Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems

• URL: http://arxiv.org/abs/2603.21876v2
• Date: Sat, 28 Mar 2026 05:02:40 GMT
• Title: Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems
• Abstract summary: The Universal Physical Patch Attack (UPPA) is the first universal physical attack method in the infrared domain.<n>UPPA achieves an outstanding physical attack success rate without any online computational overhead.
• Score: 9.1429852822672
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Although infrared pedestrian detectors have been widely deployed in visual perception tasks, their vulnerability to physical adversarial attacks is becoming increasingly apparent. Existing physical attack methods predominantly rely on instance-specific online optimization and rigid pattern design, leading to high deployment costs and insufficient physical robustness. To address these limitations, this work proposes the Universal Physical Patch Attack (UPPA), the first universal physical attack method in the infrared domain. This method employs geometrically constrained parameterized Bezier blocks to model perturbations and utilizes the Particle Swarm Optimization (PSO) algorithm to perform unified optimization across the global data distribution, thus maintaining topological stability under dynamic deformations. In the physical deployment phase, we materialize the optimized digital perturbations into physical cold patches, achieving a continuous and smooth low-temperature distribution that naturally aligns with the thermal radiation characteristics of infrared imaging. Extensive experiments demonstrate that UPPA achieves an outstanding physical attack success rate without any online computational overhead, while also exhibiting strong cross-domain generalization and reliable black-box transferability.

