A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessories

Asaf Shabtai; Ben Nassi; Jacob Shams; Satoru Koda; Yuval Elovici

REVIEW 4 major objections 5 minor 46 references

A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessories

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A privacy-concerned pedestrian can reduce detection confidence by walking through the scene's blind spots, with no adversarial accessories.

desk verdict Real phenomenon, but the evasion and countermeasure results are in-sample and partly built into the update rule, so the headline numbers are not yet established. read the letter →

arxiv 2501.15653 v1 pith:GL4JQPUR submitted 2025-01-26 cs.CV

Jacob Shams , Ben Nassi , Satoru Koda , Asaf Shabtai , Yuval Elovici This is my paper · ORCID

classification cs.CV

keywords privacy-enhancingtechnologypedestriandetectionevasionobjectdetectorconfidenceblindspotsheatmapsurveillancecameraprivacybottleneckpathplanninglocation-basedadaptivethreshold

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a privacy-concerned pedestrian can evade a street video camera's automatic pedestrian detector without wearing adversarial patches or carrying special accessories, simply by choosing where to walk. The authors show that detector confidence varies with a person's distance, angle, and height relative to the camera, as well as with ambient light, so that a static scene contains spatial 'blind spots' where the detector is systematically less confident. They build a per-pixel confidence heatmap from several hours of footage and route a path through the lowest-confidence areas, lowering the maximum and average detection confidence along the path compared with direct or random routes. They also propose a countermeasure that raises confidence in those blind spots, shrinking the advantage of such path planning while improving the detector's true-positive rate. If the claim holds, it would mean that surveillance footage can be dodged without any physical adversarial tool, and that camera operators can partially defend against this merely by adjusting detection thresholds per location.

What carries the argument

The central object is the confidence heatmap: for each pixel, the average confidence of all 'person' bounding boxes that cover that pixel, computed from frames sampled every two seconds from a four-hour recording. It converts the continuous scene into a grid where every pixel carries a detection-confidence weight. The path-finding step is a modified Dijkstra algorithm (a bottleneck shortest path) that, instead of minimizing total cost, minimizes the maximum node confidence that must be crossed to go from start to end, so the pedestrian always stays in the weakest-detection regions. The countermeasure L-BAT reweights a detection's confidence by the local heatmap average, $c_{\text{new}} = \min(1, c_{bb} / \bar{H}_c)$, which raises confidence in blind spots.

What would settle it

Re-run the evaluation with the confidence heatmap built from the first half of each recording and L-PET paths evaluated on the second half (or on a different day's recording of the same scene); if the max/average confidence reductions collapse toward zero, the location-based vulnerability is an artifact of evaluating on the very footage used to build the map.

Watch

Extended reading notes

Core claim

Automatic pedestrian detectors trained on curated datasets carry an inherent weakness: their confidence in detecting a person depends on where that person appears in the scene. The paper demonstrates this with five detector architectures (Faster R-CNN, YOLOv3, SSD, DiffusionDet, RTMDet) across three real-world locations, measuring how distance, angle, camera height, and lighting shift detection confidence from 1.0 down to about 0.55. In a fixed scene these variations form stable 'blind spots' of low confidence, which the paper exploits with L-PET: a confidence heatmap is built by averaging the detector's person-box confidences per pixel over hours of footage, the scene is turned into a pixel graph, and a modified Dijkstra search finds the path whose highest-confidence crossing is as low as possible. On Faster R-CNN this lowers the maximum path confidence by up to 0.09 and the average by up to 0.13 compared with direct and random paths. The companion countermeasure, L-BAT, divides each detection's confidence by the average heatmap confidence of the pixels it covers, raising the confidence of detections in weak areas and thereby forcing a would-be evader back toward more expensive attack methods.

Load-bearing premise

The heatmap built from a four-hour recording is assumed to predict detection confidence for paths evaluated on that same recording and for future traversals, yet the paper does not hold out separate footage for heatmap building versus path evaluation, so the reported reductions may be inflated by in-sample fitting.

