{"id":"a132082b-3827-41ab-836d-613fe491576b","arxiv_id":"2412.07253","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"CAPGen recolors adversarial patches with environment-derived base colors and reports that preserving the texture pattern while swapping colors retains most of the attack effectiveness.","lead":"CapGen generates adversarial patches whose colors are drawn from the surrounding environment, aiming to hide objects from AI detectors while looking natural to humans. It also reports that a patch's attack power lives mostly in its texture pattern, so recoloring an existing strong patch can quickly adapt it to a new background.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Pattern-vs-color conclusion is confounded: CAPGen-P inherits an optimized color probability matrix from AdvPatch while CAPGen-T is trained from scratch, so the performance gap may reflect optimization difficulty rather than pattern dominance.","rationale":"The reader's weakest assumption identifies exactly the confound I find most load-bearing: CAPGen-P and CAPGen-T are not comparable as clean isolates of pattern versus color because they differ in the optimization state of the color probability matrix. This is not a minor implementation detail; it is the evidential basis for the paper's headline conceptual finding, and the fast generation strategy is explicitly derived from that finding. If the gap between CAPGen-P and CAPGen-T is due to optimization difficulty rather than pattern dominance, the central claim collapses and the fast strategy loses its stated justification. The paper does have independent strengths: the subjective stealth scores (Tab. 8), the physical demonstrations (Figs. 1 and 6), and the consistent observation that recoloring an optimized patch largely preserves attack performance across datasets and models. These facts support a more modest, practical claim: recoloring a strong patch is an effective way to maintain attack strength while improving visual harmony. But the stronger universal conclusion about patterns versus colors is not established by the reported experiments. The proposed concrete test would settle the confound directly by matching the initialization and optimization state of the two arms. Until that test is run, a conditional verdict is appropriate, and I recommend keeping the reader's CONDITIONAL verdict unchanged.","tokens_in":18670,"tokens_out":4242,"duration_ms":46810,"concrete_test":"Re-run the CAPGen-T training protocol but initialize the color probability matrix from the optimized AdvPatch m instead of random initialization, then fine-tune under the same base-color constraint and training budget. If the resulting mAP50 approaches CAPGen-P1's value (within a few points), the original gap is an optimization artifact and the pattern-dominance claim is unsupported. If a large gap persists across several random restarts and with extended training, the claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that patterns matter more than colors rests on the comparison in Sec. 4.3, Table 1 between CAPGen-P and CAPGen-T. CAPGen-P (Eq. 4) recolors a fully optimized AdvPatch while keeping its color probability matrix m; CAPGen-T trains a fresh matrix mt from random initialization under the color constraint (Eq. 5, Sec. 3.3). These two conditions differ in two variables at once: whether m has already been optimized against the victim models, and whether the optimization was performed in the unconstrained or the 3-color-constrained space. The large gap in mean mAP50 (22.92 for CAPGen-P1 vs 48.04 for CAPGen-T1 on INRIA; 21.88 vs 30.90 on FLIR) is therefore also consistent with the alternative explanation that optimizing within a heavily restricted palette from random initialization is simply harder, or requires more epochs or different hyperparameters, rather than that patterns dominate colors. No control for initialization, optimization budget, or multiple restarts is reported. The same confound propagates into the black-box tables and the ablation in Sec. 4.5. A secondary issue is that the quantitative attack tables use randomly chosen color sets Bc1 and Bc2 rather than environment-extracted base colors, so the claimed fast recoloring strategy's attack performance is not demonstrated for the actual environment-matched use case.