mlsanityData to 7 Oct 2026

Printability-Constrained Adversarial Decals for Near-Nadir Aerial Perception: Measured Ink Gamuts, Nested Realism Constraints, and a Physical-World Bound

arXiv 2609.33513 ↗First posted 27 Sep 2026cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

Adversarial patches for aerial perception are typically evaluated as digital composites, with printing left as an implementation detail. This study imposes three physical constraints during optimization rather than after it: the color range a particular printer can reproduce, the size of the flat panel a vehicle offers, and the loss of fine detail incurred when the patch is imaged from altitude. The principal comparison isolates the ink set. Two patches share all seventeen recorded optimization settings and differ only in the colors available to them. One is constrained to a uniform color cube; the other to a gamut measured by printing and scanning a 216-patch chart. Each was optimized at three seeds and evaluated against thirteen victim conditions, with every rate reported against a size-matched optimized control. The effect of the measured gamut is victim-dependent rather than uniform. Net attack success rises on three of six closed-set segmentation victims, and for these the seed ranges of the two ink sets are disjoint: +0.120 on DeepLabv3-R101 and +0.041 on SegFormer-B0. The color-cube patch is consistently stronger on the open-vocabulary segmenter and on two of four detectors, though no detector exceeds a net of +0.026 under either ink set. The natural explanation is that a printable palette is simply less chromatic and lower in frequency than a digital one. Eleven further patches test this account and it does not hold. Once cardinality is matched, a palette as chromatic as the cube attacks equally well. Cardinality itself shows no trend from three inks to thirty-two. Palettes matched on cardinality, lightness and chroma, and differing only in hue placement, span 0.035 to 0.136. A physical evaluation with printed decals did not detect transfer; it bounds the transferred rate at 0.133, which does not exclude the simulated value of 0.121.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 46 of its 74 references that are in the map. First posted on arXiv 27 Sep 2026.

Builds on

46 of 74 references.

References · 46

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  4. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  5. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  6. 2016Feature Pyramid Networks for Object Detectioncited by 5,021
  7. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  8. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  9. 2022A ConvNet for the 2020scited by 3,545
  10. 2021SegFormer: Simple and Efficient Design for Semantic Segmentation with Transformerscited by 2,923
  11. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,154
  12. 2019FCOS: Fully Convolutional One-Stage Object Detectioncited by 1,573
34 more
  1. 2017Domain Randomization for Transferring Deep Neural Networks from Simulation to the Real Worldcited by 1,401
  2. 2018Unified Perceptual Parsing for Scene Understandingcited by 1,265
  3. 2017AirSim: High-Fidelity Visual and Physical Simulation for Autonomous Vehiclescited by 517
  4. 2017Adversarial Patchcited by 514
  5. 2021Image Segmentation Using Text and Image Promptscited by 509
  6. 2018Training Deep Networks with Synthetic Data: Bridging the Reality Gap by Domain Randomizationcited by 292
  7. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  8. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  9. 2020Detection and Tracking Meet Drones Challengecited by 261
  10. 2021Understanding Robustness of Transformers for Image Classificationcited by 250
  11. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  12. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  13. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  14. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  15. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  16. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  17. 2020Certified Defenses for Adversarial Patchescited by 100
  18. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  19. 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
  20. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  21. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  22. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  23. 2022Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?cited by 47
  24. 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
  25. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 31
  26. 2022Universal Adversarial Examples in Remote Sensing: Methodology and Benchmarkcited by 24
  27. 2022Benchmarking Adversarial Patch Against Aerial Detectioncited by 21
  28. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  29. 2020Adversarial Patch Camouflage against Aerial Detectioncited by 16
  30. 2023Threatening Patch Attacks on Object Detection in Optical Remote Sensing Imagescited by 8
  31. 2023CBA: Contextual Background Attack against Optical Aerial Detection in the Physical Worldcited by 7
  32. 2022Empirical Evaluation of Physical Adversarial Patch Attacks Against Overhead Object Detection Modelscited by 4
  33. 2024Model Agnostic Defense against Adversarial Patch Attacks on Object Detection in Unmanned Aerial Vehiclescited by 2
  34. 2026Digital-to-Physical Transfer of Adversarial Patches for Aerial Vehicle Detectioncited by 1

Built on by

Not cited yet.