PaperlayerView exact revision on arXiv

Source-linked AI summary

Adv-Camou: An Emissivity-based Physical Dynamic Adversarial Patch for Infrared Attack

Zhuo Chen, Xu Zheng, Runyun He, Tuoyu Liu, Kaixuan Ding, Yufei Ge, Yijing Song, Tingting Shi, Haining Ji, Pinghua Tang, Haifeng Cheng, Xikun Hu, Dongqing Liu

arXiv:2610.22434v1eess.IV

TL;DR

Existing infrared physical attacks are largely static, with limited environmental adaptability and physical robustness. Adv-Camou combines feature-confusion losses, differentiable binarization, adaptive transformations, and reconfigurable emissivity devices. It reports 95.59% ASR digitally and up to 91.55% ASR for dynamic physical patches in complex environments.

  • Problem

    Existing infrared physical attack methods predominantly use static thermal suppression strategies, with limited environmental adaptability, attack robustness, and visual concealment.

    Source: §I · p. 2

  • Method

    Adv-Camou combines feature-confusion losses, differentiable binary-mask optimization, adaptive physical transformations, and a reconfigurable electrochromic emissivity array for dynamic pattern switching.

    Source: §I · p. 2, B. Adversarial Mask Patterns… · p. 4, C. Physical Simulation Transformation · p. 5

  • Results

    95.59% ASR and a 60.51% reduction in AP digitally; dynamic physical patches reached up to 91.55% ASR in complex environments.

    Source: §I · p. 2

  • Takeaways & Limitations

    Dynamic patches significantly outperform static ones in diverse environments, with the reported advantage particularly evident in complex scenarios.

    Source: §IV · p. 10

    Experiments focused on single-target scenarios and the method targets long-wave infrared (8–14 μm), without cross-band synergy with visible or mid-wave infrared spectra.

    Source: §IV · p. 10

Abstract

from arXiv · show

With the widespread application of infrared object detection technologies in military domains, intelligent infrared adversarial camouflage capabilities have become critical. Existing physical attack methods predominantly employ static thermal suppression strategies, suffering from limited environmental adaptability, insufficient attack robustness, and inadequate visual concealment. This study proposes Adv-Camou, an emissivity-based physical dynamic adversarial patch that achieves paradigm-shifting advancements from static to dynamic attacks through algorithm-material co-innovation. First, a multi-level loss function based on feature confusion mechanisms is designed to deceive detectors by attenuating target saliency and enforcing background feature alignment. Second, adaptive physical transformations and differentiable binarization optimization are integrated to address physical robustness and realizability constraints. A 6*4 array of reversible electrochromic emissivity device is developed and tested across a range of background scenarios, enabling scene-adaptive dynamic camouflage through independent unit control. Experiments demonstrate that this method achieves 95.59% attack success rate (ASR), reducing average precision (AP) by 60.51%. Physical validations show that static adversarial patches attain 76.55% average ASR under multi-view, multi-range, and multi-spectral conditions, while dynamic patches enhance ASR up to 91.55% in complex environments (wilderness/urban) through adaptive switching. The seamless digital-to-physical transfer via tunable emissivity devices transcends the limitations of traditional static camouflage by establishing a dynamic infrared regulation capability. This advancement enhances the battlefield survivability of military assets and demonstrates transformative potential for adaptive camouflage in practical combat scenarios.

I. INTRODUCTION

The introduction frames infrared physical attacks as constrained by static designs, physical instability, and weak transfer across detector architectures. Adv-Camou combines feature confusion, differentiable discrete-pattern optimization, and reconfigurable emissivity hardware to pursue scene-adaptive attacks.

I. INTRODUCTION

  • Existing infrared attacks face environmental-adaptability, physical-stability, and cross-architecture-transferability limits that motivate a dynamic, physically realizable approach.Static patches can fail as background features shift; heating approaches encounter thermal diffusion, convective heat loss, and power depletion, while discrete emissivity states create an optimization gap.Source: §I · pp. 1–2
  • Adv-Camou combines foreground feature suppression and background latent alignment with discrete pattern optimization and a reconfigurable 6×4 emissivity array for dynamic camouflage.The paper reports digital results of 95.59% ASR and a 60.51% reduction in AP, with physical deployments reaching 91.55% ASR in complex wilderness and urban environments.Source: §I · p. 2

