Pith. sign in

REVIEW 2 major objections 2 minor 8 cited by

On Physical Adversarial Patches for Object Detection

T0 review · 2 major / 2 minor · reviewed 2026-05-25 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An adversarial patch placed anywhere in an image can cause an object detector to miss every object in the scene.

desk verdict The paper claims a non-overlapping physical patch that globally suppresses YOLOv3 detections, but supplies no numbers or transfer evidence to back the physical part. read the letter →

arxiv 1906.11897 v1 pith:JUA73VFT submitted 2019-06-20 cs.CV cs.CRcs.LGstat.ML

Mark Lee , Zico Kolter This is my paper · ORCID
classification cs.CVcs.CRcs.LGstat.ML
keywords adversarialpatchobjectdetectionphysicalattackYOLOv3globalsuppressionuniversal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper shows that a single adversarial patch, when placed at any location, can make the YOLOv3 detector fail to report virtually all objects present, including those distant from the patch. Earlier physical attacks required the patch to overlap or sit near the targets being hidden. The new method needs no alteration to the objects themselves. A reader should care because it identifies a way to disrupt detection systems without touching the things they are meant to find.

What carries the argument

The adversarial patch optimized to produce global suppression of object detections regardless of its position in the image.

What would settle it

Print the optimized patch, place it in a real scene containing visible objects, photograph the scene, and run the detector on the photo; continued detection of the objects would show the claim does not hold.

Watch

Extended reading notes

Core claim

We demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene.

Load-bearing premise

A patch optimized in digital simulation will still suppress detections after it is printed and photographed under real lighting, angles, and distances.

Editorial extensions

If this is right

  • Object detectors can be attacked without any change to the objects being detected.
  • A single patch can affect detections across the entire image rather than only locally.
  • Physical attacks become possible in scenes where modifying the objects themselves is impractical.
  • Detection systems must now defend against location-independent suppression effects.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The result suggests detectors may depend on global image statistics that a localized patch can override.
  • Similar patches could be tested on other detectors to determine whether the suppression effect is architecture-specific.
  • One could explore whether retraining with such patches improves robustness without harming normal accuracy.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 2 minor

Summary. The manuscript demonstrates an adversarial patch attack on object detectors (notably YOLOv3) in which a digitally optimized patch, when placed anywhere in the scene, suppresses detection of virtually all objects—even those distant from the patch—without requiring overlap with the targets. The work claims this effect transfers to the physical world after printing and real-world capture, supported by a video demonstration.

Significance. If the physical transfer holds with quantitative validation, the result would be significant because it enables non-local physical attacks on detection systems that require no modification of the objects themselves. This opens new attack surfaces for applications such as surveillance and autonomous vehicles. The provided video demo is a strength that aids reproducibility of the claimed effect.

major comments (2)
  1. [Abstract and §4] Abstract and §4 (Physical Experiments): The central claim of a successful physical attack is asserted, yet no quantitative metrics are supplied—e.g., no success rates, mAP drops, or tables comparing digital vs. physical performance under controlled variations in lighting, angle, distance, or camera model. This directly undermines the transfer from digital optimization to physical realization.
  2. [§3] §3 (Patch Optimization): The non-local suppression effect is presented as a key novelty, but the manuscript provides no ablation or analysis (e.g., via attention maps or feature visualizations) showing the mechanism by which a localized patch affects distant objects; without this, the generality of the attack remains unclear.
minor comments (2)
  1. Figure captions and the video link should explicitly state the camera model, printing method, and environmental conditions used in the physical tests to allow replication.
  2. [§2] The related-work section should include a direct quantitative comparison table against prior physical patch attacks (e.g., those requiring object overlap) to clarify the advance.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their thoughtful review and constructive comments regarding the physical validation and mechanistic analysis of our adversarial patch attack. We provide point-by-point responses below.

read point-by-point responses

  1. Referee: [Abstract and §4] Abstract and §4 (Physical Experiments): The central claim of a successful physical attack is asserted, yet no quantitative metrics are supplied—e.g., no success rates, mAP drops, or tables comparing digital vs. physical performance under controlled variations in lighting, angle, distance, or camera model. This directly undermines the transfer from digital optimization to physical realization.

