Pith. sign in

REVIEW 3 major objections 5 minor 2 cited by

CapGen:An Environment-Adaptive Generator of Adversarial Patches

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial patches carry their attack power mostly in their pattern rather than their colors, so recoloring a trained patch with a new environment's base colors preserves the attack while improving visual stealth.

desk verdict The recoloring trick is genuinely useful and mostly works, but the pattern-vs-color conclusion is built on a confounded comparison and the paper oversells its evidence. read the letter →

arxiv 2412.07253 v1 pith:EISQTOLB submitted 2024-12-10 cs.CV

Chaoqun Li , Zhuodong Liu , Huanqian Yan , Hang Su This is my paper · ORCID
classification cs.CV
keywords adversarialpatchesphysicalattacksobjectdetectionevasionvisualstealthcamouflagepatternversuscolorenvironmentadaptationfastpatchgeneration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial patches that hide objects from detectors usually stand out to human eyes because they ignore the background. This paper claims that what makes a patch effective is mostly its pattern—the relative magnitudes of pixel values—not the colors themselves, and that recoloring an already-strong patch with base colors taken from a new environment preserves most of its attack power while making it visually blend in. To exploit this, CAPGen extracts the environment's dominant colors by K-means clustering, then optimizes a per-pixel color probability matrix that blends those base colors with a softmax temperature, so the patch's palette is constrained while its texture is free to attack. In white-box and black-box tests across YOLOv2–v5 variants and Faster R-CNN on the INRIA and FLIR datasets, recolored patches (CAPGen-P) outperform freshly trained color-constrained patches (CAPGen-T) by a large margin. A sympathetic reader would care because the result, if correct, turns environmental adaptation into a one-step recoloring operation—no new data collection or optimization per scene—and isolates texture as the carrier of adversarial signal.

What carries the argument

The load-bearing object is the color probability matrix $m \in (0,1)^{W \times H \times 3}$, learned by gradient optimization, together with the soft-blend equation $t_{ij} = \sum_k c_k \mathrm{Softmax}(\log m_{ijk}/\tau)$ that turns base colors into pixel values. With temperature $\tau = 0.1$ the softmax is near one-hot, so each pixel is effectively assigned to one base color while gradients still flow through the assignment. This machinery separates the stealth constraint—which lives in the palette $c_k$—from the attack objective, which lives in the spatial structure encoded by $m$; keeping $m$ fixed and changing only $c_k$ defines CAPGen-P, the recolored patch, and is the operation the fast strategy uses for new environments.

What would settle it

Re-run CAPGen-T from the same optimized color probability matrix used in CAPGen-P instead of from random initialization, and compare final mAP50 values. If the gap disappears, pattern dominance is an artifact of inherited optimization; if a large gap persists under matched initialization, colors play a genuinely secondary role.

Watch

Extended reading notes

Core claim

At the core of the paper is a decomposition of an adversarial patch into two parts: the pattern, defined as the color-agnostic texture information carried by the relative magnitude of neighboring pixel values, and the colors, defined as the set of base colors chosen from the environment. CAPGen constructs a patch by writing each pixel as $t_{ij} = \sum_{k=1}^{3} c_k r_k$, where the $c_k$ are base colors extracted via K-means and $r_k = \mathrm{Softmax}(\log m_{ijk}/\tau)$ comes from an optimized color probability matrix $m$ with temperature $\tau = 0.1$. To separate the two components, the paper recolors a fully trained AdvPatch by replacing the base colors $c_k$ with new environment colors while keeping $m$ fixed (CAPGen-P), and compares this with CAPGen-T, which trains a fresh color probability matrix from random initialization under fixed environment colors. Across victim detectors and both white-box and black-box settings, CAPGen-P achieves much lower mAP50 than CAPGen-T—for example, average 22.92 versus 48.04 on INRIA in the white-box table—which the paper reads as evidence that patterns are the dominant carrier of adversarial effect, with colors playing a secondary role. On that basis, the fast generation strategy simply swaps in new base colors for a high-performance patch, aiming at stealth without retraining.

