REVIEW 4 major objections 4 minor 27 references
Texture- and Shape-based Adversarial Attacks for Overhead Image Vehicle Detection
T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read Combining practical texture limits — low resolution, a few fixed colors, masked areas — with a small learned 3D shape change hides vehicles from overhead detectors nearly as well as unrestricted texture attacks, at a small fraction of the…
desk verdict A solid, honestly scoped empirical study of practical texture/shape camouflage for overhead vehicle detection, but the headline EASR numbers need variance bars and a cleaner evaluation split before the 'approaches unconstrained' claim is trusted quantitatively. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central mechanism is the paper's fully differentiable adversarial-mesh pipeline: a universal texture map and a universal $64\times64$ displacement map, both optimized through a differentiable renderer against a weighted ensemble loss over three detector architectures. The texture map is kept as a $32\times32\times3$ latent tensor and upscaled by nearest-neighbor interpolation, which is what enforces the blocky $16\times16$-pixel resolution; the fixed-color variant stores per-pixel probabilities over a small palette and sharpens them with a double softmax so each pixel settles on a single allowed color. The shape perturbation displaces each vertex by $\Delta V_i = \mathrm{PM}\cdot W\cdot\sigma(R_i D_i)$, radiating outward from the mesh center with bilateral symmetry enforced and total deformation clamped by the perturbation magnitude PM. This displacement map is the load-bearing element: at $\mathrm{PM}=0.2$ it restores most of the attack success that texture constraints remove, which is the paper's justification for the combined-attack recipe.
What would settle it
Physically apply the combined attack to a real vehicle — the five-color blocky texture plus a 20%-of-width shape add-on — photograph it from a UAV at about 12.5 cm per pixel over varied terrain, and measure EASR against detectors trained on real aerial data; the central claim collapses if the deployed mesh's success rate falls toward the random-camouflage baseline (3.16% on PT3D) or if the gap to the unconstrained texture attack grows far beyond the single-digit margin seen in simulation.
Extended reading notes
Core claim
On the paper's own terms, the central claim is that constrained, practical attacks need not stay far behind idealized ones. The load-bearing result is a specific adversarial object: a universal mesh whose texture is stored as a $32\times32\times3$ latent map, upscaled to $512\times512$ to form $16\times16$-pixel blocks, and limited to five colors fixed in advance by clustering the background imagery, while its shape is displaced outward by a learned map scaled to a perturbation magnitude of $\mathrm{PM}=0.2$ (20% of vehicle width). Tested against an ensemble of three detector architectures, this mesh achieves 86.83% effective attack success rate (EASR) on the PT3D test set and 75.76% on a separately physics-rendered test set, within a few points of the unconstrained texture attack on the first set and above it on the second (95.77% and 70.02%). The paper draws two conclusions: there is an inverse relationship between practicality and attack performance, and combining constrained texture with a small shape budget is noticeably more efficient than shape modification alone, because the texture carries most of the adversarial load while the shape modification buys back what the texture constraints remove.
Load-bearing premise
The load-bearing premise is that detectors trained on synthetically rendered vehicles, blurred with a Gaussian kernel of $\sigma=2.4$ to mimic real aerial imagery, rank attack effectiveness the same way real aerial vehicle detectors would; the paper evaluates attacks only on synthetic test sets and itself acknowledges a real-to-synthetic distribution gap.
Editorial extensions
If this is right
- The paper's results imply a nearby physical threat model: a vehicle painted or wrapped with a blocky few-color pattern and fitted with small add-on bulges could evade overhead detectors at roughly 75–87% effective attack success, approaching an idealized unrestricted texture attack.
- Practicality and effectiveness trade off predictably: in the paper's scoring (production cost, difficulty of installation and operation), the most practical texture-only camouflage scores highest but drops to 12.70% EASR on PT3D, while the least practical unconstrained texture reaches 95.77%.
- A small shape budget goes a long way when combined with constrained texture: the combined attack reaches 86.83% EASR at PM=0.2, whereas shape-only attacks need PM=0.4 to reach 89.82%, so the texture carries most of the adversarial load while the shape perturbation recovers the loss at half the deformation cost.