Related papers

• Physically Real-time Infrared Attack against Optical Flow Estimation Networks [19.19261635934934]
  We present an approach for real-time attacks on Optical Flow Estimation Networks in the physical world.<n>By generating a large number of Adversarial Examples in advance, our approach computes AEs in real time and dynamically displays them.<n>Unlike previous digital-to-physical attack techniques, our method directly attacks victim models within the physical world.
  arXiv  Detail & Related papers  (2026-07-29T09:12:30Z)
• Unleashing the Representational Power of Fourier Shapes for Attacking Infrared Object Detection [9.990665128755014]
  We introduce learnable Fourier shapes to the infrared domain.<n>This enables efficient gradient-based optimization to generate potent shapes that cause human targets to evade detection.<n>Our resulting physical patch achieves robustness, successfully evading detectors across diverse distances, angles, poses, and individuals, and achieves 88% attack success rate at greater than 25m.
  arXiv  Detail & Related papers  (2026-05-18T03:51:33Z)
• PhyCo: Learning Controllable Physical Priors for Generative Motion [55.59209981836171]
  We present PhyCo, a framework that introduces continuous, interpretable, and physically grounded control into video generation.<n>Our approach integrates three key components: (i) a large-scale dataset of over 100K photorealistic simulation videos where friction, restitution, deformation, and force are systematically varied across diverse scenarios; (ii) physics-supervised fine-tuning of a pretrained diffusion model using a ControlNet conditioned on pixel-aligned physical property maps; and (iii) VLM-guided reward optimization, where a fine-tuned vision-language model evaluates generated videos with targeted physics queries and provides differentiable feedback.
  arXiv  Detail & Related papers  (2026-04-30T17:53:03Z)
• Revealing Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models [21.429674567539607]
  Infrared vision-language models (IR-VLMs) have emerged as a promising paradigm for multimodal perception in low-visibility environments.<n>Existing adversarial patch methods are mainly designed for RGB-based models in closed-set settings.<n>We propose Universal Curved-Grid Patch (UCGP), a universal physical adversarial patch framework for IR-VLMs.
  arXiv  Detail & Related papers  (2026-04-03T15:42:55Z)
• R-PGA: Robust Physical Adversarial Camouflage Generation via Relightable 3D Gaussian Splatting [59.29134814041703]
  Physical adversarial camouflage poses a severe security threat to autonomous driving systems.<n>Current methods fail to generalize across diverse geometric (e.g., viewing configurations) and radiometric variations.<n>We propose the Relightable Physical 3D Gaussian Splatting framework (R-PGA)
  arXiv  Detail & Related papers  (2026-03-27T04:38:04Z)
• Adversarial Patch Generation for Visual-Infrared Dense Prediction Tasks via Joint Position-Color Optimization [14.358458317718174]
  We propose a joint position-color optimization framework (AP-PCO) for generating adversarial patches in visual-infrared settings.<n>We introduce a crossmodal color adaptation strategy that constrains patch appearance according to infrared grayscale characteristics.<n> experiments on visual-infrared dense prediction tasks demonstrate that the proposed AP-PCO achieves consistently strong attack performance.
  arXiv  Detail & Related papers  (2026-02-27T19:26:17Z)
• When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Models [54.08784776767683]
  We present Physical-Conditioned World Model Attack (PhysCond-WMA), the first white-box world model attack that perturbs physical-condition channels.<n>PhysCond-WMA induces semantic, logic, or decision-level distortion while preserving perceptual fidelity.
  arXiv  Detail & Related papers  (2026-02-21T07:22:37Z)
• 3DGAA: Realistic and Robust 3D Gaussian-based Adversarial Attack for Autonomous Driving [17.849564138275845]
  We propose 3D Gaussian-based Adrial Attack (3DGAA), a novel adversarial object generation framework.<n>Unlike prior works that rely on patches or texture optimization, 3DGAA jointly perturbs both geometric attributes and appearance attributes.<n>We show that 3DGAA achieves to reduce the detection mAP from 87.21% to 7.38%, significantly outperforming existing 3D physical attacks.
  arXiv  Detail & Related papers  (2025-07-14T07:27:52Z)
• 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation [50.03578546845548]
  Physical adversarial attack methods expose the vulnerabilities of deep neural networks and pose a significant threat to safety-critical scenarios such as autonomous driving.<n> Camouflage-based physical attack is a more promising approach compared to the patch-based attack, offering stronger adversarial effectiveness in complex physical environments.<n>We propose a physical attack framework based on 3D Gaussian Splatting (3DGS), named PGA, which provides rapid and precise reconstruction with few images.
  arXiv  Detail & Related papers  (2025-07-02T05:10:16Z)
• Improving Black-Box Generative Attacks via Generator Semantic Consistency [51.470649503929344]
  generative attacks produce adversarial examples in a single forward pass at test time.<n>We enforce semantic consistency by aligning the early generator's intermediate features to an EMA teacher.<n>Our approach can be seamlessly integrated into existing generative attacks with consistent improvements in black-box transfer.
  arXiv  Detail & Related papers  (2025-06-23T02:35:09Z)
• Pixel-Optimization-Free Patch Attack on Stereo Depth Estimation [37.97727884936262]
  We build a unified framework that extends pixel-optimization attacks to four stereo-matching stages.<n>We propose PatchHunter, the first pixel-optimization-free attack.<n>On KITTI, PatchHunter outperforms pixel-level attacks in both effectiveness and black-box transferability.
  arXiv  Detail & Related papers  (2025-06-21T08:23:02Z)
• Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical World [11.24237636482709]
  We design a unified adversarial patch that can perform cross-modal physical attacks, achieving evasion in both modalities simultaneously with a single patch. We propose a novel boundary-limited shape optimization approach that aims to achieve compact and smooth shapes for the adversarial patch. Our method is evaluated against several state-of-the-art object detectors, achieving an Attack Success Rate (ASR) of over 80%.
  arXiv  Detail & Related papers  (2023-07-27T08:14:22Z)
• Physically Adversarial Infrared Patches with Learnable Shapes and Locations [1.1172382217477126]
  We propose a physically feasible infrared attack method called "adversarial infrared patches" Considering the imaging mechanism of infrared cameras by capturing objects' thermal radiation, adversarial infrared patches conduct attacks by attaching a patch of thermal insulation materials on the target object to manipulate its thermal distribution. We verify adversarial infrared patches in different object detection tasks with various object detectors.
  arXiv  Detail & Related papers  (2023-03-24T09:11:36Z)
• HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Design [60.97064635095259]
  textscHotCold Block is a novel physical attack for infrared detectors that hide persons utilizing the wearable Warming Paste and Cooling Paste. By attaching these readily available temperature-controlled materials to the body, textscHotCold Block evades human eyes efficiently.
  arXiv  Detail & Related papers  (2022-12-12T05:23:11Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.