Editorial extensions

If this is right

L-PET lowers the maximum and average detection confidence along a path for all five detector architectures, with the largest reductions on Faster R-CNN (0.09 max, 0.13 average).
The effect holds across three global locations (Shibuya, Broadway, Castro Street) and across times of day, including night footage.
L-BAT raises the max/average confidence of L-PET paths by 0.09 and 0.05 on Faster R-CNN, and improves the detector's TPR and average true-positive confidence at the cost of a higher false-positive rate.
A pedestrian needs no white-box access to the target model, no adversarial accessories, and no physical modification of the scene, only footage of the scene and knowledge of the detector.
The countermeasure is not plug-and-play across lighting conditions or model architectures: heatmaps are specific to the location, time of day, and detector.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because heatmaps are built and evaluated on the same recordings, the reported reductions are upper bounds; a held-out evaluation would likely show smaller but still nonzero gains.
The same training-distribution mismatch that creates blind spots for pedestrians should create analogous location-dependent blind spots for other detection tasks, such as vehicle detection for autonomous driving, making the L-PET/L-BAT pattern portable.
An adaptive attacker could treat the heatmap as an online map that must be kept fresh, while a defender could periodically re-estimate the heatmap to close newly exploited blind spots.
If the technique transfers across cameras of the same scene, a pedestrian could precompute paths from one vantage and use them under another, though the paper's own limitation notes that heatmaps do not transfer across lighting or detectors.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. The controlled experiments are the strongest part: across five detectors, three public scenes, and controlled lighting, the paper shows that a pedestrian's distance, angle, height relative to the camera, and ambient light shift detection confidence by meaningful amounts. That part is credible and worth reading. The problem is that the two headline techniques are not evaluated the way they are claimed.

L-PET is a clean idea: build a confidence heatmap from footage, then find a path that minimizes the maximum heatmap value, using a minimax Dijkstra. But in Sections 4.2 and 4.3 the heatmap is built from the full four-hour recording and then scored on the same recording. The baselines are random or shortest-distance paths that are not optimized, so it is expected that L-PET scores lower. There is no held-out footage, no temporal split, and no test of whether a heatmap from one day predicts confidence on another day. The threat model assumes a pedestrian can obtain footage before walking the path, so that temporal transfer is the actual use case. The numbers in Table 3 (up to 0.23 max confidence drop) are therefore in-sample artifacts until shown otherwise.

L-BAT has a deeper issue. Algorithm 3 divides each detection confidence by the historical average confidence at that bounding box's pixels. If the detector's confidence at a location is roughly the same as its historical average, the new confidence becomes near one by construction. So the reported increases in L-PET path confidence and TP confidence are largely forced by the update rule. The paper honestly reports the accompanying FPR increase (0.19 to 0.24 on Faster R-CNN), but the benefit of L-BAT over a simpler location-specific threshold is not demonstrated.

The title overstates things. L-PET's average max path confidence for Faster R-CNN is still 0.71, well above typical detection thresholds, so 'evade detection' is not supported. What is supported is a modest shift in confidence, and only on heatmaps, not on actual walking pedestrians.

Net: the underlying phenomenon is real and the path-planning idea is worth discussing, but the quantitative claims need held-out evaluation and a real-world traversal test. I would send this to a serious referee, expecting major revision.

Referee Report

4 major / 5 minor

Summary. The paper claims that automatic pedestrian detectors exhibit location-dependent blind spots, proposes L-PET, a technique that plans a path through a scene to minimize the maximum and average detection confidence using a per-pixel confidence heatmap, and proposes L-BAT, a countermeasure that reweights detection confidences according to historical per-location averages. The evaluation uses public street-camera footage from three locations and five object detectors, reporting that L-PET reduces max and average path confidence by up to 0.09 and 0.13 for Faster R-CNN, and that L-BAT raises these values while improving the detector's true-positive rate and average true-positive confidence.

Significance. If the claims were validated, the contribution would be notable: it would demonstrate a practical, accessory-free evasion technique that relies only on footage and model inference, plus a countermeasure that is inexpensive to deploy. The paper is well-structured, covers multiple scenes, models, and lighting conditions, and provides clear algorithmic descriptions. However, the evaluation does not test the central temporal-transfer scenario (past footage to plan a future walk), uses a proxy metric rather than the detector's output on an actual walking person, and the countermeasure's reported gains are partly a consequence of its normalization rule. These issues currently prevent the results from supporting the stated conclusions.

major comments (4)

