Prompt-Guided Environmentally Consistent Adversarial Patch

ChaoQun Li; Hang Su; Huanqian Yan; Lifeng Zhou; Tairan Chen; Zhuodong Liu

REVIEW 5 major objections 5 minor 1 cited by

Prompt-Guided Environmentally Consistent Adversarial Patch

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that optimizing a diffusion model's initial latent with two alignment losses produces adversarial patches that evade detectors while matching the environment described by a text prompt.

desk verdict PG-ECAP is a plausible new way to generate adversarial patches with diffusion models, but its central 'environmental consistency' claim rests on a 10-person subjective test and no physical baselines. read the letter →

arxiv 2411.10498 v1 pith:ADD53YCU submitted 2024-11-15 cs.CV

Chaoqun Li , Huanqian Yan , Lifeng Zhou , Tairan Chen , Zhuodong Liu , Hang Su This is my paper · ORCID

classification cs.CV

keywords adversarialpatchphysicalattackobjectdetectiondiffusionmodelsenvironmentalconsistencypromptalignmentlosslatentspaceoptimizationtext-to-imagegeneration

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to show that adversarial patches—printable patterns that make object detectors miss a person—can be both effective and visually indistinguishable from their environment, a property it calls environmental consistency. It proposes PG-ECAP, which uses a text-to-image diffusion model and optimizes the latent variable at the last noising step so the decoded patch maximizes attack success while staying true to a textual description of the scene, such as "a picture full of leaf-like green colors." The key claim is that two alignment losses, one on cross-attention maps and one on the initial latent, are enough to keep the patch from drifting away from the prompt during optimization. A sympathetic reader would care because prior patches are conspicuous, and a method that adapts by simply changing the prompt could make physical attacks much harder to spot in real scenes.

What carries the argument

The mechanism is latent-space optimization of a diffusion model's initial noise $z_T$: instead of perturbing pixels, the patch is the decoded output of a DDIM chain conditioned on text embeddings $C$, and the optimizer walks $z_T$ to minimize detection confidence. Two alignment losses carry the environmental-consistency claim: $\mathcal{L}_{\text{prompt}}$ uses cosine similarity between current and initial cross-attention maps $A_{i,j}$ to anchor the prompt's influence, while $\mathcal{L}_{\text{latent}}$ exponentially penalizes deviation of $z_0$ from its initial value $z_0^{\text{initial}}$, which has already absorbed the prompt across the full denoising trajectory. These losses are what prevent the unconstrained adversarial objective from producing patches that no longer look like the requested environment.

What would settle it

A concrete test: generate patches with PG-ECAP for a forest prompt and a desert prompt, place both in the same non-prompted scene (e.g., a gray concrete wall), and measure human spotting latency or perceptual similarity to the background; if the forest-prompt patch is not noticeably more conspicuous than a plain patch in that scene, then prompt-guided consistency does not generalize beyond the described environment.

Watch

Extended reading notes

Core claim

PG-ECAP's central claim is that optimizing the initial latent variable $z_T$ of a Stable Diffusion DDIM sampler, with the combined objective $\mathcal{L} = \alpha \mathcal{L}_{\text{attack}} + \beta \mathcal{L}_{\text{prompt}} + \gamma \mathcal{L}_{\text{latent}}$ (Eq. 13), yields adversarial patches that both evade object detectors and match a prompt-specified environment. The prompt alignment loss $\mathcal{L}_{\text{prompt}}$ preserves the cosine similarity between current and initial cross-attention maps, and the latent alignment loss $\mathcal{L}_{\text{latent}} = 1 - e^{-(z_0 - z_0^{\text{initial}})^2}$ keeps the decoded patch close to its prompt-conditioned starting point. The paper reports that this beats prior patch methods on the INRIA dataset in both white-box and black-box settings, and that physical T-shirts printed from the patch achieve a mean attack success rate of 94.14% across four scenes while receiving the highest subjective environmental-consistency score (5.56 on a 7-point scale).

Load-bearing premise

The method's environmental consistency rests on the assumption that a short text prompt (e.g., 'a picture full of leaf-like green colors') adequately describes the target environment, and that keeping the diffusion latent and cross-attention maps close to their initial values is enough to make the patch blend into physical scenes under real lighting and viewpoint changes.

