Pith. sign in

REVIEW 4 major objections 6 minor 59 references

AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systems

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes a joint 2D–3D adversarial training framework whose printed clothing textures evade modern pedestrian detectors in physical tests, with an average attack success rate of 70.13% on YOLOv12.

desk verdict The paper's headline physical claim is actually a digital closed-box result; the framework and digital evaluation are solid, but the physical claims need major revision. read the letter →

arxiv 2505.16402 v2 pith:OQIZQBX2 submitted 2025-05-22 cs.CV

Yuanhao Huang , Yilong Ren , Jinlei Wang , Lujia Huo , Xuesong Bai , Jinchuan Zhang , Haiyan Yu This is my paper · ORCID
classification cs.CV
keywords adversarialpatchphysicalattackpedestriandetectionobjectautonomousdrivingperception3Drenderingnon-rigidclothdeformationsuccessrate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper seeks to establish that physical-world adversarial patches for pedestrian detectors become far more reliable when the patch is optimized jointly in ordinary 2D images and in rendered 3D scenes that mimic real street conditions. It introduces AdvReal, a training pipeline that adds stress-based cloth-wrinkle modeling, viewpoint and scale matching, and relighting to the usual patch optimization, then prints the resulting texture onto clothing. The reported result is an average attack success rate of 70.13% against YOLOv12 in physical scenarios, compared with 21.65% for T-SEA and 19.70% for AdvTexture, with success above 90% at four meters from both frontal and oblique views. If the transfer from synthetic renders to real clothing is genuine, the framework offers a practical way to stress-test the pedestrian perception modules of autonomous vehicles before deployment.

What carries the argument

The load-bearing mechanism is a joint 2D–3D adversarial optimization pipeline with a realism-enhancement module. Stress-tensor estimates over garment mesh vertices (Eqs. 2–8) identify fabric regions under high tension, place spatially separated control points there, and apply noise-injected, stress-bounded deformation to generate natural wrinkles. A time-space mapping step derives camera distance, elevation, and azimuth from bounding-box sequences so the rendered human matches the background's scale and perspective, and a relighting step (Algorithm 1, Eq. 10) optimizes contrast, brightness, and bias coefficients against the structural similarity (SSIM) of the real background. Both 2D and 3D synthesized images are fed to the victim detector, and the patch is updated by the weighted detection loss $L_{total} = \mu_1 L_{det}^{patch} + \mu_2 L_{det}^{real} + \mu_3 L_{tv}$ (Eq. 17). Stochastic-depth-style fusion of identity and stacked-layer outputs in the detector's residual blocks, applied to forward and backward passes, diversifies gradients during training and supports transfer to unseen detectors.

What would settle it

Print the released AdvReal patch, have subjects wear it in an independently run test with a different camera, different body types, and street backgrounds not used in training, and measure the attack success rate on YOLOv12 under the paper's distance and lighting conditions; if the 70% physical ASR cannot be reproduced and the rate falls to the level of a random texture, the sim-to-real transfer claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that realistic rendering, not just stronger optimization, is what makes adversarial patches survive the trip from a computer monitor to a printed garment. AdvReal trains a patch on 2D pedestrian images, then renders the same patch on a deformable 3D human mesh; stress estimates over the garment mesh place control points in high-wrinkle regions, a time-space mapping step aligns the rendered person to the perspective and scale of real background frames, and a structural-similarity-based relighting step adjusts brightness and contrast so the rendered person looks like part of the scene. Detection loss is computed on both the 2D and 3D synthesized images, with a stochastic-depth-style regularization that perturbs forward and backward passes through the detector's residual blocks to improve transferability. The authors report that this combination raises physical attack success rates on modern YOLO detectors far above existing patch methods, and that class-activation visualizations show the patch redirects the detector's attention away from the person's body.

Load-bearing premise

The whole approach depends on the computer-rendered 3D human, with simulated wrinkles and lighting, being a faithful stand-in for a real person wearing printed fabric in a real street scene; if real cloth, body motion, camera noise, or illumination differ enough from the render, the optimized textures will not transfer to the physical world.

