Research map / Adversarial robustness and security / Attacks on text and graphs
PhyCamo: A Robust Physical Camouflage via Contrastive Learning for Multi-View Physical Adversarial Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PhyCamo, a multi-view physical adversarial camouflage method that combines diffusion-based data augmentation (RePaint), a bbox-IoU loss, and a contrastive embedding loss with diverse input augmentation to attack detectors in digital and physical space.
Problem
Multi-view physical adversarial attacks against DNN-based object detectors suffer from costly data augmentation, a gap between digital and physical attack performance, and poor transferability across detectors due to model-specific noise.
Approach
Uses a diffusion inpainting model (RePaint) plus brightness changes for randomized input augmentation to simulate digital-to-physical transformations, and a contrastive loss on encoder embeddings that pulls adversarial embeddings toward reference (no-target) images and pushes them away from benign renders, with dynamic embedding enhancement to suppress model-specific noise.
Key results
- In digital space on the car dataset, PhyCamo achieves about 1.26x higher ASR and about 0.55x AP on average versus baselines, with 90.58% average ASR under subtler transformations.
- In physical space, PhyCamo reaches ASR of 75.2% on YOLOv3, 68.5% on YOLOv5, 75.1% on FrRCNN and 80.1% on MaskRCNN, about 1.63x the baselines' average ASR.
- PhyCamo attains average ASR of 90.3% when attacking YOLOv3 and 80.7% when attacking FrRCNN in digital transfer evaluation.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PhyCamo instead of benchmark attacks | Multi-view physical attack on car dataset · Digital space, car dataset | ASR: higher ASR ∼×1.26 | Helped |
| Use PhyCamo instead of benchmark attacks | Multi-view physical attack on car dataset · Digital space, car dataset | AP: lower AP∼×0.55 | Helped |
| Use PhyCamo instead of benchmark attacks | Multi-view physical attack on car dataset · Physical space, car dataset | ASR: more than ∼×1.63 ASR | Helped |
| Apply PhyCamo rather than Boosting | Yolo-V3-targeted car camouflage · Car dataset, physical, Yolo-V3 test | ASR: 50.8 -> 75.2 | Helped |
Surprising findings
- Attacks targeting the best-performing detector (YOLOv3) did not transfer best; PhyCamo was weaker when targeting YOLOv5, attributed to richer model-specific noise in a more complex network.
Limitations
- Cannot handle texture blur caused by changes in camera distance.
- Physical tests limited to 5 adversarial textures targeting Yolo-V3 due to cost.
- Transferability is uneven; attacks on YOLOv5 underperform relative to YOLOv3.
Experimental setup
Datasets: Car dataset (Wang et al. 2021a, CARLA) Tank dataset (self-constructed, 900 images) Pedestrian dataset (Hu et al. 2023)
Benchmarks: Car dataset digital evaluation across six detectors Physical space test on 1:64 scaled Audi model with Yolo-V3, Yolo-V5, FrRCNN, MaskRCNN
Metrics: ASR AP@0.5:0.95 Roby
Baselines: DAS AT2 DTA FCA ACTIVE Boosting
Builds on: EoT DAS FCA ACTIVE Boosting (Zhang et al. 2023) RePaint
Closest papers by meaning
- Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles (CVPR 2020 · similarity 0.89)
- RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation (ICML 2024 · similarity 0.88)
- CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors (NeurIPS 2024 · similarity 0.87)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.85)
- UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.84)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.