{"id":"d7196d32-4dfc-4ab5-94a5-82a40d18af1d","arxiv_id":"2411.10498","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"PG-ECAP generates adversarial clothing patches with prompt-conditioned diffusion models and two alignment losses, improving attack success and perceived environmental consistency.","lead":"The paper introduces PG-ECAP, a method that uses text-to-image diffusion models to generate adversarial clothing patches that evade person detectors while blending into the environment. It adds two alignment losses to keep the patch faithful to a user-chosen prompt, and reports gains in attack success and in human-rated visual consistency.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed 'environmental consistency' is validated only by a 10-person subjective test on one green background matching the chosen prompt; no objective metric or mismatched-environment control supports the central seamless-integration claim.","rationale":"The reader's CONDITIONAL verdict is appropriate. My concern does not overturn it; it specifies why the condition is essential: environmental consistency is the paper's main novelty and currently rests on a single, prompt-matched subjective evaluation with no objective or mismatch control. The proposed automated metric would directly test whether the alignment losses actually produce patches that blend into scenes beyond the one green background. If the metric shows no advantage, the paper's contribution reduces to a small and per-detector inconsistent digital mAP50 improvement, which would not justify the 'environmentally consistent' claim. Therefore the verdict remains CONDITIONAL pending this evidence.","tokens_in":12526,"tokens_out":5359,"duration_ms":56182,"concrete_test":"Run an objective consistency evaluation on at least five backgrounds (forest, desert, ocean, lobby, hallway) comparing PG-ECAP, DAP, and NAP patches using an automated scene-consistency metric such as CLIP directional similarity between the patch region and the surrounding scene, or LPIPS between the patched and unpatched images. If PG-ECAP is not significantly better than DAP/NAP on the mismatched backgrounds, or if it only wins on the green background used to choose the prompt, then the environmental-consistency claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's distinctive claim is that prompt-guided diffusion optimization (Eq. 13) produces patches that are both adversarial and seamlessly integrated into the target environment. This rests on the assumption, introduced in Sec. 3.3-3.4, that aligning cross-attention maps (Eq. 11) and the initial latent z0 (Eq. 12) is sufficient to preserve environmental consistency in physical scenes. The only direct evidence is Sec. 4.2.3: 10 participants rate T-shirts on a 7-point Likert scale against a single green-natural background sourced from Fig. 3. Because the prompt is 'a picture full of leaf-like green colors' and the background is green, the large gap (5.56 vs 3.00) mostly confirms color matching rather than scene-consistent blending. No inter-rater reliability, confidence intervals, or independent-rater details are reported. The physical experiments (Sec. 4.3) report ASR only for the adversarial T-shirt; the regular-clothing control mentioned in the text is never quantified, and no physical baseline (DAP/NAP printed) is included. Additionally, ASR in the Lobby and Hallway (95.59 and 93.41) is as high as in Woodland and Lawn, consistent with the patch acting as a generic strong adversarial pattern rather than an environment-matched one. Without an objective test of patch-scene consistency, the central contribution over DAP/NAP is unverified; the digital advantage (Table 1 average 27.09 vs 28.69) is small and per-detector inconsistent (e.g., YOLOv4: 40.76 vs 20.09; YOLOv5: 16.00 vs 10.26) with no error bars.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PG-ECAP, a method for generating adversarial patches that are both effective at evading object detectors and visually consistent with a specified environment. The approach optimizes the initial latent variable z_T of a Stable Diffusion model using an objective (Eq. 13) that combines an attack loss with two alignment losses: a Prompt Alignment Loss based on cross-attention map cosine similarity (Eq. 11) and a Latent Space Alignment Loss based on similarity to the initial z_0 (Eq. 12). The authors evaluate the method on the INRIA dataset with white-box and black-box detectors, conduct a subjective study of environmental consistency, perform physical-world experiments with a printed T-shirt in four scenes, and include ablations on loss weights and prompts. The central claim is that PG-ECAP outperforms existing methods in both attack