Editorial extensions

If this is right

  • If the reported physical ASR transfers beyond the authors' test setup, printed AdvReal clothing provides a repeatable way to audit pedestrian detectors before deployment, since the code and textures are released.
  • The 70.13% physical ASR on YOLOv12 implies that one-stage modern YOLO detectors remain vulnerable to localized texture attacks, so defenses should target attention hijacking rather than pixel-level noise alone.
  • Because the paper reports stable ASR across distances and lighting conditions, the same patch may remain effective as a vehicle's camera approaches a pedestrian, rather than only at a fixed shooting distance.
  • The digital transfer across YOLOv2 through YOLOv12, Faster R-CNN, and D-DETR suggests that 3D realism training reduces the patch's overfitting to the glass-box detector's feature space.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the sim-to-real transfer is the crux, so an independent replication that varies body shape, garment fit, fabric type, and camera sensor would show whether the reported physical ASR is a property of the training method or of the specific printed samples.
  • Beyond the paper: the attention-hijacking behavior the paper visualizes suggests a testable defensive extension, such as training detectors to penalize attention concentrated on patch-like regions, though the paper does not evaluate such a defense.
  • Beyond the paper: the authors' observation that the patch works at macro scale and at low resolution implies that minor printing misalignment or laundering wear may degrade it less than high-frequency adversarial patches, a property that could be measured directly.
  • Beyond the paper: because the physical tests use fixed cameras and recorded video, a natural next experiment is a live test with a moving vehicle and onboard cameras to see whether the patch's robustness survives real optical pipelines and motion blur.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes AdvReal, a framework for generating physical adversarial patches against pedestrian detectors. The method jointly optimizes adversarial textures in 2D image space and 3D mesh space, incorporating physics-inspired non-rigid cloth deformation (Eqs. 2-8), a time-space/relighting mapping module (Section 3.4, Algorithm 1), and ShakeDrop-style stochastic gradient regularization. The authors evaluate on the INRIA and nuScenes datasets, compare against AdvPatch, AdvTshirt, NatPatch, AdvTexture, AdvCaT, and T-SEA, and report both digital and physical experiments. The abstract claims a 70.13% ASR on YOLOv12 in physical scenarios and >90% ASR at 4 meters under frontal and oblique views.

Significance. If the physical claims were properly supported, the paper would make a useful contribution to adversarial robustness evaluation for autonomous driving perception: the joint 2D-3D optimization with explicit cloth deformation and relighting is a plausible way to improve physical transferability, and the digital experiments show large margins over baselines (e.g., 70.13% vs. 21.65% for T-SEA on YOLOv12 in Table 3). The authors also provide code and a demo video, which aids reproducibility. However, the physical evidence for the central claim is currently weak: the physical experiments use only YOLOv5 as the victim model, lack a clean-clothing control, and report no confidence intervals or per-cell trial counts. The current manuscript does not substantiate the abstract's physical YOLOv12 claim or the >90% at-4m claim.

