Infrared pedestrian detectors are increasingly deployed in all-weather perception systems, but their robustness against physical adversarial attacks remains insufficiently understood. Existing infrared physical attacks are mostly instance-specific, requiring perturbations to be optimized for particular samples, poses, or scenes, which limits scalability under changing deployment conditions. This paper proposes Universal Physical Patch Attack (UPPA), a universal cold-patch framework for infrared pedestrian detection. UPPA is built on the observation that infrared physical perturbations should exploit smooth, low-frequency thermal structures rather than visible-light texture patterns. It represents the attack carrier as topology-constrained Bézier Curved-Blocks, providing a compact and manufacturable geometric parameterization, and optimizes one shared perturbation with Particle Swarm Optimization (PSO) under Thin Plate Spline (TPS) deformation and Expectation over Transformation (EOT) imaging transformations. The optimized pattern is then deployed as wearable cold patches without sample-specific re-optimization during deployment. Experiments on five infrared datasets and nine pedestrian detectors show consistent digital attack performance, strong cross-dataset and cross-model transferability, and a 92.59% attack success rate in real-world physical experiments. Ablation, visualization, and defense analyses show that Curved-Blocks disrupt pedestrian thermal feature aggregation and remain difficult for image-restoration-style defenses to remove. These results reveal a practical universal physical vulnerability in current infrared pedestrian detection systems and provide a benchmark for robustness evaluation.
Figures & tables
Method
Perturbation
Stealthiness
Scenario
Paradigm
Real-time
BulbAttack Zhu et al. (2021a)
Light bulbs
×
White-box
Instance-specific
×
QRattack Zhu et al. (2022)
Aerogels
×
White-box
Instance-specific
×
AIP Wei et al. (2023b)
Aerogels
×
White-box
Instance-specific
×
AdvCloth Zhu et al. (2023)
Electric heating films
✓
White-box
Instance-specific
×
HCB Wei et al. (2023a)
Hot and cold pastes
✓
Black-box
Instance-specific
×
AdvIB Hu et al. (2024a)
Hot and cold pastes
✓
Black-box
Instance-specific
×
Table 1: Comparison of representative infrared physical attack methods against pedestrian detectors. Stealthiness: human-perceptual concealment without auxiliary infrared sensors; Paradigm: whether the perturbation is optimized for each individual instance or learned once as a universal pattern; Real-time: direct physical deployment of the digitally optimized perturbation without per-input re-optimization.
Figure 1: Infrared physical attack methods against pedestrian detectors. (A) Prior instance-specific methods, including BulbAttack Zhu et al. (2021a) , QRattack Zhu et al. (2022) , AIP Wei et al. (2023b) , AdvCloth Zhu et al. (2023) , HCB Wei et al. (2023a) , AdvIB Hu et al. (2024a) , AdvIC Hu et al. (2024b) , and AdvGrid Tiliwalidi et al. (2025) ; (B) Universal (UPPA, ours).
Figure 2: Overall framework of UPPA. The pipeline consists of three components: digital optimization of topology-constrained Bézier Curved-Blocks using PSO-based black-box optimization, robustness modeling with TPS and EOT transformations, and physical deployment as wearable cold patches.
Figure 3: Topology-constrained optimization of Curved-Blocks.
Figure 4: Experimental devices and physical deployment. (a) Infrared camera, tripod, and cold patch. (b) Visible spectrum image of the clothing. (c) Infrared image of the clothing. (d) Visible spectrum image of a pedestrian. (e) Infrared image of a pedestrian.
Architecture
Target Model
Backbone
Datasets (ASR %) ↑
FLIR v1_3
FLIR v2
LLVIP
MFNet
M3FD
One-Stage
YOLOF Chen et al. (2021)
ResNet-50
86.45
76.19
97.14
93.75
56.83
YOLOv3 Redmon and Farhadi (2018)
DarkNet-53
62.42
47.27
45.45
86.21
35.66
RetinaNet Lin et al. (2017)
ResNet-50
44.30
45.24
50.42
52.90
20.44
YOLOX Ge et al. (2021)
CSPDarknet
42.14
77.16
53.47
87.02
77.85
Two-Stage
Faster R-CNN Ren et al. (2015)
ResNet-50
89.91
94.78
91.49
94.92
83.74
Table 2: Attack Success Rate (ASR) against different detection architectures and backbones across five benchmark datasets. For each detector–dataset setting, UPPA optimizes one universal perturbation over the samples in that setting. The highest ASR for each dataset is highlighted in bold , and the second-highest is underlined . Models are grouped by their base architecture to illustrate relative robustness.
Figure 5: Digital samples generated by UPPA.
