Research map / Adversarial robustness and security / Attacks on text and graphs
AdvDisplay: Adversarial Display Assembled by Thermoelectric Cooler for Fooling Thermal Infrared Detectors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Designs AdvDisplay, a reusable thermal adversarial display built from an array of thermoelectric coolers under PID temperature control, optimized with CMA-ES against a YOLOv5 pedestrian detector using heat-transfer and power losses.
Problem
Physical adversarial attacks against thermal infrared pedestrian detectors are limited: passive hot-cold or insulation patches offer only binary or ternary radiation control and are not reusable, while active bulb/resistor methods lack fine radiation control.
Approach
Model an adversarial patch as a grid of thermoelectric cooler (TEC) units whose temperatures are continuously and bidirectionally set by PID control, optimize the per-unit temperatures with CMA-ES using black-box detector queries, and add heat-transfer and electric-power losses to narrow the digital-physical gap and reduce power.
Key results
- Digital attack with 9x9 AdvDisplay (4cm TECs) reduces YOLOv5 AP to 41.2% with 48.2% ASR, versus 87.2% AP for random display.
- In the physical world, a volunteer holding AdvDisplay at 2m achieves 96.1% ASR in the default setting.
- ASR drops by 54.5% when distance increases from 1m to 5m but remains around 42%; indoor-to-outdoor change lowers ASR by only 12.1%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace random display with optimized AdvDisplay (9×9, 4 cm) | YOLOv5 on FLIR ADAS V2 clean test set · FLIR ADAS V2 clean test set | ASR: 29.6 -> 48.2 | Helped |
| Use AdvDisplay instead of the Hot-cold Block attack | YOLOv5 on FLIR ADAS V2 test set · FLIR ADAS V2 test set | AP: 53.7 -> 41.2 | Helped |
| Add heat-transfer loss Lht to Lobj (ablation) | AdvDisplay on FLIR ADAS V2 clean test set · FLIR ADAS V2 clean test set | ASR: 59.6 -> 56.7 | Hurt |
| Add power-loss term Lep to Lobj + Lht (ablation) | AdvDisplay on FLIR ADAS V2 clean test set · FLIR ADAS V2 clean test set | ASR: 56.7 -> 48.2 | Hurt |
| Add heat-transfer loss Lht to Lobj (ablation) | AdvDisplay on FLIR ADAS V2 clean test set · FLIR ADAS V2 clean test set | Heat Transfer (Normalize): 0.412 -> 0.187 | Helped |
| Add power-loss term Lep to Lobj + Lht (ablation) | AdvDisplay on FLIR ADAS V2 clean test set · FLIR ADAS V2 clean test set | Power (W): 267.6 -> 196.2 | Helped |
| Increase TEC array resolution and TEC size (ablation) | AdvDisplay on FLIR ADAS V2 clean test set · FLIR ADAS V2 clean test set | ASR | Helped |
| Adversarially train YOLOv5 using AdvDisplay samples | YOLOv5 against AdvDisplay · AdvDisplay adversarial samples | AP: 41.2% to 73.6% | Hurt |
| Adversarially train YOLOv5 using AdvDisplay samples | YOLOv5 against AdvDisplay · AdvDisplay adversarial samples | ASR: 48.2% to 29.7% | Hurt |
Surprising findings
- Adding the heat-transfer and power losses slightly lowers digital ASR (59.6% to 48.2%) while cutting power, indicating a trade-off between attack strength and physical practicality.
- Adversarial training on AdvDisplay samples raises AP on adversarial samples from 41.2% to 73.6% and lowers ASR from 48.2% to 29.7%.
Limitations
- Attack effectiveness degrades with distance (ASR falls by 54.5% from 1m to 5m) due to low thermal camera resolution.
- Requires insulation between adjacent TEC units and electrical power, and physical fabrication, limiting practicality.
- Evaluated only on YOLOv5 and a single pedestrian dataset with a 160x120 thermal camera.
Experimental setup
Datasets: FLIR ADAS V2
Benchmarks: FLIR ADAS V2 (filtered pedestrian test set)
Metrics: Average Precision (AP) Attack Success Rate (ASR)
Baselines: HOTCOLD Block Bulb Attack QR Attack Random display
Builds on: CMA-ES PID control Dong et al. 2019 decision-based black-box attack
Closest papers by meaning
- DEAL: Data-Efficient Adversarial Learning for High-Quality Infrared Imaging (CVPR 2025 · similarity 0.82)
- Infrared Adversarial Car Stickers (CVPR 2024 · similarity 0.78)
- TCI-Former: Thermal Conduction-Inspired Transformer for Infrared Small Target Detection (AAAI 2024 · similarity 0.77)
- ThermalGaussian: Thermal 3D Gaussian Splatting (ICLR 2025 · similarity 0.76)
- NTR-Gaussian: Nighttime Dynamic Thermal Reconstruction with 4D Gaussian Splatting Based on Thermodynamics (CVPR 2025 · similarity 0.76)
- RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation (ICML 2024 · similarity 0.75)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.