[Sections 4.2-4.3, Algorithm 1] The evaluation of L-PET is entirely in-sample: the confidence heatmap used to plan paths is generated from the same 4-hour recordings that are later used to compute the path confidences reported in Table 3. The threat model in Section 2 requires a pedestrian to build a heatmap from previously obtained footage and use it for a future traversal, but no held-out temporal split is reported. As a result, the claimed reductions (e.g., 0.09 max and 0.13 average for Faster R-CNN) may be inflated by optimizing and scoring on the same data, and the central claim that a pedestrian can use past footage to plan an effective future path is not established.
[Section 4.3, Algorithm 1] The path score is the per-pixel average of the confidence heatmap, not the actual output of the detector on a person traversing the path. A pedestrian is detected as a bounding box covering many pixels, and the detector's confidence for that box may differ substantially from the mean of pixel-level heatmap values. Moreover, pixels with no historical detections (Hd=0 in Algorithm 1) are undefined in the heatmap, and the path optimizer may route through them even though they are not evidence of a detector blind spot; they may simply be areas where pedestrians rarely walk. The paper does not validate L-PET by having a person walk planned paths and measuring the detector's confidence or detection rate, so the claimed evasion capability is not directly demonstrated.
[Section 3.3, Insight 6] The location-based 'blind spots' are computed from pedestrian traffic footage, where each pixel's confidence is averaged only over bounding boxes that cover it. Low-confidence regions therefore conflate weak detector performance with sparse pedestrian presence or static occlusion. For example, a path that crosses a road lane with no pedestrian traffic would trivially have low heatmap confidence but would not demonstrate that the detector is weak there. The paper should control for pedestrian density (e.g., by using the detection heatmap as a mask or constraining paths to walkable, pedestrian-accessible areas) to support the claim that the effect is due to detector vulnerability rather than data availability.
[Section 5.2, Algorithm 3] L-BAT's update rule divides each detection confidence by the historical average confidence at that location (Algorithm 3, line 9). This is a location-dependent normalization that, by construction, raises confidences in low-average regions and lowers them in high-average regions, making the heatmap more uniform. The reported increases in L-PET path confidence (Table 4) therefore follow in part from the normalization itself. Similarly, in Section 5.3, the Faster R-CNN AUC is unchanged (0.89 before and after L-BAT in Table 5a), so the reported TPR and average TP confidence improvements are threshold effects caused by rescaling scores, not improvements in ranking quality. The evaluation also builds the heatmap and measures TPR/FPR on the same footage, so the temporal-transfer limitation applies here as well.

minor comments (5)

[Algorithm 1, line 9] The division Hc(i,j) <- Hc(i,j)/Hd(i,j) appears inside the outer loop over bounding boxes in the pseudocode; if executed there, it would normalize partial sums and corrupt subsequent accumulation. The division should occur once after all bounding boxes have been processed; please clarify the control flow.
[Section 4.3 / Table 3] The text states that Table 3 presents results for five object detectors, but Table 3 lists only four; the DiffusionDet results are in the appendix (Table 7). Please adjust the cross-reference.
[Section 5.3.1] The evaluation constructs ground-truth positive samples by running an SSD detector and selecting one accepted person box per frame; this couples the ground truth to a particular detector, which may bias the TPR/FPR results. Please state whether any manual verification was performed, and discuss the potential bias.
[Section 5.3.2] The threshold used to compute TPR and FPR is not stated; the results depend on the chosen threshold, and the unchanged AUC for Faster R-CNN suggests the ranking is not improved. Please report the threshold and include ROC curves or threshold-independent statistics.
[Abstract and Section 4.3] The claimed reductions 'up to 0.09 and 0.13' refer to averages over all scenes, but individual rows in Table 3 show reductions as large as 0.23 (max) and 0.19 (average). Please make clear whether the headline numbers are means across all settings and provide error bars or ranges.

Circularity Check

2 steps flagged · score 7.0 of 10

Partially circular: L-PET's reported reductions are scored on the same heatmap it optimizes, and L-BAT's confidence improvements follow from its own normalization rule.

fitted input called prediction [Section 4.2 (Algorithm 1), Section 4.3 (Table 3), and Algorithm 2 line 13]
"For each 4 hour recording and object detector, we calculated a confidence heatmap, and detection heatmap according to the methodology presented in Algorithm 1 and Section 4.1. ... On the set of 100 paths between each pair of start and end points, we calculated the average: (1) max node confidence of the path, and (2) per-step confidence of the path."

Algorithm 1 builds Hc as the per-pixel mean detection confidence from the same 4-hour recording, and Algorithm 2's path cost is exactly Hc(v): alt <- min(max(dist(u), Hc(v)), dist(v)). The evaluation then scores L-PET and the random/direct baselines using the max and per-step values of that same Hc. Since L-PET is a minimizer of max Hc, beating non-optimized baselines on the same Hc is guaranteed by construction for any spatially nonuniform heatmap. The reported reductions (up to 0.09 max, 0.13 average) therefore measure the optimization objective itself, not whether a person walking later through the scene is detected with lower confidence; no temporal held-out split or actual traversal is tested.
self definitional [Section 5.1, Algorithm 3 lines 8-9; results in Sections 5.2.2 and 5.3.2]
"8: t <- Σscores / |scores| 9: cnew <- min(1, cbb/t)"

