mlsanityData to 14 Oct 2026

Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical World

arXiv 2307.14682 ↗First posted 27 Jul 2023cs.CVcited by 21

Not on the map. Why?

Abstract (arXiv)

Physical adversarial attacks have put a severe threat to DNN-based object detectors. To enhance security, a combination of visible and infrared sensors is deployed in various scenarios, which has proven effective in disabling existing single-modal physical attacks. To further demonstrate the potential risks in such cases, we design a unified adversarial patch that can perform cross-modal physical attacks, achieving evasion in both modalities simultaneously with a single patch. Given the different imaging mechanisms of visible and infrared sensors, our work manipulates patches' shape features, which can be captured in different modalities when they undergo changes. To deal with challenges, we propose a novel boundary-limited shape optimization approach that aims to achieve compact and smooth shapes for the adversarial patch, making it easy to implement in the physical world. And a score-aware iterative evaluation method is also introduced to balance the fooling degree between visible and infrared detectors during optimization, which guides the adversarial patch to iteratively reduce the predicted scores of the multi-modal sensors. Furthermore, we propose an Affine-Transformation-based enhancement strategy that makes the learnable shape robust to various angles, thus mitigating the issue of shape deformation caused by different shooting angles in the real world. Our method is evaluated against several state-of-the-art object detectors, achieving an Attack Success Rate (ASR) of over 80%. We also demonstrate the effectiveness of our approach in physical-world scenarios under various settings, including different angles, distances, postures, and scenes for both visible and infrared sensors.

Key facts. Cited by 21 papers in the map (data through 14 Oct 2026). Builds on 34 of its 52 references that are in the map. First posted on arXiv 27 Jul 2023.

Builds on

34 of 52 references.

References · 34

  1. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
  2. 2023Segment Anythingcited by 8,234
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  7. 2018YOLOv3: An Incremental Improvementcited by 2,659
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  9. 2019EfficientDet: Scalable and Efficient Object Detectioncited by 1,020
  10. 2022YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectorscited by 982
  11. 2016Adversarial Machine Learning at Scalecited by 936
  12. 2017Adversarial Patchcited by 517
22 more
  1. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  2. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  3. 2021LLVIP: A Visible-infrared Paired Dataset for Low-light Visioncited by 231
  4. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  5. 2019Learning Data Augmentation Strategies for Object Detectioncited by 139
  6. 2023Benchmarking Robustness of 3D Object Detection to Common Corruptions in Autonomous Drivingcited by 114
  7. 2022Exploiting Unlabeled Data with Vision and Language Models for Object Detectioncited by 97
  8. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
  9. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  10. 2023C2Former: Calibrated and Complementary Transformer for RGB-Infrared Object Detectioncited by 58
  11. 2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
  12. 2018Multispectral Pedestrian Detection via Simultaneous Detection and Segmentationcited by 49
  13. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  14. 2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
  15. 2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
  16. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 42
  17. 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 39
  18. 2022HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Designcited by 27
  19. 2023Unified Adversarial Patch for Cross-modal Attacks in the Physical Worldcited by 27
  20. 2021Adversarial Attacks on Camera-LiDAR Models for 3D Car Detectioncited by 16
  21. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  22. 2020Adversarial Robustness of Deep Sensor Fusion Modelscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 7; 2025: 5; 2026: 7.

21 papers.

Sort:

By area:

  1. 2023Towards Transferable Targeted 3D Adversarial Attack in the Physical Worldcited by 25
  2. 2024DMM: Disparity-guided Multispectral Mamba for Oriented Object Detection in Remote Sensingcited by 20
  3. 2024UniRGB-IR: A Unified Framework for Visible-Infrared Semantic Tasks via Adapter Tuningcited by 17
  4. 2024NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectorscited by 17
  5. 2025CDUPatch: Color-Driven Universal Adversarial Patch Attack for Dual-Modal Visible-Infrared Detectorscited by 6
  6. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  7. 2025Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Modelscited by 5
  8. 2023Embodied Laser Attack:Leveraging Scene Priors to Achieve Agent-based Robust Non-contact Attackscited by 4
  9. 2024DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Timecited by 4
  10. 2025Medusa: Cross-Modal Transferable Adversarial Attacks on Multimodal Medical Retrieval-Augmented Generationcited by 2
  11. 2024MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agentscited by 1
  12. 2025Learning Fourier shapes to probe the geometric world of deep neural networkscited by 1
9 more
  1. 2026Physical Adversarial Clothing Evades Visible-Thermal Detectors via Non-Overlapping RGB-T Patterncited by 1
  2. 2024Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patchescited by 0
  3. 2025Robust Physical Adversarial Patches Using Dynamically Optimized Clusterscited by 0
  4. 2026Adversarial Patch Generation for Visual-Infrared Dense Prediction Tasks via Joint Position-Color Optimizationcited by 0
  5. 2026Physical Adversarial Attacks on AI Surveillance Systems:Detection, Tracking, and Visible--Infrared Evasioncited by 0
  6. 2026LLM-Agnostic Semantic Representation Attackcited by 0
  7. 2026Unleashing the Representational Power of Fourier Shapes for Attacking Infrared Object Detectioncited by 0
  8. 2026Physical Adversarial Examples for Person Detectors in Thermal Images Based on 3D Modelingcited by 0
  9. 2026Stealthy in Semantics, Antagonistic in Space: Attacking Visible-Infrared Object Detectors via Object-Level Misalignmentcited by 0