Load-bearing premise

The central claim depends on comparing a recolored version of an already-optimized adversarial patch with a patch whose color weights are trained from scratch; if that gap comes from optimization difficulty or initialization rather than from pattern versus color, the conclusion and the fast-recoloring strategy lose their evidential basis.

Editorial extensions

If this is right

  • If the pattern-dominance result holds, an adversarial patch prepared for one scene can be reused in another scene by recoloring it with that scene's base colors, skipping data collection and optimization.
  • CAPGen-P's attack performance stays close to AdvPatch's in both white-box and black-box evaluations, so visual stealth is not bought by sacrificing attack power.
  • The pattern/color decomposition gives a diagnostic: comparing a recolored patch with a freshly trained color-restricted patch measures how much of an attack lives in texture rather than palette.
  • Increasing the number of base colors improves attack performance in the paper's ablations, implying richer palettes give the pattern more room to express adversarial detail.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A consequence the paper does not develop is that defenses built on color statistics or color calibration should be less effective against CAPGen-style patches; detectors would do better to target local contrast and high-frequency texture.
  • The recoloring transfer could be tested as a general attack toolkit: take any strong physical patch and recolor it with the target scene's palette; if the mAP50 drop stays small across many scenes and detectors, the result becomes a practical design rule for adaptive camouflage.
  • The same separation might transfer to digital adversarial perturbations, where high-frequency pattern components are known to survive compression; if pattern dominance is universal, color-space defenses are a weak point for physical attacks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces CAPGen, a method for generating adversarial patches whose colors are constrained to a small set of base colors extracted from the surrounding environment. The patch is formed by a soft blend of base colors weighted by an optimized color probability matrix (Eq. 3), and an EOT-based objective (Eq. 2) is used for training. The central claim is that adversarial attack performance is driven primarily by the patch's pattern (color-agnostic texture) rather than its colors. Based on this, the authors propose a fast generation strategy: take a high-performance patch, keep its color probability matrix fixed, and replace only the base colors with those of a new environment (Eq. 4). Experiments on INRIA and FLIR ADAS against multiple detectors, plus ablations, are presented as support. The paper also includes physical-world demonstrations and a subjective stealthiness evaluation.

Significance. If the pattern-vs-color claim were rigorously established, the paper would make a useful conceptual contribution to physical adversarial patch design: separating color and pattern could enable rapid patch adaptation across environments, which is practically relevant for both attack and defense evaluation. The proposed CAPGen formulation is clean and the experimental scope is broad: two datasets, six detectors, white-box and black-box settings, and a physical-world demo. However, the central comparison underlying the pattern-dominance claim is confounded, and the fast-recoloring strategy is not quantitatively tested with environment-extracted colors. These issues are fixable, but they are load-bearing for the paper's main conclusions.