success rate and environmental consistency.","tokens_in":12851,"tokens_out":4935,"duration_ms":47976,"significance":"If the claims were fully supported, PG-ECAP would be a valuable contribution to physical adversarial attacks, offering a practical way to generate printed patches that blend into their environment while evading detectors. The use of text prompts to control environmental adaptation is an interesting and potentially generalizable idea, and the paper includes both digital and physical evaluations. However, the evidence presented is not yet sufficient: the white-box advantage over DAP is small (1.6 mAP50 points on average) and inconsistent across detectors, the subjective evaluation of environmental consistency is underpowered and lacks controls, and the physical experiments include no baseline patches. The formulation is generally clear, and the ablation on prompts shows adaptability, but the central claims require stronger empirical support before they can be accepted.","major_comments":[{"comment":"The white-box attack performance advantage is small and inconsistent across detectors. The average mAP50 of PG-ECAP is 27.09 versus 28.69 for DAP, a 1.6-point improvement, but PG-ECAP is substantially worse than DAP on YOLOv4 (40.76 vs. 20.09) and worse than both DAP and NAP on YOLOv5 (16.00 vs. 10.26 and 5.95). The claim of outperforming existing methods is therefore only partially supported; the authors should either provide a per-detector analysis explaining these inconsistencies or present a more robust aggregate metric that accounts for the variability.","section":"§4.2.1, Table 1"},{"comment":"The central claim of environmental consistency is not convincingly established. The subjective evaluation in §4.2.3 uses 10 participants rating T-shirts against a single green background that matches the prompt \"a picture full of leaf-like green colors,\" with no inter-rater reliability, confidence intervals, or a mismatched-environment control. The physical experiments in §4.3 report ASR only for the PG-ECAP T-shirt; no printed DAP/NAP baselines are included, and the regular-clothing control mentioned in the text is never quantified. Moreover, the ASR in indoor scenes (Lobby 95.59, Hallway 93.41) is as high as in outdoor scenes (Woodland 92.75, Lawn 94.79), which is consistent with the patch acting as a generic strong adversarial pattern rather than an environment-matched one. Please add objective patch-background consistency metrics (e.g., color statistics, feature similarity, or human perception with background variation) and include physical baselines.","section":"§4.2.3 and §4.3"},{"comment":"The alignment losses are not rigorously specified. In Eq. (12), L_latent = 1 - exp(-(z0 - z0_initial)^2) is written for a latent tensor; as written the expression is elementwise and does not reduce to a scalar. The authors should specify the norm and reduction (e.g., mean squared error over all latent dimensions). Similarly, Eq. (11) writes a sum over i and j of cosine similarities, but A_{i,j} are attention matrices; the exact reduction over spatial and layer dimensions should be clarified. These details matter for reproducibility and for interpreting the trade-off between attack and alignment.","section":"§3.4, Eqs. (11)–(12)"},{"comment":"The transferability analysis is presented without comparison to any baseline, so the claim of \"strong transferability\" is not supported. Several black-box mAP50 values are high (e.g., 52.78, 56.43, 49.3, 42.26), which do not obviously indicate strong transfer. Please add transferability results for DAP and NAP under the same protocol and report aggregate black-box mAP50 across all source models.","section":"§4.2.2, Table 2"},{"comment":"The ablation of loss weights varies β and γ simultaneously, so the individual contributions of the Prompt Alignment Loss and the Latent Space Alignment Loss cannot be separated. The text also states that attack effectiveness and visual quality stabilize for certain configurations, but no quantitative attack or quality metrics are reported for the configurations in Fig. 6. A one-at-a-time ablation with numerical mAP50 and a perceptual metric (or human scores) is needed to justify the chosen weights.","section":"§4.4.1"}],"minor_comments":[{"comment":"Eq. (8) introduces a single environmental loss L_env with weight λ, while Eq. (13) uses α, β, and γ for L_attack, L_prompt, and L_latent. The relationship between L_env and the two alignment losses should be made explicit.","section":"§3.2, Eqs. (8) and (13)"},{"comment":"Eq. (7) contains a typesetting error: the brace notation is broken and the second term is not a valid mathematical expression. Please fix the