Budget-Aware Adaptive Adversarial Patches for Black-Box Object Detection

• URL: http://arxiv.org/abs/2606.18318v1
• Date: Tue, 16 Jun 2026 13:38:15 GMT
• Title: Budget-Aware Adaptive Adversarial Patches for Black-Box Object Detection
• Abstract summary: We present a query-efficient, budget-adaptive black-box attack that couples a lightweight placer with NES-style pixel updates.<n>Across YOLOv5, Faster R-CNN, and YOLOS, method achieves strong suppression on CNN-based detectors and substantial suppression on the transformer-based detector.
• Score: 1.8641315013048299
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Adversarial patches pose a practical threat to modern object detectors. Prior work shows vulnerability, but three gaps limit actionable insight: (i) few \emph{score-based black-box} attacks \emph{jointly} optimize patch \emph{location, texture, and size} under tight query budgets; (ii) success is rarely tied to the patch's \emph{visual footprint}; and (iii) evaluations often conflate EOT robustness with plain-view suppression. We present \method{}, a query-efficient, budget-adaptive black-box attack that couples a lightweight \emph{Contextual Thompson-Sampling} placer with NES-style pixel updates, growing the patch only when progress stalls. Reporting is anchored by a \emph{strict plain-image} suppression test; EOT is audited but never used as a substitute for success, and optional appearance/printability weights expose strength--visibility trade-offs. Across YOLOv5, Faster R-CNN, and YOLOS, \method{} achieves strong suppression on CNN-based detectors and substantial suppression on the transformer-based detector, using compact patches and exposing clear query--footprint trade-offs relative to fixed-size and heuristic baselines. A print--capture pilot further shows transfer across unseen physical objects and viewpoints.

Related papers

• TRACE: Trajectory-robust Admission with Evidence Ordering for Efficient GUI Agents [54.88208747581851]
  Training-free visual token pruning can reduce this cost, but cache reuse introduces a fundamental constraint.<n>We propose textbfmethod, a training-free framework for emphtextbfTrajectory-textbfrobust textbfAdmission and textbfCoverage-aware textbfEvidence ordering.
  arXiv  Detail & Related papers  (2026-09-09T15:12:48Z)
• Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack [78.02110947708535]
  Adversarial images pose a severe security threat to multimodal large language models through prompt injection.<n>We show that successful adversarial attacks do not rely on the entire image uniformly but instead depend on a small subset of critical image tokens.<n>We propose Gradient Token Masking (GTM), which localizes these tokens via gradient analysis and neutralizes them through masking.
  arXiv  Detail & Related papers  (2026-05-24T17:51:34Z)
• Evading Visual Aphasia: Contrastive Adaptive Semantic Token Pruning for Vision-Language Models [52.78477729846771]
  We introduce COAST (COntrastive Adaptive Semantic Token Pruning), a training-free pruning framework that casts compression as adaptive semantic routing.<n> COAST consistently outperforms strong pruning baselines across token budgets and generalizes across multiple LVLM families.
  arXiv  Detail & Related papers  (2026-05-10T09:07:04Z)
• Revisiting Token Compression for Accelerating ViT-based Sparse Multi-View 3D Object Detectors [18.684602624559734]
  We propose SEPatch3D, a novel framework that dynamically adjusts patch sizes while preserving semantic information within coarse patches.<n> Experiments on the nuScenes and Argoverse 2 validation sets show that SEPatch3D achieves up to textbf57% faster inference than the StreamPETR baseline and textbf20% higher efficiency than the state-of-the-art ToC3D-faster.
  arXiv  Detail & Related papers  (2026-04-16T02:46:53Z)
• PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devices [5.082257334702858]
  Adrial attacks pose a significant challenge to the reliable deployment of machine learning models in EdgeAI applications.<n>We present PatchBlock, a framework designed to detect and neutralize adversarial patches in images.<n>We show that PatchBlock consistently improves robustness, recovering up to 77% of model accuracy under strong patch attacks.
  arXiv  Detail & Related papers  (2026-01-01T15:04:16Z)
• When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models [81.7618160628979]
  Vision-Language-Action (VLA) models are vulnerable to adversarial attacks, yet universal and transferable attacks remain underexplored.<n>We introduce UPA-RFAS (Universal Patch Attack via Robust Feature, Attention, and Semantics), a unified framework that learns a single physical patch in a shared feature space.<n> Experiments across diverse VLA models, manipulation suites, and physical executions show that UPA-RFAS consistently transfers across models, tasks, and viewpoints.
  arXiv  Detail & Related papers  (2025-11-26T09:16:32Z)
• Pixel-Optimization-Free Patch Attack on Stereo Depth Estimation [37.97727884936262]
  We build a unified framework that extends pixel-optimization attacks to four stereo-matching stages.<n>We propose PatchHunter, the first pixel-optimization-free attack.<n>On KITTI, PatchHunter outperforms pixel-level attacks in both effectiveness and black-box transferability.
  arXiv  Detail & Related papers  (2025-06-21T08:23:02Z)
• BankTweak: Adversarial Attack against Multi-Object Trackers by Manipulating Feature Banks [2.8931452761678345]
  We present textsfBankTweak, a novel adversarial attack designed for multi-object tracking (MOT) trackers. Our method substantially surpasses existing attacks, exposing the vulnerability of the tracking-by-detection framework.
  arXiv  Detail & Related papers  (2024-08-22T20:35:46Z)
• Improving Adversarial Robustness of Masked Autoencoders via Test-time Frequency-domain Prompting [133.55037976429088]
  We investigate the adversarial robustness of vision transformers equipped with BERT pretraining (e.g., BEiT, MAE) A surprising observation is that MAE has significantly worse adversarial robustness than other BERT pretraining methods. We propose a simple yet effective way to boost the adversarial robustness of MAE.
  arXiv  Detail & Related papers  (2023-08-20T16:27:17Z)
• Benchmarking Adversarial Patch Against Aerial Detection [11.591143898488312]
  A novel adaptive-patch-based physical attack (AP-PA) framework is proposed. AP-PA generates adversarial patches that are adaptive in both physical dynamics and varying scales. We establish one of the first comprehensive, coherent, and rigorous benchmarks to evaluate the attack efficacy of adversarial patches on aerial detection tasks.
  arXiv  Detail & Related papers  (2022-10-30T07:55:59Z)
• Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection [142.24869736769432]
  Adversarial patch attacks pose a serious threat to state-of-the-art object detectors. We propose Segment and Complete defense (SAC), a framework for defending object detectors against patch attacks. We show SAC can significantly reduce the targeted attack success rate of physical patch attacks.
  arXiv  Detail & Related papers  (2021-12-08T19:18:48Z)
• Generating Adversarial yet Inconspicuous Patches with a Single Image [15.217367754000913]
  We propose an approach to gen-erate adversarial yet inconspicuous patches with onesingle image. In our approach, adversarial patches areproduced in a coarse-to-fine way with multiple scalesof generators and discriminators. Our ap-proach shows strong attacking ability in both the white-box and black-box setting.
  arXiv  Detail & Related papers  (2020-09-21T11:56:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.