Research map / Adversarial robustness and security / Attacks on text and graphs
Full-Distance Evasion of Pedestrian Detectors in the Physical World
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Full Distance Attack (FDA), a physics-based distant image converter plus multi-frequency optimization, to create adversarial patches and clothing that evade pedestrian detectors at distances up to 41 m in the physical world.
Problem
Adversarial patterns for evading pedestrian detectors in the physical world are weak at medium-to-long distances because naive distance simulation creates an appearance gap and low-frequency optimization conflicts across distances.
Approach
A physics-based Distant Image Converter (atmospheric perspective, camera blur, and effect filter modules with 15 learnable parameters) fitted on a small physically photographed dataset replaces naive downscaling during optimization, and Multi-Frequency Optimization (multi-scale cropping plus two-stage optimization) resolves the short- versus long-distance conflict.
Key results
- The FDA patch achieved an average physical-world ASR of 74% across distances, versus 19% for NAP and 42% for T-SEA.
- The DIC kept a stable l2-norm error of about 0.11 across distances, while naive conversion rose from about 0.11 to 0.16.
- FDA clothing reached an average ASR of 76% in the front and back view against YOLOv5, versus 37% for TCA clothing.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FDA instead of Adv-Tshirt | YOLOv5 physical-world patch attack · Pedestrian patch attack, 3.5–41m | average ASR | Helped |
| Optimize the FDA pattern against Mask RCNN ResNet and Swin as an ensemble | FDA black-box attack · Physical-world transfer to black-box detectors | average ASR: 79%, 74%, 71%, 77%, 87%, 80%, 75% | Helped |
| Use FDA clothing instead of TCA clothing | YOLOv5 · Physical-world clothing attack, front and back | average ASR: 37% -> 76% | Helped |
| Use FDA clothing instead of TCA clothing | YOLOv5 · Physical-world clothing attack, side view | average ASR: 15% higher | Helped |
| Add DIC to the attack optimization pipeline (ablation) | FDA patch attack · Physical-world patch attack | average ASR: 22% -> 65% | Helped |
| Add MFO to FDA with DIC (ablation) | FDA patch attack · Physical-world patch attack | average ASR: 65% -> 74% | Helped |
| Remove effect filter simulation from DIC (ablation) | DIC · Distant image conversion test set | average L2-norm error: 0.11 -> 0.12 | Hurt |
| Remove camera simulation from DIC (ablation) | DIC · Distant image conversion test set | average L2-norm error: 0.11 -> 0.13 | Hurt |
| Remove atmospheric perspective simulation from DIC (ablation) | DIC · Distant image conversion test set | average L2-norm error: 0.11 -> 0.14 | Hurt |
| Add multi-scale cropping (MSC) (ablation) | FDA MFO · Digital-world patch attack | average ASR: 66% -> 73% | Helped |
| Add two-stage optimization (TSO) (ablation) | FDA MFO with MSC · Digital-world patch attack | average ASR: 56% -> 66% | Helped |
| Increase EOT color and noise strength to 1x, 3x, or 10x | Adv-Tshirt patch attack · Physical-world patch attack | average ASR: 22%, 10%, 8% | Hurt |
Surprising findings
- Adv-Tshirt with stronger EOTs (1x, 3x, 10x) did not improve distant attack and obtained only 22%, 10% and 8% ASR, so larger EOT is not helpful for FDA.
Limitations
- Without specific transferability designs, the FDA patch transfers poorly to most black-box detectors (only Deformable DETR exceeded 50%); ensemble attack was needed.
- On YOLOv5 clothing, abstract human-like patterns produce small detections that lower ASR at low IoU thresholds (from 76% to 38%).
- Evaluation uses only five subjects and three phone cameras with a small distant image dataset of 45 training images.
Experimental setup
Datasets: INRIA PennFudan COCO Background dataset from existing work [18] Self-collected distant image dataset
Benchmarks: Physical world attack (YOLOv5 patch ASR across 3.5-41 m) Digital world patch ASR (300 held-out pedestrian images) Black-box transfer to Mask RCNN, FrRCNN, RetinaNet, YOLOv8, D-DETR
Metrics: attack success rate (ASR) l2-norm error for DIC conversion
Baselines: Adv-Tshirt TCA NAP T-SEA Adv-Patch FCN distant image conversion Random patch
Builds on: Adv-Tshirt TCA EOT Ensemble attack
Closest papers by meaning
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.87)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.85)
- GLOW: Global Layout Aware Attacks on Object Detection (CVPR 2024 · similarity 0.85)
- UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.84)
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.84)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.