t is the mean of the historical confidence heatmap over the bounding box's pixels, i.e., the average confidence previously recorded at that location. The updated confidence is defined as cbb/t. In the evaluated scenes the historical mean confidence t is below 1 (Tables 1-2), so dividing by t<1 inflates every confidence score; if cbb ≈ t then cnew ≈ 1. The reported increases in average true-positive confidence (0.79 to 0.94 in Table 5) and in L-PET path confidence (Table 4) are algebraic consequences of this normalization, not an independently measured improvement. The countermeasure's headline effectiveness is thus built into its defining update rule.

full rationale

L-PET's core concept is not wholly circular: the controlled position experiments (Section 3.1-3.2) independently show that detector confidence varies with distance, angle, height, and lighting, and the minimax pathfinding formulation is a legitimate planning method. However, the paper's central quantitative claim that L-PET lowers max/average path confidence by up to 0.09/0.13 versus direct and random paths is evaluated by optimizing and scoring on the same confidence heatmap built from the same 4-hour recordings; no temporal split or real traversal is tested, so the reduction versus non-optimized baselines is substantially an in-sample artifact of the optimization objective. L-BAT is more clearly circular: its updated confidence is defined as cbb divided by the local historical mean t, and since t<1 in the evaluated scenes, the reported improvements in true-positive confidence and path confidence follow from the normalization itself. Score 7 reflects that one major claim (L-BAT's improvement) is forced by definition and the other major claim (L-PET's evasion magnitude) is measured on the training objective rather than on held-out or future footage.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claims rely on a fitted confidence heatmap and several domain assumptions about scene stationarity, pedestrian knowledge, and the validity of average confidence as a proxy. No new physical entities are introduced. L-BAT's update rule is a normalization that forces most of its reported improvements.

free parameters (1)

per-pixel confidence heatmap H_c = per-scene, per-model, per-time-of-day empirical averages
Used as the cost map for L-PET and as the normalization divisor in L-BAT; it is fitted to the same 4-hour recordings used to evaluate the resulting paths, so the evaluation is in-sample.

assumptions (5)

standard math Dijkstra's algorithm computes optimal paths in weighted graphs.
Used in Algorithm 2 with a modified update rule.
domain assumption The confidence heatmap is stationary over the recording and transferable to the evaluation paths.
The paper builds H_c from the same footage used to evaluate L-PET, Sections 4.2 and 4.3; no train/test split.
domain assumption The pedestrian knows the detector model and has access to scene footage.
Stated in the threat model, Section 2; standard in adversarial ML but strong for real-world pedestrians.
domain assumption Averaging detection confidences over pixels covered by bounding boxes is a valid proxy for a pedestrian's detectability at that pixel.
Used to build both heatmaps; a pedestrian may not be detected at all or may be partially occluded, and the average confidence may not equal the confidence of a specific traversal.
ad hoc to paper The per-location average confidence t is a reliable normalization factor for L-BAT.
L-BAT's update rule divides by t; if t is noisy or based on few detections, the updated confidence is unstable, and the claimed improvements are partly a consequence of this normalization.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessories." pith.science (2026). https://pith.science/paper/GL4JQPUR

@misc{pith2026250115653,
  author       = {Pith},
  title        = {Pith review of: A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessories},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GL4JQPUR}},
  note         = {Machine review of arXiv:2501.15653}
}

read the original abstract

In this paper, we propose a privacy-enhancing technique leveraging an inherent property of automatic pedestrian detection algorithms, namely, that the training of deep neural network (DNN) based methods is generally performed using curated datasets and laboratory settings, while the operational areas of these methods are dynamic real-world environments. In particular, we leverage a novel side effect of this gap between the laboratory and the real world: location-based weakness in pedestrian detection. We demonstrate that the position (distance, angle, height) of a person, and ambient light level, directly impact the confidence of a pedestrian detector when detecting the person. We then demonstrate that this phenomenon is present in pedestrian detectors observing a stationary scene of pedestrian traffic, with blind spot areas of weak detection of pedestrians with low confidence. We show how privacy-concerned pedestrians can leverage these blind spots to evade detection by constructing a minimum confidence path between two points in a scene, reducing the maximum confidence and average confidence of the path by up to 0.09 and 0.13, respectively, over direct and random paths through the scene. To counter this phenomenon, and force the use of more costly and sophisticated methods to leverage this vulnerability, we propose a novel countermeasure to improve the confidence of pedestrian detectors in blind spots, raising the max/average confidence of paths generated by our technique by 0.09 and 0.05, respectively. In addition, we demonstrate that our countermeasure improves a Faster R-CNN-based pedestrian detector's TPR and average true positive confidence by 0.03 and 0.15, respectively.