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces CAPGen, a method for generating adversarial patches whose colors are constrained to a small set of base colors extracted from the surrounding environment. The patch is formed by a soft blend of base colors weighted by an optimized color probability matrix (Eq. 3), and an EOT-based objective (Eq. 2) is used for training. The central claim is that adversarial attack performance is driven primarily by the patch's pattern (color-agnostic texture) rather than its colors. Based on this, the authors propose a fast generation strategy: take a high-performance patch, keep its color probability matrix fixed, and replace only the base colors with those of a new environment (Eq. 4). Experiments on INRIA and FLIR ADAS against multiple detectors, plus ablations, are presented as support. The paper also includes physical-world demonstrations and a subjective stealthiness evaluation.","tokens_in":18917,"tokens_out":3611,"duration_ms":40567,"significance":"If the pattern-vs-color claim were rigorously established, the paper would make a useful conceptual contribution to physical adversarial patch design: separating color and pattern could enable rapid patch adaptation across environments, which is practically relevant for both attack and defense evaluation. The proposed CAPGen formulation is clean and the experimental scope is broad: two datasets, six detectors, white-box and black-box settings, and a physical-world demo. However, the central comparison underlying the pattern-dominance claim is confounded, and the fast-recoloring strategy is not quantitatively tested with environment-extracted colors. These issues are fixable, but they are load-bearing for the paper's main conclusions.","major_comments":[{"comment":"The comparison between CAPGen-P and CAPGen-T does not isolate pattern from color. CAPGen-P keeps the fully optimized AdvPatch color probability matrix m and only changes the base color values (Eq. 4), whereas CAPGen-T trains a fresh color probability matrix mt from random initialization under the 3-color constraint (Eq. 5 plus gradient-driven allocation). These conditions differ in both the initialization/prior optimization and the optimization trajectory. The large gap in mean mAP50 (22.92 for CAPGen-P1 vs. 48.04 for CAPGen-T1 on INRIA, and 21.88 vs. 30.90 on FLIR in Table 3) could therefore reflect the greater difficulty of training a strong patch from scratch in a heavily restricted color space, rather than an intrinsic dominance of patterns over colors. To support the claim, the authors should run a matched control in which CAPGen-T is initialized with the AdvPatch matrix m (or both variants are trained from the same initialization with the same optimization budget), and report those numbers. The same confound propagates to the black-box results in Table 2 and the ablation in Fig. 5.","section":"Sec. 3.3, Table 1"},{"comment":"All quantitative attack results use randomly selected base color sets Bc1 and Bc2, not the environment-extracted base colors described in Sec. 3.2. Therefore, the proposed fast generation strategy, which is supposed to update colors to align with a new environment, is never quantitatively tested in the environment-matched setting; its attack performance is only demonstrated for arbitrary random colors. The environment-matched claims rest on qualitative visualizations (Fig. 1, Fig. 7). The authors should either report attack metrics for patches recolored with K-means-extracted base colors from the INRIA and FLIR ADAS backgrounds, or explicitly restrict the quantitative claims to arbitrary color replacement and treat the environment-matched case as a separate qualitative demonstration.","section":"Sec. 4.2, Tables 1 and 3"},{"comment":"The foundational assertion that \"adversarial noise influences the predictions of deep models primarily due to the relative magnitude relationship between different pixel values and small perturbations in pixel values\" is stated without derivation or direct test. The decomposition into pattern and color components is then defined operationally through Eqs. (3)-(5), which is reasonable, but the key comparison used to support the assertion (CAPGen-P vs. CAPGen-T) is the same confounded comparison noted above. The authors should provide a cleaner test of the assertion, e.g., by measuring attack success when only the color magnitudes are scaled or shifted while preserving relative pixel ratios, or when only the relative pattern is preserved with randomized base colors, under identical optimization budgets.","section":"Sec. 3.3"}],"minor_comments":[{"comment":"The softmax expression is missing an explicit index: it should be r_{ijk} = Softmax(log(m_{ijk})/tau), and a summation over k should appear in the expression for t_{ij}. As written, the equation is inconsistent with the surrounding text.","section":"Eq. (3)"},{"comment":"The phrase \"the model of the fist column\" in Table 2 (and Table 4) should be \"the model of the first column\".","section":"Sec. 4.2"},{"comment":"The dataset name is misspelled as \"FILA ADAS\" in the caption of