Research map / Adversarial robustness and security / Attacks on text and graphs
Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Camera-Agnostic Patch (CAP), an adversarial patch attack on person detection that models the camera ISP with a differentiable proxy network and trains patches against it in a min-max game so they work across different cameras.
Problem
Physical adversarial patches against person detectors are unstable across cameras because the camera ISP (physical-to-digital transition) is ignored, making attacks hard to reproduce on unseen imaging hardware.
Approach
Model the camera ISP as a conditional differentiable U-Net proxy and optimize it adversarially: the attacker updates the patch to maximize attack effectiveness while the defender updates the ISP condition parameters to minimize it, yielding patches robust to unknown cameras.
Key results
- In digital space, CAP reaches ASR 54.4% to 73.8% across original and four ISP settings, exceeding T-SEA (44.5% to 53.0%) and other baselines.
- In physical space across six cameras (Sony, Canon, iPhone, Redmi, Huawei, Samsung), CAP achieves over 90% ASR on every camera, reaching 100% on iPhone and Huawei, while AdvPatch gets 0% on iPhone.
- Adversarial training with CAP attacks reduces physical ASR to 0–10.8% while keeping digital AP within about 1% of non-attack AP.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CAP instead of T-SEA | Person detection attack on INRIAPerson test · INRIAPerson test, ISP 1 | ASR (%): 53.0 -> 64.5 | Helped |
| Use CAP instead of T-SEA | Person detection attack on INRIAPerson test · INRIAPerson test, ISP 2 | ASR (%): 52.7 -> 73.8 | Helped |
| Use CAP instead of AdvPatch | Physical person detection attack · Six cameras | ASR (%): AdvPatch: 20, 35, 0, 10, 20, 20; CAP: 95, 95, 100, 90, 100, 95 | Helped |
| Add the camera ISP module to the patch-generation pipeline (ablation) | CAP · Physical space, six cameras | ASR (%): without camera ISP: 55, 70, 60, 75, 85, 75; full method: 95, 95, 100, 90, 100, 95 | Mixed |
| Add adversarial optimization of ISP conditional parameters (ablation) | CAP with camera ISP module · Physical space, six cameras | ASR (%): without adversarial optimization: 75, 65, 70, 70, 80, 50; full method: 95, 95, 100, 90, 100, 95 | Helped |
Surprising findings
- T-SEA has low AP in digital space yet low ASR due to multi-box detections creating false positives, so AP and ASR disagree.
- JPEG compression is ineffective against CAP in digital and physical settings, while SAC helps only slightly in digital space.
Limitations
- ISP proxy models only a subset of six ISP parameters rather than a full end-to-end differentiable camera simulator (exposure, aperture, ISO not modeled).
- Physical evaluation uses only six cameras and a small number of images per patch (120 per patch).
Experimental setup
Datasets: INRIAPerson COCO
Benchmarks: INRIAPerson
Metrics: AP% ASR%
Baselines: AdvPatch AdvT-shirt AdvCloak NAP LAP TC-EGA T-SEA Random Noise
Builds on: GAN training strategy AdvPatch U-Net learned ISP pipelines
Closest papers by meaning
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.90)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.87)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.87)
- UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.86)
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.85)
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.