Gong, Hao Wen, Xikun Hu, Xiaoyan Xia, Hejun Jiang, and Ping Zhong. 2024. Pattern corruption-assisted physical attacks against object detection in uav remote sensing.IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing17 (2024), 12...

    2024

  24. [32]

    Pengfei Zhu, Longyin Wen, Dawei Du, Xiao Bian, Heng Fan, Qinghua Hu, and Haibin Ling. 2020. Detection and tracking meet drones challenge.IEEE Trans- actions on Pattern Analysis and Machine Intelligence44, 11 (2020), 7380–7399. doi:10.1109/TPAMI.2021.3119563

    2020

  25. [33]

    Xiaopei Zhu, Zhuo Hu, Siyuan Huang, Jianmin Li, and Xian-Sheng Hua. 2022. Infrared invisible clothing: Hiding from infrared detectors at multiple angles in real world. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 13317–13326. Supplementa...

    2022

  26. [2023]

    InProceedings of the IEEE/CVF international conference on computer vision

    Active: Towards highly transferable 3d physical camouflage for universal and robust vehicle evasion. InProceedings of the IEEE/CVF international conference on computer vision. 4305–4314

  27. [2025]

    Two-stage optimized unified adversarial patch for attacking visible-infrared cross-modal detectors in the physical world.Applied Soft Computing168 (2025), 112678

    2025

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.