A. Physical Adversarial Attacks in the Visible Spectrum

  • Visible-spectrum physical attacks evolved from planar patches to wearable and 3D camouflage, but manipulate RGB reflectance rather than thermal emission.Work cited includes EOT-based patches, printable cardboard patches, naturalistic textures, and wearable multi-view garments; these approaches do not directly address thermal sensors.Source: A. Physical Adversarial Attacks in the… · pp. 2–3

B. Thermal Infrared and Cross-Modal Physical Attacks

Prior infrared physical attacks manipulate temperature or emissivity, but existing patches remain static and some approaches use simple geometric structures. Adv-Camou pairs differentiable binarization with electrically tunable emissivity for scene-adaptive switching.

B. Thermal Infrared and Cross-Modal Physical Attacks

  • Prior infrared attacks use active thermal perturbations, passive low-emissivity materials, heuristic geometric optimization, or gradient-based and cross-modal patches, but remain static after fabrication.Fine-grained stripe or grid patterns may spatially alias at extended distances because thermal focal plane arrays have low spatial resolution.Source: B. Thermal Infrared and Cross-Modal… · p. 3
  • Adv-Camou combines differentiable binarized optimization with an electrically tunable electrochromic emissivity array to enable scene-adaptive dynamic switching and multi-scale feature confusion.The related-work discussion contrasts this approach with static infrared and cross-modal patches whose topologies cannot adapt to changing background thermal distributions.Source: B. Thermal Infrared and Cross-Modal… · p. 3

A. Loss Function Design

The loss design treats detection evasion as disrupting target features: suppress target saliency while making perturbed target representations resemble background features. The patch is applied within the target box, and the objective combines background alignment and target suppression terms.

A. Loss Function Design

  • The patch is constrained to be smaller than the target bounding box and is applied through a mask to form the adversarial input.The model output is described through bounding-box position, target-presence confidence, and class probability.Source: A. Loss Function Design · p. 3
  • Foreground feature vectors represent target characteristics within the bounding box, while background vectors capture context outside it; the objective uses this contrast to confuse target representations.The paper relates the mechanism to contrastive learning, treating canonical target features as anchors, background features as positive samples, and adversarial targets as negative samples.Source: A. Loss Function Design · p. 4
  • The attack objective combines background feature alignment and target feature suppression losses, optimized through iterative backpropagation.The paper frames the objective as reducing target saliency and aligning target representations with background distributions in latent space.Source: A. Loss Function Design · p. 4
  • The background alignment term compares perturbed target features with background features using a minimized pairwise similarity metric.The passage describes this term as intended to make target features resemble background components and induce misclassification.Source: A. Loss Function Design · p. 4
  • The target suppression term maximizes similarity between perturbed and original target regions to disrupt the intrinsic feature distribution and prevent reliable target characterization.The paper defines a comparison count for this term, but the supplied passages do not give its full equation in readable form.Source: A. Loss Function Design · p. 4

B. Adversarial Mask Patterns Optimization

The mask-optimization method uses Gumbel-Softmax relaxation and a Straight-Through Estimator to make binary patterns trainable while respecting discrete physical states. A coarse-to-fine process adds structural coherence to the generated masks.

B. Adversarial Mask Patterns Optimization

  • Gumbel-Softmax models each pixel’s probabilities of taking binary values 0 and 1, enabling differentiable approximation of discrete masks.The probabilities sum to one, and temperature-controlled relaxation approximates one-hot samples.Source: B. Adversarial Mask Patterns… · pp. 4–5
  • A Straight-Through Estimator allows backpropagation through hard thresholding, with forward passes assigning pixels to 1 at p*≥0.5 and otherwise 0.The method addresses the mismatch between continuous gradient-optimized masks and the discrete binary structures required for physical fabrication.Source: B. Adversarial Mask Patterns… · pp. 4–5
  • A coarse-to-fine pipeline pools an 80×60 noise map into an 8×6 mask, upsamples it, and refines edges with Gaussian blur regularization.The passage says this strategy enhances structural coherence and reports that the Gumbel-Softmax framework bridges continuous optimization and discrete binarization requirements.Source: B. Adversarial Mask Patterns… · p. 5

C. Physical Simulation Transformation

The physical-simulation framework adapts transformations to environmental complexity and target size, while pose-aware perspective warping aligns patches to changing human poses. It also uses EOT and perspective transformations to model real-world imaging conditions during digital optimization.