Fig. 9; it should be \"FLIR ADAS\".","section":"Appendix H"},{"comment":"The reference list entry for Duan et al. (2021) contains an apparent author-name error (\"Akshay Qin\"); this should be corrected.","section":"Sec. 2"},{"comment":"The caption lists CAPGen-P1, CAPGen-P2, CAPGen-R1, CAPGen-T1 but the text refers to CAPGen-R2 and CAPGen-T2 elsewhere; for clarity, the caption should include all variants or state explicitly which are shown.","section":"Fig. 4"}],"recommendation":"major_revision","confidential_remarks":"The paper's central conceptual contribution is the pattern-vs-color decomposition and the resulting fast recoloring strategy. The main comparison is currently confounded, but the fix is straightforward: add a properly controlled experiment that holds initialization and optimization budget fixed between the pattern-preserving and color-training variants. If the authors also add quantitative results with environment-extracted base colors, the claims would be substantially strengthened. The paper would then be a reasonable fit for the venue; as it stands, the evidence does not yet support the headline conclusion."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things worth knowing about this paper. First, the practical idea is good and largely works: recoloring an already-trained adversarial patch with new base colors preserves most of its attack performance across datasets and detectors, which is a genuinely useful trick for rapid physical-world adaptation. Second, the central scientific claim that \"patterns matter more than colors\" is not established by the experiments as designed. CAPGen-P keeps the fully optimized color probability matrix from AdvPatch and only swaps the palette; CAPGen-T trains a fresh matrix from random initialization inside the color-constrained space. Those differ in two variables at once, so the large gap in mAP50 (22.92 vs 48.04 on INRIA) could just as easily be optimization difficulty, not pattern dominance. The paper needs a control where the same initialization and optimization budget are used, or where CAPGen-P's matrix is re-optimized under the color constraint.\n\nWhat is actually new and good: the color-probability-matrix plus base-color-palette formulation is a clean way to constrain patch colors to an environment, and I have not seen the pattern/color decomposition done this way in the cited literature. The results are also consistent across INRIA and FLIR, white-box and black-box, six detectors, and a follow-up with the T-SEA baseline; the subjective stealth scores point the same way. That consistency is real evidence, even though there is no code and no error bars.\n\nSoft spots, in order of importance. The confound above is the load-bearing one; it also infects the ablation section and the black-box transferability discussion. Second, the quantitative tables use randomly chosen color sets Bc1 and Bc2 rather than the environment-extracted base colors that define the method, so the actual use case—environment-matched palettes—is only supported by qualitative figures and the subjective test. Third, the fast-generation strategy is proposed from the observation that recoloring works and then validated with the same recoloring operation, which is partly self-referential; the FLIR and T-SEA results mitigate but do not remove that. The \"first to comprehensively examine\" claim in the abstract is also stronger than warranted.\n\nWho is this for? People working on physical adversarial patches, especially anyone who cares about practical stealthiness and rapid deployment. It deserves a serious referee: the idea is useful, the framing is sensible, and the core recollection result is reproducible in principle from the given tables, but the paper should not be accepted as-is. The pattern-vs-color claim needs a clean experiment, and the environment-matched palettes need quantitative attack evaluation. A conditional with those requirements is the right verdict.","headline":"The recoloring trick is genuinely useful and mostly works, but the pattern-vs-color conclusion is built on a confounded comparison and the paper oversells its evidence.","tokens_in":19491,"tokens_out":2047,"would_cite":true,"duration_ms":23661,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adversarial patches carry their attack power mostly in their pattern rather than their colors, so recoloring a trained patch with a new environment's base colors preserves the attack while improving visual stealth.","keywords":["adversarial patches","physical adversarial attacks","object detection evasion","visual stealth","camouflage","pattern versus color","environment adaptation","fast patch generation"],"falsifier":"Re-run CAPGen-T from