major comments (3)
  1. [Sec. 3.3, Table 1] The comparison between CAPGen-P and CAPGen-T does not isolate pattern from color. CAPGen-P keeps the fully optimized AdvPatch color probability matrix m and only changes the base color values (Eq. 4), whereas CAPGen-T trains a fresh color probability matrix mt from random initialization under the 3-color constraint (Eq. 5 plus gradient-driven allocation). These conditions differ in both the initialization/prior optimization and the optimization trajectory. The large gap in mean mAP50 (22.92 for CAPGen-P1 vs. 48.04 for CAPGen-T1 on INRIA, and 21.88 vs. 30.90 on FLIR in Table 3) could therefore reflect the greater difficulty of training a strong patch from scratch in a heavily restricted color space, rather than an intrinsic dominance of patterns over colors. To support the claim, the authors should run a matched control in which CAPGen-T is initialized with the AdvPatch matrix m (or both variants are trained from the same initialization with the same optimization budget), and report those numbers. The same confound propagates to the black-box results in Table 2 and the ablation in Fig. 5.
  2. [Sec. 4.2, Tables 1 and 3] All quantitative attack results use randomly selected base color sets Bc1 and Bc2, not the environment-extracted base colors described in Sec. 3.2. Therefore, the proposed fast generation strategy, which is supposed to update colors to align with a new environment, is never quantitatively tested in the environment-matched setting; its attack performance is only demonstrated for arbitrary random colors. The environment-matched claims rest on qualitative visualizations (Fig. 1, Fig. 7). The authors should either report attack metrics for patches recolored with K-means-extracted base colors from the INRIA and FLIR ADAS backgrounds, or explicitly restrict the quantitative claims to arbitrary color replacement and treat the environment-matched case as a separate qualitative demonstration.
  3. [Sec. 3.3] The foundational assertion that "adversarial noise influences the predictions of deep models primarily due to the relative magnitude relationship between different pixel values and small perturbations in pixel values" is stated without derivation or direct test. The decomposition into pattern and color components is then defined operationally through Eqs. (3)-(5), which is reasonable, but the key comparison used to support the assertion (CAPGen-P vs. CAPGen-T) is the same confounded comparison noted above. The authors should provide a cleaner test of the assertion, e.g., by measuring attack success when only the color magnitudes are scaled or shifted while preserving relative pixel ratios, or when only the relative pattern is preserved with randomized base colors, under identical optimization budgets.
minor comments (5)
  1. [Eq. (3)] The softmax expression is missing an explicit index: it should be r_{ijk} = Softmax(log(m_{ijk})/tau), and a summation over k should appear in the expression for t_{ij}. As written, the equation is inconsistent with the surrounding text.
  2. [Sec. 4.2] The phrase "the model of the fist column" in Table 2 (and Table 4) should be "the model of the first column".
  3. [Appendix H] The dataset name is misspelled as "FILA ADAS" in the caption of Fig. 9; it should be "FLIR ADAS".
  4. [Sec. 2] The reference list entry for Duan et al. (2021) contains an apparent author-name error ("Akshay Qin"); this should be corrected.
  5. [Fig. 4] The caption lists CAPGen-P1, CAPGen-P2, CAPGen-R1, CAPGen-T1 but the text refers to CAPGen-R2 and CAPGen-T2 elsewhere; for clarity, the caption should include all variants or state explicitly which are shown.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular reduction: the recoloring strategy and pattern-vs-color conclusion rest on empirical comparisons, not on definitions or self-citations.

full rationale

The paper's central operational move is Eq. (4), where the base colors c_k in Eq. (3) are replaced by new base colors nc_k while the color probability matrix r_k is frozen. The fast generation strategy in Sec. 3.3 is exactly this substitution, and CAPGen-P in Sec. 4.2 is the same construction applied to AdvPatch. That makes the strategy and the evidence operationally identical, but the link is empirical rather than definitional: the paper measures mAP50 after recoloring (Table 1: CAPGen-P1 22.92 vs AdvPatch 19.58 on INRIA; Table 3: 21.88 vs 20.34 on FLIR) instead of deriving the outcome from Eq. (4). A recolored patch could in principle have lost its attack, so the finding is falsifiable. The pattern-vs-color conclusion (Sec. 4.3) compares CAPGen-P with CAPGen-T, which is a confounded comparison because CAPGen-P inherits an already-optimized AdvPatch matrix while CAPGen-T optimizes a fresh matrix under a 3-color constraint; initialization and optimization difficulty are not controlled. This is a validity concern about the causal claim, not a circular reduction of the paper's conclusion to its inputs. The paper also checks the recoloring operation against external baselines (AdvPatch, DAP, NAP, T-SEA in Appendix E) and across INRIA, FLIR, six detectors, and physical trials, so the central claim has independent empirical content. No load-bearing self-citation or imported uniqueness theorem is used. Overall: no significant circularity; the main weaknesses are experimental confounds, not circular reasoning.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claims rest on an asserted mechanism for how deep models respond to pixel magnitudes, on hand-chosen hyperparameters, and on the assumption that three K-means colors capture enough of the background for human stealth. The main quantitative tables substitute random palettes for the actual environment-extraction pipeline, so the connection between the method as described and the attack numbers is loose. No new physical entities are introduced.

