AdvTiles: Physical Adversarial Camouflage Clothing against Person Detectors via Learnable Tiles

• URL: http://arxiv.org/abs/2608.06801v1
• Date: Fri, 07 Aug 2026 04:45:46 GMT
• Title: AdvTiles: Physical Adversarial Camouflage Clothing against Person Detectors via Learnable Tiles
• Abstract summary: AdvTiles is a physical adversarial camouflage framework built from learnable tiles.<n>We use a Straight-through (ST) Gumbel-Softmax estimator for differentiable tile selection.<n>We further fabricate the optimized camouflage into wearable adversarial clothing, validating its effectiveness in real-world scenarios.
• Score: 35.23345194190519
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Physical adversarial attacks against person detectors have evolved from localized patches to full-body textures. However, achieving both visual naturalness and strong attack effectiveness remains challenging. Existing natural-looking methods typically optimize camouflage textures as a whole, limiting the flexibility to refine local adversarial patterns and their spatial arrangement. To address this issue, we propose AdvTiles, a physical adversarial camouflage framework built from learnable tiles, enabling strong attack performance while preserving a natural camouflage appearance. Specifically, we use a Straight-through (ST) Gumbel-Softmax estimator for differentiable tile selection, enabling joint optimization of tile patterns and spatial layouts. This design provides fine-grained control over adversarial texture generation. To improve robustness in diverse physical conditions, we further optimize the camouflage through differentiable 3D Gaussian Splatting rendering with variations in viewpoints, scales, illuminations and backgrounds. Extensive experiments across multiple detectors demonstrate that AdvTiles achieves an average ASR of 86.2%, outperforming existing state-of-the-art attack methods. We further fabricate the optimized camouflage into wearable adversarial clothing, validating its effectiveness in real-world scenarios across diverse distances, angles and backgrounds.

Related papers

• R-PGA: Robust Physical Adversarial Camouflage Generation via Relightable 3D Gaussian Splatting [59.29134814041703]
  Physical adversarial camouflage poses a severe security threat to autonomous driving systems.<n>Current methods fail to generalize across diverse geometric (e.g., viewing configurations) and radiometric variations.<n>We propose the Relightable Physical 3D Gaussian Splatting framework (R-PGA)
  arXiv  Detail & Related papers  (2026-03-27T04:38:04Z)
• 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation [50.03578546845548]
  Physical adversarial attack methods expose the vulnerabilities of deep neural networks and pose a significant threat to safety-critical scenarios such as autonomous driving.<n> Camouflage-based physical attack is a more promising approach compared to the patch-based attack, offering stronger adversarial effectiveness in complex physical environments.<n>We propose a physical attack framework based on 3D Gaussian Splatting (3DGS), named PGA, which provides rapid and precise reconstruction with few images.
  arXiv  Detail & Related papers  (2025-07-02T05:10:16Z)
• BadPatch: Diffusion-Based Generation of Physical Adversarial Patches [75.35862017536253]
  BadPatch is a novel diffusion-based framework for generating naturalistic adversarial patches.<n>We construct AdvT-shirt-1K, the first physical adversarial T-shirt dataset.
  arXiv  Detail & Related papers  (2024-12-02T12:30:35Z)
• CNCA: Toward Customizable and Natural Generation of Adversarial Camouflage for Vehicle Detectors [19.334642862951537]
  We propose a Customizable and Natural Camouflage Attack (CNCA) method by leveraging an off-the-shelf pre-trained diffusion model. Our method can generate natural and customizable adversarial camouflage while maintaining high attack performance.
  arXiv  Detail & Related papers  (2024-09-26T15:41:18Z)
• Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds [62.94859179323329]
  Adrial attack methods based on point manipulation for 3D point cloud classification have revealed the fragility of 3D models. We propose a novel shape-based adversarial attack method, HiT-ADV, which conducts a two-stage search for attack regions based on saliency and imperceptibility perturbation scores. We propose that by employing benign resampling and benign rigid transformations, we can further enhance physical adversarial strength with little sacrifice to imperceptibility.
  arXiv  Detail & Related papers  (2024-03-08T12:08:06Z)
• RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generation [19.334642862951537]
  We propose a robust and accurate camouflage generation method, namely RAUCA. The core of RAUCA is a novel neural rendering component, Neural Renderer Plus (NRP), which can accurately project vehicle textures and render images with environmental characteristics such as lighting and weather. Experimental results on six popular object detectors show that RAUCA consistently outperforms existing methods in both simulation and real-world settings.
  arXiv  Detail & Related papers  (2024-02-24T16:50:10Z)
• Flexible Physical Camouflage Generation Based on a Differential Approach [7.042192479182557]
  This study introduces a novel approach to neural rendering, specifically tailored for adversarial camouflage.<n>Our method, named FPA, goes beyond traditional techniques by faithfully simulating lighting conditions and material variations.<n>Our findings highlight the versatility and efficacy of the FPA approach in adversarial camouflage applications.
  arXiv  Detail & Related papers  (2024-02-21T07:15:16Z)
• The Making and Breaking of Camouflage [95.37449361842656]
  We show that camouflage can be measured by the similarity between background and foreground features and boundary visibility. We incorporate the proposed camouflage score into a generative model as an auxiliary loss and show that effective camouflage images or videos can be synthesised in a scalable manner.
  arXiv  Detail & Related papers  (2023-09-07T17:58:05Z)
• DTA: Physical Camouflage Attacks using Differentiable Transformation Network [0.4215938932388722]
  We propose a framework for generating a robust physical adversarial pattern on a target object to camouflage it against object detection models. Using our attack framework, an adversary can gain both the advantages of the legacy photo-realistics and the benefit of white-box access. Our experiments show that our camouflaged 3D vehicles can successfully evade state-of-the-art object detection models.
  arXiv  Detail & Related papers  (2022-03-18T10:15:02Z)
• FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attack [5.476797414272598]
  We propose a robust Full-coverage Camouflage Attack (FCA) to fool detectors. Specifically, we first try rendering the non-planar camouflage texture over the full vehicle surface. We then introduce a transformation function to transfer the rendered camouflaged vehicle into a photo-realistic scenario.
  arXiv  Detail & Related papers  (2021-09-15T10:17:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.