mlsanityData to 7 Oct 2026

Adversarial Texture for Fooling Person Detectors in the Physical World

arXiv 2203.03373 ↗First posted 7 Mar 2022cs.CVcited by 96

Not on the map. Why?

Abstract (arXiv)

Nowadays, cameras equipped with AI systems can capture and analyze images to detect people automatically. However, the AI system can make mistakes when receiving deliberately designed patterns in the real world, i.e., physical adversarial examples. Prior works have shown that it is possible to print adversarial patches on clothes to evade DNN-based person detectors. However, these adversarial examples could have catastrophic drops in the attack success rate when the viewing angle (i.e., the camera's angle towards the object) changes. To perform a multi-angle attack, we propose Adversarial Texture (AdvTexture). AdvTexture can cover clothes with arbitrary shapes so that people wearing such clothes can hide from person detectors from different viewing angles. We propose a generative method, named Toroidal-Cropping-based Expandable Generative Attack (TC-EGA), to craft AdvTexture with repetitive structures. We printed several pieces of cloth with AdvTexure and then made T-shirts, skirts, and dresses in the physical world. Experiments showed that these clothes could fool person detectors in the physical world.

Key facts. Cited by 96 papers in the map (data through 7 Oct 2026). Builds on 29 of its 40 references that are in the map. First posted on arXiv 7 Mar 2022.

Builds on

29 of 40 references.

References · 29

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Mask R-CNNcited by 7,259
  6. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2018YOLOv3: An Incremental Improvementcited by 2,652
  11. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  12. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
17 more
  1. 2016Adversarial examples in the physical worldcited by 1,762
  2. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  3. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  4. 2018Learning deep representations by mutual information estimation and maximizationcited by 1,265
  5. 2014Striving for Simplicity: The All Convolutional Netcited by 983
  6. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  7. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
  8. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  9. 2017Adversarial Patchcited by 514
  10. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  11. 2019Cascade R-CNN: High Quality Object Detection and Instance Segmentationcited by 428
  12. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  13. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  14. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  15. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  16. 2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
  17. 2020Can 3D Adversarial Logos Cloak Humans?cited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 10; 2023: 27; 2024: 25; 2025: 19; 2026: 15.

96 papers.

Sort:

By area:

  1. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  2. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  3. 2023Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modelingcited by 41
  4. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  5. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 31
  6. 2022HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Designcited by 27
  7. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  8. 2023Language-Driven Anchors for Zero-Shot Adversarial Robustnesscited by 23
  9. 2022A Comprehensive Study of the Robustness for LiDAR-based 3D Object Detectors against Adversarial Attackscited by 22
  10. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  11. 2023Towards Benchmarking and Assessing Visual Naturalness of Physical World Adversarial Attackscited by 18
  12. 2024Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policiescited by 17
38 more
  1. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  2. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  3. 2023On the Importance of Backbone to the Adversarial Robustness of Object Detectorscited by 12
  4. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  5. 2023Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical Worldcited by 11
  6. 2024Cross-Modality Attack Boosted by Gradient-Evolutionary Multiform Optimizationcited by 11
  7. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  8. 2023Adversarial Infrared Curves: An Attack on Infrared Pedestrian Detectors in the Physical Worldcited by 10
  9. 2023State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systemscited by 8
  10. 2024Infrared Adversarial Car Stickerscited by 8
  11. 2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 8
  12. 2024Flexible Physical Camouflage Generation Based on a Differential Approachcited by 7
  13. 2022Adversarial Neon Beam: A Light-based Physical Attack to DNNscited by 6
  14. 2022Consistent Attack: Universal Adversarial Perturbation on Embodied Vision Navigationcited by 6
  15. 2022Differential Evolution based Dual Adversarial Camouflage: Fooling Human Eyes and Object Detectorscited by 6
  16. 20253D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generationcited by 6
  17. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  18. 2023Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectorscited by 5
  19. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  20. 2023DOEPatch: Dynamically Optimized Ensemble Model for Adversarial Patches Generationcited by 5
  21. 2024I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectorscited by 5
  22. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  23. 2023Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimizationcited by 4
  24. 2023Two-stage optimized unified adversarial patch for attacking visible-infrared cross-modal detectors in the physical worldcited by 4
  25. 2023MVPatch: More Vivid Patch for Adversarial Camouflaged Attacks on Object Detectors in the Physical Worldcited by 4
  26. 2024DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Timecited by 4
  27. 2025AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systemscited by 4
  28. 2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
  29. 2024Attack Anything: Blind DNNs via Universal Background Adversarial Attackcited by 3
  30. 2024Out-of-Bounding-Box Triggers: A Stealthy Approach to Cheat Object Detectorscited by 3
  31. 2025PapMOT: Exploring Adversarial Patch Attack against Multiple Object Trackingcited by 3
  32. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  33. 2023Self-supervised Adaptive Pre-training of Multilingual Speech Models for Language and Dialect Identificationcited by 2
  34. 2023Natural Adversarial Patch Generation Method Based on Latent Diffusion Modelcited by 2
  35. 2024Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attackscited by 2
  36. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  37. 2025Safety2Drive: Safety-Critical Scenario Benchmark for the Evaluation of Autonomous Drivingcited by 2
  38. 2025Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insightscited by 2

50 most cited of 96 All 96 (JSON)