    Authors: We agree that quantitative metrics would provide stronger evidence for the physical transfer. The current manuscript supports the physical claim primarily through the video demonstration. In the revised manuscript, we will include quantitative evaluations, such as detection suppression rates in physical settings, to address this concern. We will also discuss the limitations in controlling all variables like camera models. revision: yes

  2. Referee: [§3] §3 (Patch Optimization): The non-local suppression effect is presented as a key novelty, but the manuscript provides no ablation or analysis (e.g., via attention maps or feature visualizations) showing the mechanism by which a localized patch affects distant objects; without this, the generality of the attack remains unclear.

    Authors: The non-local effect is highlighted as a novel aspect, but we recognize the value of providing analysis to explain the underlying mechanism. We will add visualizations, such as feature maps or attention analysis, in the revised version to demonstrate how the patch influences distant objects and to support the generality of the attack. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: empirical attack demonstration only

full rationale

The paper is an empirical demonstration of a physical adversarial patch against YOLOv3 that suppresses detections non-locally. No derivation chain, equations, first-principles predictions, or fitted parameters renamed as outputs appear in the provided text. The central claim is a reported experimental result rather than a mathematical reduction. No self-citations are load-bearing for any derivation, and the work does not invoke uniqueness theorems or ansatzes from prior author work. The physical-transfer concern raised in the skeptic note is an evidence-strength issue, not a circularity issue per the evaluation rules.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

Abstract-only review supplies no equations, training details, or modeling choices; no free parameters, axioms, or invented entities can be identified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On Physical Adversarial Patches for Object Detection." pith.science (2026). https://pith.science/paper/JUA73VFT

@misc{pith2026190611897,
  author       = {Pith},
  title        = {Pith review of: On Physical Adversarial Patches for Object Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JUA73VFT}},
  note         = {Machine review of arXiv:1906.11897}
}
read the original abstract

In this paper, we demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene. A demo of the system can be found at https://youtu.be/WXnQjbZ1e7Y.

Figures

Figures reproduced from arXiv: 1906.11897 by the authors.

Figure 2
Figure 2. ROI plots for the unclipped case. Top row shows original. (a) Training Loss (Ours) (b) mAP-50 (Ours) (c) Training Loss (DPatch) (d) mAP-50 (DPatch) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Our method vs. DPatch for the clipped case. To verify that our patch attacks at the bounding box proposal level, we plot the pre-non-max suppression bounding box confidence scores for a random image, shown in [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 6
Figure 6. shows a printed version of our patch attacking YOLOv3 running real-time with a standard webcam. The patch was printed on regular printer paper and recorded un￾der natural lighting. While the patch is somewhat invariant to location, the patch generally has weaker influence on objects that are farther away, as seen in [PITH_FULL_IMAGE:figures/full_fig_p004_6.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: ROI plots for the clipped case. Top row shows original. improve significantly [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. AdvScene: Rethinking Adversarial Patch Evaluation Through Scene Robustness

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    AdvScene is a scene-grounded evaluation method using Adversarial Patch-to-Scene Embedding (APSE) to map the operational envelope of physical adversarial patches in reconstructed real environments.

  2. Physically Real-time Infrared Attack against Optical Flow Estimation Networks

    cs.CV 2026-07 reject novelty 6.0 of 10

    Infrared light arrays controlled by a learned generator can physically attack optical flow networks in real time, making tracked objects appear blank or chaotic.

  3. Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors

    cs.CV 2025-06 conditional novelty 6.0 of 10

    A universal adversarial patch placed below a traffic light can flip red detections to green on YOLO models, with partial real-world success on a full autonomous driving perception pipeline.