free parameters (5)
  • Number of base colors K = 3 (default)
    Hand-chosen default in Sec. 3.2; Fig. 5 shows attack performance improves with more colors, so K=3 is a design choice trading stealth for attack strength.
  • Temperature coefficient tau = 0.1
    Set in Eq. (3) to keep each pixel close to a single base color; no sensitivity analysis is reported.
  • EOT transformation ranges = D~U(0.8,1.2), B~U(0.9,1.1), N~U(0,0.1), rotation in [-20,20]
    Chosen in Appendix D without justification or ablation; these ranges directly affect the robustness claim.
  • Regularization coefficients lambda_1, lambda_2 = unspecified
    Appear in Eq. (2) balancing attack, robustness, and stealth, but values are never given, leaving the main objective incompletely specified.
  • Random base color sets Bc1 and Bc2 = Bc1=[[119,49,72],[2,204,1],[134,2,182]], Bc2=[[199,21,131],[40,165,4],[16,69,120]]
    Used in all main attack tables instead of environment-derived colors; the claim that CAPGen uses environment colors is not tested in the quantitative experiments.
assumptions (4)
  • ad hoc to paper Deep models respond primarily to the relative magnitude relationship between pixel values and small perturbations in pixel values (Sec. 3.3).
    Motivates the pattern/color decomposition and the fast recoloring strategy; no theoretical or independent empirical support is provided beyond the paper's own experiments.
  • domain assumption Three K-means color clusters faithfully represent the background for human stealthiness (Sec. 3.2).
    No evaluation of how many clusters or which background regions suffice for visual concealment; only a small subjective test in Appendix G.
  • domain assumption EOT transformations simulate physical conditions sufficiently for deployment (Appendix D).
    Standard in physical adversarial ML, but the chosen ranges are unvalidated against physical prints and lighting conditions.
  • domain assumption The victim detector is fixed and attack performance is measured by mAP50 decreases (Sec. 4.1).
    Standard benchmark practice, but implies findings may not transfer to other detection paradigms; the FCOS and RetinaNet appendix partially mitigates this.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CapGen:An Environment-Adaptive Generator of Adversarial Patches." pith.science (2026). https://pith.science/paper/EISQTOLB

@misc{pith2026241207253,
  author       = {Pith},
  title        = {Pith review of: CapGen:An Environment-Adaptive Generator of Adversarial Patches},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EISQTOLB}},
  note         = {Machine review of arXiv:2412.07253}
}
read the original abstract

Adversarial patches, often used to provide physical stealth protection for critical assets and assess perception algorithm robustness, usually neglect the need for visual harmony with the background environment, making them easily noticeable. Moreover, existing methods primarily concentrate on improving attack performance, disregarding the intricate dynamics of adversarial patch elements. In this work, we introduce the Camouflaged Adversarial Pattern Generator (CAPGen), a novel approach that leverages specific base colors from the surrounding environment to produce patches that seamlessly blend with their background for superior visual stealthiness while maintaining robust adversarial performance. We delve into the influence of both patterns (i.e., color-agnostic texture information) and colors on the effectiveness of attacks facilitated by patches, discovering that patterns exert a more pronounced effect on performance than colors. Based on these findings, we propose a rapid generation strategy for adversarial patches. This involves updating the colors of high-performance adversarial patches to align with those of the new environment, ensuring visual stealthiness without compromising adversarial impact. This paper is the first to comprehensively examine the roles played by patterns and colors in the context of adversarial patches.

Figures

Figures reproduced from arXiv: 2412.07253 by the authors.

Figure 1
Figure 1. Detection results of different Adversarial coat against Yolov5s. CAPGen-based coat (ours) [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Comparison between adversarial patch (Left), traditional camouflage (Mid) and our pro [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The pipeline of the proposed CAPGen. During the training stage, we optimize a color [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Adversarial patches obtained by attacking Yolov5s with AdvPatch (4a), its variants after [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: The results of adversarial patches with increasing size (left) and the results with different [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Detection results using AdvPatch and CAPGen in shrubbery. All patches are generated [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Adversarial patches in background images are marked with red circles. [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Detection results on INRIA dataset using different adversarial patches. All the adversarial [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Detection results on FILA ADAS dataset using different adversarial patches. All the adversarial patches are generated and tested on Yolov5s. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. BadPatch: Diffusion-Based Generation of Physical Adversarial Patches

    cs.CV 2024-12 conditional novelty 6.0 of 10

    BadPatch generates naturalistic, customizable adversarial patches for evading person detectors using incomplete diffusion optimization, and it introduces the AdvT-shirt-1K physical-world dataset.

