Infrared pedestrian detectors are increasingly deployed in all-weather perception systems, but their robustness against physical adversarial attacks remains insufficiently understood. Existing infrared physical attacks are mostly instance-specific, requiring perturbations to be optimized for particular samples, poses, or scenes, which limits scalability under changing deployment conditions. This paper proposes Universal Physical Patch Attack (UPPA), a universal cold-patch framework for infrared pedestrian detection. UPPA is built on the observation that infrared physical perturbations should exploit smooth, low-frequency thermal structures rather than visible-light texture patterns. It represents the attack carrier as topology-constrained Bézier Curved-Blocks, providing a compact and manufacturable geometric parameterization, and optimizes one shared perturbation with Particle Swarm Optimization (PSO) under Thin Plate Spline (TPS) deformation and Expectation over Transformation (EOT) imaging transformations. The optimized pattern is then deployed as wearable cold patches without sample-specific re-optimization during deployment. Experiments on five infrared datasets and nine pedestrian detectors show consistent digital attack performance, strong cross-dataset and cross-model transferability, and a 92.59% attack success rate in real-world physical experiments. Ablation, visualization, and defense analyses show that Curved-Blocks disrupt pedestrian thermal feature aggregation and remain difficult for image-restoration-style defenses to remove. These results reveal a practical universal physical vulnerability in current infrared pedestrian detection systems and provide a benchmark for robustness evaluation.
Figures & tables
Method
Perturbation
Stealthiness
Scenario
Paradigm
Real-time
BulbAttack Zhu et al. (2021a)
Light bulbs
×
White-box
Instance-specific
×
QRattack Zhu et al. (2022)
Aerogels
×
White-box
Instance-specific
×
AIP Wei et al. (2023b)
Aerogels
×
White-box
Instance-specific
×
AdvCloth Zhu et al. (2023)
Electric heating films
✓
White-box
Instance-specific
×
HCB Wei et al. (2023a)
Hot and cold pastes
✓
Black-box
Instance-specific
×
AdvIB Hu et al. (2024a)
Hot and cold pastes
✓
Black-box
Instance-specific
×
Table 1: Comparison of representative infrared physical attack methods against pedestrian detectors. Stealthiness: human-perceptual concealment without auxiliary infrared sensors; Paradigm: whether the perturbation is optimized for each individual instance or learned once as a universal pattern; Real-time: direct physical deployment of the digitally optimized perturbation without per-input re-optimization.
Figure 1: Infrared physical attack methods against pedestrian detectors. (A) Prior instance-specific methods, including BulbAttack Zhu et al. (2021a) , QRattack Zhu et al. (2022) , AIP Wei et al. (2023b) , AdvCloth Zhu et al. (2023) , HCB Wei et al. (2023a) , AdvIB Hu et al. (2024a) , AdvIC Hu et al. (2024b) , and AdvGrid Tiliwalidi et al. (2025) ; (B) Universal (UPPA, ours).
Figure 2: Overall framework of UPPA. The pipeline consists of three components: digital optimization of topology-constrained Bézier Curved-Blocks using PSO-based black-box optimization, robustness modeling with TPS and EOT transformations, and physical deployment as wearable cold patches.
Figure 3: Topology-constrained optimization of Curved-Blocks.
Figure 4: Experimental devices and physical deployment. (a) Infrared camera, tripod, and cold patch. (b) Visible spectrum image of the clothing. (c) Infrared image of the clothing. (d) Visible spectrum image of a pedestrian. (e) Infrared image of a pedestrian.
Architecture
Target Model
Backbone
Datasets (ASR %) ↑
FLIR v1_3
FLIR v2
LLVIP
MFNet
M3FD
One-Stage
YOLOF Chen et al. (2021)
ResNet-50
86.45
76.19
97.14
93.75
56.83
YOLOv3 Redmon and Farhadi (2018)
DarkNet-53
62.42
47.27
45.45
86.21
35.66
RetinaNet Lin et al. (2017)
ResNet-50
44.30
45.24
50.42
52.90
20.44
YOLOX Ge et al. (2021)
CSPDarknet
42.14
77.16
53.47
87.02
77.85
Two-Stage
Faster R-CNN Ren et al. (2015)
ResNet-50
89.91
94.78
91.49
94.92
83.74
Table 2: Attack Success Rate (ASR) against different detection architectures and backbones across five benchmark datasets. For each detector–dataset setting, UPPA optimizes one universal perturbation over the samples in that setting. The highest ASR for each dataset is highlighted in bold , and the second-highest is underlined . Models are grouped by their base architecture to illustrate relative robustness.
