Physical Adversarial Examples for Person Detectors in Thermal Images Based on 3D Modeling
Not on the map. Why?
Abstract (arXiv)
Thermal Infrared detection is widely used in autonomous driving, medical AI, etc., but its security has only attracted attention recently. We propose infrared adversarial clothing designed to evade thermal person detectors in real-world scenarios. The design of the adversarial clothing is based on 3D modeling, which makes it easier to simulate multiangle scenes near the real world compared to 2D modeling. We optimized the black patch layout pattern of 3D clothing based on the adversarial example technique and made physical adversarial clothing using the aerogel. The idea is to paste a set of square aerogel patches, which display black squares in thermal images, in the inner side of clothing at specific locations with specific orientations. To enhance realism, we propose a method to build infrared 3D models with real infrared photos and develop texture maps for 3D models to simulate varied infrared characteristics over time and location. In physical attacks, we achieved an attack success rate of 80.11% indoors and 76.85% outdoors against YOLOv9. In contrast, randomly placed patches yielded much lower success rates (26.53% indoors and 23.03% outdoors). The adversarial clothing also showed good transferability to unknown detectors with an ensemble attack method, demonstrating the effectiveness of our approach.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 59 of its 92 references that are in the map. First posted on arXiv 31 Aug 2026.
Builds on
59 of 92 references.
References · 59
- 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
- 2020End-to-End Object Detection with Transformerscited by 7,384
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Mask R-CNNcited by 7,259
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2020Deformable DETR: Deformable Transformers for End-to-End Object Detectioncited by 3,410
- 2015SSD: Single Shot MultiBox Detectorcited by 3,125
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019MMDetection: Open MMLab Detection Toolbox and Benchmarkcited by 1,379
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2022DINO: DETR with Improved DeNoising Anchor Boxes for End-to-End Object Detectioncited by 1,306
38 more
- 2022YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectorscited by 978
- 2016Adversarial Machine Learning at Scalecited by 934
- 2020Accelerating 3D Deep Learning with PyTorch3Dcited by 781
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2022DAB-DETR: Dynamic Anchor Boxes are Better Queries for DETRcited by 569
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
- 2019Cascade R-CNN: High Quality Object Detection and Instance Segmentationcited by 428
- 2024YOLOv9: Learning What You Want to Learn Using Programmable Gradient Informationcited by 422
- 2024YOLOv11: An Overview of the Key Architectural Enhancementscited by 414
- 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
- 2018Generating Adversarial Examples with Adversarial Networkscited by 256
- 2019Libra R-CNN: Towards Balanced Learning for Object Detectioncited by 255
- 2018Adversarial Robustness Toolbox v1.0.0cited by 214
- 2016A study of the effect of JPG compression on adversarial imagescited by 196
- 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
- 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
- 2018Generating 3D Adversarial Point Cloudscited by 144
- 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
- 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
- 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
- 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
- 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
- 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
- 2023Dense Distinct Query for End-to-End Object Detectioncited by 76
- 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
- 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
- 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
- 2019Adversarial Objects Against LiDAR-Based Autonomous Driving Systemscited by 62
- 2019AdvFaces: Adversarial Face Synthesiscited by 59
- 2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
- 2022DTA: Physical Camouflage Attacks using Differentiable Transformation Networkcited by 51
- 2022Infrared Invisible Clothing:Hiding from Infrared Detectors at Multiple Angles in Real Worldcited by 42
- 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
- 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 38
- 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
- 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 31
- 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
50 most cited of 59 All 59 (JSON)
Built on by
Not cited yet.