display.","section":"§3.1, Eq. (7)"},{"comment":"The caption and content of Table 5 are unclear: the values 21.7 and 18.1 appear without clear column headers, and the text refers to \"the figure\" but no figure is shown. Also, the baseline mAP50 of 91.5 for YOLOv5 on INRIA is mentioned in the text but not included in the table.","section":"§4.4.2, Table 5"},{"comment":"The regular-clothing control is mentioned but never quantified. Either report its ASR or remove the mention to avoid an unsupported comparison.","section":"§4.3"},{"comment":"The spelling of detector names is inconsistent (e.g., \"Yolov5\" vs. \"YOLOv5\", \"Y olov2\" in tables). Please standardize. Also, the author name \"Hang su\" should be \"Hang Su\".","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The reader's report and stress-test concerns align with my assessment. The paper's core idea is interesting, but the evidence for the two central claims—attack outperformance and environmental consistency—is not yet convincing. The digital gain is marginal and inconsistent, and the environmental consistency evidence is based on a small, uncontrolled subjective study and physical experiments with no baselines. These issues are fixable within the scope of a revision: adding physical baselines, objective consistency metrics, a larger and better-controlled human study, and per-detector analysis would substantially strengthen the paper. I recommend major revision rather than rejection because the proposed method and formulation have merit and the missing evidence is attainable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the new thing: PG-ECAP optimizes the initial latent of Stable Diffusion with a combined loss that includes the attack loss, a cross-attention-map preservation term (prompt alignment), and a penalty on the distance from the initial z0 (latent alignment). That is a sensible and new way to bring prompt-defined environmental constraints into adversarial patch generation, and it avoids the pixel-space distortions of prior work. The idea that unconstrained zT optimization drifts away from the prompt, motivating the alignment losses, is clearly articulated. The digital experiments cover a broad detector set, and the physical ASR numbers are high.\n\nNow the soft spots. The headline claim of outperforming existing methods is not robustly supported. In Table 1, PG-ECAP is better than DAP on YOLOv2, YOLOv3, and Faster R-CNN, but worse on YOLOv4, YOLOv5, and DETR; the average advantage is 1.6 mAP50 points. No error bars, no multiple seeds. The physical experiment has no printed baseline, and the regular-clothing control mentioned in Sec. 4.3 is never quantified. The subjective consistency evaluation uses 10 raters, one green background, and a prompt that matches that background; the large gap over DAP is likely mostly color matching, not scene-consistent blending. There is no mismatched-environment control, which would be the direct test of 'environmental consistency.' The hyperparameters β and γ are picked via an ablation on the evaluation set, a minor but real form of test-set tuning. And as you note, the alignment losses directly enforce similarity to the prompt-conditioned initial sample, so the observed prompt fidelity is partly a consequence of the objective, not an independent discovery.\n\nThese are all addressable rather than fatal. The method is plausible and the paper is honest about the trade-off between attack performance and naturalness. The right next step is a major revision focused on evaluation: printed DAP/NAP baselines in the physical world, a mismatched-environment condition, a larger and more careful subjective study with multiple backgrounds and inter-rater reliability, and release of code. I would send it to peer review, not desk-reject it.","headline":"PG-ECAP is a plausible new way to generate adversarial patches with diffusion models, but its central 'environmental consistency' claim rests on a 10-person subjective test and no physical baselines.","tokens_in":13400,"tokens_out":2958,"would_cite":false,"duration_ms":28394,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that optimizing a diffusion model's initial latent with two alignment losses produces adversarial patches that evade detectors while matching the environment described by a text prompt.","keywords":["adversarial patch","physical adversarial attack","object detection","diffusion models","environmental consistency","prompt alignment loss","latent space optimization","text-to-image generation"],"falsifier":"A concrete test: generate patches with PG-ECAP for a forest prompt and a desert prompt, place both in the same non-prompted scene (e.g., a gray concrete wall), and measure human spotting latency or