Distance (m)
4.8
5.6
6.0
6.6
7.2
7.8
8.4
Number of images
23
31
37
33
37
34
37
ASR (%)
100.00
100.00
100.00
96.77
96.55
87.10
85.29
Table 3: Physical attack results of UPPA at different camera–target distances. The number of images indicates the physical samples collected at each distance, and ASR reports the attack success rate against YOLOv3.
Figure 6: Representative physical samples of UPPA.
Architecture
Model
Source
Target Datasets (ASR %) ↑
FLIR v1_3
FLIR v2
LLVIP
MFNet
M3FD
One-Stage
YOLOF
86.45
65.99 ( -20.46 )
36.63 ( -49.82 )
95.83 ( +9.38 )
43.88 ( -42.57 )
YOLOv3
62.42
43.64 ( -18.78 )
41.41 ( -21.01 )
77.01 ( +14.59 )
34.27 ( -28.15 )
RetinaNet
44.30
42.26 ( -2.04 )
44.54 ( +0.24 )
59.42 ( +15.12 )
17.52 ( -26.78 )
YOLOX
42.14
75.31 ( +33.17 )
94.29 ( +52.15 )
83.97 ( +41.83 )
73.15 ( +31.01 )
Two-Stage
Faster R-CNN
89.91
87.31 ( -2.60 )
86.17 ( -3.74 )
94.92 ( +5.01 )
74.80 ( -15.11 )
Table 4: Cross-dataset transferability (ASR %) of the proposed method. The perturbations are generated on the source dataset (FLIR v1_3, shaded in gray) and evaluated on four unseen target datasets across various model architectures. Parenthesized values below each ASR denote the change relative to the source dataset. The highest transfer ASR in each target dataset is highlighted in bold , and the second-highest is underlined .
Figure 7: Comparison with baseline methods. (a) Dataset-wise ASR when each method is optimized on the corresponding dataset. (b) Cross-dataset transfer ASR when perturbations are generated on FLIR v1_3 (Src.) and evaluated on FLIR v2, LLVIP, MFNet, and M3FD.
Source
Target
YOLOv3
DETR
Mask R-CNN
Faster R-CNN
Libra R-CNN
RetinaNet
YOLOF
YOLOX
Deformable DETR
YOLOv3
62.42%
14.30%
58.76%
60.20%
57.73%
46.24%
63.29%
35.42%
26.25%
DETR
72.22%
20.20%
90.00%
80.00%
85.00%
64.71%
91.67%
57.89%
42.86%
Mask R-CNN
47.06%
12.09%
85.05%
90.11%
71.43%
29.76%
45.21%
30.34%
21.05%
Faster R-CNN
36.56%
10.20%
83.51%
89.91%
64.95%
20.45%
29.27%
31.18%
28.21%
Libra R-CNN
56.32%
12.50%
81.05%
86.32%
75.00%
32.94%
56.58%
36.96%
24.39%
Table 5: Cross-model transferability (ASR %) of UPPA on FLIR v1_3. The first column lists the source models used to generate perturbations, and the remaining columns correspond to target models. Diagonal entries report the original ASR on each source model. In each source row, the two highest transfer ASR values are marked in green and the two lowest transfer ASR values are marked in red, excluding the diagonal entry.
Optimizer
Random
GA
DE
PSO (Ours)
ASR (%)
55.41
54.78
61.78
62.42
Table 6: Attack performance using different optimization methods.
Boundary Formulation
Geometric Continuity
ASR (%)
Linear
Discontinuous
52.23
Polyline
Piecewise continuous
53.50
Catmull-Rom spline
Smooth interpolating spline
59.24
Bézier spline (Ours)
Flexible parametric curve
62.42
Table 7: Ablation study on different boundary formulations for perturbation generation.
Figure 8: Ablation of Curved-Block dimension and width.
Figure 9: Ablation of grayscale level for Curved-Blocks.
Grayscale
0
51
102
153
204
255
ASR (%)
62.42
60.51
53.50
57.96
59.87
51.59
Table 8: Ablation of grayscale intensity for Curved-Blocks. Each grayscale value is applied uniformly to the three image channels in the digital proxy.
Degree
2
3
4
5
6
ASR (%)
62.42
40.56
39.16
46.85
39.86
Table 9: Ablation study on Bézier curve degree.
Figure 10: Visual examples of Bézier curves with different degrees from 2 to 6.
Figure 11: Grad-CAM visualization of the detector under clean and adversarial samples.
No defense
AT-1
AT-2
DW
ASR (%)
86.21
28.16 ( ↓ 58.05)
36.89 ( ↓ 49.32)
66.09 ( ↓ 20.12)
Table 10: Evaluation of adversarial defenses against UPPA on YOLOv3.
School of Information and Communications Engineering, Faculty of Electronic and Information Engineering, Xi’an Jiao-tong University, Xi’an, China · School of Physics, Xi’an Jiao-tong University, Xi’an, China.