Figures

Figures reproduced from arXiv: 2501.15653 by the authors.

**Figure 1.** Left: A stationary scene observed by an automatic pedestrian detector. Right: A heatmap indicating varying average confidence in the automatic pedestrian detector depending on the pedestrian’s location in the frame. their privacy by either avoiding detection or be detected with reduced confidence, without requiring any adversarial accessories [4, 6, 9, 10] or prior setup in the scene [11]. First, we analyze the fact… view at source ↗

**Figure 2.** Observed scenes from (left to right): Shibuya Crossing, Broadway, and Castro Street. Insight 3: The confidence of an object detector is dependent on the height of the camera recording the scene for the object detector. 3.2. Effect of Time of Day and Ambient Lighting In this section, we analyze the effect of time of day and ambient light on the confidence of object detectors when detecting people at different angles,… view at source ↗

**Figure 3.** The average confidence of pedestrian detection for each pixel in the observed area of Shibuya Crossing. The six videos, recorded in different lighting conditions (from left to right: daytime, daytime, afternoon, evening, night, and night), are presented separately. (YOLOv3, SSD, and RTMDet) the effect persists through all ambient light levels. Insight 5: The effects of varying pedestrian position and ambient light i… view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: The average confidence of pedestrian detection for each pixel in the observed area of Broadway. The six videos, recorded in different lighting conditions (from left to right: daytime, daytime, daytime, night, night, and night), are presented separately. various object …

**Figure 5.** Figure 5: The average confidence of pedestrian detection for each pixel in the observed area of Castro Street. The five videos, recorded in different lighting conditions (from left to right: sunrise, daytime, sunset, night, and night), are presented separately [PITH_FULL_IMAGE:…

**Figure 6.** Figure 6: A visualization of the reduction of the scene/heatmap from a pixel-based matrix representation to a graph-based representation. format. We perform a reduction from a pixel-based matrix representation to a graph-based representation. Each pixel is represented by a node …

**Figure 7.** Figure 7: The positioning of the person and camera in the analysis. Top row: the three analyzed heights. Middle row: the three analyzed distances. Bottom row: Three of the eight analyzed angles [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]

**Figure 8.** Figure 8: The average DiffusionDet confidence of pedestrian detection for each pixel in the observed area of Shibuya Crossing. The six videos, recorded in different lighting conditions (from left to right: daytime, daytime, afternoon, evening, night, and night), are presented se…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 31 canonical work pages

[1]

Prediction of pedestrian crossing behavior based on surveillance video,

X. Zhou, H. Ren, T. Zhang, X. Mou, Y . He, and C.-Y . Chan, “Prediction of pedestrian crossing behavior based on surveillance video,” Sensors, vol. 22, no. 4, 2022. [Online]. Available: https: //www.mdpi.com/1424-8220/22/4/1467

work page 2022
[2]

Hawk-eye: An ai-powered threat detector for intelligent surveillance cameras,

A. A. Ahmed and M. Echi, “Hawk-eye: An ai-powered threat detector for intelligent surveillance cameras,” IEEE Access, vol. 9, pp. 63 283–63 293, 2021

work page 2021
[3]

Surveilling surveillance: Estimating the prevalence of surveillance cameras with street view data,

H. Sheng, K. Yao, and S. Goel, “Surveilling surveillance: Estimating the prevalence of surveillance cameras with street view data,” in Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Society, ser. AIES ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 221–230. [Online]. Available: https://doi .org/10.1145/ 3461702.3462525

arXiv 2021
[4]

Adversarial mask: Real-world universal adversarial attack on face recognition models,

A. Zolfi, S. Avidan, Y . Elovici, and A. Shabtai, “Adversarial mask: Real-world universal adversarial attack on face recognition models,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases . Springer, 2022, pp. 304– 320

work page 2022
[5]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’16. New York, NY , USA: Association for Computing Machinery, 2016, p. 1528–1540. [Online]. Available: https: //...

arXiv 2016
[6]

AdvHat: Real-world adversarial attack on ArcFace face ID system,

S. Komkov and A. Petiushko, “AdvHat: Real-world adversarial attack on ArcFace face ID system,” in 2020 25th International Conference on Pattern Recognition (ICPR). IEEE, jan 2021. [Online]. Available: https: //doi.org/10.1109%2Ficpr48806.2021.9412236

arXiv 2020
[7]

