Research map / Adversarial robustness and security / Attacks on text and graphs
RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RAUCA, a UV-map-based adversarial camouflage attack on vehicle detectors using a new Neural Renderer Plus (NRP) that adds environment (lighting/fog) rendering and a CARLA multi-weather dataset, evaluated in simulation and with printed camouflage on 1:12 car models.
Problem
Physical adversarial camouflage against vehicle detectors often fails to accurately map textures onto the vehicle, to render environmental effects such as lighting and shadow, and to remain effective under diverse weather such as fog.
Approach
Combine a UV-map-based neural renderer (NR) with an encoder-decoder Environment Feature Extractor that adds lighting/weather effects (NRP), train it with an area-weighted BCE loss, and generate camouflage over a multi-weather CARLA dataset with a new attack loss and smoothness loss.
Key results
- On the white-box YOLOv3, RAUCA reduces car AP@0.5 to 0.304 versus 0.439 for ACTIVE and 0.555 for FCA in the multi-weather simulation setting.
- On unseen weather, RAUCA reaches 0.369 AP@0.5 on YOLOv3 versus 0.594 for ACTIVE, and 0.272 vs 0.372 on DDTR.
- In real-world tests, RAUCA averages 0.195 AP@0.5 across noon, afternoon, night and fog, the lowest among compared methods except DTA's fog result.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use RAUCA instead of the strongest baseline camouflage | vehicle detectors in multi-weather simulation · Multi-weather simulation, six detectors | AP@0.5: 0.70 vs 0.439 (YOLOv3); 0.899 vs 0.611 (YOLOX); 0.780 vs 0.341 (DDTR); 0.784 vs 0.513 (DRCN); 0.785 vs 0.464 (SRCN); 0.7 | Helped |
| use RAUCA instead of ACTIVE camouflage | vehicle detectors in unseen-weather simulation · Unseen-weather dataset, six detectors | AP@0.5: 0.814 vs 0.594 (YOLOv3); 0.923 vs 0.608 (YOLOX); 0.815 vs 0.328 (DDTR); 0.816 vs 0.533 (DRCN); 0.807 vs 0.446 (SRCN); 0. | Helped |
| use RAUCA instead of ACTIVE camouflage | YOLOv3 vehicle detector · Real-world noon | AP@0.5: 0.253 vs 0.252 | No clear effect |
| use RAUCA instead of ACTIVE camouflage | YOLOv3 vehicle detector · Real-world fog | AP@0.5: 0.163 vs 0.200 | Hurt |
| add W(x_ref) loss weighting during NRP training (ablation) | NRP rendering · Vehicle-region rendering at distances 5, 10, 15, and 20 | MAE: 7.22 -> 6.50; 6.91 -> 5.51; 7.14 -> 5.53; 6.76 -> 5.23 | Helped |
| replace NR with NRP (ablation) | texture generation on single-weather dataset · YOLOv3 simulation | AP@0.5: 0.60 -> 0.42 | Helped |
| replace NR with NRP (ablation) | texture generation on multi-weather dataset · YOLOv3 simulation | AP@0.5: 0.64 -> 0.30 | Helped |
| use multi-weather instead of single-weather texture-generation data (ablation) | NR renderer · YOLOv3 simulation | AP@0.5: 0.60 -> 0.64 | Hurt |
| use multi-weather instead of single-weather texture-generation data (ablation) | NRP renderer · YOLOv3 simulation | AP@0.5: 0.42 -> 0.30 | Helped |
| use RAUCA adversarial loss instead of FCA loss (ablation) | camouflage texture generation · YOLOv3 and detector suite | AP@0.5: YOLOv3 0.331 -> 0.304; YOLOX 0.620 -> 0.611; DDTR 0.404 -> 0.285; DRCN 0.437 -> 0.449; SRCN 0.479 -> 0.384; FrRCN 0.453 | Mixed |
| use RAUCA adversarial loss instead of ACTIVE loss (ablation) | camouflage texture generation · YOLOv3 and detector suite | AP@0.5: YOLOv3 0.348 -> 0.304; YOLOX 0.625 -> 0.611; DDTR 0.344 -> 0.285; DRCN 0.439 -> 0.449; SRCN 0.462 -> 0.384; FrRCN 0.424 | Mixed |
| add smooth loss with β=0.0001 instead of β=0.0 (ablation) | RAUCA camouflage generation · YOLOv3 and detector suite | AP@0.5: 0.343 -> 0.304; 0.619 -> 0.611; 0.307 -> 0.285; 0.454 -> 0.449; 0.419 -> 0.384; 0.431 -> 0.406 | Helped |
Surprising findings
- Adding multi-weather data slightly hurt attack performance when using the original NR renderer (0.60 to 0.64 AP), attributed to NR's inability to render weather effects.
- In real-world foggy conditions, DTA and ACTIVE slightly outperformed RAUCA.
Limitations
- Real-world fog conditions were hard to control with a smoke machine, making comparisons noisy.
- Evaluated on a single vehicle model (Audi E-Tron) and mostly on AP@0.5 with a white-box YOLOv3 surrogate.
- Multi-weather training did not help when using the NR renderer, indicating the approach depends on the NRP renderer.
Experimental setup
Datasets: CARLA-generated multi-weather vehicle dataset COCO (detector pretraining)
Benchmarks: CARLA simulation test set (16 weather conditions) CARLA unseen-weather dataset real-world printed 1:12 Audi E-Tron tests
Metrics: AP@0.5 MAE
Baselines: DAS FCA DTA ACTIVE Random camouflage
Builds on: Neural Renderer FCA DTA ACTIVE EOT
Closest papers by meaning
- CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors (NeurIPS 2024 · similarity 0.90)
- PhyCamo: A Robust Physical Camouflage via Contrastive Learning for Multi-View Physical Adversarial Attack (AAAI 2025 · similarity 0.88)
- DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches (NeurIPS 2025 · similarity 0.84)
- Infrared Adversarial Car Stickers (CVPR 2024 · similarity 0.83)
- Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · similarity 0.83)
- NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack (AAAI 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.