perceptual similarity to the background; if the forest-prompt patch is not noticeably more conspicuous than a plain patch in that scene, then prompt-guided consistency does not generalize beyond the described environment.","tokens_in":12327,"feed_emoji":"🧥","tokens_out":6023,"duration_ms":56648,"temperature":0.7,"pith_summary":"The paper aims to show that adversarial patches—printable patterns that make object detectors miss a person—can be both effective and visually indistinguishable from their environment, a property it calls environmental consistency. It proposes PG-ECAP, which uses a text-to-image diffusion model and optimizes the latent variable at the last noising step so the decoded patch maximizes attack success while staying true to a textual description of the scene, such as \"a picture full of leaf-like green colors.\" The key claim is that two alignment losses, one on cross-attention maps and one on the initial latent, are enough to keep the patch from drifting away from the prompt during optimization. A sympathetic reader would care because prior patches are conspicuous, and a method that adapts by simply changing the prompt could make physical attacks much harder to spot in real scenes.","feed_headline":"Adversarial patches that blend into scenes still fool detectors","feed_subtitle":"A single text prompt steers the patch to match its surroundings, keeping attacks effective in digital and physical tests.","key_machinery":"The mechanism is latent-space optimization of a diffusion model's initial noise $z_T$: instead of perturbing pixels, the patch is the decoded output of a DDIM chain conditioned on text embeddings $C$, and the optimizer walks $z_T$ to minimize detection confidence. Two alignment losses carry the environmental-consistency claim: $\\mathcal{L}_{\\text{prompt}}$ uses cosine similarity between current and initial cross-attention maps $A_{i,j}$ to anchor the prompt's influence, while $\\mathcal{L}_{\\text{latent}}$ exponentially penalizes deviation of $z_0$ from its initial value $z_0^{\\text{initial}}$, which has already absorbed the prompt across the full denoising trajectory. These losses are what prevent the unconstrained adversarial objective from producing patches that no longer look like the requested environment.","core_discovery":"PG-ECAP's central claim is that optimizing the initial latent variable $z_T$ of a Stable Diffusion DDIM sampler, with the combined objective $\\mathcal{L} = \\alpha \\mathcal{L}_{\\text{attack}} + \\beta \\mathcal{L}_{\\text{prompt}} + \\gamma \\mathcal{L}_{\\text{latent}}$ (Eq. 13), yields adversarial patches that both evade object detectors and match a prompt-specified environment. The prompt alignment loss $\\mathcal{L}_{\\text{prompt}}$ preserves the cosine similarity between current and initial cross-attention maps, and the latent alignment loss $\\mathcal{L}_{\\text{latent}} = 1 - e^{-(z_0 - z_0^{\\text{initial}})^2}$ keeps the decoded patch close to its prompt-conditioned starting point. The paper reports that this beats prior patch methods on the INRIA dataset in both white-box and black-box settings, and that physical T-shirts printed from the patch achieve a mean attack success rate of 94.14% across four scenes while receiving the highest subjective environmental-consistency score (5.56 on a 7-point scale).","pith_inferences":["A natural extension the paper leaves implicit: replace the subjective Likert rating with automated perceptual metrics, such as human detection time or perceptual distance, so environmental consistency can be verified across many more scenes than the four reported.","If the prompt is the only carrier of environmental context, the method inherits the prompt's ambiguity; a phrase like 'leaf-like green colors' may not capture lighting, texture, or non-green objects in a scene, so the patch could still stand out in cluttered real environments.","The success of latent-space alignment suggests that other diffusion-based generation or editing tools could similarly constrain adversarial objectives, potentially enabling environment-adaptive patches without retraining for each new setting.","A direct physical-world stress test would compare PG-ECAP patches against baseline patches under varying weather, camera angles, and backgrounds, quantifying whether the perceived environmental consistency survives changes that a static prompt cannot encode."],"forward_implications":["Changing the text prompt alone re-targets the patch to a new environment; the paper demonstrates forest, desert-grid, and ocean-style prompts, each yielding patches with comparable attack performance.","A single pipeline can serve both digital and physical attacks: tiling the patch onto clothing and