On Physical Adversarial Patches for Object Detection

Mark Lee; Zico Kolter

arxiv: 1906.11897 · v1 · pith:JUA73VFTnew · submitted 2019-06-20 · 💻 cs.CV · cs.CR· cs.LG· stat.ML

On Physical Adversarial Patches for Object Detection

Mark Lee , Zico Kolter This is my paper

Pith reviewed 2026-05-25 19:57 UTC · model grok-4.3

classification 💻 cs.CV cs.CRcs.LGstat.ML

keywords adversarial patchobject detectionphysical attackYOLOv3global suppressionuniversal attack

0 comments

The pith

An adversarial patch placed anywhere in an image can cause an object detector to miss every object in the scene.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that a single adversarial patch, when placed at any location, can make the YOLOv3 detector fail to report virtually all objects present, including those distant from the patch. Earlier physical attacks required the patch to overlap or sit near the targets being hidden. The new method needs no alteration to the objects themselves. A reader should care because it identifies a way to disrupt detection systems without touching the things they are meant to find.

Core claim

We demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene.

What carries the argument

The adversarial patch optimized to produce global suppression of object detections regardless of its position in the image.

If this is right

Object detectors can be attacked without any change to the objects being detected.
A single patch can affect detections across the entire image rather than only locally.
Physical attacks become possible in scenes where modifying the objects themselves is impractical.
Detection systems must now defend against location-independent suppression effects.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The result suggests detectors may depend on global image statistics that a localized patch can override.
Similar patches could be tested on other detectors to determine whether the suppression effect is architecture-specific.
One could explore whether retraining with such patches improves robustness without harming normal accuracy.

Load-bearing premise

A patch optimized in digital simulation will still suppress detections after it is printed and photographed under real lighting, angles, and distances.

What would settle it

Print the optimized patch, place it in a real scene containing visible objects, photograph the scene, and run the detector on the photo; continued detection of the objects would show the claim does not hold.

Figures

Figures reproduced from arXiv: 1906.11897 by Mark Lee, Zico Kolter.

**Figure 2.** Figure 2: ROI plots for the unclipped case. Top row shows original. (a) Training Loss (Ours) (b) mAP-50 (Ours) (c) Training Loss (DPatch) (d) mAP-50 (DPatch) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Figure 3: Our method vs. DPatch for the clipped case. To verify that our patch attacks at the bounding box proposal level, we plot the pre-non-max suppression bounding box confidence scores for a random image, shown in [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

**Figure 6.** Figure 6: shows a printed version of our patch attacking YOLOv3 running real-time with a standard webcam. The patch was printed on regular printer paper and recorded under natural lighting. While the patch is somewhat invariant to location, the patch generally has weaker influence on objects that are farther away, as seen in [PITH_FULL_IMAGE:figures/full_fig_p004_6.png] view at source ↗

**Figure 5.** Figure 5: ROI plots for the clipped case. Top row shows original. improve significantly [PITH_FULL_IMAGE:figures/full_fig_p004_5.png] view at source ↗

read the original abstract

In this paper, we demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene. A demo of the system can be found at https://youtu.be/WXnQjbZ1e7Y.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper claims a non-overlapping physical patch that globally suppresses YOLOv3 detections, but supplies no numbers or transfer evidence to back the physical part.

read the letter

The central new point is that a single adversarial patch can be placed anywhere in the scene and still cause the detector to miss every object, even ones far from the patch. This differs from earlier physical attacks that needed the patch to overlap or sit near the targets. The authors frame this as opening attacks that leave the actual objects untouched, which is a reasonable distinction from the cited prior work on patches for object detection.

Referee Report

2 major / 2 minor

Summary. The manuscript demonstrates an adversarial patch attack on object detectors (notably YOLOv3) in which a digitally optimized patch, when placed anywhere in the scene, suppresses detection of virtually all objects—even those distant from the patch—without requiring overlap with the targets. The work claims this effect transfers to the physical world after printing and real-world capture, supported by a video demonstration.