Dodging Attack Using Carefully Crafted Natural Makeup

N. Guetta, A. Shabtai, I. Singh, S. Momiyama, and Y . Elovici, “Dodging attack using carefully crafted natural makeup,” 2021. [Online]. Available: https://arxiv.org/abs/2109.06467

work page Pith review arXiv 2021
[8]

Adversarial t- shirt! evading person detectors in a physical world,

K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y . Chen, Y . Wang, and X. Lin, “Adversarial t- shirt! evading person detectors in a physical world,” in Computer Vision – ECCV 2020 , A. Vedaldi, H. Bischof, T. Brox, and J.-M. Frahm, Eds. Cham: Springer International Publishing, 2020, pp. 665–681

work page 2020

Show all 46 references

[9]

Fooling automated surveillance cameras: adversarial patches to attack person detection,

S. Thys, W. V . Ranst, and T. Goedemé, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” 2019

2019
[10]

Making an invisibility cloak: Real world adversarial attacks on object detectors,

Z. Wu, S.-N. Lim, L. Davis, and T. Goldstein, “Making an invisibility cloak: Real world adversarial attacks on object detectors,” 2020

2020
[11]

Dirty road can attack: Security of deep learning based automated lane centering under Physical-World attack,

T. Sato, J. Shen, N. Wang, Y . Jia, X. Lin, and Q. A. Chen, “Dirty road can attack: Security of deep learning based automated lane centering under Physical-World attack,” in 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021, pp. 3309–

2021
[12]

Faster r-cnn: Towards real-time object detection with region proposal networks,

S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” 2016. [Online]. Available: https: //arxiv.org/abs/1506.01497

2016 arXiv
[13]

Yolov3: An incremental improvement,

J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” 2018. [Online]. Available: https:// arxiv.org/abs/1804.02767

2018 arXiv
[14]

W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, SSD: Single Shot MultiBox Detector . Springer International Publishing, 2016, p. 21–37. [Online]. Available: http://dx.doi.org/10.1007/978-3-319-46448-0_2

2016 doi
[15]

Diffusiondet: Diffusion model for object detection,

S. Chen, P. Sun, Y . Song, and P. Luo, “Diffusiondet: Diffusion model for object detection,” 2023. [Online]. Available: https://arxiv.org/abs/2211.09788

2023 arXiv
[16]

Rtmdet: An empirical study of designing real-time object detectors,

C. Lyu, W. Zhang, H. Huang, Y . Zhou, Y . Wang, Y . Liu, S. Zhang, and K. Chen, “Rtmdet: An empirical study of designing real-time object detectors,” 2022. [Online]. Available: https://arxiv.org/abs/2212.07784

2022 arXiv
[17]

Surveillance camera statistics: which are the most surveilled cities?

P. Bischoff, “Surveillance camera statistics: which are the most surveilled cities?” [Online]. Available: https://www .comparitech.com/ blog/vpn-privacy/the-worlds-most-surveilled-cities/
[18]

Invisible mask: Practical attacks on face recognition with infrared,

Z. Zhou, D. Tang, X. Wang, W. Han, X. Liu, and K. Zhang, “Invisible mask: Practical attacks on face recognition with infrared,” 2018

2018
[19]

Darts: Deceiving autonomous cars with toxic signs,

C. Sitawarin, A. N. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal, “Darts: Deceiving autonomous cars with toxic signs,” 2018

2018
[20]

Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,

Y . Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, “Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,” Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019. [Online]. Available: ...

2019
[21]

Synthesizing robust adversarial examples,

A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” 2018

2018
[22]

ShapeShifter: Robust physical adversarial attack on faster r-CNN object detector,

S.-T. Chen, C. Cornelius, J. Martin, and D. H. Chau, “ShapeShifter: Robust physical adversarial attack on faster r-CNN object detector,” in Machine Learning and Knowledge Discovery in Databases . Springer International Publishing, 2019, pp. 52–68. [Online]. Available: https://...

