Research map / Adversarial robustness and security / Attacks on text and graphs
DAP: A Dynamic Adversarial Patch for Evading Person Detectors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DAP, a GAN-free adversarial patch optimized directly in pixel space with a cosine similarity loss to a benign target image and a creases transformation block, to evade person detectors digitally and physically on a T-shirt.
Problem
Adversarial patches for person detection are conspicuous, and GAN-based naturalistic patches have limited latent space, low attack success, and cannot handle non-rigid clothing deformations from body movement.
Approach
Replace the GAN generator with direct pixel optimization of the patch under a detection loss plus a squared cosine-similarity loss toward a target benign image and a total variation loss, and add a Creases Transformation block that displaces pixels along random crease vectors to model non-rigid fabric deformation.
Key results
- Digital attack success rate up to 82.28% against YOLOv7 on INRIA, per the abstract.
- Under non-rigid deformation, Yolov3tiny NAP mAP rose from 10.02% to 69.20% while DAP went from 6.54% to 15.44%.
- User study naturalness score of 93.12% for DAP versus 47.75% for NAP; physical T-shirt TPR of 92.01% for DAP versus 57.22% for NAP.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DAP instead of NAP under clothing transformations | YOLOv3tiny person detection on INRIA · INRIA, clothing transformations | mAP: 69.20% -> 15.44% | Helped |
| Add rigid and non-rigid clothing transformations during DAP evaluation (ablation) | DAP on YOLOv3tiny · INRIA | mAP: 6.54% -> 15.44% | Hurt |
| Add rigid and non-rigid clothing transformations to NAP (ablation) | NAP on YOLOv3tiny · INRIA | mAP: 10.02% -> 69.20% | Hurt |
| Remove similarity loss (ablation) | DAP on YOLOv3tiny · INRIA | mAP: 2.54% | Helped |
| Remove detection loss (ablation) | DAP · INRIA | mAP | No clear effect |
| Remove total variation loss (ablation) | DAP · Patch appearance | smoothness | Hurt |
| Increase patch scale from 0.3 through 0.6 (ablation) | DAP on YOLOv3tiny · INRIA | mAP: 58.98% -> 37.20% -> 15.44% -> 6.54% | Helped |
| Use DAP rather than NAP for the physical T-shirt attack | YOLOv3tiny · Physical video evaluation | TPR: 57.22% -> 92.01% | Helped |
| Add Noise, Rotation, and Creases to GAN patch training with τ = 1 (ablation) | GAN-based patch on YOLOv3tiny · INRIA | mAP: 23.43% -> 29.82% | Hurt |
| Add Noise, Rotation, and Creases to GAN patch training with τ = 100 (ablation) | GAN-based patch on YOLOv3tiny · INRIA | mAP: 13.21% -> 21.53% | Hurt |
| Raise the GAN latent-vector norm threshold from τ = 1 to τ = 100 (ablation) | GAN-based patch without transformations · INRIA, YOLOv3tiny | mAP: 23.43% -> 13.21% | Helped |
| Raise the GAN latent-vector norm threshold from τ = 1 to τ = 100 (ablation) | GAN-based patch with Noise, Rotation, and Creases · INRIA, YOLOv3tiny | mAP: 29.82% -> 21.53% | Helped |
Surprising findings
- Removing the similarity loss yields a more efficient but noisy and conspicuous patch (mAP 2.54% on Yolov3tiny), showing a trade-off between efficiency and stealth.
- Higher GAN latent norm thresholds increased attack effectiveness but produced visibly unrealistic patches.
Limitations
- Interpretability of why certain target classes yield more effective patches is not explored.
- Physical evaluation uses a single participant and a single T-shirt setup with a small-scale video study.
- Against some baselines, DAP is less effective in mAP (e.g., Yolov7 17.72% vs NAP 60.78% without transformations in some comparisons).
Experimental setup
Datasets: INRIA
Benchmarks: INRIA
Metrics: mAP TPR TNR FPR FNR naturalness user score
Baselines: Naturalistic Patches (NAP) Adversarial T-shirt Adversarial YOLO Universal Physical Camouflage (UPC)
Builds on: Expectation Over Transformation Adversarial YOLO Naturalistic Patches (NAP) Adam
Closest papers by meaning
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.90)
- UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.88)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.88)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.87)
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.85)
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.