- Random patterns are not a substitute for optimization: random camouflages achieve as little as 3.16% EASR on PT3D, so the constrained attacks' effectiveness comes from the optimization procedure, not from the constraints themselves.
- Sequential and parallel optimization of texture and shape land within a few EASR points of each other (86.83% versus 89.34% on PT3D), so an attacker can freeze one modality while optimizing the other without forfeiting much.
Reading between the lines
- An implication the paper leaves implicit is that its documented color-saturation effect — unconstrained optimizers crowd colors at the edges of the RGB cube, while weather augmentation during optimization pushes pixels inward — could be turned into a cheap 'printability' regularizer for unconstrained attacks, steering the optimizer back inside the color gamut without imposing explicit color limits
- The near-recovery of performance at PM=0.2 hints at an empirical budget-transfer rule: the cheapest practical texture constraint costs a predictable amount of effectiveness, and the smallest shape deformation buys most of it back; if this holds across object classes and sensor altitudes, attack design becomes a two-step search rather than a joint optimization.
- A testable extension the paper does not run is a true end-to-end physical validation — printing the five-color blocky texture, attaching the small shape add-ons to a real car, and imaging it from a drone; the paper's supplement only runs real-data-trained detectors on synthetic renders, so physical deployment could confirm or overturn its EASR ranking.
- Because shape-only attacks need PM=0.4 while combined attacks reach comparable success at PM=0.2, a fine-grained sweep of PM between 0.1 and 0.4 would locate where the texture-shape synergy saturates; the current experiments sample only a few points on that curve.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies adversarial attacks on vehicle detectors in overhead imagery, with a focus on real-world practicality. It introduces constraints on adversarial texture (pixelation, spatial masking, limited color palette) and shape (symmetry and perturbation magnitude), and evaluates texture-only, shape-only, and combined attacks against an ensemble of RetinaNet, Faster R-CNN, and YOLOv5 detectors trained on synthetic PyTorch3D-rendered data. Effectiveness is measured by EASR on PyTorch3D and Blender test sets, and practicality is scored according to production cost, installation difficulty, and operational difficulty. The central claim is that there is an inverse relationship between practicality and attack performance, and that combined constrained-texture plus small-shape attacks approach the performance of unconstrained texture attacks.
Significance. If the results are robust, the paper provides a useful systematic exploration of practical constraints for physical adversarial camouflage in aerial vehicle detection, which is relatively underexplored. The release of code and data is a notable strength, as is the use of two renderers (PT3D and Blender) to test generalization. The study is also careful to introduce a conservative metric (EASR) that penalizes newly introduced false positives. However, the headline conclusions currently rest on single-run evaluations on synthetic detectors and involve circular selection of the perturbation magnitude, and one Blender result appears to contradict the stated inverse relationship; these issues require additional evidence or tempering before the claims can be fully accepted.
major comments (4)
- [Table 2 and §5.4–5.5] Table 2 reports a single EASR value for each attack configuration without variance, number of runs, or seeds. Because the adversarial optimization is stochastic (e.g., random initialization of the texture tensor in §S4.2 and random mesh/background sampling per iteration), EASR can vary across optimization seeds. The key comparisons for the paper's headline claim—C-PixFc (seq.) at 86.83% versus T-U at 95.77% on PT3D, and 75.76% versus 70.02% on Blender—are presented without any indication of this variance. Please report at least three seeds with mean and standard deviation for the main comparisons, or explicitly state that only one seed was used and interpret the results accordingly.
- [§5.5 (PM* selection) and Table 2] The optimal perturbation magnitudes PM* are selected by maximizing P1, the harmonic mean of EASR and Pr, computed on the PT3D evaluation set, and the same set is used to report the headline EASR in Table 2. This makes the reported EASR for the combined attacks partly circular: PM* is chosen to maximize the reported metric on the test set. The paper should use a separate validation split to select PM* and then report EASR on a held-out test set, or show that the EASR is insensitive to PM in the vicinity of the selected value.