major comments (4)
  1. [Abstract; Section 4.2.1 (Table 3); Section 4.7.2 (Tables 10-11)] The abstract states that AdvReal achieves 'an average attack success rate (ASR) of 70.13% on YOLOv12 in physical scenarios' and exceeds 90% under frontal and oblique views at 4 meters. However, the 70.13% ASR appears in Table 3, which is the digital closed-box experiment, not a physical experiment. The physical experiments in Tables 10-11 do not include any YOLOv12 row, and Section 4.7.2 explicitly states that the victim model was YOLOv5. No angle-by-distance disaggregated physical data supporting the >90% at-4m claim is presented anywhere in Section 4.7. This mismatch between the abstract and the reported experimental record must be resolved, either by removing the unsupported physical YOLOv12 claim or by providing the corresponding physical experiments.
  2. [Section 4.7.2 (Tables 10-11)] The physical distance experiments lack a clean-clothing or non-adversarial control condition, so the reported ASR values may include natural detection failures at small scale (especially at 4 m), and the contribution of the adversarial patch to the miss rate is not identified. In addition, the text says 'Each patch was taken 111 times at different distances,' but the percentages in Tables 10-11 imply denominators of only about 37 per distance cell (e.g., 81.08% = 30/37, 35.14% = 13/37). No confidence intervals or per-cell sample sizes are reported. Without such statistical reporting, the observed ordering of methods in the physical tables is not supported.
  3. [Section 4.1.2; Section 4.7.2] Section 4.1.2 states that 'we conduct closed-box attack tests on SOTA detectors (YOLO-v8, v11, v12) in the physical world for the first time,' but the physical experiments in Section 4.7.2 only use YOLOv5 as the victim model. Tables 10-11 list patches trained on different detectors (YOLOv2, YOLOv3, YOLOv5, F-RCNN, D-DETR) but evaluate all of them with YOLOv5. The claim about physical closed-box tests on YOLOv8/v11/v12 is therefore not supported. This should be corrected to avoid overstating the physical evaluation.
  4. [Table 7] In Table 7, the F1-score reported for AdvReal on YOLOv8 is 70.26%, but the precision (56.55%) and recall (32.68%) in the same row imply F1 = 2·56.55·32.68/(56.55+32.68) ≈ 41.4%, not 70.26%. This numerical inconsistency affects the transferability comparison and should be corrected. The corresponding text in Section 4.5.3 appears to rely on these numbers.
minor comments (6)
  1. [Section 3.3, Eq. (6)] Equation (6) appears garbled: '|C|=max{Nmax, j ρ|S|/ko}' contains undefined symbols (j, k, o), and the text immediately before it refers to N_min while the equation uses N_max. Please clarify the intended formula and the roles of all parameters.
  2. [Algorithm 1] In Algorithm 1, the update line 'ε←ε−η∇εLtot, ε=[α,β,θ]' is followed by clipping only α and β, and the condition 'α<[α_l,α_h]' is not a valid comparison. The algorithm would be clearer with explicit bounds checks for each parameter, including θ.
  3. [Table 5, caption and text] Table 5 reports the ablation results but does not state which detector, dataset, or evaluation protocol (digital or physical, glass-box or closed-box) is used. The column header 'AC↑' is also inconsistent with the text, which describes lower AC as better.
  4. [Section 3.2.3, Section 3.5.3] The term 'closed-box' is used to describe the attack in Section 3.5.3, where the detector's gradients are used for optimization. This is white-box access by standard terminology; the later use of 'closed-box' to mean a held-out detector not used in training (Section 4.1.5) should be distinguished, or a different term such as 'black-box transfer' should be used.
  5. [Section 4.7.2] The sentence 'For the adversarial patches of this paper trained with different target detectors. DDETR is used as a target detector of the transfromer architecture.' is grammatically incomplete and contains typos ('transfromer'). It should be rewritten for clarity.
  6. [Figure 9 caption] The caption of Figure 9 does not state whether the angle-dependent results are from physical or digital experiments, or which victim detector was used. This should be clarified to avoid ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported attack numbers are benchmark measurements, not quantities that reduce to the method's fitted inputs by construction.

full rationale

AdvReal's derivation chain is a standard adversarial-patch training pipeline: a texture is optimized by minimizing the joint detection-plus-smoothness loss in Eq. 17 using 2D INRIA images and 3D nuScenes-rendered pedestrians, and the resulting texture is then evaluated on held-out digital test images and on printed clothing in physical trials. No constant is fitted to the reported attack success rate: the loss weights (mu_1=1.0, mu_2=1.0, mu_3=2.5) are fixed and taken from the published T-SEA weighting strategy; the non-rigid deformation thresholds (sigma=0.8, gamma=0.01, rho=0.2) are hand-set; and the relighting parameters (alpha, beta, theta) are optimized per training image for SSIM-based realism, not for maximizing the final ASR. The baseline comparisons in Table 3, the ablation study, and the physical-world tables all use the same evaluation protocol and do not re-fit any parameter to the headline numbers. The paper's abstract states that AdvReal 'achieves an average attack success rate (ASR) of 70.13% on YOLOv12 in physical scenarios,' whereas the 70.13% figure actually comes from the digital closed-box evaluation in Table 3 and the physical experiments in Section 4.7 are run with YOLOv5 as the victim model. That is a reporting/validation mismatch and an unsupported extrapolation, but it is not a circular reduction: the claim is not equivalent to its inputs by construction, and no fitted parameter has been renamed as a prediction. Self-citations appear in related work and application contexts (e.g., refs. [31] and [33]) but are not load-bearing for the derivation, and no uniqueness theorem or ansatz is imported from the authors' prior work to force the choice of method. Accordingly, the central claim has independent empirical content and the circularity score is 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim does not define any new physical constant or fit a model to the target ASR. The hand-chosen constants are training and evaluation settings. The load-bearing assumptions are about whether 3D rendering and relighting adequately simulate the physical world, and whether fixed glass-box gradients remain informative for closed-box transfer. No invented entities are introduced.