Editorial extensions

If this is right

Changing the text prompt alone re-targets the patch to a new environment; the paper demonstrates forest, desert-grid, and ocean-style prompts, each yielding patches with comparable attack performance.
A single pipeline can serve both digital and physical attacks: tiling the patch onto clothing and testing across indoor and outdoor scenes gave mean attack success rates above 92% in every scene.
The attack transfers across detector architectures even though transferability is not explicitly optimized, with black-box mAP50 close to white-box values for some models.
The trade-off between naturalness and attack strength is controlled by the weights $\beta$ and $\gamma$; raising them improves visual consistency at some cost to attack performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension the paper leaves implicit: replace the subjective Likert rating with automated perceptual metrics, such as human detection time or perceptual distance, so environmental consistency can be verified across many more scenes than the four reported.
If the prompt is the only carrier of environmental context, the method inherits the prompt's ambiguity; a phrase like 'leaf-like green colors' may not capture lighting, texture, or non-green objects in a scene, so the patch could still stand out in cluttered real environments.
The success of latent-space alignment suggests that other diffusion-based generation or editing tools could similarly constrain adversarial objectives, potentially enabling environment-adaptive patches without retraining for each new setting.
A direct physical-world stress test would compare PG-ECAP patches against baseline patches under varying weather, camera angles, and backgrounds, quantifying whether the perceived environmental consistency survives changes that a static prompt cannot encode.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First, the new thing: PG-ECAP optimizes the initial latent of Stable Diffusion with a combined loss that includes the attack loss, a cross-attention-map preservation term (prompt alignment), and a penalty on the distance from the initial z0 (latent alignment). That is a sensible and new way to bring prompt-defined environmental constraints into adversarial patch generation, and it avoids the pixel-space distortions of prior work. The idea that unconstrained zT optimization drifts away from the prompt, motivating the alignment losses, is clearly articulated. The digital experiments cover a broad detector set, and the physical ASR numbers are high.

Now the soft spots. The headline claim of outperforming existing methods is not robustly supported. In Table 1, PG-ECAP is better than DAP on YOLOv2, YOLOv3, and Faster R-CNN, but worse on YOLOv4, YOLOv5, and DETR; the average advantage is 1.6 mAP50 points. No error bars, no multiple seeds. The physical experiment has no printed baseline, and the regular-clothing control mentioned in Sec. 4.3 is never quantified. The subjective consistency evaluation uses 10 raters, one green background, and a prompt that matches that background; the large gap over DAP is likely mostly color matching, not scene-consistent blending. There is no mismatched-environment control, which would be the direct test of 'environmental consistency.' The hyperparameters β and γ are picked via an ablation on the evaluation set, a minor but real form of test-set tuning. And as you note, the alignment losses directly enforce similarity to the prompt-conditioned initial sample, so the observed prompt fidelity is partly a consequence of the objective, not an independent discovery.

These are all addressable rather than fatal. The method is plausible and the paper is honest about the trade-off between attack performance and naturalness. The right next step is a major revision focused on evaluation: printed DAP/NAP baselines in the physical world, a mismatched-environment condition, a larger and more careful subjective study with multiple backgrounds and inter-rater reliability, and release of code. I would send it to peer review, not desk-reject it.

Referee Report

5 major / 5 minor

Summary. The paper proposes PG-ECAP, a method for generating adversarial patches that are both effective at evading object detectors and visually consistent with a specified environment. The approach optimizes the initial latent variable z_T of a Stable Diffusion model using an objective (Eq. 13) that combines an attack loss with two alignment losses: a Prompt Alignment Loss based on cross-attention map cosine similarity (Eq. 11) and a Latent Space Alignment Loss based on similarity to the initial z_0 (Eq. 12). The authors evaluate the method on the INRIA dataset with white-box and black-box detectors, conduct a subjective study of environmental consistency, perform physical-world experiments with a printed T-shirt in four scenes, and include ablations on loss weights and prompts. The central claim is that PG-ECAP outperforms existing methods in both attack success rate and environmental consistency.