- [§5.3 and §S5.4 (transferability to real detectors)] The main results are obtained exclusively with detectors trained on synthetic PT3D data (with Gaussian blur σ=2.4), which achieve only 49–64% AP on real LINZ imagery while real-data-trained models achieve 80–96% AP (Table S1). The supplementary material (S5.4) evaluates real-data-trained models on Blender-rendered adversarial data, but the headline EASR table and all attack-parameter selections use synthetic models only. Since adversarial susceptibility is detector- and domain-dependent, it is not yet established that the central comparison—C-PixFc approaching T-U—holds for detectors trained on real aerial imagery. The authors should either add the real-model EASR values to the main text and use them to verify the ranking, or explicitly restrict the claim to synthetic detectors and rephrase the conclusion accordingly.
- [Table 2 and §4/Conclusion (inverse relationship)] On the Blender test set, the combined constrained attacks C-PixFc (seq.) and C-PixFc (par.) achieve 75.76% and 77.86% EASR respectively, both higher than T-U's 70.02%. Since Table S4 assigns C-PixFc a higher practicality score (−2) than T-U (−3), this outcome directly contradicts the paper's stated inverse relationship between practicality and performance (§4, Conclusion). The paper does not discuss this discrepancy. The authors should address it explicitly, for example by analyzing whether the Blender rendering pipeline responds differently to the constrained texture or by explaining why the trade-off relationship does not hold in this setting.
minor comments (4)
- [Notation throughout] The attack abbreviations are inconsistent: the main text uses T-U, T-Pix, etc., while Table S2 in the supplement uses A-U, A-Pix, etc.; please unify the notation.
- [Table 2 and §5.6] Table 2 omits rows for C-U, C-Pix, C-Lc, and C-PixLc even though Section 5.6 refers to six sequential combined attacks; please add these rows or explain in the caption that they coincide with their texture-only counterparts when PM*=0.
- [Section 4] The sentence about 'randomly generated camouflages (Table 2) show performance reduction that may not be justified without optimization' is ambiguous, since random textures have lower EASR (i.e., lower attack success), not higher detector performance; please rephrase to clarify the intended comparison.
- [Table 1 and Table S4] The practicality scores are presented as integers aggregated from +/0/− ratings; please state explicitly that these are ordinal scores and that the aggregation into a total score is a modeling choice, not an empirical measurement.
Circularity Check
No significant circularity: the trade-off claims rest on independently measured EASR in two renderers, and the PM* selection by the paper's P1 metric is a model-selection step rather than a construction that forces the result.
full rationale
The paper is an empirical study: each attack configuration is optimized on PyTorch3D-rendered data, evaluated with EASR on matched PT3D and Blender test sets, and practicality is assigned through the authors' qualitative PC/DI/DO criteria. The closest candidate for circularity is Section 5.5, where the perturbation magnitude PM* is selected by maximizing the paper-defined harmonic mean P1 = 2*EASR*Pr/(EASR+Pr) with Pr = 1-PM, and Section 5.6 reuses this procedure for combined attacks. This is a test-set model-selection rule, not a construction that forces the reported EASR values: EASR is measured after the choice, and the Blender evaluation, which was not used for selection, independently reproduces the trade-off and the combined-attack result (e.g., C-PixFc seq. 75.76% vs T-U Blender 70.02%). The practicality scores in Table 1 are qualitative author assignments, but the inverse performance-practicality relationship is established by measured EASR differences, not by those assignments. No load-bearing step reduces to its inputs by equation, and no cited result is load-bearing via author self-citation; prior works are used for method components, not to justify the headline comparison. The in-scope limitation about synthetic-to-real transfer (Section 5.3 and Table S1) and the Blender inversion of the shape-only comparison (S-O 78.86% vs T-U 70.02% on Blender) are correctness or external-validity concerns, not circularity. Therefore the finding is no significant circularity.