free parameters (5)
  • Non-rigid deformation parameters = sigma=0.8, gamma=0.01, rho=0.2
    Hand-set constants in Eqs. 3 and 5 control stress threshold, control-point spacing, and number of controls; they shape the cloth folds in 3D renders and thereby affect physical robustness.
  • Loss weights = mu1=1.0, mu2=1.0, mu3=2.5
    Eq. 17 weights 2D detection loss, 3D detection loss, and TV loss; chosen by hand following T-SEA, they directly control the optimized patch.
  • ASR evaluation thresholds = IoU < 0.5, confidence < 0.5
    Section 4.1.3 defines attack success with these thresholds; all reported ASR numbers depend on them and Table 4 shows strong sensitivity to IoU threshold.
  • Relighting optimization hyperparameters = not reported
    Algorithm 1 requires regularization weights, learning rate, and iteration count; without them the relighting step cannot be replicated exactly.
  • Training hyperparameters = epochs=800, batch=8, lr=0.01, patch=300x300, seed=42, distance=1-4m
    Standard chosen settings; digital results depend on them, though they are not fitted to the target ASR.
assumptions (5)
  • domain assumption Pretrained MS COCO detectors used as fixed glass-box models provide differentiable gradients that reliably guide patch optimization.
    Section 3.5.3 treats the detector as a fixed closed-box for gradient propagation; if gradients are uninformative for two-stage or transformer detectors, the transferability claims weaken.
  • domain assumption The stress-based non-rigid deformation model (Eqs. 2-8) produces cloth wrinkles representative of real garments.
    Section 3.3 assumes stress-weighted control points plus Gaussian perturbation capture real fabric behavior; if not, patches trained on rendered folds transfer poorly to physical clothing.
  • domain assumption SSIM-based relighting with linear brightness/contrast and bias (Eq. 10) is sufficient to simulate real illumination variation between rendered humans and backgrounds.
    Section 3.4.2 matches global contrast and brightness only; it does not model shadows, camera response curves, or print color gamut.
  • domain assumption Randomly split nuScenes backgrounds and INRIA persons represent deployment conditions for AV pedestrian detection.
    Section 4.1.1; the scene distribution determines whether the reported physical ASR generalizes beyond the test set.
  • standard math Gradient descent and sign-gradient updates optimize the patch toward lower detection loss.
    Section 3.5.3 Eq. 16; standard PGD-style optimization, assumed to converge adequately in 800 training epochs.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systems." pith.science (2026). https://pith.science/paper/OQIZQBX2

@misc{pith2026250516402,
  author       = {Pith},
  title        = {Pith review of: AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OQIZQBX2}},
  note         = {Machine review of arXiv:2505.16402}
}
read the original abstract

Autonomous vehicles are typical complex intelligent systems with artificial intelligence at their core. However, perception methods based on deep learning are extremely vulnerable to adversarial samples, resulting in security accidents. How to generate effective adversarial examples in the physical world and evaluate object detection systems is a huge challenge. In this study, we propose a unified joint adversarial training framework for both 2D and 3D domains, which simultaneously optimizes texture maps in 2D image and 3D mesh spaces to better address intra-class diversity and real-world environmental variations. The framework includes a novel realistic enhanced adversarial module, with time-space and relighting mapping pipeline that adjusts illumination consistency between adversarial patches and target garments under varied viewpoints. Building upon this, we develop a realism enhancement mechanism that incorporates non-rigid deformation modeling and texture remapping to ensure alignment with the human body's non-rigid surfaces in 3D scenes. Extensive experiment results in digital and physical environments demonstrate that the adversarial textures generated by our method can effectively mislead the target detection model. Specifically, our method achieves an average attack success rate (ASR) of 70.13% on YOLOv12 in physical scenarios, significantly outperforming existing methods such as T-SEA (21.65%) and AdvTexture (19.70%). Moreover, the proposed method maintains stable ASR across multiple viewpoints and distances, with an average attack success rate exceeding 90% under both frontal and oblique views at a distance of 4 meters. This confirms the method's strong robustness and transferability under multi-angle attacks, varying lighting conditions, and real-world distances. The demo video and code can be obtained at https://github.com/Huangyh98/AdvReal.git.

Figures

Figures reproduced from arXiv: 2505.16402 by the authors.

