Research map / Adversarial robustness and security / Attacks on text and graphs
CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Generates natural, customizable adversarial vehicle camouflage by optimizing an adversarial feature added to a text-prompt embedding of a pretrained Stable Diffusion model, with norm clipping to trade off naturalness and attack strength.
Problem
Existing physical adversarial camouflage attacks against vehicle detectors optimize textures at the pixel level, producing conspicuous patterns that humans easily notice, and cannot be customized to environments.
Approach
Optimize an adversarial feature vector concatenated with a text prompt embedding that conditions a pretrained text-to-image diffusion model to generate UV-map camouflage textures; clip the adversarial feature's norm to balance naturalness and attack success.
Key results
- CNCA achieves total AP@0.5 of 0.495 across six detectors versus 0.504 for ACTIVE, 0.541 for DTA, and 0.723 for DAS, with a normal car at 0.779.
- Subjective naturalness score of CNCA is 2.84 out of 5, versus 1.84 to 2.11 for DAS, FCA, DTA and ACTIVE, while normal car texture scores 4.68.
- In physical tests, YOLOv3 AP@0.5 drops from 0.705 (normal) to 0.363 with CNCA camouflage.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CNCA instead of the strongest baseline ACTIVE | Vehicle camouflage attack · Digital evaluation, total across detectors | AP@0.5: 0.504 -> 0.495 | Helped |
| Use CNCA instead of ACTIVE | Vehicle camouflage attack · YOLOF | AP@0.5: 0.577 -> 0.538 | Helped |
| Use CNCA instead of DTA | Vehicle camouflage attack · DDTR | AP@0.5: 0.402 -> 0.436 | Hurt |
| Use CNCA instead of ACTIVE | Vehicle camouflage attack · DRCN | AP@0.5: 0.534 -> 0.536 | No clear effect |
| Use CNCA instead of ACTIVE | Vehicle camouflage attack · SRCN | AP@0.5: 0.484 -> 0.470 | Helped |
| Use CNCA instead of ACTIVE | Vehicle camouflage attack · FrRCN | AP@0.5: 0.520 -> 0.504 | Helped |
| Generate camouflage with CNCA rather than a normal car texture | Physical vehicle evaluation · Physical evaluation across YOLOv3, YOLOX, SSD, CenterNet, and RetinaNet | AP@0.5 | Helped |
| Use diffusion-based CNCA camouflage rather than DTA camouflage | Vehicle camouflage · Subjective naturalness evaluation | Naturalness score: 1.86 ± 0.98 -> 2.84 ± 1.09 | Helped |
| Increase the adversarial-feature clipping threshold (ablation) | CNCA · Prompt yellow black graffiti | AP@0.5: 0.606, 0.449, 0.479, 0.481, 0.520 | Mixed |
| Increase the adversarial-feature clipping threshold (ablation) | CNCA · Prompt yellow black graffiti | Naturalness score: 4.79, 3.54, 3.33, 1.46, 1.71 | Hurt |
Surprising findings
- Prompts describing natural objects gave lower attack performance than abstract prompts, averaging around 0.03 less AP@0.5.
Limitations
- Back-propagation through the diffusion model is more expensive than previous gradient-based camouflage methods.
- Norm threshold tau must be manually tuned for each text prompt.
- Attack performance is lower than the best pixel-level baselines (ACTIVE, DTA) in total AP, and the naturalness score (2.84) is well below the normal texture (4.68).
Experimental setup
Datasets: Carla simulator generated vehicle images (Audi E-Tron) LAION-5B (diffusion model pretraining) COCO (detector training)
Benchmarks: Carla-generated vehicle test set physical 1:12 scaled Audi E-Tron evaluation
Metrics: AP@0.5 naturalness score (1-5 subjective rating)
Baselines: DAS FCA DTA ACTIVE Random camouflage Normal car texture
Builds on: Stable Diffusion DTA ACTIVE PGD Pytorch3D
Closest papers by meaning
- RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation (ICML 2024 · similarity 0.90)
- PhyCamo: A Robust Physical Camouflage via Contrastive Learning for Multi-View Physical Adversarial Attack (AAAI 2025 · similarity 0.87)
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.83)
- Strategic Preys Make Acute Predators: Enhancing Camouflaged Object Detectors by Generating Camouflaged Objects (ICLR 2024 · similarity 0.83)
- Infrared Adversarial Car Stickers (CVPR 2024 · similarity 0.82)
- DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches (NeurIPS 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.