testing across indoor and outdoor scenes gave mean attack success rates above 92% in every scene.","The attack transfers across detector architectures even though transferability is not explicitly optimized, with black-box mAP50 close to white-box values for some models.","The trade-off between naturalness and attack strength is controlled by the weights $\\beta$ and $\\gamma$; raising them improves visual consistency at some cost to attack performance."],"supporting_citations":[{"why":"Supplies the text-to-image latent diffusion model (Stable Diffusion 2) whose latent variable is optimized.","marker":"[29]"},{"why":"Provides the DDIM sampler, with sigma_t = 0, that deterministically maps z_T to z_0 during optimization.","marker":"[31]"},{"why":"Prior work extending adversarial attacks into diffusion latent space, which the paper explicitly builds on.","marker":"[4]"},{"why":"Another prior diffusion-based adversarial attack that the paper builds on for latent-space optimization.","marker":"[6]"},{"why":"Adversarial T-shirt baseline for physical clothing attacks and a comparison point for attack success.","marker":"[37]"},{"why":"NAP naturalistic adversarial patch baseline and the comparison for subjective environmental-consistency scoring.","marker":"[12]"},{"why":"AdvCat baseline that uses limited color spaces; the paper contrasts its fixed color-space limitation with prompt-based adaptation.","marker":"[14]"},{"why":"INRIA dataset used for all digital and physical experiments.","marker":"[7]"}],"fun_headline_variants":["Stealthy adversarial patches guided by prompts","Prompt-based patches blend in and still deceive","Adversarial patches that match their environment","Diffusion-guided patches for subtle attacks","Natural-looking adversarial patches with prompt control"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method's environmental consistency rests on the assumption that a short text prompt (e.g., 'a picture full of leaf-like green colors') adequately describes the target environment, and that keeping the diffusion latent and cross-attention maps close to their initial values is enough to make the patch blend into physical scenes under real lighting and viewpoint changes.","fun_headline_variants_meta":{"raw":{"variants":["Stealthy adversarial patches guided by prompts","Prompt-based patches blend in and still deceive","Adversarial patches that match their environment","Diffusion-guided patches for subtle attacks","Natural-looking adversarial patches with prompt control"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000213,"raw_usage":{"total_tokens":1424,"prompt_tokens":952,"completion_tokens":472,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":568,"completion_tokens_details":{"reasoning_tokens":408}},"tokens_in":568,"tokens_out":472,"duration_ms":5060,"temperature":1.0,"reasoning_tokens":408,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T20:00:20.661170+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test: generate patches with PG-ECAP for a forest prompt and a desert prompt, place both in the same non-prompted scene (e.g., a gray concrete wall), and measure human spotting latency or perceptual similarity to the background; if the forest-prompt patch is not noticeably more conspicuous than a plain patch in that scene, then prompt-guided consistency does not generalize beyond the described environment.","supporting_citations":[{"cited_title":"Denois- ing diffusion implicit models","cited_arxiv_id":null,"evidence_quote":"Provides the DDIM sampler, with sigma_t = 0, that deterministically maps z_T to z_0 during optimization."},{"cited_title":"Diffusion models for imperceptible and transferable adversarial attack","cited_arxiv_id":null,"evidence_quote":"Prior work extending adversarial attacks into diffusion latent space, which the paper explicitly builds on."},{"cited_title":"Content-based unrestricted ad- versarial attack","cited_arxiv_id":null,"evidence_quote":"Another prior diffusion-based adversarial attack that the paper builds on for latent-space optimization."},{"cited_title":"Adversarial t-shirt! evading person detectors in a physical world","cited_arxiv_id":null,"evidence_quote":"Adversarial T-shirt baseline for physical clothing attacks and a comparison point for attack success."},{"cited_title":"Nat- uralistic physical adversarial patch for object detectors","cited_arxiv_id":null,"evidence_quote":"NAP naturalistic adversarial patch baseline and the comparison for subjective environmental-consistency scoring."},{"cited_title":"Histograms of oriented gra- dients for human detection","cited_arxiv_id":null,"evidence_quote":"INRIA dataset used for all digital and physical experiments."}],"review_version":1}