the same optimized color probability matrix used in CAPGen-P instead of from random initialization, and compare final mAP50 values. If the gap disappears, pattern dominance is an artifact of inherited optimization; if a large gap persists under matched initialization, colors play a genuinely secondary role.","tokens_in":18396,"feed_emoji":"🎨","tokens_out":8139,"duration_ms":78507,"temperature":0.7,"pith_summary":"Adversarial patches that hide objects from detectors usually stand out to human eyes because they ignore the background. This paper claims that what makes a patch effective is mostly its pattern—the relative magnitudes of pixel values—not the colors themselves, and that recoloring an already-strong patch with base colors taken from a new environment preserves most of its attack power while making it visually blend in. To exploit this, CAPGen extracts the environment's dominant colors by K-means clustering, then optimizes a per-pixel color probability matrix that blends those base colors with a softmax temperature, so the patch's palette is constrained while its texture is free to attack. In white-box and black-box tests across YOLOv2–v5 variants and Faster R-CNN on the INRIA and FLIR datasets, recolored patches (CAPGen-P) outperform freshly trained color-constrained patches (CAPGen-T) by a large margin. A sympathetic reader would care because the result, if correct, turns environmental adaptation into a one-step recoloring operation—no new data collection or optimization per scene—and isolates texture as the carrier of adversarial signal.","feed_headline":"Patch texture, not palette, drives adversarial attacks","feed_subtitle":"Swap a strong patch's colors for the scene's base colors, and it stays effective while blending in.","key_machinery":"The load-bearing object is the color probability matrix $m \\in (0,1)^{W \\times H \\times 3}$, learned by gradient optimization, together with the soft-blend equation $t_{ij} = \\sum_k c_k \\mathrm{Softmax}(\\log m_{ijk}/\\tau)$ that turns base colors into pixel values. With temperature $\\tau = 0.1$ the softmax is near one-hot, so each pixel is effectively assigned to one base color while gradients still flow through the assignment. This machinery separates the stealth constraint—which lives in the palette $c_k$—from the attack objective, which lives in the spatial structure encoded by $m$; keeping $m$ fixed and changing only $c_k$ defines CAPGen-P, the recolored patch, and is the operation the fast strategy uses for new environments.","core_discovery":"At the core of the paper is a decomposition of an adversarial patch into two parts: the pattern, defined as the color-agnostic texture information carried by the relative magnitude of neighboring pixel values, and the colors, defined as the set of base colors chosen from the environment. CAPGen constructs a patch by writing each pixel as $t_{ij} = \\sum_{k=1}^{3} c_k r_k$, where the $c_k$ are base colors extracted via K-means and $r_k = \\mathrm{Softmax}(\\log m_{ijk}/\\tau)$ comes from an optimized color probability matrix $m$ with temperature $\\tau = 0.1$. To separate the two components, the paper recolors a fully trained AdvPatch by replacing the base colors $c_k$ with new environment colors while keeping $m$ fixed (CAPGen-P), and compares this with CAPGen-T, which trains a fresh color probability matrix from random initialization under fixed environment colors. Across victim detectors and both white-box and black-box settings, CAPGen-P achieves much lower mAP50 than CAPGen-T—for example, average 22.92 versus 48.04 on INRIA in the white-box table—which the paper reads as evidence that patterns are the dominant carrier of adversarial effect, with colors playing a secondary role. On that basis, the fast generation strategy simply swaps in new base colors for a high-performance patch, aiming at stealth without retraining.","pith_inferences":["A consequence the paper does not develop is that defenses built on color statistics or color calibration should be less effective against CAPGen-style patches; detectors would do better to target local contrast and high-frequency texture.","The recoloring transfer could be tested as a general attack toolkit: take any strong physical patch and recolor it with the target scene's palette; if the mAP50 drop stays small across many scenes and detectors, the result becomes a practical design rule for adaptive camouflage.","The same separation might transfer to digital adversarial perturbations, where high-frequency pattern components are known to survive compression; if pattern dominance is universal, color-space defenses are a weak point for physical attacks."],"forward_implications":["If the pattern-dominance