Figure 5: Digital samples generated by UPPA.
Distance (m)
4.8
5.6
6.0
6.6
7.2
7.8
8.4
Number of images
23
31
37
33
37
34
37
ASR (%)
100.00
100.00
100.00
96.77
96.55
87.10
85.29
Table 3: Physical attack results of UPPA at different camera–target distances. The number of images indicates the physical samples collected at each distance, and ASR reports the attack success rate against YOLOv3.
Figure 6: Representative physical samples of UPPA.
Architecture
Model
Source
Target Datasets (ASR %) ↑
FLIR v1_3
FLIR v2
LLVIP
MFNet
M3FD
One-Stage
YOLOF
86.45
65.99 ( -20.46 )
36.63 ( -49.82 )
95.83 ( +9.38 )
43.88 ( -42.57 )
YOLOv3
62.42
43.64 ( -18.78 )
41.41 ( -21.01 )
77.01 ( +14.59 )
34.27 ( -28.15 )
RetinaNet
44.30
42.26 ( -2.04 )
44.54 ( +0.24 )
59.42 ( +15.12 )
17.52 ( -26.78 )
YOLOX
42.14
75.31 ( +33.17 )
94.29 ( +52.15 )
83.97 ( +41.83 )
73.15 ( +31.01 )
Two-Stage
Faster R-CNN
89.91
87.31 ( -2.60 )
86.17 ( -3.74 )
94.92 ( +5.01 )
74.80 ( -15.11 )
Table 4: Cross-dataset transferability (ASR %) of the proposed method. The perturbations are generated on the source dataset (FLIR v1_3, shaded in gray) and evaluated on four unseen target datasets across various model architectures. Parenthesized values below each ASR denote the change relative to the source dataset. The highest transfer ASR in each target dataset is highlighted in bold , and the second-highest is underlined .
Figure 7: Comparison with baseline methods. (a) Dataset-wise ASR when each method is optimized on the corresponding dataset. (b) Cross-dataset transfer ASR when perturbations are generated on FLIR v1_3 (Src.) and evaluated on FLIR v2, LLVIP, MFNet, and M3FD.
Source
Target
YOLOv3
DETR
Mask R-CNN
Faster R-CNN
Libra R-CNN
RetinaNet
YOLOF
YOLOX
Deformable DETR
YOLOv3
62.42%
14.30%
58.76%
60.20%
57.73%
46.24%
63.29%
35.42%
26.25%
DETR
72.22%
20.20%
90.00%
80.00%
85.00%
64.71%
91.67%
57.89%
42.86%
Mask R-CNN
47.06%
12.09%
85.05%
90.11%
71.43%
29.76%
45.21%
30.34%
21.05%
Faster R-CNN
36.56%
10.20%
83.51%
89.91%
64.95%
20.45%
29.27%
31.18%
28.21%
Libra R-CNN
56.32%
12.50%
81.05%
86.32%
75.00%
32.94%
56.58%
36.96%
24.39%
Table 5: Cross-model transferability (ASR %) of UPPA on FLIR v1_3. The first column lists the source models used to generate perturbations, and the remaining columns correspond to target models. Diagonal entries report the original ASR on each source model. In each source row, the two highest transfer ASR values are marked in green and the two lowest transfer ASR values are marked in red, excluding the diagonal entry.
Optimizer
Random
GA
DE
PSO (Ours)
ASR (%)
55.41
54.78
61.78
62.42
Table 6: Attack performance using different optimization methods.
Boundary Formulation
Geometric Continuity
ASR (%)
Linear
Discontinuous
52.23
Polyline
Piecewise continuous
53.50
Catmull-Rom spline
Smooth interpolating spline
59.24
Bézier spline (Ours)
Flexible parametric curve
62.42
Table 7: Ablation study on different boundary formulations for perturbation generation.
Figure 8: Ablation of Curved-Block dimension and width.
Figure 9: Ablation of grayscale level for Curved-Blocks.