  2. Distillation-Enhanced Physical Adversarial Attacks

    cs.CV 2025-01 conditional novelty 5.0 of 10

    A knowledge distillation framework transfers attack features from an unconstrained adversarial patch to a color-constrained stealthy patch, improving attack performance by about 20% on pedestrian detectors.

Reference graph

Works this paper leans on

48 extracted references · 36 canonical work pages · cited by 2 Pith papers

  1. [1]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Jennifer G. Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning, volume 80, pp.\ 284--293, Stockholmsm \" a ssan, Stockholm, Sweden, July 2018 a . PMLR

    work page 2018

  2. [2]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397, 2018 b

    arXiv 2018

  3. [3]

    Yolov4: Optimal speed and accuracy of object detection

    Alexey Bochkovskiy, Chien - Yao Wang, and Hong - Yuan Mark Liao. Yolov4: Optimal speed and accuracy of object detection. CoRR, abs/2004.10934, 2020. URL https://arxiv.org/abs/2004.10934

    arXiv 2004

  4. [4]

    Adversarial patch

    Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. In 31st Conference on Neural Information Processing Systems (NIPS 2017), 2017

    work page 2017

  5. [5]

    Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector

    Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Chau. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In Proceedings of the European Conference on Computer Vision (ECCV), pp.\ 100--117, 2018

    work page 2018

  6. [6]

    Histograms of oriented gradients for human detection

    Navneet Dalal and Bill Triggs. Histograms of oriented gradients for human detection. In 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition , pp.\ 886--893, San Diego, CA, USA, June 2005

    work page 2005

  7. [7]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In IEEE Conference on Computer Vision and Pattern Recognition , pp.\ 4312--4321. Computer Vision Foundation / IEEE , June 2019

    work page 2019

  8. [8]

    Adversarial yolo: Defense against physical adversarial attacks on object detection

    Rui Duan, Xiaoyu Ma, Yuezun Wang, James Bailey, Akshay Qin, and Bin Yang. Adversarial yolo: Defense against physical adversarial attacks on object detection. IEEE Transactions on Information Forensics and Security, 16: 0 2137--2151, 2021

    work page 2021

Show all 48 references
  1. [9]

    Learning coated adversarial camouflages for object detectors

    Yexin Duan, Jialin Chen, Xingyu Zhou, Junhua Zou, Zhengyun He, Jin Zhang, Wu Zhang, and Zhisong Pan. Learning coated adversarial camouflages for object detectors. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, pp.\ 891--897, Vienn...

    2022

  2. [10]

    Dap: A dynamic adversarial patch for evading person detectors

    Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 24595--24604, 2024

    2024

  3. [11]

    Ganmouflage: 3d object nondetection with texture fields

    Rui Guo, Jasmine Collins, Oscar de Lima, and Andrew Owens. Ganmouflage: 3d object nondetection with texture fields. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 4702--4712, 2023

    2023

  4. [12]

    Naturalistic physical adversarial patch for object detectors

    Yu - Chih - Tuan Hu, Jun - Cheng Chen, Bo - Han Kung, Kai - Lung Hua, and Daniel Stanley Tan. Naturalistic physical adversarial patch for object detectors. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021 , pp.\...

    2021

  5. [13]

    Naturalistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Naturalistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp.\ 7848--7857, 2021 b

    2021

  6. [14]

    Adversarial texture for fooling person detectors in the physical world

    Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp.\ 13297--13306, New Orleans, LA, USA, June 2022

    2022

  7. [15]

    T-SEA: transfer-based self-ensemble attack on object detection

    Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-SEA: transfer-based self-ensemble attack on object detection. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023 , pp.\ 20514--20523. IEEE ,...