Assumptions & free parameters
free parameters (5)
- Blur level sigma =
2.4
- Perturbation magnitude PM* per attack =
0.4 (S-O), 0.2 (C-Fc, C-PixFc)
- Five fixed colors for Fc =
K-means cluster centers of background pixels
- Loss coefficients lambda_i per attack =
Various, e.g., 0.020, 10.000, 10.000 for A-U (Table S2)
- Pixelation block size =
16x16 px (32x32 latent)
assumptions (5)
- domain assumption T3GAN-based mesh generator produces a representative distribution of vehicle meshes
- domain assumption PyTorch3D differentiable rendering is a valid proxy for attack optimization
- domain assumption Synthetic models trained on PT3D data with blur sigma=2.4 are representative of real detectors for ranking attack effectiveness
- domain assumption The qualitative practicality ratings (PC, DI, DO) assigned in Table 1 and Table S4 are valid without user studies or physical prototyping
- ad hoc to paper Pr = 1 - PM is a correct encoding of shape-attack practicality
Cite this review
Pith. "Pith review of Texture- and Shape-based Adversarial Attacks for Overhead Image Vehicle Detection." pith.science (2026). https://pith.science/paper/T2POATDQ
@misc{pith2026241216358,
author = {Pith},
title = {Pith review of: Texture- and Shape-based Adversarial Attacks for Overhead Image Vehicle Detection},
year = {2026},
howpublished = {\url{https://pith.science/paper/T2POATDQ}},
note = {Machine review of arXiv:2412.16358}
}
read the original abstract
Detecting vehicles in aerial images is difficult due to complex backgrounds, small object sizes, shadows, and occlusions. Although recent deep learning advancements have improved object detection, these models remain susceptible to adversarial attacks (AAs), challenging their reliability. Traditional AA strategies often ignore practical implementation constraints. Our work proposes realistic and practical constraints on texture (lowering resolution, limiting modified areas, and color ranges) and analyzes the impact of shape modifications on attack performance. We conducted extensive experiments with three object detector architectures, demonstrating the performance-practicality trade-off: more practical modifications tend to be less effective, and vice versa. We release both code and data to support reproducibility at https://github.com/humansensinglab/texture-shape-adversarial-attacks.
Reference graph
Works this paper leans on
-
[1]
INTRODUCTION Robust object detection in aerial and satellite images is vi- tal for automating critical tasks such as traffic management, urban planning, and disaster response. State-of-the-art detec- tors, such as YOLO [1] and RetinaNet [2], which are based on deep neural networks (DNN), have become foundational in this domain. However, recent studies suc...
-
[2]
Szegedyet al.[3] introduced AAs to expose vulnerabilities in deep learning models
RELATED WORK Adversarial attacks (AAs) have become central to computer vision research. Szegedyet al.[3] introduced AAs to expose vulnerabilities in deep learning models. Research has since focused on generating adversarial examples and divided AAs into digital and physical categories [5]. Digital AAs modify image pixels imperceptibly [6], while physical ...
-
[3]
Texture- and Shape-based Adversarial Attacks for Overhead Image Vehicle Detection
have revealed that DNNs can be susceptible to adversarial examples. Given the importance of these applications, under- standing this vulnerability is crucial, especially in object de- tection in Remote Sensing Imagery (RSI). Furthermore, there are scenarios where utilizing AAs to impede vehicle detec- tion by computer vision systems in overhead images cou...
work page Pith review arXiv 2025
-
[4]
METHOD 3.1. PyTorch3D Data Generation PyTorch3D (PT3D) data is generated using PyTorch3D [13] with 3D vehicle meshes from a GAN-based generator. We adapt and retrain the Textured 3D GAN (T3GAN) [14] to en- able semantic segmentation map sampling, producing a set of meshesM. Using GMaps backgroundsI GMaps bg and vehi- cle meshesM, the differentiable render...