Figure 1
Figure 1. In response to multi-dimensional realistic challenges, performance of proposed adversarial patches in the physical world. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the proposed adversarial attack method. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Schematic diagram and results display of non-rigid surfaces modeling. (a) Mesh of the simulated cloth, with control points strategically [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Flowchart of spatiotemporal mapping. (a) Select consecutive candidate bounding boxes that satisfy the perspective relationship in the [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Adversarial patches of other advanced algorithms and ours. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: ASRs with different method and IOU thresholds in digital world. The confidence threshold is set as 0.5. 4.5. Transferability 4.5.1. Transfer confusion matrix As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]
Figure 7
Figure 7. Figure 7: ASRs with different detectors and confidence thresholds in digital world. The glass-box detector used for adversarial training is marked on the top of each sub-image, and lines of different colors represent the corresponding detectors used for evaluation. reasonably we…
Figure 8
Figure 8. Figure 8: NAPGuard detection visualizations. Patches with aggressive features yield stronger activation. AdvReal maintains moderate detectability. [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: ASRs of adversarial patches trained with di [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Visual evaluation using Grad-CAM in the digital and physical worlds. (a) and (b) are visualization results under di [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]
Figure 11
Figure 11. Figure 11: Localized attention shift visualized by Grad-CAM with zoom-in regions. [PITH_FULL_IMAGE:figures/full_fig_p022_11.png]
Figure 12
Figure 12. Figure 12: Visualization of the proposed adversarial patch and other adversarial patches in the physical world. (a) Glass-box is YOLOv2, closed [PITH_FULL_IMAGE:figures/full_fig_p022_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

59 extracted references · 42 canonical work pages

  1. [1]

    Adversarial patch,

    T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,”arXiv preprint arXiv:1712.09665, 2017

    arXiv 2017

  2. [2]

    Camopatch: An evolutionary strategy for generating camoflauged adversarial patches,

    P. Williams and K. Li, “Camopatch: An evolutionary strategy for generating camoflauged adversarial patches,” Advances in Neural Information Processing Systems, vol. 36, 2024

    work page 2024

  3. [3]

    Stealthy and effective physical adversarial attacks in autonomous driving,

    M. Zhou, W. Zhou, J. Huang, J. Yang, M. Du, and Q. Li, “Stealthy and effective physical adversarial attacks in autonomous driving,”IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  4. [4]

    Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,

    X. Wei, Y . Guo, J. Yu, and B. Zhang, “Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,”IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 7, pp. 9041–9054, 2022

    work page 2022

  5. [5]

    Eap: An effective black-box impersonation adversarial patch attack method on face recognition in the physical world,

    X. Liu, F. Shen, J. Zhao, and C. Nie, “Eap: An effective black-box impersonation adversarial patch attack method on face recognition in the physical world,”Neurocomputing, vol. 580, p. 127517, 2024

    work page 2024

  6. [6]

    Fooling human detectors via robust and visually natural adversarial patches,

    D. Zhou, H. Qu, N. Wang, C. Peng, Z. Ma, X. Yang, and X. Gao, “Fooling human detectors via robust and visually natural adversarial patches,”Neurocomputing, vol. 616, p. 128915, 2025

    work page 2025

  7. [7]

    Deep learning-based few-shot person re-identification from top-view rgb and depth images,

    A. Abed, B. Akrout, and I. Amous, “Deep learning-based few-shot person re-identification from top-view rgb and depth images,”Neural Computing and Applications, vol. 36, no. 31, pp. 19 365–19 382, 2024

    work page 2024

  8. [8]

    Fooling automated surveillance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedemé, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    work page 2019

Show all 59 references
  1. [9]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,”IEEE transactions on pattern analysis and machine intelligence, vol. 39, no. 6, pp. 1137–1149, 2016

    2016

  2. [11]

    End-to-end object detection with transformers,

    N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and S. Zagoruyko, “End-to-end object detection with transformers,” inEuropean conference on computer vision. Springer, 2020, pp. 213–229

    2020

  3. [12]

    Adversarial texture for fooling person detectors in the physical world,

    Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, and X. Hu, “Adversarial texture for fooling person detectors in the physical world,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 13 307–13 316

    2022

  4. [13]

    Learning transferable 3d adversarial cloaks for deep trained detectors,

    A. Maesumi, M. Zhu, Y . Wang, T. Chen, Z. Wang, and C. Bajaj, “Learning transferable 3d adversarial cloaks for deep trained detectors,”arXiv preprint arXiv:2104.11101, 2021

    2021 arXiv

  5. [14]

    Adversarial t-shirt! evading person detectors in a physical world,

    K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y . Chen, Y . Wang, and X. Lin, “Adversarial t-shirt! evading person detectors in a physical world,” inComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16. Springer, 2...