2019
[23]

Robust physical-world attacks on deep learning models,

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning models,” 2018

2018
[24]

{SLAP}: Improving physical adversarial examples with {Short-Lived} adversarial perturbations,

G. Lovisotto, H. Turner, I. Sluganovic, M. Strohmeier, and I. Martinovic, “ {SLAP}: Improving physical adversarial examples with {Short-Lived} adversarial perturbations,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 1865–1882

2021
[25]

Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception,

T. Sato, S. H. V . Bhupathiraju, M. Clifford, T. Sugawara, Q. A. Chen, and S. Rampazzi, “Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception,” arXiv preprint arXiv:2401.03582, 2024

2024 arXiv
[26]

Vla: A practical visible light-based attack on face recognition systems in physical world,

M. Shen, Z. Liao, L. Zhu, K. Xu, and X. Du, “Vla: A practical visible light-based attack on face recognition systems in physical world,” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 3, no. 3, pp. 1–19, 2019

2019
[27]

Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks,

B. Nassi, Y . Mirsky, D. Nassi, R. Ben-Netanel, O. Drokin, and Y . Elovici, “Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks,” in Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, 2020, pp. 293–308

2020
[28]

Adversarial examples in the physical world,

A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” 2016. [Online]. Available: https://arxiv.org/abs/1607.02533

2016 arXiv
[29]

Adv-makeup: A new imperceptible and transferable attack on face recognition,

B. Yin, W. Wang, T. Yao, J. Guo, Z. Kong, S. Ding, J. Li, and C. Liu, “Adv-makeup: A new imperceptible and transferable attack on face recognition,” in Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21 , Z.- H. Zhou, Ed. Internati...

2021 doi
[30]

Adversarial texture for fooling person detectors in the physical world,

Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, and X. Hu, “Adversarial texture for fooling person detectors in the physical world,” in 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2022, pp. 13 297–13 306

2022
[31]

advpattern: Physical-world attacks on deep person re-identification via adversarially transformable patterns,

Z. Wang, S. Zheng, M. Song, Q. Wang, A. Rahimpour, and H. Qi, “advpattern: Physical-world attacks on deep person re-identification via adversarially transformable patterns,” in 2019 IEEE/CVF International Conference on Computer Vision (ICCV) , 2019, pp. 8340–8349

2019
[32]

Physical adversarial examples for object detectors,

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, T. Kohno, and D. Song, “Physical adversarial examples for object detectors,” 2018. [Online]. Available: https: //arxiv.org/abs/1807.07769

2018 arXiv
[33]

On physical adversarial patches for object detection,

M. Lee and Z. Kolter, “On physical adversarial patches for object detection,” 2019. [Online]. Available: https://arxiv.org/abs/1906.11897

2019 arXiv
[34]

Beyond digital domain: Fooling deep learning based recognition system in physical world,

K. Yang, T. Tsai, H. Yu, T.-Y . Ho, and Y . Jin, “Beyond digital domain: Fooling deep learning based recognition system in physical world,” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 01, pp. 1088–1095, Apr. 2020. [Online]. Available: https://oj...

2020
[35]

The translucent patch: A physical and universal attack on object detectors,

A. Zolfi, M. Kravchik, Y . Elovici, and A. Shabtai, “The translucent patch: A physical and universal attack on object detectors,” 2020. [Online]. Available: https://arxiv.org/abs/2012.12528

2020 arXiv
[36]

Dynamic adversarial patch for evading object detection models,

S. Hoory, T. Shapira, A. Shabtai, and Y . Elovici, “Dynamic adversarial patch for evading object detection models,” 2020. [Online]. Available: https://arxiv.org/abs/2010.13070

2020 arXiv
[37]

A note on two problems in connexion with graphs,

E. W. Dijkstra, “A note on two problems in connexion with graphs,” Numerische mathematik , vol. 1, no. 1, pp. 269–271, 1959

1959
[38]

Bias-based universal adversarial patch attack for automatic check-out,

A. Liu, J. Wang, X. Liu, B. Cao, C. Zhang, and H. Yu, “Bias-based universal adversarial patch attack for automatic check-out,” 2020. [Online]. Available: https://arxiv.org/abs/2005.09257

2020 arXiv
[39]

Universal adversarial patch attack for automatic checkout using perceptual and attentional bias,

J. Wang, A. Liu, X. Bai, and X. Liu, “Universal adversarial patch attack for automatic checkout using perceptual and attentional bias,” IEEE Transactions on Image Processing, vol. 31, pp. 598–611, 2022

2022
[40]

Tnt attacks! universal naturalistic adversarial patches against deep neural network systems,

B. G. Doan, M. Xue, S. Ma, E. Abbasnejad, and D. C. Ranasinghe, “Tnt attacks! universal naturalistic adversarial patches against deep neural network systems,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 3816–3830, 2022

2022
[41]

Traffic sign detection and recognition using deep learning,

R. M. Oza, A. Geisen, and T. Wang, “Traffic sign detection and recognition using deep learning,” in 2021 4th International Conference on Artificial Intelligence for Industries (AI4I) , 2021, pp. 16–20

2021
[42]

I can see the light: Attacks on autonomous vehicles using invisible lights,

W. Wang, Y . Yao, X. Liu, X. Li, P. Hao, and T. Zhu, “I can see the light: Attacks on autonomous vehicles using invisible lights,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’21. New York, NY , USA: Association for Compu...