Significance. If the claims were fully supported, PG-ECAP would be a valuable contribution to physical adversarial attacks, offering a practical way to generate printed patches that blend into their environment while evading detectors. The use of text prompts to control environmental adaptation is an interesting and potentially generalizable idea, and the paper includes both digital and physical evaluations. However, the evidence presented is not yet sufficient: the white-box advantage over DAP is small (1.6 mAP50 points on average) and inconsistent across detectors, the subjective evaluation of environmental consistency is underpowered and lacks controls, and the physical experiments include no baseline patches. The formulation is generally clear, and the ablation on prompts shows adaptability, but the central claims require stronger empirical support before they can be accepted.

major comments (5)

[§4.2.1, Table 1] The white-box attack performance advantage is small and inconsistent across detectors. The average mAP50 of PG-ECAP is 27.09 versus 28.69 for DAP, a 1.6-point improvement, but PG-ECAP is substantially worse than DAP on YOLOv4 (40.76 vs. 20.09) and worse than both DAP and NAP on YOLOv5 (16.00 vs. 10.26 and 5.95). The claim of outperforming existing methods is therefore only partially supported; the authors should either provide a per-detector analysis explaining these inconsistencies or present a more robust aggregate metric that accounts for the variability.
[§4.2.3 and §4.3] The central claim of environmental consistency is not convincingly established. The subjective evaluation in §4.2.3 uses 10 participants rating T-shirts against a single green background that matches the prompt "a picture full of leaf-like green colors," with no inter-rater reliability, confidence intervals, or a mismatched-environment control. The physical experiments in §4.3 report ASR only for the PG-ECAP T-shirt; no printed DAP/NAP baselines are included, and the regular-clothing control mentioned in the text is never quantified. Moreover, the ASR in indoor scenes (Lobby 95.59, Hallway 93.41) is as high as in outdoor scenes (Woodland 92.75, Lawn 94.79), which is consistent with the patch acting as a generic strong adversarial pattern rather than an environment-matched one. Please add objective patch-background consistency metrics (e.g., color statistics, feature similarity, or human perception with background variation) and include physical baselines.
[§3.4, Eqs. (11)–(12)] The alignment losses are not rigorously specified. In Eq. (12), L_latent = 1 - exp(-(z0 - z0_initial)^2) is written for a latent tensor; as written the expression is elementwise and does not reduce to a scalar. The authors should specify the norm and reduction (e.g., mean squared error over all latent dimensions). Similarly, Eq. (11) writes a sum over i and j of cosine similarities, but A_{i,j} are attention matrices; the exact reduction over spatial and layer dimensions should be clarified. These details matter for reproducibility and for interpreting the trade-off between attack and alignment.
[§4.2.2, Table 2] The transferability analysis is presented without comparison to any baseline, so the claim of "strong transferability" is not supported. Several black-box mAP50 values are high (e.g., 52.78, 56.43, 49.3, 42.26), which do not obviously indicate strong transfer. Please add transferability results for DAP and NAP under the same protocol and report aggregate black-box mAP50 across all source models.
[§4.4.1] The ablation of loss weights varies β and γ simultaneously, so the individual contributions of the Prompt Alignment Loss and the Latent Space Alignment Loss cannot be separated. The text also states that attack effectiveness and visual quality stabilize for certain configurations, but no quantitative attack or quality metrics are reported for the configurations in Fig. 6. A one-at-a-time ablation with numerical mAP50 and a perceptual metric (or human scores) is needed to justify the chosen weights.

minor comments (5)

[§3.2, Eqs. (8) and (13)] Eq. (8) introduces a single environmental loss L_env with weight λ, while Eq. (13) uses α, β, and γ for L_attack, L_prompt, and L_latent. The relationship between L_env and the two alignment losses should be made explicit.
[§3.1, Eq. (7)] Eq. (7) contains a typesetting error: the brace notation is broken and the second term is not a valid mathematical expression. Please fix the display.
[§4.4.2, Table 5] The caption and content of Table 5 are unclear: the values 21.7 and 18.1 appear without clear column headers, and the text refers to "the figure" but no figure is shown. Also, the baseline mAP50 of 91.5 for YOLOv5 on INRIA is mentioned in the text but not included in the table.
[§4.3] The regular-clothing control is mentioned but never quantified. Either report its ASR or remove the mention to avoid an unsupported comparison.
[General] The spelling of detector names is inconsistent (e.g., "Yolov5" vs. "YOLOv5", "Y olov2" in tables). Please standardize. Also, the author name "Hang su" should be "Hang Su".