    2020

  6. [15]

    Adversarial objectness gradient attacks in real-time object detection systems,

    K.-H. Chow, L. Liu, M. Loper, J. Bae, M. E. Gursoy, S. Truex, W. Wei, and Y . Wu, “Adversarial objectness gradient attacks in real-time object detection systems,” in2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications...

    2020

  7. [16]

    Naturalistic physical adversarial patch for object detectors,

    Y .-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, and W.-H. Cheng, “Naturalistic physical adversarial patch for object detectors,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7848–7857

    2021

  8. [17]

    Dap: A dynamic adversarial patch for evading person detectors,

    A. Guesmi, R. Ding, M. A. Hanif, I. Alouani, and M. Shafique, “Dap: A dynamic adversarial patch for evading person detectors,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 595–24 604

    2024

  9. [18]

    Pad: Patch-agnostic defense against adversarial patch attacks,

    L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou, “Pad: Patch-agnostic defense against adversarial patch attacks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 472– 24 481

    2024

  10. [19]

    Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,

    Z. Hu, W. Chu, X. Zhu, H. Zhang, B. Zhang, and X. Hu, “Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 975–16 984

    2023

  11. [20]

    Reap: a large-scale realistic adversarial patch benchmark,

    N. Hingun, C. Sitawarin, J. Li, and D. Wagner, “Reap: a large-scale realistic adversarial patch benchmark,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4640–4651

    2023

  12. [21]

    nuscenes: A multimodal dataset for autonomous driving,

    H. Caesar, V . Bankiti, A. H. Lang, S. V ora, V . E. Liong, Q. Xu, A. Krishnan, Y . Pan, G. Baldan, and O. Beijbom, “nuscenes: A multimodal dataset for autonomous driving,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11 621–11 631

    2020

  13. [22]

    Yolo9000: better, faster, stronger,

    J. Redmon and A. Farhadi, “Yolo9000: better, faster, stronger,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 7263–7271

    2017

  14. [23]

    Yolov3: An incremental improvement,

    ——, “Yolov3: An incremental improvement,” 2018. [Online]. Available: https://arxiv.org/abs/1804.02767

    2018 arXiv

  15. [24]

    ultralytics/yolov5: v3. 0,

    G. Jocher, A. Stoken, J. Borovec, L. Changyu, A. Hogan, L. Diaconu, J. Poznanski, L. Yu, P. Rai, R. Ferriday et al., “ultralytics/yolov5: v3. 0,”Zenodo, 2020

    2020

  16. [25]

    Deformable detr: Deformable transformers for end-to-end object detection,

    X. Zhu, W. Su, L. Lu, B. Li, X. Wang, and J. Dai, “Deformable detr: Deformable transformers for end-to-end object detection,”arXiv preprint arXiv:2010.04159, 2020

    2010 arXiv

  17. [26]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” 2016. [Online]. Available: https://arxiv.org/abs/1506.01497

    2016 arXiv

  18. [27]

    T-sea: Transfer-based self-ensemble attack on object detection,

    H. Huang, Z. Chen, H. Chen, Y . Wang, and K. Zhang, “T-sea: Transfer-based self-ensemble attack on object detection,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 20 514–20 523

    2023

  19. [28]

    Grad-cam: Visual explanations from deep networks via gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” inProceedings of the IEEE international conference on computer vision, 2017, pp. 618–626

    2017

  20. [29]

    Fca: Learning a 3d full- coverage vehicle camouflage for multi-view physical adversarial attack,

    D. Wang, T. Jiang, J. Sun, W. Zhou, Z. Gong, X. Zhang, W. Yao, and X. Chen, “Fca: Learning a 3d full- coverage vehicle camouflage for multi-view physical adversarial attack,” inProceedings of the AAAI conference on artificial intelligence, vol. 36, no. 2, 2022, pp. 2414–2422

    2022

  21. [30]

    Intelligent amphibious ground-aerial vehicles: State of the art technology for future transportation,

    X. Zhang, J. Huang, Y . Huang, K. Huang, L. Yang, Y . Han, L. Wang, H. Liu, J. Luo, and J. Li, “Intelligent amphibious ground-aerial vehicles: State of the art technology for future transportation,”IEEE Transactions on Intelligent Vehicles, vol. 8, no. 1, pp. 970–987, 2022. 26

    2022

  22. [31]

    An ar-based meta vehicle road cooperation testing systems: framework, components modeling and an implementation example,

