Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems
UPPA introduces the first universal physical adversarial patch attack for infrared pedestrian detection, replacing costly instance-specific optimization with offline Particle Swarm Optimization over Bézier curve parameters. The method generates cold thermal patches that maintain topological stability under deformation while claiming zero online deployment overhead.
The paper presents a technically sound approach to universal physical attacks in the infrared domain, with strong digital evaluation across nine detectors and five datasets. The Bézier parameterization effectively addresses low-frequency thermal constraints. However, physical validation is limited to a single detector (YOLOv3) and narrow distance range (4.8–8.4m), while baseline comparisons rely on adapted rather than original implementations. Claims of "zero online computational overhead" obscure substantial offline query costs required for the PSO optimization.
The geometric modeling using parameterized Bézier curves with axial locking and convex-hull constraints is well-motivated for infrared's low-resolution thermal characteristics. The topological safety threshold ($\tau=0.45$) prevents block collision during deformation, enabling manufacturable cold patches. Cross-dataset transfer experiments demonstrate genuine generalization beyond the training distribution, particularly on MFNet where ASR reaches 77-90% for most CNN-based detectors without fine-tuning.
Physical robustness claims exceed the evidence: despite emphasizing "dynamic deformations" and "real-world dynamic pose changes" as core motivation, physical experiments only test static targets at fixed distances without pose variation. The baseline comparison methodology is problematic—instance-specific methods (HCB, AdvIC, AdvGrid) were adapted to universal settings, potentially handicapping their performance relative to their original design. The "zero online overhead" framing is misleading; while deployment requires no computation, the offline PSO optimization consumes substantial query budgets (50 particles $\times$ 10 iterations $\times$ dataset size). Finally, defense evaluation is limited to only adversarial training and digital watermarking, omitting physical defenses or preprocessing techniques specific to infrared.
Digital experiments support the claim that UPPA outperforms adapted baselines on all datasets, with particularly strong margins on MFNet (+16.1% ASR over HCB). The ablation study effectively isolates Bézier curves ($62.42\%$ ASR) as superior to rigid blocks ($52.23\%$) and Catmull-Rom splines ($57.21\%$). However, the cross-model transfer analysis lacks statistical confidence intervals, and physical ASR metrics do not account for false positive rates or detection latency. The Grad-CAM visualization qualitatively supports "thermal topology collapse" but lacks quantitative feature suppression metrics.
Hyperparameters are comprehensively documented (PSO: $N=50$, $K=10$, $\omega=0.9$, $c_1=1.6$, $c_2=1.4$; geometric: $D=6$, $W=1/4$, $\tau=0.45$). However, no code repository or implementation details for the physical patch fabrication are provided—critical gaps given that the thermal properties of cold patches (emissivity values, cooling mechanisms) determine physical success. The EOT transformation distribution $\mathcal{T}$ and TPS deformation parameters are not fully specified, preventing exact reproduction of the robustness training pipeline. Physical experiments use undisclosed ambient temperature conditions and target clothing materials.
Although infrared pedestrian detectors have been widely deployed in visual perception tasks, their vulnerability to physical adversarial attacks is becoming increasingly apparent. Existing physical attack methods predominantly rely on instance-specific online optimization and rigid pattern design, leading to high deployment costs and insufficient physical robustness. To address these limitations, this work proposes the Universal Physical Patch Attack (UPPA), the first universal physical attack method in the infrared domain. This method employs geometrically constrained parameterized Bezier blocks to model perturbations and utilizes the Particle Swarm Optimization (PSO) algorithm to perform unified optimization across the global data distribution, thus maintaining topological stability under dynamic deformations. In the physical deployment phase, we materialize the optimized digital perturbations into physical cold patches, achieving a continuous and smooth low-temperature distribution that naturally aligns with the thermal radiation characteristics of infrared imaging. Extensive experiments demonstrate that UPPA achieves an outstanding physical attack success rate without any online computational overhead, while also exhibiting strong cross-domain generalization and reliable black-box transferability.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.