C. Physical Simulation Transformation

  • EOT and perspective transformations simulate environmental variation and multi-view observation during digital optimization to improve real-world robustness.The stated factors include lighting variation and thermal drift.Source: C. Physical Simulation Transformation · p. 5
  • Dynamic EOT adjusts augmentation intensity using environmental complexity C and target bounding-box dimensions S.The framework predicts complexity with ICNet; high-complexity scenes receive stronger noise and thermal-drift simulation, while distant targets receive Gaussian blurring.Source: C. Physical Simulation Transformation · p. 5
  • Pose-aware perspective warping uses shoulder and hip keypoints to align patch corners with the target body surface.A homography maps source patch coordinates to body-surface coordinates, with its optimal matrix estimated from corresponding corner-keypoint pairs.Source: C. Physical Simulation Transformation · p. 5

A. Adversarial Camouflage Patch Generation

The section evaluates adversarial camouflage patches across datasets and tests how patch size, grayscale, and resolution affect attack success. Posture adaptation achieves a 95.59% overall ASR on the self-made dataset.

A. Adversarial Camouflage Patch Generation

  • 81.18% ASR against YOLOv5 accompanied an AP drop from 98.28% to 37.77% on the FLIR ADAS v1.3 test set.The 8×6 binary patch was applied to pedestrians’ upper bodies; Fig. 2(a) compares detection effects and feature-attention heatmaps.Source: A. Adversarial Camouflage Patch… · p. 5, Figure 2 · p. 6
  • 95.59% overall ASR was achieved by the posture-adapted patch on the self-made dataset.The method maintained attack performance in extreme side views and distant scenes.Source: A. Adversarial Camouflage Patch… · p. 5
  • Increasing relative patch size from 0.18 to 0.28 raised ASR from 46.77% to 89.43%, and Adv-Camou achieved 41% higher ASR than the black-patch baseline at identical size.The passage attributes the size effect to broader coverage of thermal-signature regions; Fig. 2(b) presents ASR by patch size.Source: A. Adversarial Camouflage Patch… · p. 6, Figure 2 · p. 6
  • ASR was 82.44% for grayscale 0, 60.39% for grayscale 1, and 34.78% for grayscale 0.6; Fig. 2(c) compares pixel configurations.The passage relates the lower result at 0.6 to its similarity to the background grayscale of approximately 0.7.Source: A. Adversarial Camouflage Patch… · p. 6, Figure 2 · p. 6
  • An 8×6 grid achieved 74.91% ASR, while 6×4 degraded ASR by 7.17% and 11×9 reduced it by 18%; Fig. 2(d) compares resolutions.The passage recommends size ≥0.22, grayscale 0, and 8×6 resolution for robust attacks with ASR >80%.Source: A. Adversarial Camouflage Patch… · p. 6, Figure 2 · p. 6

B. Static Adversarial Camouflage Patch Attack

Adv-Camou’s static patches outperform comparison methods and retain attack effectiveness across detector architectures, viewing angles, distances, and outdoor backgrounds. Performance varies with architecture and environmental complexity.

B. Static Adversarial Camouflage Patch Attack

  • 95.59% ASR was achieved on a custom multi-view, multi-distance dataset, with performance maintained at ±45° side views and distances greater than 10 m.Overhead-angle adaptation also sustained coverage of key thermal regions under target deformation.Source: B. Static Adversarial Camouflage Patch… · p. 6, Figure 3 · p. 7
  • 81.18% ASR and a 60.51% reduction in YOLOv5 AP (98.28% to 37.77%) were reported for Adv-Camou, versus AIP at 23.66% ASR and UCA at 21.32%.The comparison used identical perturbation regions; comparative methods retained AP values above 89%.Source: B. Static Adversarial Camouflage Patch… · p. 6, Table I · p. 7
  • 65.81% ASR and a 59.22% mean AP reduction were reported across six detectors, with single-stage models more vulnerable than DETR and YOLOv8.RetinaNet reached 85.83% ASR and 16.41% AP; DETR reached 49.54% ASR and 44.93% AP, while YOLOv8 reached 23.95% ASR and 77.15% AP.Source: B. Static Adversarial Camouflage Patch… · p. 7, Table II · p. 8
  • 94.45% average ASR was reported across distance and view scenarios, including 90.1% at 8 m and 91.6% at ±45°, while urban-background ASR was 52.78%.Field-background ASR was 82.42%; the authors attribute urban degradation to complex thermal background interference.Source: Figure 4 · p. 8, B. Static Adversarial Camouflage Patch… · p. 8
  • Physical-world tests show Adv-Camou achieves 94.45% average ASR across 2–8 m and tri-view angles (-45°/0°/+45°), with 90.1% efficacy at 8 m; environmental thermal noise degrades consistency.Source: B. Static Adversarial Camouflage Patch… · p. 8