-
[5]
Given the high effec- tiveness of unconstrained AAs, there is limited room for im- provement
PRACTICALITY AND COMPARISONS Our focus is not on enhancing AAs performance but explor- ing the impact of realistic constraints. Given the high effec- tiveness of unconstrained AAs, there is limited room for im- provement. We evaluate our work based on three qualitative criteria:production cost(PC),difficulty of installation(DI), anddifficulty of operation...
-
[6]
We also study the performance-practicality trade-off when imple- menting adversarial camouflages
CONCLUSION This study outlines a methodology for developing effective camouflage strategies to conceal vehicles in RSI. We also study the performance-practicality trade-off when imple- menting adversarial camouflages. While our findings could be misused, it is vital for the research community to be aware of the vulnerabilities in current models that we hi...
-
[7]
EXPERIMENTS AND RESULTS While Section 4 qualitatively compares practicality — con- sidering production cost, installation, and operational com- plexity — this section provides a quantitative evaluation of effectiveness under different adversarial attack scenarios. 0.5 0.6 0.7 0.8 0.9 1.0 (Pr) 0% 20% 40% 60% 80% 100% EASR C-U C-Pix C-Lc C-Fc (seq.) S-O C-P...
work page 2012
-
[8]
Adversarial Examples in the Physical World,
Alexey Kurakin, Ian Goodfellow, Samy Bengio, et al., “Adversarial Examples in the Physical World,” 2016. 2
work page 2016
Show all 27 references
-
[9]
YOLOv5 by Ultralytics,
Glenn Jocher, “YOLOv5 by Ultralytics,” May 2020. 1, 5
2020
-
[10]
Focal Loss for Dense Object Detection,
Lin, Tsung-Yi and Goyal, Priya and Girshick, Ross and He, Kaiming and Dollar, Piotr, “Focal Loss for Dense Object Detection,” inProceedings of the IEEE Inter- national Conference on Computer Vision (ICCV), Oct
-
[11]
More details on score as- signment are in Section S6 in the Supplementary Material
(ON) and EVD4UA V [16] achieve similar practicality scores, but their patches are too small for effective use in aerial imagery at our resolution. More details on score as- signment are in Section S6 in the Supplementary Material. Results from Tables 1 to 2 highlight the trade...
-
[12]
Intriguing properties of neural networks,
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013. 1, 2
2013 arXiv
-
[13]
ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Uni- versal and Robust Vehicle Evasion,
Suryanto, Naufal and Kim, Yongsu and Larasati, Ha- rashta Tatimma and Kang, Hyoeun and Le, Thi-Thu- Huong and Hong, Yoonyoung and Yang, Hunmin and Oh, Se-Yoon and Kim, Howon, “ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Uni- versal and Robust Vehicle Evasion...
2023
-
[14]
Ad- versarial Attacks on Aerial Imagery : The State-of-the- Art and Perspective,
Syed M. Kazam Abbas Kazmi, Nayyer Aafaq, Man- soor Ahmad Khan, Ammar Saleem, and Zahid Ali, “Ad- versarial Attacks on Aerial Imagery : The State-of-the- Art and Perspective,” in2023 3rd International Confer- ence on Artificial Intelligence (ICAI), 2023, pp. 95–102. 2
2023
-
[15]
Ad- versarial Attacks against a Satellite-borne Multispectral Cloud Detector,
Andrew Du, Yee Wei Law, Michele Sasdelli, Bo Chen, Ken Clarke, Michael Brown, and Tat-Jun Chin, “Ad- versarial Attacks against a Satellite-borne Multispectral Cloud Detector,” in2022 International Conference on Digital Image Computing: Techniques and Applications (DICTA), 2022...
2022
-
[16]
Robust Physical- World Attacks on Deep Learning Visual Classification,
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Ta- dayoshi Kohno, and Dawn Song, “Robust Physical- World Attacks on Deep Learning Visual Classification,” inProceedings of the IEEE Conference on Computer Vi- sion and Pattern Re...