    2023

  8. [16]

    T-SEA: transfer-based self-ensemble attack on object detection

    Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-SEA: transfer-based self-ensemble attack on object detection. In IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp.\ 20514--20523, Vancouver, BC, Canada, June 2023 b

    2023

  9. [17]

    Yuille, Changqing Zou, and Ning Liu

    Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L. Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp.\ 717--726, Seattle, WA, USA, 2020

    2020

  10. [18]

    Improving camouflaged object detection with the uncertainty of pseudo-edge labels

    Nobukatsu Kajiura, Hong Liu, and Shin'ichi Satoh. Improving camouflaged object detection with the uncertainty of pseudo-edge labels. In ACM Multimedia Asia, pp.\ 1--7. ACM , 2021

    2021

  11. [19]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016

    2016 arXiv

  12. [20]

    Towards benchmarking and assessing visual naturalness of physical world adversarial attacks

    Simin Li, Shuning Zhang, Gujun Chen, Dong Wang, Pu Feng, Jiakai Wang, Aishan Liu, Xin Yi, and Xianglong Liu. Towards benchmarking and assessing visual naturalness of physical world adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Re...

    2023

  13. [21]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \'a r, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, pp.\ 740--755, Zurich, Switzerland, September 2014

    2014

  14. [22]

    Focal loss for dense object detection

    Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Doll \'a r. Focal loss for dense object detection. In Proceedings of the IEEE international conference on computer vision, pp.\ 2980--2988, 2017

    2017

  15. [23]

    Some methods for classification and analysis of multivariate observations

    James MacQueen et al. Some methods for classification and analysis of multivariate observations. In Proceedings of the fifth Berkeley symposium on mathematical statistics and probability, volume 1, pp.\ 281--297. Oakland, CA, USA, 1967

    1967

  16. [24]

    Camouflaging an object from many viewpoints

    Andrew Owens, Connelly Barnes, Alex Flint, Hanumant Singh, and William Freeman. Camouflaging an object from many viewpoints. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 2782--2789, 2014

    2014

  17. [25]

    Belongie, Bharath Hariharan, Mark E

    Rui Qian, Divyansh Garg, Yan Wang, Yurong You, Serge J. Belongie, Bharath Hariharan, Mark E. Campbell, Kilian Q. Weinberger, and Wei - Lun Chao. End-to-end pseudo-lidar for image-based 3d object detection. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition ...

    2020

  18. [26]

    YOLO9000: better, faster, stronger

    Joseph Redmon and Ali Farhadi. YOLO9000: better, faster, stronger. In 2017 IEEE Conference on Computer Vision and Pattern Recognition , pp.\ 6517--6525, Honolulu, HI, USA, July 2017

    2017

  19. [27]

    Yolov3: An incremental improvement

    Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. CoRR, abs/1804.02767, 2018. URL http://arxiv.org/abs/1804.02767

    2018 arXiv

  20. [28]

    Girshick, and Jian Sun

    Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. Faster R-CNN: towards real-time object detection with region proposal networks. In Corinna Cortes, Neil D. Lawrence, Daniel D. Lee, Masashi Sugiyama, and Roman Garnett (eds.), Advances in Neural Information Processing S...

    2015

  21. [29]

    Physical adversarial examples for object detectors

    Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tram \` e r, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In 12th USENIX Workshop on Offensive Technologies , Baltimore, MD, USA, 2018

    2018

  22. [30]

    DTA: physical camouflage attacks using differentiable transformation network

    Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Harashta Tatimma Larasati, Youngyeo Yun, Thi - Thu - Huong Le, Hunmin Yang, Se - Yoon Oh, and Howon Kim. DTA: physical camouflage attacks using differentiable transformation network. In IEEE/CVF Conference on Computer Vision and Patter...

