Research map / Adversarial robustness and security / Attacks on text and graphs
Infrared Adversarial Car Stickers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes infrared adversarial aluminum stickers, optimized via 3D mesh shadow attack on a 3D infrared car model, that hide real cars from Faster R-CNN across viewing angles and distances.
Problem
Infrared physical adversarial attacks have focused on pedestrians and model cars; there is no full-angle, universal infrared physical attack on real cars that hides vehicles from infrared object detectors.
Approach
Optimize a 3D adversarial mesh in 3D space, project its shadow into a 2D infrared sticker pattern, and apply it to a 3D infrared car model, with control-point mesh smoothing and smoothness losses to make the stickers physically manufacturable; stickers use aluminum film to modify surface emissivity.
Key results
- Adversarial stickers achieved 91.49% ASR on two real Mercedes-Benz A200L cars against Faster R-CNN, versus 6.21% for random stickers and 0.66% for no sticker.
- In the digital world, the method reached 96.31% ASR on Faster R-CNN, versus 14.97% for AIP and 20.06% for UAP.
- Black-box transfer to six unseen detectors yielded 73.35%-95.80% ASR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use 3D mesh shadow adversarial stickers instead of the original car texture | Car texture against Faster R-CNN · 3D car model (digital) | ASR (%): 2.10 -> 96.31 | Helped |
| Use 3D mesh shadow adversarial stickers instead of random shape stickers | Car texture against Faster R-CNN · 3D car model (digital) | ASR (%): 18.26 -> 96.31 | Helped |
| Use the proposed stickers rather than AIP | Car texture against Faster R-CNN · 3D car model (digital) | ASR (%): 14.97 -> 96.31 | Helped |
| Use the proposed stickers rather than UAP | Car texture against Faster R-CNN · 3D car model (digital) | ASR (%): 20.06 -> 96.31 | Helped |
| Transfer the proposed stickers to unseen detectors | Ours, optimized against Faster R-CNN · Unseen detectors | ASR (%): 73.35%-95.80% | Helped |
| Use adversarial stickers rather than random shape stickers | Real cars with engines running, Faster R-CNN · Real cars, physical | ASR (%): 6.21% -> 91.49% | Helped |
| Use adversarial stickers rather than no sticker | Real cars with engines running, Faster R-CNN · Real cars, physical | ASR (%): 0.66% -> 91.49% | Helped |
| Turn the engines off for one hour | Adversarial stickers on real cars · Real cars, physical | ASR (%): 91.49% -> 88.42% | Hurt |
| Add the 3D control points-based mesh smoothing algorithm (ablation) | 3D mesh shadow attack · Adversarial meshes and patterns | Smoothness | Helped |
| Add the set of mesh smoothness losses (ablation) | 3D mesh shadow attack · Adversarial meshes and patterns | Smoothness | Helped |
| Combine control-point mesh smoothing and smoothness losses (ablation) | 3D mesh shadow attack · Adversarial meshes and patterns | Smoothness | Helped |
| Use control-point mesh smoothing and smoothness losses (ablation) | Physical implementation of adversarial patterns · Sticker implementation | Implementation time | Helped |
Surprising findings
- Faster R-CNN showed a decrease in ASR at 2 meters and at 0/180-degree horizontal angles, attributed to training image distribution.
Limitations
- Attack evaluated on a single car model (Mercedes-Benz A200L) and one primary detector, Faster R-CNN.
- Real-car ASR dropped when engines were off (88.42%), since infrared patterns were less clear.
- Adversarial defenses reduce ASR somewhat (to 88.83%-94.81%).
Experimental setup
Datasets: FLIR ADAS v1.3 Real infrared car photos captured with FLIR T560
Benchmarks: FLIR ADAS v1.3 test split
Metrics: attack success rate (ASR) average precision
Baselines: AIP UAP random shape stickers original car texture
Builds on: Expectation Over Transformation Faster R-CNN Pytorch3D
Closest papers by meaning
- FCA: Learning a 3D Full-Coverage Vehicle Camouflage for Multi-View Physical Adversarial Attack (AAAI 2022 · similarity 0.86)
- RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation (ICML 2024 · similarity 0.83)
- Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving (CVPR 2024 · similarity 0.82)
- CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors (NeurIPS 2024 · similarity 0.82)
- Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · similarity 0.82)
- Full-Distance Evasion of Pedestrian Detectors in the Physical World (NeurIPS 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.