Circularity Check

1 steps flagged · score 2.0 of 10

Environmental-consistency validation is partly self-confirming because the objective itself enforces prompt matching; attack-success evidence remains independent.

self definitional [Sec. 3.4, Eqs. (11)-(13) and Sec. 4.2.3]
"Lprompt = 1 − 1/N·M Σ_{i,j} A_{i,j}·A^{initial}_{i,j}/(∥A_{i,j}∥∥A^{initial}_{i,j}∥) ... Llatent = 1 − e^{−(z0−z^{initial}_0)^2} ... arg min_{zT} L = αLattack + βLprompt + γLlatent (13). ... we set the prompt P to "a picture full of leaf-like green colors" ... For the background, we choose a green natural theme, with the specific background image sourced from Fig. 3."

The paper's environmental-consistency objective is, by construction, to keep the generated patch close to the prompt-conditioned initial generation: Eq. (11) maximizes cosine similarity of cross-attention maps to their initial values, and Eq. (12) penalizes deviation of z0 from z^{initial}_0, both conditioned on prompt P. The subjective evaluation then uses the same prompt-environment match: P is "a picture full of leaf-like green colors" and the background is "a green natural theme." Hence the high mean score of 5.56 for PG-ECAP in Table 3 largely confirms that the optimization performed the matching it was explicitly constrained to perform, rather than independently establishing seamless scene integration.

full rationale

The paper contains no self-citation chain, no imported uniqueness theorem, and no renamed known result. Its derivation chain is an optimization pipeline: sample zT, denoise with Stable Diffusion, and minimize Eq. (13). The attack-effectiveness claim is grounded in independent digital mAP50 comparisons on INRIA and physical ASR across four scenes, which do not reduce to the loss terms. The only circularity concern is that the distinctive environmental-consistency claim is validated on a background that matches the prompt used in the alignment losses, making the high subjective score partly a consequence of the objective rather than an independent discovery. Because the human Likert ratings are still external to the optimization and because a central part of the paper (attack success) is separately and independently tested, this is a minor, evaluation-level circularity rather than a collapse of the derivation. Score 2 reflects that one supporting claim is partially self-confirming while the main attack results stand on their own.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

No new physical entities are introduced. The method relies on pre-trained diffusion models and several domain assumptions about prompt representation, attention-map semantics, latent-space alignment, EOT adequacy, and evaluation validity. Three loss weights are selected by ablation on the evaluation benchmark, which is the main free-parameter burden.

free parameters (3)

attack loss weight α = 1
Chosen by hand and ablation in Sec. 4.4.1 to balance attack efficacy against alignment losses.
prompt alignment loss weight β = 5
Selected via ablation in Sec. 4.4.1 to preserve the natural appearance of the patch.
latent space alignment loss weight γ = 0.1
Selected via ablation in Sec. 4.4.1 to keep the final latent z0 close to its initial value.

assumptions (6)

domain assumption Stable Diffusion 2 (LDM-based) can generate visually natural images from textual prompts and is a suitable prior for adversarial patch generation.
Relied on in Sec. 3.1 and Sec. 4.1.2; the entire naturalness claim rests on the pre-trained diffusion model.
domain assumption Cross-attention maps between latent features and text embeddings encode the prompt semantics, and preserving them preserves prompt alignment.
This is the basis of Prompt Alignment Loss in Sec. 3.4; no proof is offered.
domain assumption The initial latent z0 after the full DDIM denoising encodes rich semantic information from the prompt, so keeping z0 close to it preserves environmental consistency.
Basis of Latent Space Alignment Loss, Eq. 12 in Sec. 3.4.
domain assumption The expectation over transformations Φ (EOT) adequately models physical-world variations such as lighting and viewpoint.
Used in Eq. 8-9; the actual set Φ is never specified.
domain assumption The INRIA dataset and COCO-pretrained detectors are a representative evaluation setup for physical person-detection attacks.
Used in Sec. 4.1.1; no justification that results generalize beyond this setup.
domain assumption A 10-participant Likert rating against one background image is a reliable measure of environmental consistency.
The only perceptual validation is in Sec. 4.2.3; no inter-rater reliability or significance testing is reported.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Prompt-Guided Environmentally Consistent Adversarial Patch." pith.science (2026). https://pith.science/paper/ADD53YCU