2021
[43]

Fooling thermal infrared pedestrian detectors in real world using small bulbs,

X. Zhu, X. Li, J. Li, Z. Wang, and X. Hu, “Fooling thermal infrared pedestrian detectors in real world using small bulbs,” Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 4, pp. 3616–3624, May 2021. [Online]. Available: https: //ojs.aaai.org/index....

2021
[44]

Infrared invisible clothing:hiding from infrared detectors at multiple angles in real world,

X. Zhu, Z. Hu, S. Huang, J. Li, and X. Hu, “Infrared invisible clothing:hiding from infrared detectors at multiple angles in real world,” 2022. [Online]. Available: https://arxiv.org/abs/2205.05909

2022 arXiv
[46]

Effect of Pedestrian Position on Pedestrian Detection Systems - Additional Figures Figure 7: The positioning of the person and camera in the analysis

Appendix 9.1. Effect of Pedestrian Position on Pedestrian Detection Systems - Additional Figures Figure 7: The positioning of the person and camera in the analysis. Top row: the three analyzed heights. Middle row: the three analyzed distances. Bottom row: Three of the eight an...
[3326]

Available: https://www .usenix.org/ conference/usenixsecurity21/presentation/sato

[Online]. Available: https://www .usenix.org/ conference/usenixsecurity21/presentation/sato

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Prediction of pedestrian crossing behavior based on surveillance video,

X. Zhou, H. Ren, T. Zhang, X. Mou, Y . He, and C.-Y . Chan, “Prediction of pedestrian crossing behavior based on surveillance video,” Sensors, vol. 22, no. 4, 2022. [Online]. Available: https: //www.mdpi.com/1424-8220/22/4/1467

work page 2022

[2] [2]

Hawk-eye: An ai-powered threat detector for intelligent surveillance cameras,

A. A. Ahmed and M. Echi, “Hawk-eye: An ai-powered threat detector for intelligent surveillance cameras,” IEEE Access, vol. 9, pp. 63 283–63 293, 2021

work page 2021

[3] [3]

Surveilling surveillance: Estimating the prevalence of surveillance cameras with street view data,

H. Sheng, K. Yao, and S. Goel, “Surveilling surveillance: Estimating the prevalence of surveillance cameras with street view data,” in Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Society, ser. AIES ’21. New York, NY , USA: Association for Computing Machinery, 2021, p. 221–230. [Online]. Available: https://doi .org/10.1145/ 3461702.3462525

arXiv 2021

[4] [4]

Adversarial mask: Real-world universal adversarial attack on face recognition models,

A. Zolfi, S. Avidan, Y . Elovici, and A. Shabtai, “Adversarial mask: Real-world universal adversarial attack on face recognition models,” in Joint European Conference on Machine Learning and Knowledge Discovery in Databases . Springer, 2022, pp. 304– 320

work page 2022

[5] [5]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’16. New York, NY , USA: Association for Computing Machinery, 2016, p. 1528–1540. [Online]. Available: https: //...

arXiv 2016

[6] [6]

AdvHat: Real-world adversarial attack on ArcFace face ID system,

S. Komkov and A. Petiushko, “AdvHat: Real-world adversarial attack on ArcFace face ID system,” in 2020 25th International Conference on Pattern Recognition (ICPR). IEEE, jan 2021. [Online]. Available: https: //doi.org/10.1109%2Ficpr48806.2021.9412236

arXiv 2020

[7] [7]

Dodging Attack Using Carefully Crafted Natural Makeup

N. Guetta, A. Shabtai, I. Singh, S. Momiyama, and Y . Elovici, “Dodging attack using carefully crafted natural makeup,” 2021. [Online]. Available: https://arxiv.org/abs/2109.06467

work page Pith review arXiv 2021

[8] [8]

Adversarial t- shirt! evading person detectors in a physical world,

K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y . Chen, Y . Wang, and X. Lin, “Adversarial t- shirt! evading person detectors in a physical world,” in Computer Vision – ECCV 2020 , A. Vedaldi, H. Bischof, T. Brox, and J.-M. Frahm, Eds. Cham: Springer International Publishing, 2020, pp. 665–681

work page 2020