2018
-
[17]
D3AdvM: A direct 3D adversarial sample attack inside mesh data,
Huangxinxin Xu, Fazhi He, Linkun Fan, and Junwei Bai, “D3AdvM: A direct 3D adversarial sample attack inside mesh data,”Computer Aided Geometric Design, vol. 97, pp. 102122, 2022. 2
2022
-
[18]
ShapeAdv: Generating Shape- Aware Adversarial 3D Point Clouds,
Kibok Lee, Zhuoyuan Chen, Xinchen Yan, Raquel Urta- sun, and Ersin Yumer, “ShapeAdv: Generating Shape- Aware Adversarial 3D Point Clouds,”arXiv preprint arXiv:2005.11626, 2020. 2
2005 arXiv
-
[19]
Physical Adversarial Attacks on an Aerial Imagery Object Detector,
Andrew Du, Bo Chen, Tat-Jun Chin, Yee Wei Law, Michele Sasdelli, Ramesh Rajasegaran, and Dillon Campbell, “Physical Adversarial Attacks on an Aerial Imagery Object Detector,” inProceedings of the IEEE/CVF Winter Conference on Applications of Com- puter Vision (WACV), January 2...
2022
-
[20]
TPH-YOLOv5: Improved YOLOv5 Based on Trans- former Prediction Head for Object Detection on Drone- captured Scenarios,
Xingkui Zhu, Shuchang Lyu, Xu Wang, and Qi Zhao, “TPH-YOLOv5: Improved YOLOv5 Based on Trans- former Prediction Head for Object Detection on Drone- captured Scenarios,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 2778–2788. 2
2021
-
[21]
Accelerating 3D Deep Learning with Py- Torch3D,
Nikhila Ravi, Jeremy Reizenstein, David Novotny, Tay- lor Gordon, Wan-Yen Lo, Justin Johnson, and Georgia Gkioxari, “Accelerating 3D Deep Learning with Py- Torch3D,”arXiv:2007.08501, 2020. 2, 4
2007 arXiv
-
[22]
Learning Generative Models of Textured 3D Meshes From Real-World Images,
Dario Pavllo, Jonas Kohler, Thomas Hofmann, and Au- relien Lucchi, “Learning Generative Models of Textured 3D Meshes From Real-World Images,” inProceedings of the IEEE/CVF International Conference on Com- puter Vision (ICCV), October 2021, pp. 13879–13889. 2
2021
-
[23]
DTA: Physical Camou- flage Attacks Using Differentiable Transformation Net- work,
Suryanto, Naufal and Kim, Yongsu and Kang, Hyoeun and Larasati, Harashta Tatimma and Yun, Youngyeo and Le, Thi-Thu-Huong and Yang, Hunmin and Oh, Se-Yoon and Kim, Howon, “DTA: Physical Camou- flage Attacks Using Differentiable Transformation Net- work,” inProceedings of the IE...
2022
-
[24]
Evd4uav: An altitude-sensitive benchmark to evade vehicle detection in uav,
Huiming Sun, Jiacheng Guo, Zibo Meng, Tianyun Zhang, Jianwu Fang, Yuewei Lin, and Hongkai Yu, “Evd4uav: An altitude-sensitive benchmark to evade vehicle detection in uav,”arXiv preprint arXiv:2403.05422, 2024. 4
2024 arXiv
-
[25]
Inpaint Anything: Segment Anything Meets Image Inpainting,
Tao Yu, Runseng Feng, Ruoyu Feng, Jinming Liu, Xin Jin, Wenjun Zeng, and Zhibo Chen, “Inpaint Anything: Segment Anything Meets Image Inpainting,”arXiv preprint arXiv:2304.06790, 2023. 4
2023 arXiv
-
[26]
Blender Cycles,
“Blender Cycles,”https://docs.blender. org/manual/en/latest/render/cycles/ index.html, Accessed: 2024-03-06. 4
2024
-
[27]
Faster R-CNN: Towards Real-Time Object De- tection with Region Proposal Networks,
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun, “Faster R-CNN: Towards Real-Time Object De- tection with Region Proposal Networks,” inAdvances in Neural Information Processing Systems, C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett, Eds. 2015, vol. 28, Curr...
2015
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.