@misc{pith2026241110498,
  author       = {Pith},
  title        = {Pith review of: Prompt-Guided Environmentally Consistent Adversarial Patch},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ADD53YCU}},
  note         = {Machine review of arXiv:2411.10498}
}

read the original abstract

Adversarial attacks in the physical world pose a significant threat to the security of vision-based systems, such as facial recognition and autonomous driving. Existing adversarial patch methods primarily focus on improving attack performance, but they often produce patches that are easily detectable by humans and struggle to achieve environmental consistency, i.e., blending patches into the environment. This paper introduces a novel approach for generating adversarial patches, which addresses both the visual naturalness and environmental consistency of the patches. We propose Prompt-Guided Environmentally Consistent Adversarial Patch (PG-ECAP), a method that aligns the patch with the environment to ensure seamless integration into the environment. The approach leverages diffusion models to generate patches that are both environmental consistency and effective in evading detection. To further enhance the naturalness and consistency, we introduce two alignment losses: Prompt Alignment Loss and Latent Space Alignment Loss, ensuring that the generated patch maintains its adversarial properties while fitting naturally within its environment. Extensive experiments in both digital and physical domains demonstrate that PG-ECAP outperforms existing methods in attack success rate and environmental consistency.

Figures

Figures reproduced from arXiv: 2411.10498 by the authors.

**Figure 2.** Ours vs State-of-the-Art patches: (a) AdvYolo [ [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** An overview of the proposed PG-ECAP. We first extract prompt P from the environment and feed P into a text encoder ψ(.) to obtain text embeddings C. Then, we sample zT from a Gaussian distribution and feed it with C into the diffusion model, extracting the cross attention maps during the DDIM process for alignment. After the DDIM process is finished, we align both the cross attention maps and z0 with their correspon… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: During the optimization of zT , without constraints, the adversarial patch gradually misaligns with P, where P is ”a picture full of leaf-like green color”. While the latent space optimization allows for robust adversarial patch generation, the optimization of zT wit…

**Figure 5.** Figure 5: The detection results of four postures in four scenes. Our generated clothing can successfully evade detection in different scenes [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: The attack performance and visualization of patches gen [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Distillation-Enhanced Physical Adversarial Attacks
cs.CV 2025-01 conditional novelty 5.0 of 10

A knowledge distillation framework transfers attack features from an unconstrained adversarial patch to a color-constrained stealthy patch, improving attack performance by about 20% on pedestrian detectors.

Reference graph

Works this paper leans on

40 extracted references · 29 canonical work pages · cited by 1 Pith paper

[1]

Yolov4: Optimal speed and accuracy of object detection

Alexey Bochkovskiy, Chien-Yao Wang, and Hong- Yuan Mark Liao. Yolov4: Optimal speed and accuracy of object detection. CoRR, abs/2004.10934, 2020. 6

arXiv 2004
[2]

Large scale GAN training for high fidelity natural image synthe- sis

Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthe- sis. In 7th International Conference on Learning Represen- tations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019 . OpenReview.net, 2019. 3

work page 2019
[3]

Adversarial sensor attack on lidar-based per- ception in autonomous driving

Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. Adversarial sensor attack on lidar-based per- ception in autonomous driving. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 2267–2281, 2019. 1

work page 2019
[4]

Diffusion models for imperceptible and transferable adversarial attack

Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 2, 3

work page 2024
[5]

Multimodal diffusion models for text-to-image generation

Wei Chen, Hao Zhang, and Yi Wu. Multimodal diffusion models for text-to-image generation. In International Con- ference on Learning Representations, 2023. 3

work page 2023
[6]

Content-based unrestricted ad- versarial attack

Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-based unrestricted ad- versarial attack. Advances in Neural Information Processing Systems, 36, 2024. 2, 3

work page 2024
[7]