  4. SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models

    cs.CV 2025-05 conditional novelty 6.0 of 10

    SuperPure is an iterative GAN-super-resolution masking defense that reports higher robustness than PatchCleanser against localized and distributed adversarial patches at a small fraction of the compute.

  5. A Privacy Enhancing Technique to Evade Detection by Street Video Cameras Without Using Adversarial Accessories

    cs.CV 2025-01 conditional novelty 6.0 of 10

    Pedestrians can lower a detector's confidence by walking through spatial 'blind spots' found from confidence heatmaps, and a location-based threshold can partially counter this.

  6. Towards an End-to-End (E2E) Adversarial Learning and Application in the Physical World

    cs.CV 2025-01 conditional novelty 6.0 of 10

    Adversarial patches can be trained and applied entirely in the physical world through a projector-camera feedback loop, avoiding the transferability loss of printed stickers.

  7. A Real-Time Defense Against Object Vanishing Adversarial Patch Attacks for Object Detection in Autonomous Vehicles

    cs.CV 2024-12 conditional novelty 6.0 of 10

    ADAV uses temporal consistency between video frames to detect and mask object-vanishing adversarial patches in real time.

  8. Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling

    cs.CV 2024-12 reject novelty 5.0 of 10

    A tiling and scaling placement plus a borderline false-positive loss reduces true-positive face detections for remote adversarial patches, but standard metrics show it underperforms prior work.

Reference graph

Works this paper leans on

8 extracted references · 8 canonical work pages · cited by 8 Pith papers

  1. [2]

    Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimization

    URL http://arxiv. org/abs/1805.12302. Brown, T. B., Man´e, D., Roy, A., Abadi, M., and Gilmer, J. Adversarial patch. CoRR, abs/1712.09665,

    work page Pith review arXiv

  2. [3]

    Adversarial Patch

    URL http://arxiv.org/abs/1712.09665. Chen, S., Cornelius, C., Martin, J., and Chau, D. H. Ro- bust physical adversarial attack on faster R-CNN ob- ject detector. CoRR, abs/1804.05810,

    work page Pith review arXiv

  3. [4]

    ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector

    URL http://arxiv.org/abs/1804.05810. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. X. Robust physical-world attacks on deep learning visual classification. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1625–1634,

    work page Pith review arXiv 2018

  4. [6]

    Microsoft COCO: Common Objects in Context

    URL http:// arxiv.org/abs/1405.0312. Liu, X., Yang, H., Song, L., Li, H., and Chen, Y . Dpatch: At- tacking object detectors with adversarial patches. CoRR, abs/1806.02299,

    work page Pith review arXiv

  5. [7]

    DPatch: An Adversarial Patch Attack on Object Detectors

    URL http://arxiv.org/ abs/1806.02299. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations,

    work page Pith review arXiv

  6. [9]

    YOLOv3: An Incremental Improvement

    URL http://arxiv.org/abs/1804.02767. Sharif, M., Bhagavatula, S., Bauer, L., and Reiter, M. K. Accessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communica- tions Security, pp. 1528–1540. ACM,

    work page Pith review arXiv 2016

  7. [11]

    A General Framework for Adversarial Examples with Objectives

    URL http://arxiv.org/abs/1801.00349. Thys, S., Ranst, W. V ., and Goedem´e, T. Fooling automated surveillance cameras: adversarial patches to attack person detection. CoRR, abs/1904.08653,

    work page Pith review arXiv 1904

  8. [12]

    Fooling automated surveillance cameras: adversarial patches to attack person detection

    URL http: //arxiv.org/abs/1904.08653. Xie, C., Wang, J., Zhang, Z., Zhou, Y ., Xie, L., and Yuille, A. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, pp. 1369–1378, 2017

    work page Pith review arXiv 1904

Pith tools

Reviewed May 25, 2026 · model on record in the stance chip above.