    2022

  23. [31]

    Fooling automated surveillance cameras: Adversarial patches to attack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedem \' e . Fooling automated surveillance cameras: Adversarial patches to attack person detection. In IEEE Conference on Computer Vision and Pattern Recognition Workshops , pp.\ 49--55, Long Beach, CA, USA, 2019

    2019

  24. [32]

    Fcos: Fully convolutional one-stage object detection

    Z Tian, C Shen, H Chen, and T He. Fcos: Fully convolutional one-stage object detection. arxiv 2019. arXiv preprint arXiv:1904.01355, 1904

    2019 arXiv

  25. [33]

    Ultralytics. Yolov5. https://github.com/ultralytics/yolov5, 2020

    2020

  26. [34]

    Adversarial attacks against face recognition: A comprehensive study

    Fatemeh Vakhshiteh, Ahmad Nickabadi, and Raghavendra Ramachandra. Adversarial attacks against face recognition: A comprehensive study. IEEE Access , 9: 0 92735--92756, 2021

    2021

  27. [35]

    FCA: learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack

    Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. FCA: learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In Thirty-Sixth AAAI Conference on Artificial Intelligence, AAAI , p...

    2022

  28. [36]

    Dual attention suppression attack: Generate adversarial camouflage in physical world

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In IEEE Conference on Computer Vision and Pattern Recognition , pp.\ 8565--8574, virtual, June 2021

    2021

  29. [37]

    Boosting the transferability of video adversarial examples via temporal translation

    Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu - Gang Jiang. Boosting the transferability of video adversarial examples via temporal translation. In Thirty-Sixth AAAI Conference on Artificial Intelligence , pp.\ 2659--2667. AAAI Press, March 2022

    2022

  30. [38]

    Camopatch: An evolutionary strategy for generating camoflauged adversarial patches

    Phoenix Williams and Ke Li. Camopatch: An evolutionary strategy for generating camoflauged adversarial patches. Advances in Neural Information Processing Systems, 36, 2024

    2024

  31. [39]

    Davis, and Tom Goldstein

    Zuxuan Wu, Ser - Nam Lim, Larry S. Davis, and Tom Goldstein. Making an invisibility cloak: Real world adversarial attacks on object detectors. In Computer Vision - ECCV 2020 - 16th European Conference , volume 12349, pp.\ 1--17, Glasgow, UK, 2020

    2020

  32. [40]

    Adversarial t-shirt! evading person detectors in a physical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin - Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In Computer Vision - ECCV 2020 - 16th European Conference , volume 12350, pp.\ 665--681, Glasgo...

    2020

  33. [41]

    Design of digital camouflage by recursive overlapping of pattern templates

    Feng Xue, Shan Xu, Yue-Tong Luo, and Wei Jia. Design of digital camouflage by recursive overlapping of pattern templates. Neurocomputing, 172: 0 262--270, 2016

    2016

  34. [42]

    Research on digital camouflage pattern generation algorithm based on adversarial autoencoder network

    Xin Yang, Wei-Dong Xu, Qi Jia, and Ling Li. Research on digital camouflage pattern generation algorithm based on adversarial autoencoder network. International Journal of Pattern Recognition and Artificial Intelligence, 34 0 (06): 0 2050017, 2020

    2020

  35. [43]

    Texthoaxer: Budgeted hard-label adversarial attacks on text

    Muchao Ye, Chenglin Miao, Ting Wang, and Fenglong Ma. Texthoaxer: Budgeted hard-label adversarial attacks on text. In Thirty-Sixth AAAI Conference on Artificial Intelligence , pp.\ 3877--3884. AAAI Press, March 2022

    2022

  36. [44]

    Camouflaged image synthesis is all you need to boost camouflaged detection

    Haichao Zhang, Can Qin, Yu Yin, and Yun Fu. Camouflaged image synthesis is all you need to boost camouflaged detection. arXiv preprint arXiv:2308.06701, 2023

    2023

  37. [45]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  38. [46]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  39. [47]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  40. [48]

    0vd -ȅ w޽ v?lO ?(,W H> ޙn'E pyi Y)o 3(vރ _ w nA a bĖ2pB?' wf2Kl0vl3R ᤷ wE1ƶ>p& ) p ( *uD ģ@[+]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.