Histograms of oriented gra- dients for human detection

Navneet Dalal and Bill Triggs. Histograms of oriented gra- dients for human detection. In 2005 IEEE Computer Soci- ety Conference on Computer Vision and Pattern Recognition, pages 886–893, San Diego, CA, USA, 2005. 6

work page 2005
[8]

Efficient decision-based black- box adversarial attacks on face recognition

Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient decision-based black- box adversarial attacks on face recognition. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7714–7722, 2019. 1

work page 2019

Show all 40 references

[9]

Learning coated adversarial camouflages for object detec- tors

Yexin Duan, Jialin Chen, Xingyu Zhou, Junhua Zou, Zhengyun He, Jin Zhang, Wu Zhang, and Zhisong Pan. Learning coated adversarial camouflages for object detec- tors. arXiv preprint arXiv:2109.00124, 2021. 3

2021 arXiv
[10]

Dap: A dynamic adversarial patch for evading person detectors

Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24595–24604, 2024. 1, 2, 3, 7

2024
[11]

Denoising dif- fusion probabilistic models

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. 2, 4

2020
[12]

Nat- uralistic physical adversarial patch for object detectors

Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun- Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Nat- uralistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7848–7857, 2021. 1, 2, 3, 6, 7

2021
[13]

Adversarial texture for fooling person detectors in the physical world

Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13307–13316, 2022. 1, 2, 3, 6, 7

2022
[14]

Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling

Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition , pages 16975–16984,
[15]

T-sea: Transfer-based self-ensemble attack on object detection

Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-sea: Transfer-based self-ensemble attack on object detection. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , pages 20514–20523, 2023. 1, 2, 3, 7

2023
[16]

Universal physical camouflage attacks on object detectors

Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 720–729, 2020. 1, 2, 3, 7

2020
[17]

Neu- ral 3d mesh renderer

Hiroharu Kato, Yoshitaka Ushiku, and Tatsuya Harada. Neu- ral 3d mesh renderer. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 3907– 3916, 2018. 3

2018
[18]

Adam: A method for stochastic opti- mization

Diederik P Kingma. Adam: A method for stochastic opti- mization. arXiv preprint arXiv:1412.6980, 2014. 6

2014 arXiv
[19]

Hierarchical text- to-image generation with long descriptions

Xiaoming Li, Lei Zhang, and Sheng Wang. Hierarchical text- to-image generation with long descriptions. In Proceedings of the ACM SIGGRAPH Conference on Computer Graphics and Interactive Techniques, 2023. 3

2023
[20]

Microsoft coco: Common objects in context

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference , pages 740–755, Zurich, Switzerland, 2014. 6

2014
[21]

Text-guided image editing with diffusion models

Yang Liu, Zheng Huang, and Xiao Wang. Text-guided image editing with diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022. 3

2022
[22]

Imperceptible, robust, and targeted adversarial examples for automatic speech recognition

Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfel- low, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In International conference on machine learning, pages 5231–
[23]

Learning transferable visual models from natural language supervi- sion

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, 9 Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning...

2021
[24]

Zero-shot text-to-image generation

Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea V oss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International confer- ence on machine learning, pages 8821–8831. Pmlr, 2021. 3

2021
[25]

Deep convolutional neu- ral networks for image classification: A comprehensive re- view

Waseem Rawat and Zenghui Wang. Deep convolutional neu- ral networks for image classification: A comprehensive re- view. Neural computation, 29(9):2352–2449, 2017. 1

2017
[26]

YOLO9000: better, faster, stronger

Joseph Redmon and Ali Farhadi. YOLO9000: better, faster, stronger. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, pages 6517–6525, Honolulu, HI, USA,

2017
[27]

Yolov3: An incremental improvement

Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. CoRR, abs/1804.02767, 2018. 6

2018 arXiv
[28]

Girshick, and Jian Sun

Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. Faster R-CNN: towards real-time object detection with re- gion proposal networks. In Advances in Neural Information Processing Systems 28: Annual Conference on Neural Infor- mation Processing Systems, pages 91–99, Montr...