    X. Bai, P. Dong, Y . Huang, S. Kumari, H. Yu, and Y . Ren, “An ar-based meta vehicle road cooperation testing systems: framework, components modeling and an implementation example,”IEEE Internet of Things Journal, 2024

    2024

  23. [32]

    Street-view image generation from a bird’s-eye view layout,

    A. Swerdlow, R. Xu, and B. Zhou, “Street-view image generation from a bird’s-eye view layout,”IEEE Robotics and Automation Letters, 2024

    2024

  24. [33]

    Advswap: Covert adversarial perturba- tion with high frequency info-swapping for autonomous driving perception,

    Y . Huang, Q. Zhang, J. Xing, M. Cheng, H. Yu, Y . Ren, and X. Xiong, “Advswap: Covert adversarial perturba- tion with high frequency info-swapping for autonomous driving perception,” in2024 IEEE 27th International Conference on Intelligent Transportation Systems (ITSC), 2024,...

    2024

  25. [34]

    Attention-disentangled re-id network for unsupervised domain adaptive person re-identification,

    L. Wang, J. Huang, L. Huang, F. Wang, C. Gao, J. Li, F. Xiao, and D. Luo, “Attention-disentangled re-id network for unsupervised domain adaptive person re-identification,”Knowledge-Based Systems, vol. 304, p. 112583, 2024

    2024

  26. [35]

    Adversarial examples for vehicle detection with projection transformation,

    J. Cui, W. Guo, H. Huang, X. Lv, H. Cao, and H. Li, “Adversarial examples for vehicle detection with projection transformation,”IEEE Transactions on Geoscience and Remote Sensing, 2024

    2024

  27. [36]

    Toward robust 3d perception for autonomous vehicles: A review of adversarial attacks and countermeasures,

    K. Y . Mahima, A. G. Perera, S. Anavatti, and M. Garratt, “Toward robust 3d perception for autonomous vehicles: A review of adversarial attacks and countermeasures,”IEEE Transactions on Intelligent Transportation Systems, 2024

    2024

  28. [37]

    Deep networks with stochastic depth,

    G. Huang, Y . Sun, Z. Liu, D. Sedra, and K. Q. Weinberger, “Deep networks with stochastic depth,” inComputer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceed- ings, Part IV 14. Springer, 2016, pp. 646–661

    2016

  29. [38]

    Uv-attack: Physical-world adversarial attacks for person detection via dynamic-nerf-based uv mapping,

    Y . Li, W. Zhang, K. Liang, and B. Xiao, “Uv-attack: Physical-world adversarial attacks for person detection via dynamic-nerf-based uv mapping,”arXiv preprint arXiv:2501.05783, 2025

    2025

  30. [39]

    Physical adversarial attack meets computer vision: A decade survey,

    H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang, “Physical adversarial attack meets computer vision: A decade survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    2024

  31. [40]

    Force-based representation for non-rigid shape and elastic model estimation,

    A. Agudo and F. Moreno-Noguer, “Force-based representation for non-rigid shape and elastic model estimation,” IEEE transactions on pattern analysis and machine intelligence, vol. 40, no. 9, pp. 2137–2150, 2017

    2017

  32. [41]

    Garnet++: Im- proving fast and accurate static 3d cloth draping by curvature loss,

    E. Gundogdu, V . Constantin, S. Parashar, A. Seifoddini, M. Dang, M. Salzmann, and P. Fua, “Garnet++: Im- proving fast and accurate static 3d cloth draping by curvature loss,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 1, pp. 181–195, 2020

    2020

  33. [42]

    Ultralytics yolov8,

    G. Jocher, A. Chaurasia, and J. Qiu, “Ultralytics yolov8,” 2023. [Online]. Available: https://github.com/ ultralytics/ultralytics

    2023

  34. [43]

    Ultralytics yolo11,

    G. Jocher and J. Qiu, “Ultralytics yolo11,” 2024. [Online]. Available: https://github.com/ultralytics/ultralytics

    2024

  35. [44]

    Yolov12: Attention-centric real-time object detectors,

    Y . Tian, Q. Ye, and D. Doermann, “Yolov12: Attention-centric real-time object detectors,”arXiv preprint arXiv:2502.12524, 2025

    2025 arXiv

  36. [45]

    Shakedrop regularization,

    Y . Yamada, M. Iwamura, and K. Kise, “Shakedrop regularization,” 2018. [Online]. Available: https: //openreview.net/forum?id=S1NHaMW0b

    2018

  37. [46]

    Histograms of oriented gradients for human detection,

    N. Dalal and B. Triggs, “Histograms of oriented gradients for human detection,” in2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05), vol. 1. Ieee, 2005, pp. 886–893

    2005

  38. [47]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13. Springer, 201...

