Research map / Adversarial robustness and security / Attacks on text and graphs
UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UV-Attack, a physical adversarial clothing attack on person detectors that combines dynamic-NeRF-based UV-Volume rendering, GMM pose sampling, and diffusion-latent patch optimization (PSO + Adam) to remain effective across unseen human poses.
Problem
Adversarial attacks on person detectors via clothing textures degrade sharply under large, non-rigid human movement and unseen poses, because prior patch and static-3D-model attacks cannot model pose-dependent deformations.
Approach
Edit clothing textures as UV texture stacks of a dynamic NeRF (UV-Volume) rather than inside NeRF weights, sample novel poses from a GMM over SMPL pose space, optimize the initial latent of a stable diffusion model without classifier-free guidance, and use an expectation-over-pose-transformation loss.
Key results
- Achieves 92.75% ASR on FastRCNN at IoU 0.5 under unseen GMM poses, versus 28.5% for AdvCamou.
- Reaches 49.5% ASR on YOLOv8 in black-box transfer from FastRCNN in the static-pose setting (Table 2).
- Physical attack ASR of 0.82 on FastRCNN and 0.78 on MaskRCNN at confidence threshold 0.5.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Sample training poses from a GMM instead of video frames (ablation) | UV-Attack · Unseen-pose ZJU-Mocap | ASR (%): 82.50 -> 92.75 | Helped |
| Expand texture coverage from upper body to upper body, arms, and thighs (ablation) | UV-Attack · Physical attack, RCNN | ASR: 23.26 -> 84.35 | Helped |
| Expand texture coverage from upper body to upper body, arms, and thighs (ablation) | UV-Attack · Physical attack, YOLOv3 | ASR: 41.16 -> 87.68 | Helped |
| Remove classifier-free guidance (ablation) | UV-Attack · White-box and black-box detectors | mAP | Helped |
| Use classifier-free guidance (ablation) | UV-Attack · Adversarial patch generation | visual naturalness | Helped |
| Train with an ensemble of RCNN and YOLOv3 after RCNN pretraining (ablation) | UV-Attack · Six black-box detectors | mAP | Helped |
| Train on subject 1 and test on subject 2 (ablation) | UV-Attack · Unseen subjects | ASR: 20%-35% | Hurt |
| Increase adversarial-image complexity during training (ablation) | UV-Attack · Training epochs | mAP | Helped |
| Use UV-Volume rather than alternative dynamic NeRF texture-editing models (ablation) | UV-Attack · Clothing texture editing | render time: ∼5h; ∼2h; ∼15min -> <0.5s | Helped |
| Add classifier-free guidance (ablation) | UV-Attack · Adversarial loss optimization | adversarial loss convergence | Hurt |
Surprising findings
- Removing classifier-free guidance yields a lower mAP on black-box detectors, which the authors attribute to truncation reducing noise levels under guidance.
- Attacks trained on one subject lose 20-35% ASR when tested on a different subject.
Limitations
- Transfer to a different subject drops ASR by 20-35 percentage points.
- Ensemble training converged slowly and required a staged schedule.
- Co-DETR-SWIN remains relatively robust to the attack.
Experimental setup
Datasets: ZJU-Mocap MPII COCO
Benchmarks: ZJU-Mocap unseen pose dataset COCO
Metrics: attack success rate mAP
Baselines: AdvYolo AdvTshirt NatPatch AdvTexture AdvCamou Diff2Conf DiffPGD DAP
Builds on: UV-Volume AdvCamou Stable Diffusion Thin Plate Spline Expectation over Transformation
Closest papers by meaning
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.88)
- Omni-Angle Assault: An Invisible and Powerful Physical Adversarial Attack on Face Recognition (ICML 2025 · similarity 0.86)
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.86)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.86)
- GLOW: Global Layout Aware Attacks on Object Detection (CVPR 2024 · similarity 0.85)
- ProjAttacker: A Configurable Physical Adversarial Attack for Face Recognition via Projector (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.