Significance. If the physical transfer holds with quantitative validation, the result would be significant because it enables non-local physical attacks on detection systems that require no modification of the objects themselves. This opens new attack surfaces for applications such as surveillance and autonomous vehicles. The provided video demo is a strength that aids reproducibility of the claimed effect.

major comments (2)

[Abstract and §4] Abstract and §4 (Physical Experiments): The central claim of a successful physical attack is asserted, yet no quantitative metrics are supplied—e.g., no success rates, mAP drops, or tables comparing digital vs. physical performance under controlled variations in lighting, angle, distance, or camera model. This directly undermines the transfer from digital optimization to physical realization.
[§3] §3 (Patch Optimization): The non-local suppression effect is presented as a key novelty, but the manuscript provides no ablation or analysis (e.g., via attention maps or feature visualizations) showing the mechanism by which a localized patch affects distant objects; without this, the generality of the attack remains unclear.

minor comments (2)

Figure captions and the video link should explicitly state the camera model, printing method, and environmental conditions used in the physical tests to allow replication.
[§2] The related-work section should include a direct quantitative comparison table against prior physical patch attacks (e.g., those requiring object overlap) to clarify the advance.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their thoughtful review and constructive comments regarding the physical validation and mechanistic analysis of our adversarial patch attack. We provide point-by-point responses below.

read point-by-point responses

Referee: [Abstract and §4] Abstract and §4 (Physical Experiments): The central claim of a successful physical attack is asserted, yet no quantitative metrics are supplied—e.g., no success rates, mAP drops, or tables comparing digital vs. physical performance under controlled variations in lighting, angle, distance, or camera model. This directly undermines the transfer from digital optimization to physical realization.

Authors: We agree that quantitative metrics would provide stronger evidence for the physical transfer. The current manuscript supports the physical claim primarily through the video demonstration. In the revised manuscript, we will include quantitative evaluations, such as detection suppression rates in physical settings, to address this concern. We will also discuss the limitations in controlling all variables like camera models. revision: yes
Referee: [§3] §3 (Patch Optimization): The non-local suppression effect is presented as a key novelty, but the manuscript provides no ablation or analysis (e.g., via attention maps or feature visualizations) showing the mechanism by which a localized patch affects distant objects; without this, the generality of the attack remains unclear.

Authors: The non-local effect is highlighted as a novel aspect, but we recognize the value of providing analysis to explain the underlying mechanism. We will add visualizations, such as feature maps or attention analysis, in the revised version to demonstrate how the patch influences distant objects and to support the generality of the attack. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical attack demonstration only

full rationale

The paper is an empirical demonstration of a physical adversarial patch against YOLOv3 that suppresses detections non-locally. No derivation chain, equations, first-principles predictions, or fitted parameters renamed as outputs appear in the provided text. The central claim is a reported experimental result rather than a mathematical reduction. No self-citations are load-bearing for any derivation, and the work does not invoke uniqueness theorems or ansatzes from prior author work. The physical-transfer concern raised in the skeptic note is an evidence-strength issue, not a circularity issue per the evaluation rules.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only review supplies no equations, training details, or modeling choices; no free parameters, axioms, or invented entities can be identified.

pith-pipeline@v0.9.0 · 5656 in / 958 out tokens · 36157 ms · 2026-05-25T19:57:40.227283+00:00 · methodology

discussion (0)

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

Transferable Physical-World Adversarial Patches Against Pedestrian Detection Models
cs.CV 2026-04 unverdicted novelty 6.0

TriPatch generates transferable physical adversarial patches via multi-stage triplet loss, appearance consistency, and data augmentation to achieve higher attack success rates on pedestrian detectors than prior methods.

Reference graph

Works this paper leans on

8 extracted references · 8 canonical work pages · cited by 1 Pith paper · 8 internal anchors

[2]

Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimization

URL http://arxiv. org/abs/1805.12302. Brown, T. B., Man´e, D., Roy, A., Abadi, M., and Gilmer, J. Adversarial patch. CoRR, abs/1712.09665,

work page internal anchor Pith review Pith/arXiv arXiv
[3]

Adversarial Patch

URL http://arxiv.org/abs/1712.09665. Chen, S., Cornelius, C., Martin, J., and Chau, D. H. Ro- bust physical adversarial attack on faster R-CNN ob- ject detector. CoRR, abs/1804.05810,

work page internal anchor Pith review Pith/arXiv arXiv
[4]

ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector

URL http://arxiv.org/abs/1804.05810. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. X. Robust physical-world attacks on deep learning visual classiﬁcation. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1625–1634,

work page internal anchor Pith review Pith/arXiv arXiv 2018
[6]

Microsoft COCO: Common Objects in Context

URL http:// arxiv.org/abs/1405.0312. Liu, X., Yang, H., Song, L., Li, H., and Chen, Y . Dpatch: At- tacking object detectors with adversarial patches. CoRR, abs/1806.02299,

work page internal anchor Pith review Pith/arXiv arXiv
[7]

DPatch: An Adversarial Patch Attack on Object Detectors

URL http://arxiv.org/ abs/1806.02299. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations,

work page internal anchor Pith review Pith/arXiv arXiv
[9]

YOLOv3: An Incremental Improvement

URL http://arxiv.org/abs/1804.02767. Sharif, M., Bhagavatula, S., Bauer, L., and Reiter, M. K. Accessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communica- tions Security, pp. 1528–1540. ACM,

work page internal anchor Pith review Pith/arXiv arXiv 2016
[11]

A General Framework for Adversarial Examples with Objectives

URL http://arxiv.org/abs/1801.00349. Thys, S., Ranst, W. V ., and Goedem´e, T. Fooling automated surveillance cameras: adversarial patches to attack person detection. CoRR, abs/1904.08653,

work page internal anchor Pith review Pith/arXiv arXiv 1904
[12]

Fooling automated surveillance cameras: adversarial patches to attack person detection

URL http: //arxiv.org/abs/1904.08653. Xie, C., Wang, J., Zhang, Z., Zhou, Y ., Xie, L., and Yuille, A. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, pp. 1369–1378, 2017

work page internal anchor Pith review Pith/arXiv arXiv 1904

[1] [2]

Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimization

URL http://arxiv. org/abs/1805.12302. Brown, T. B., Man´e, D., Roy, A., Abadi, M., and Gilmer, J. Adversarial patch. CoRR, abs/1712.09665,

work page internal anchor Pith review Pith/arXiv arXiv

[2] [3]

Adversarial Patch

URL http://arxiv.org/abs/1712.09665. Chen, S., Cornelius, C., Martin, J., and Chau, D. H. Ro- bust physical adversarial attack on faster R-CNN ob- ject detector. CoRR, abs/1804.05810,

work page internal anchor Pith review Pith/arXiv arXiv

[3] [4]

ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector

URL http://arxiv.org/abs/1804.05810. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. X. Robust physical-world attacks on deep learning visual classiﬁcation. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1625–1634,

work page internal anchor Pith review Pith/arXiv arXiv 2018

[4] [6]

Microsoft COCO: Common Objects in Context

URL http:// arxiv.org/abs/1405.0312. Liu, X., Yang, H., Song, L., Li, H., and Chen, Y . Dpatch: At- tacking object detectors with adversarial patches. CoRR, abs/1806.02299,

work page internal anchor Pith review Pith/arXiv arXiv

[5] [7]

DPatch: An Adversarial Patch Attack on Object Detectors

URL http://arxiv.org/ abs/1806.02299. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations,

work page internal anchor Pith review Pith/arXiv arXiv

[6] [9]

YOLOv3: An Incremental Improvement

URL http://arxiv.org/abs/1804.02767. Sharif, M., Bhagavatula, S., Bauer, L., and Reiter, M. K. Accessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communica- tions Security, pp. 1528–1540. ACM,

work page internal anchor Pith review Pith/arXiv arXiv 2016

[7] [11]

A General Framework for Adversarial Examples with Objectives

URL http://arxiv.org/abs/1801.00349. Thys, S., Ranst, W. V ., and Goedem´e, T. Fooling automated surveillance cameras: adversarial patches to attack person detection. CoRR, abs/1904.08653,

work page internal anchor Pith review Pith/arXiv arXiv 1904

[8] [12]

Fooling automated surveillance cameras: adversarial patches to attack person detection

URL http: //arxiv.org/abs/1904.08653. Xie, C., Wang, J., Zhang, Z., Zhou, Y ., Xie, L., and Yuille, A. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, pp. 1369–1378, 2017

work page internal anchor Pith review Pith/arXiv arXiv 1904