    2014

  39. [48]

    Black-box adversarial attacks against image quality assessment models,

    Y . Ran, A.-X. Zhang, M. Li, W. Tang, and Y .-G. Wang, “Black-box adversarial attacks against image quality assessment models,”Expert Systems with Applications, vol. 260, p. 125415, 2025

    2025

  40. [49]

    So-yolov8: A novel deep learning-based approach for small object detection with yolo beyond coco,

    K. J. Giriet al., “So-yolov8: A novel deep learning-based approach for small object detection with yolo beyond coco,”Expert Systems with Applications, p. 127447, 2025

    2025

  41. [50]

    State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems,

    J. Fang, Y . Jiang, C. Jiang, Z. L. Jiang, C. Liu, and S.-M. Yiu, “State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems,”Expert Systems with Applications, p. 123761, 2024

    2024

  42. [51]

    Evaluating adversarial attacks on driving safety in vision- based autonomous vehicles,

    J. Zhang, Y . Lou, J. Wang, K. Wu, K. Lu, and X. Jia, “Evaluating adversarial attacks on driving safety in vision- based autonomous vehicles,”IEEE Internet of Things Journal, vol. 9, no. 5, pp. 3443–3456, 2021

    2021

  43. [52]

    A transformer-based adversarial network frame- work for steganography,

    C. Xiao, S. Peng, L. Zhang, J. Wang, D. Ding, and J. Zhang, “A transformer-based adversarial network frame- work for steganography,”Expert Systems with Applications, vol. 269, p. 126391, 2025

    2025

  44. [53]

    Mining the benefits of two-stage and one-stage hoi detection,

    A. Zhang, Y . Liao, S. Liu, M. Lu, Y . Wang, C. Gao, and X. Li, “Mining the benefits of two-stage and one-stage hoi detection,”Advances in Neural Information Processing Systems, vol. 34, pp. 17 209–17 220, 2021

    2021

  45. [54]

    A survey and evaluation of adversarial attacks in object detection,

    K. N. T. Nguyen, W. Zhang, K. Lu, Y .-H. Wu, X. Zheng, H. L. Tan, and L. Zhen, “A survey and evaluation of adversarial attacks in object detection,”IEEE Transactions on Neural Networks and Learning Systems, 2025

    2025

  46. [55]

    Adversarial attack and defense of yolo detectors in autonomous driving scenarios,

    J. Im Choi and Q. Tian, “Adversarial attack and defense of yolo detectors in autonomous driving scenarios,” in 2022 IEEE intelligent vehicles symposium (IV). IEEE, 2022, pp. 1011–1017

    2022

  47. [56]

    Adversarial attacks on faster r-cnn object detector,

    Y . Wang, K. Wang, Z. Zhu, and F.-Y . Wang, “Adversarial attacks on faster r-cnn object detector,”Neurocomput- ing, vol. 382, pp. 87–95, 2020

    2020

  48. [57]

    On the adversarial robustness of vision transformers,

    R. Shao, Z. Shi, J. Yi, P.-Y . Chen, and C.-J. Hsieh, “On the adversarial robustness of vision transformers,”arXiv preprint arXiv:2103.15670, 2021

    2021 arXiv

  49. [58]

    From patches to pictures (paq-2-piq): Mapping the perceptual space of picture quality,

    Z. Ying, H. Niu, P. Gupta, D. Mahajan, D. Ghadiyaram, and A. Bovik, “From patches to pictures (paq-2-piq): Mapping the perceptual space of picture quality,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 3575–3585

    2020

  50. [59]

    Napguard: Towards detecting naturalistic adversarial patches,

    S. Wu, J. Wang, J. Zhao, Y . Wang, and X. Liu, “Napguard: Towards detecting naturalistic adversarial patches,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 367– 24 376

    2024

  51. [60]

    Adversarial examples in the physical world: A survey,

    J. Wang, X. Liu, J. Hu, D. Wang, S. Wu, T. Jiang, Y . Guo, A. Liu, and J. Zhou, “Adversarial examples in the physical world: A survey,”arXiv preprint arXiv:2311.01473, 2023. 28

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.