2015
[29]

High-resolution image synthesis with latent diffusion models

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 2, 6

2022
[30]

Deep unsupervised learning using nonequilibrium thermodynamics

Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International confer- ence on machine learning, pages 2256–2265. PMLR, 2015. 4

2015
[31]

Denois- ing diffusion implicit models

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denois- ing diffusion implicit models. In 9th International Con- ference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021 . OpenReview.net, 2021. 2, 4, 6

2021
[32]

Fooling automated surveillance cameras: adversarial patches to at- tack person detection

Simen Thys, Wiebe Van Ranst, and Toon Goedem´e. Fooling automated surveillance cameras: adversarial patches to at- tack person detection. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition work- shops, pages 0–0, 2019. 1, 2, 3, 7

2019
[33]

Ultralytics. Yolov5. https : / / github . com / ultralytics/yolov5, 2020. 6

2020
[34]

Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack

Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In Proceedings of the AAAI conference on artificial intelligence , p...

2022
[35]

Dual attention suppression attack: Generate adversarial camouflage in physical world

Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8565–8574, 2021. 1, 3

2021
[36]

Making an invisibility cloak: Real world adversar- ial attacks on object detectors

Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Gold- stein. Making an invisibility cloak: Real world adversar- ial attacks on object detectors. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23– 28, 2020, Proceedings, Part IV 16 , pages 1–17. Springer,

2020
[37]

Adversarial t-shirt! evading person detectors in a physical world

Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Meng- shu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Procee...

2020
[38]

Adversarial attacks on deep-learning models in natural language processing: A survey

Wei Emma Zhang, Quan Z Sheng, Ahoud Alhazmi, and Chenliang Li. Adversarial attacks on deep-learning models in natural language processing: A survey. ACM Transac- tions on Intelligent Systems and Technology (TIST) , 11(3): 1–41, 2020. 1

2020
[39]

Object detection with deep learning: A review

Zhong-Qiu Zhao, Peng Zheng, Shou-tao Xu, and Xindong Wu. Object detection with deep learning: A review. IEEE transactions on neural networks and learning systems , 30 (11):3212–3232, 2019. 1

2019
[40]

Deformable DETR: deformable transformers for end-to-end object detection

Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable DETR: deformable transformers for end-to-end object detection. In 9th International Con- ference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021. 6 10

2021

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Yolov4: Optimal speed and accuracy of object detection

Alexey Bochkovskiy, Chien-Yao Wang, and Hong- Yuan Mark Liao. Yolov4: Optimal speed and accuracy of object detection. CoRR, abs/2004.10934, 2020. 6

arXiv 2004

[2] [2]

Large scale GAN training for high fidelity natural image synthe- sis

Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthe- sis. In 7th International Conference on Learning Represen- tations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019 . OpenReview.net, 2019. 3

work page 2019

[3] [3]

Adversarial sensor attack on lidar-based per- ception in autonomous driving

Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. Adversarial sensor attack on lidar-based per- ception in autonomous driving. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 2267–2281, 2019. 1

work page 2019

[4] [4]

Diffusion models for imperceptible and transferable adversarial attack

Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 2, 3

work page 2024

[5] [5]

Multimodal diffusion models for text-to-image generation

Wei Chen, Hao Zhang, and Yi Wu. Multimodal diffusion models for text-to-image generation. In International Con- ference on Learning Representations, 2023. 3

work page 2023

[6] [6]

Content-based unrestricted ad- versarial attack

Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-based unrestricted ad- versarial attack. Advances in Neural Information Processing Systems, 36, 2024. 2, 3

work page 2024

[7] [7]

Histograms of oriented gra- dients for human detection

Navneet Dalal and Bill Triggs. Histograms of oriented gra- dients for human detection. In 2005 IEEE Computer Soci- ety Conference on Computer Vision and Pattern Recognition, pages 886–893, San Diego, CA, USA, 2005. 6

work page 2005

[8] [8]

Efficient decision-based black- box adversarial attacks on face recognition

Yinpeng Dong, Hang Su, Baoyuan Wu, Zhifeng Li, Wei Liu, Tong Zhang, and Jun Zhu. Efficient decision-based black- box adversarial attacks on face recognition. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7714–7722, 2019. 1

work page 2019