C. Dynamic Adversarial Camouflage Patch Attack

Dynamic Adv-Camou selects scene-specific patterns to address differences in environmental textures and feature attention. Physical tests report improved attack success when patches match their background, while mismatched patterns perform worse.

C. Dynamic Adversarial Camouflage Patch Attack

  • Urban patterns target low-frequency contours, while field patterns disrupt mid- and high-frequency textures, matching the differing feature patterns described for those settings.The analysis associates foliage textures with localized attention drift and urban reflections with attention dispersed to background edges.Source: C. Dynamic Adversarial Camouflage… · p. 9
  • Urban-optimized patches reduced YOLOv5 confidence from 0.42 to 0.13 in cityscapes, while wilderness-adapted patches reduced it from 0.39 to 0.21 in natural settings.The passage reports these dynamic patch-switching results for Fig. 5(a).Source: C. Dynamic Adversarial Camouflage… · p. 9, Figure 5 · p. 9
  • The analysis identifies texture competition in shallow CNN features, structural priors in deep layers, and spectral-band overlap as factors relevant to environmental attack performance.It also describes semantic conflicts between small- and large-scale FPN features in complex environments.Source: C. Dynamic Adversarial Camouflage… · p. 9
  • 91.18% ASR in wilderness and 80.43% in urban backgrounds were achieved by scene-matched dynamic patches, improvements of 28.4% and 27.65% over generic patches, respectively.A field patch used in a city fell to 31.03% ASR, a 60.15% reduction attributed to frequency-band misalignment.Source: Table III · p. 9, C. Dynamic Adversarial Camouflage… · p. 9
  • Tests beyond 15 m reported consistent performance under spatial scaling and stable 2–3°C differentials between low- and high-emissivity regions.The authors report lossless digital-to-physical transfer across varying observation distances.Source: C. Dynamic Adversarial Camouflage… · p. 10
  • Dynamic switching improved average ASR by 13–15% across scenarios using a 6×4 array of 24 independently addressable emissivity elements.Voltage modulation of ±2.5 V enabled emissivity control with Δε=0.32; field and urban patches achieved 82.35% and 56.25% ASR in their corresponding settings.Source: Table IV · p. 10, C. Dynamic Adversarial Camouflage… · p. 10

IV. CONCLUSION

Adv-Camou combines detector-feature losses, binarization, and adaptive physical transformations to generate infrared adversarial patches. Evaluations report effectiveness across detectors and physical conditions, while dynamic patches outperform static ones in complex scenarios; the study identifies single-target and LWIR scope limits.

IV. CONCLUSION

  • The framework extracts detector feature maps, generates patches with a loss function, binarizes pixels using Gumbel-Softmax, and applies adaptive physical transformations.Source: §IV · p. 10
  • Adv-Camou shows superior ASR and cross-model adaptability over existing adversarial attacks, with effectiveness against most mainstream infrared detectors.Source: §IV · p. 10
  • Physical tests report successful evasion of infrared pedestrian detectors across multiple distances, angles, and environments using aluminum foil and insulating tape.Source: §IV · p. 10
  • Dynamic patches significantly outperform static ones, with emissivity modulation improving ASR and adaptability particularly in complex scenarios.Source: §IV · p. 10
  • Experiments focus on single targets, leaving multi-target and group detection untested; the method targets LWIR and lacks visible- or mid-wave-infrared cross-band synergy.Source: §IV · p. 10
  • The study presents Adv-Camou as a multi-angle attack framework for infrared pedestrian detectors in real-world settings, with robustness across environments and devices.Source: §IV · p. 10

Related papers

Loading 2610.22434v1…