Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Crafts black-and-white adversarial clothing textures via differentiable 3D rendering and differentiable V2E so that an event-based pedestrian detector (RVT-B) misses the wearer, and validates the textures on printed clothing in indoor and outdoor real-world recordings.
Problem
Event-based pedestrian detectors are assumed to be robust, but their vulnerability to physical adversarial attacks via clothing patterns has not been studied; the paper targets fooling such detectors so the wearer goes undetected.
Approach
An end-to-end pipeline that optimizes a binarized 2D clothing texture map through a differentiable SMPL renderer and differentiable video-to-event conversion, with a loss that minimizes pedestrian objectness and class scores of a frozen event detector, then prints the texture as physical clothing.
Key results
- In the digital domain, the 10x10 grid adversarial texture reduces AP to 5.7% at confidence threshold 0.25 with SeqASR 63.1%, versus 50.5% AP and 4.7% SeqASR for a white texture.
- Physical indoor test with DAVIS346 at threshold 0.25 gives SeqASR 74.3% for the optimal texture versus 4.3% and 0.0% for the two ordinary clothing cases.
- Outdoor physical test gives SeqASR 46.0% at threshold 0.25, showing reduced but still substantial attack success compared with indoor scenes.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace white, black, or random clothing with the optimized 10×10 adversarial texture | RVT-B · Digital test, confidence threshold 0.25 | SeqASR: 1.2% -> 63.1%; 3.7% -> 63.1%; 4.7% -> 63.1% | Helped |
| Use a 10×10 grid instead of a 60×60 grid (ablation) | Adversarial clothing texture on RVT-B · Digital test, confidence threshold 0.25 | SeqASR: 8.0% -> 63.1% | Helped |
| Use a 10×10 grid instead of a 20×20 grid (ablation) | Adversarial clothing texture on RVT-B · Digital test, confidence threshold 0.25 | SeqASR: 59.5% -> 63.1% | Helped |
| Add adversarial texture to the legs (ablation) | RVT-B clothing attack · Digital test, confidence threshold 0.25 | SeqASR: 4.7% -> 21.9% | Helped |
| Add adversarial texture to all body parts rather than upper body and legs (ablation) | RVT-B clothing attack · Digital test, confidence threshold 0.25 | SeqASR: 52.0% -> 63.1% | Helped |
| Restrict texture from full-body coverage to legs only (ablation) | RVT-B clothing attack · Digital test, confidence threshold 0.25 | AP: 5.7% -> 30.1% | Hurt |
| Wear digitally optimized adversarial clothing rather than ordinary Case 1 clothing | RVT-B · Indoor physical attack, confidence threshold 0.25 | SeqASR: 4.3% -> 74.3% | Helped |
| Wear digitally optimized adversarial clothing rather than ordinary Case 2 clothing | RVT-B · Indoor physical attack, confidence threshold 0.25 | SeqASR: 0.0% -> 74.3% | Helped |
| Transfer the adversarial clothing attack from indoor to outdoor scenes | RVT-B · Physical attack, confidence threshold 0.25 | SeqASR: 74.3% -> 46.0% | Hurt |
Surprising findings
- Attacking only the legs with the adversarial texture yields a higher SeqASR (21.9%) than covering the upper body (4.7%) or arms (1.2%), and the full-body texture performs best.
- At low confidence thresholds (0.001, 0.01), the adversarial texture gives near-zero SeqASR despite lowering AP, so attack success depends strongly on the threshold.
Limitations
- Only black-and-white textures are studied, while real clothing uses more colors and complex patterns.
- Physical attack success drops in outdoor scenes with complex backgrounds and varying lighting.
- Evaluation is limited to a single detector (RVT-B) and a small set of physical recordings.
Experimental setup
Datasets: AMASS Gen1
Benchmarks: Gen1
Metrics: AP SeqASR
Baselines: RVT-B white texture RVT-B black texture RVT-B random texture YOLOv7
Builds on: RVT V2E SMPL PyTorch3D Straight-Through Estimator
Closest papers by meaning
- Full-Distance Evasion of Pedestrian Detectors in the Physical World (NeurIPS 2024 · similarity 0.87)
- UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping (ICLR 2025 · similarity 0.86)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.85)
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.85)
- GLOW: Global Layout Aware Attacks on Object Detection (CVPR 2024 · similarity 0.84)
- ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.