# Adversarial T-shirt! Evading Person Detectors in A Physical World

arXiv: https://arxiv.org/abs/1910.11099 · HTML: https://mlsanity.com/paper/1910.11099/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Oct 2019.

## Built on by (most cited first, 13 of 13)

- [AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehicles](https://mlsanity.com/paper/2101.06549/) (2021)
- [Fooling thermal infrared pedestrian detectors in real world using small bulbs](https://mlsanity.com/paper/2101.08154/) (2021)
- [LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity](https://mlsanity.com/paper/2207.13129/) (2022)
- [Reverse Engineering of Imperceptible Adversarial Image Perturbations](https://mlsanity.com/paper/2203.14145/) (2022)
- [Adv3D: Generating Safety-Critical 3D Objects through Closed-Loop Simulation](https://mlsanity.com/paper/2311.01446/) (2023)
- [Distributed Adversarial Training to Robustify Deep Neural Networks at Scale](https://mlsanity.com/paper/2206.06257/) (2022)
- [Learning Transferable 3D Adversarial Cloaks for Deep Trained Detectors](https://mlsanity.com/paper/2104.11101/) (2021)
- [Physical Passive Patch Adversarial Attacks on Visual Odometry Systems](https://mlsanity.com/paper/2207.05729/) (2022)
- [I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectors](https://mlsanity.com/paper/2406.10285/) (2024)
- [Can Adversarial Examples Be Parsed to Reveal Victim Model Information?](https://mlsanity.com/paper/2303.07474/) (2023)
- [Defending Adversarial Patches via Joint Region Localizing and Inpainting](https://mlsanity.com/paper/2307.14242/) (2023)
- [Area is all you need: repeatable elements make stronger adversarial attacks](https://mlsanity.com/paper/2306.07768/) (2023)
- [Sparse patches adversarial attacks via extrapolating point-wise information](https://mlsanity.com/paper/2411.16162/) (2024)

## Abstract (arXiv)

It is known that deep neural networks (DNNs) are vulnerable to adversarial attacks. The so-called physical adversarial examples deceive DNN-based decisionmakers by attaching adversarial patches to real objects. However, most of the existing works on physical adversarial attacks focus on static objects such as glass frames, stop signs and images attached to cardboard. In this work, we proposed adversarial T-shirts, a robust physical adversarial example for evading person detectors even if it could undergo non-rigid deformation due to a moving person's pose changes. To the best of our knowledge, this is the first work that models the effect of deformation for designing physical adversarial examples with respect to-rigid objects such as T-shirts. We show that the proposed method achieves74% and 57% attack success rates in the digital and physical worlds respectively against YOLOv2. In contrast, the state-of-the-art physical attack method to fool a person detector only achieves 18% attack success rate. Furthermore, by leveraging min-max optimization, we extend our method to the ensemble attack setting against two object detectors YOLO-v2 and Faster R-CNN simultaneously.