Research map / Adversarial robustness and security / Attacks on text and graphs
Physically Adversarial Infrared Patches With Learnable Shapes and Locations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use learned patch shape and location together instead of neither (ablation) | Adversarial infrared patches · Pedestrian detection, digital | ASR: 0% -> 93.60% | Helped |
| Use only the learned location rather than neither learned shape nor location (ablation) | Adversarial infrared patches · Pedestrian detection, digital | ASR: 0% -> 54.16% | Helped |
| Use only the learned shape rather than neither learned shape nor location (ablation) | Adversarial infrared patches · Pedestrian detection, digital | ASR: 0% -> 59.68% | Helped |
| Add binary regularization to the attack loss (ablation) | Adversarial infrared patches · Pedestrian detection, digital | ASR: 100% -> 99.60% | Hurt |
| Add binary regularization to the attack loss (ablation) | Adversarial infrared patches · Pedestrian detection, digital | Aggregation: 0.0057 -> 0.0427 | Helped |
| Add aggregation regularization to the attack and binary losses (ablation) | Adversarial infrared patches · Pedestrian detection, digital | ASR: 99.60% -> 93.60% | Hurt |
| Add aggregation regularization to the attack and binary losses (ablation) | Adversarial infrared patches · Pedestrian detection, digital | Aggregation: 0.0427 -> 0.4651 | Helped |
| Use adversarial infrared patches instead of adversarial clothing | YOLOv3 pedestrian detector · FLIR ADAS test, digital | AP: 12.30% -> 12.05% | Helped |
| Use adversarial infrared patches instead of adversarial bulbs | YOLOv3 pedestrian detector · FLIR ADAS test, digital | AP: 35.88% -> 12.05% | Helped |
| Increase shooting angle away from frontal view | Adversarial infrared patches · Physical pedestrian detection | ASR: 94.67% -> 83.38% | Hurt |
| Move the camera from 4 meters to 6 meters | Adversarial infrared patches · Physical pedestrian detection | ASR: 77.25% | Hurt |
| Change the pedestrian from standing to sitting | Adversarial infrared patches · Physical pedestrian detection | ASR: 76.70% | Hurt |
Closest papers by meaning
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.83)
- Unleashing the Representational Power of Fourier Shapes for Attacking Infrared Object Detection (ICML 2026 · similarity 0.81)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.80)
- Infrared Adversarial Car Stickers (CVPR 2024 · similarity 0.80)
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.80)
- DEAL: Data-Efficient Adversarial Learning for High-Quality Infrared Imaging (CVPR 2025 · similarity 0.79)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.