Grayscale
0
51
102
153
204
255
ASR (%)
62.42
60.51
53.50
57.96
59.87
51.59
Table 8: Ablation of grayscale intensity for Curved-Blocks. Each grayscale value is applied uniformly to the three image channels in the digital proxy.
Degree
2
3
4
5
6
ASR (%)
62.42
40.56
39.16
46.85
39.86
Table 9: Ablation study on Bézier curve degree.
Figure 10: Visual examples of Bézier curves with different degrees from 2 to 6.
Figure 11: Grad-CAM visualization of the detector under clean and adversarial samples.
No defense
AT-1
AT-2
DW
ASR (%)
86.21
28.16 ( ↓ 58.05)
36.89 ( ↓ 49.32)
66.09 ( ↓ 20.12)
Table 10: Evaluation of adversarial defenses against UPPA on YOLOv3.
Deep learning-based visual-infrared fused face detection models are increasingly deployed across a wide range of applications, yet they remain susceptible to adversarial patch attacks. Most prior attacks target either the visual or the infrared image alone in the digital domain, which renders them ineffective against fused models in the physical world. Moreover, many of these methods are readily noticeable, as their patch patterns deviate substantially from those seen in the real world. In this paper, we introduce VIPatch (Visual-Infrared Patch), a novel physical adversarial patch attack that produces inconspicuous, realistic, and natural-looking patches for facial images. Specifically, VIPatch crafts a gradient-color mask together with a band-aid sticker across both the visual and infrared images, and jointly optimizes these two elements; the resulting digital patches further guide the fabrication of their physical counterparts. Experimental results show that VIPatch achieves competitive attack success rates (over 90%) in both the digital and physical domains, while keeping the patches unobtrusive to human observers.
Qiucheng Yu, Tao Ni, Yihe Zhou +2
City University of Hong Kong · King Abdullah University of Science and Technology (KAUST)
Infrared object detection is crucial for perception in autonomous driving and surveillance but remains vulnerable to physical adversarial attacks. Unlike in the RGB domain, where attacks rely on color texture, infrared attacks must manipulate thermal signatures, making the geometry shape of heat-blocking materials the primary adversarial information carrier. Current shape-based methods suffer from a fundamental trade-off between representational capability and optimization power, limiting their attack effectiveness.In this work, we overcome this dilemma by introducing learnable Fourier shapes to the infrared domain. We utilize an end-to-end differentiable framework where a compact set of Fourier coefficients, defining the shape boundary, is analytically mapped to a pixel-space mask via the winding number theorem. This enables efficient gradient-based optimization to generate potent shapes that cause human targets to evade detection. Extensive digital and physical experiments provide a comprehensive evaluation and validate our superior performance. Our resulting physical patch achieves striking robustness, successfully evading detectors across diverse distances, angles, poses, and individuals, and achieves over 88% attack success rate at distances greater than 25m (conf.=0.5). Code is available at https://github.com/Yongyx99/Fourier-shape-attack.
Yixing Yong, Jian Wang, Ming Lei +2
School of Information and Communications Engineering, Faculty of Electronic and Information Engineering, Xi’an Jiao-tong University, Xi’an, China · School of Physics, Xi’an Jiao-tong University, Xi’an, China.
Physical adversarial patch attacks critically threaten pedestrian detection, causing surveillance and autonomous driving systems to miss pedestrians and creating severe safety risks. Despite their effectiveness in controlled settings, existing physical attacks face two major limitations in practice: they lack systematic disruption of the multi-stage decision pipeline, enabling residual modules to offset perturbations, and they fail to model complex physical variations, leading to poor robustness. To overcome these limitations, we propose a novel pedestrian adversarial patch generation method that combines multi-stage collaborative attacks with robustness enhancement under physical diversity, called TriPatch. Specifically, we design a triplet loss consisting of detection confidence suppression, bounding-box offset amplification, and non-maximum suppression (NMS) disruption, which jointly act across different stages of the detection pipeline. In addition, we introduce an appearance consistency loss to constrain the color distribution of the patch, thereby improving its adaptability under diverse imaging conditions, and incorporate data augmentation to further enhance robustness against complex physical perturbations. Extensive experiments demonstrate that TriPatch achieves a higher attack success rate across multiple detector models compared to existing approaches.
Shihui Yan, Ziqi Zhou, Yufei Song +3
Huazhong University of Science and Technology China