Research map / Adversarial robustness and security / Attacks on text and graphs
AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AngleRoCL, which learns a textual-inversion embedding concept on Stable Diffusion v1.5 using detector loss over projectively transformed views, so T2I adversarial stop-sign patches stay effective across viewing angles.
Problem
Text-to-image diffusion-generated adversarial patches that fool object detectors lose attack effectiveness when viewed from different angles in the physical world.
Approach
Learn a new token embedding (an angle-robust concept) via textual inversion, supervised by YOLOv5 detection loss on projectively transformed views at 9 sampled angles, and insert it into existing NDD attack prompts so generated patches are angle-robust without per-patch optimization.
Key results
- In digital evaluation, NDDA+AngleRoCL raises average AASR from 23.79% to 36.02% (about 51% relative improvement) and MAGIC from 26.26% to 32.51%.
- In physical environment 198, NDDA+AngleRoCL achieves 51.75% AASR vs 28.37% for NDDA, and MAGIC+AngleRoCL achieves 65.86% vs 22.72% for MAGIC, while AdvPatch gets 0.00%.
- Prompt-level task instructions (prefix, infix, suffix) degrade angle robustness relative to plain NDDA prompts (e.g., prefix average 34.31% vs 60.35%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add the learned AngleRoCL concept to NDDA | NDDA · Digital environments, six-scene average | AASR: 23.79% to 36.02% | Helped |
| Add the learned AngleRoCL concept to MAGIC | MAGIC · Digital environments, six-scene average | AASR: 26.26% to 32.51% | Helped |
| Add the learned AngleRoCL concept to NDDA | NDDA · Physical environment | AASR: 28.37% to 51.75% | Helped |
| Add the learned AngleRoCL concept to MAGIC | MAGIC · Physical environment | AASR: 22.72% to 65.86% | Helped |
| Remove color features from the prompt (ablation) | NDDA · NDDA feature-removal evaluation, YOLOv5 | AASR: 56.64% to 21.17% | Hurt |
| Add AngleRoCL to prompts with color features removed (ablation) | NDDA · Feature removal, YOLOv5 | AASR: 21.17% to 62.33% | Helped |
| Remove shape features from the prompt (ablation) | NDDA · NDDA feature-removal evaluation, YOLOv5 | AASR: 56.64% to 27.78% | Hurt |
| Remove text features from the prompt (ablation) | NDDA · NDDA feature-removal evaluation, YOLOv5 | AASR: 56.64% to 43.84% | Hurt |
| Remove pattern features from the prompt (ablation) | NDDA · NDDA feature-removal evaluation, YOLOv5 | AASR: 56.64% to 29.69% | Hurt |
| Remove all robust features from the prompt (ablation) | NDDA · NDDA feature-removal evaluation, YOLOv5 | AASR: 56.64% to 6.86% | Hurt |
| Remove shape features from the prompt (ablation) | AngleRoCL · AngleRoCL feature-removal evaluation, YOLOv5 | AASR: 77.07% to 40.75% | Hurt |
| Remove color features from the prompt (ablation) | AngleRoCL · AngleRoCL feature-removal evaluation, YOLOv5 | AASR: 77.07% to 62.33% | Hurt |
Surprising findings
- Task-specific linguistic instructions such as 'detectable at multiple angles' degrade rather than improve angle robustness of T2I patches.
- Traditional AdvPatch achieves near-zero AASR in the physical environment (0.00%).
Limitations
- Training uses only 9 sampled angles in the horizontal plane, not full 3D viewpoint variation including vertical perspectives.
- Concept is learned at a fixed observation distance, and distance sensitivity is shown in supplementary analysis.
- Learned concept is biased toward YOLOv5 feedback, giving the strongest gains on YOLOv5 and smaller changes on other detectors.
Experimental setup
Datasets: nuImage (digital evaluation scenes) NDDA prompt set (39 prompts)
Benchmarks: nuImage six-environment digital evaluation physical stop-sign environment (3 scenes in supplement)
Metrics: Angle-Aware Attack Success Rate (AASR) attack success rate (ASR) average detection confidence
Baselines: AdvPatch NDDA MAGIC
Builds on: Textual inversion NDDA (natural denoising diffusion attack) MAGIC Adversarial Robustness Toolbox AdvPatch
Closest papers by meaning
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.86)
- STEREO: A Two-Stage Framework for Adversarially Robust Concept Erasing from Text-to-Image Diffusion Models (CVPR 2025 · similarity 0.86)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.86)
- SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments (CVPR 2025 · similarity 0.85)
- Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.85)
- AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.