result holds, an adversarial patch prepared for one scene can be reused in another scene by recoloring it with that scene's base colors, skipping data collection and optimization.","CAPGen-P's attack performance stays close to AdvPatch's in both white-box and black-box evaluations, so visual stealth is not bought by sacrificing attack power.","The pattern/color decomposition gives a diagnostic: comparing a recolored patch with a freshly trained color-restricted patch measures how much of an attack lives in texture rather than palette.","Increasing the number of base colors improves attack performance in the paper's ablations, implying richer palettes give the pattern more room to express adversarial detail."],"supporting_citations":[{"why":"Supplies the AdvPatch baseline whose fully trained patch is recolored to form CAPGen-P, the central probe of pattern dominance.","marker":"Thys et al., 2019"},{"why":"Provides the Expectation Over Transformation training procedure CAPGen uses to keep patches effective across lighting, rotation, and other physical variations.","marker":"Athalye et al., 2018a"},{"why":"Provides the K-means clustering used to extract base colors from the environment, defining the palette that makes patches visually stealthy.","marker":"MacQueen et al., 1967"},{"why":"Supplies the INRIA pedestrian dataset on which the main white-box and black-box comparisons are run.","marker":"Dalal & Triggs, 2005"},{"why":"Supplies the DAP baseline that CAPGen-P is compared against in the attack performance tables.","marker":"Guesmi et al., 2024"},{"why":"Supplies the NAP baseline used for comparison and the naturalistic-patch design lineage the paper positions itself against.","marker":"Hu et al., 2021b"},{"why":"Supplies the T-SEA baseline in the appendix, showing the fast recoloring strategy also preserves attack performance when built on a stronger transferable patch.","marker":"Huang et al., 2023b"}],"fun_headline_variants":["Texture beats color in adversarial patch attacks","Patch textures dominate attack power, not colors","Adversarial patches: texture is king, color is cosmetic","Swap patch colors, keep attack strength: study","Why patch texture, not hue, makes attacks stick"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central claim depends on comparing a recolored version of an already-optimized adversarial patch with a patch whose color weights are trained from scratch; if that gap comes from optimization difficulty or initialization rather than from pattern versus color, the conclusion and the fast-recoloring strategy lose their evidential basis.","fun_headline_variants_meta":{"raw":{"variants":["Texture beats color in adversarial patch attacks","Patch textures dominate attack power, not colors","Adversarial patches: texture is king, color is cosmetic","Swap patch colors, keep attack strength: study","Why patch texture, not hue, makes attacks stick"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000161,"raw_usage":{"total_tokens":1277,"prompt_tokens":1025,"completion_tokens":252,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":641,"completion_tokens_details":{"reasoning_tokens":180}},"tokens_in":641,"tokens_out":252,"duration_ms":43957,"temperature":1.0,"reasoning_tokens":180,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:56:09.282239+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run CAPGen-T from the same optimized color probability matrix used in CAPGen-P instead of from random initialization, and compare final mAP50 values. If the gap disappears, pattern dominance is an artifact of inherited optimization; if a large gap persists under matched initialization, colors play a genuinely secondary role.","supporting_citations":[{"cited_title":"Histograms of oriented gradients for human detection","cited_arxiv_id":null,"evidence_quote":"Supplies the INRIA pedestrian dataset on which the main white-box and black-box comparisons are run."},{"cited_title":"Fooling automated surveillance cameras: Adversarial patches to attack person detection","cited_arxiv_id":null,"evidence_quote":"Supplies the AdvPatch baseline whose fully trained patch is recolored to form CAPGen-P, the central probe of pattern dominance."},{"cited_title":"Some methods for classification and analysis of multivariate observations","cited_arxiv_id":null,"evidence_quote":"Provides the K-means clustering used to extract base colors from the environment, defining the palette that makes patches visually stealthy."},{"cited_title":"Dap: A dynamic adversarial patch for evading person detectors","cited_arxiv_id":null,"evidence_quote":"Supplies the DAP baseline that CAPGen-P is compared against in the attack performance tables."}],"review_version":1}