Physical Adversarial Attacks on AI Surveillance Systems:Detection, Tracking, and Visible--Infrared Evasion
Organizations: College of Computer Studies, De La Salle University, Manila, Philippines
Abstract
Physical adversarial attacks are increasingly studied in settings that resemble deployed surveillance systems rather than isolated image benchmarks. In these settings, person detection, multi-object tracking, visible--infrared sensing, and the practical form of the attack carrier all matter at once. This changes how the literature should be read. A perturbation that suppresses a detector in one frame may have limited practical effect if identity is recovered over time; an RGB-only result may say little about night-time systems that rely on visible and thermal inputs together; and a conspicuous patch can imply a different threat model from a wearable or selectively activated carrier. This paper reviews physical attacks from that surveillance-oriented viewpoint. Rather than attempting a complete catalogue of all physical attacks in computer vision, we focus on the technical questions that become central in surveillance: temporal persistence, sensing modality, carrier realism, and system-level objective. We organize prior work through a four-part taxonomy and discuss how recent results on multi-object tracking, dual-modal visible--infrared evasion, and controllable clothing reflect a broader change in the field. We also summarize evaluation practices and unresolved gaps, including distance robustness, camera-pipeline variation, identity-level metrics, and activation-aware testing. The resulting picture is that surveillance robustness cannot be judged reliably from isolated per-frame benchmarks alone; it has to be examined as a system problem unfolding over time, across sensors, and under realistic physical deployment constraints.
Figures & tables
| Survey or perspective | Year | Primary scope | Surveillance specificity | Tracking emphasis | VI/IR emphasis | Distinctive value relative to this paper |
|---|---|---|---|---|---|---|
| Akhtar and Mian [ 1 ] | 2018 | General adversarial vision survey | Low | Low | Low | Foundational but predates the recent wave of surveillance-focused physical attacks. |
| Akhtar et al . [ 2 ] | 2021 | General attack/defense survey | Low | Low | Low | Broader than our scope and not centered on physical surveillance pipelines. |
| Wang et al . [ 30 ] | 2022 | Physical attacks in computer vision | Medium | Low | Medium | Strong taxonomy of carriers and tasks, but less focused on surveillance operations. |
| Wei et al . [ 32 ] | 2022 | Ten-year review of physical attacks | Medium | Low | Medium | Historical breadth; less emphasis on recent surveillance-specific transitions. |
| Wang et al . [ 31 ] | 2023 | Physical adversarial examples in the real world | Medium | Low | Medium | Covers the physical-world bridge well, but not the surveillance pipeline in depth. |
| Nguyen et al . [ 25 ] | 2023 | Surveillance-focused physical attacks | High | Medium | Medium | Closest in spirit; our paper sharpens the perspective around tracking, VI sensing, and wearability. |
| Task persistence Single-frame object detection Person detection under surveillance Single-object tracking Multi-object tracking and identity maintenance | Sensing modality RGB visible-light cameras Thermal infrared cameras Visible–infrared paired sensing RGB-T and other multi-modal extensions | Physical carrier Printed patch or translucent patch Full texture or adversarial garment Infrared blocks, curves, bulbs, stickers Triggered or thermally activated wearables | Operational objective Missed detection or target hiding False positives or ghost objects Track hijacking and ID switches Cross-modal evasion and on-demand activation |
| Category | Representative works | Common carriers | Core surveillance question |
|---|---|---|---|
| General patch foundations | [ 4 , 3 , 9 , 5 , 20 , 42 , 29 ] | Printed stickers, robust EoT patches, scene-integrated perturbations | How can attacks survive viewpoint change, printing, and detector-specific structure? |
| Person detection under surveillance | [ 28 , 41 , 15 , 27 , 16 , 11 , 34 , 7 , 44 ] | Wearable patches, garments, naturalistic textures, dynamic or triggered patches | How can attacks remain effective across distance, camera pipelines, and human-compatible deployment? |
| Tracking and temporal persistence | [ 37 , 6 , 17 , 8 , 19 , 43 , 26 , 21 ] | Textures, query-based perturbations, trajectory-level manipulations, printable patches | How does attack success accumulate over time through association, memory, and identity maintenance? |
| Thermal and infrared evasion | [ 45 , 46 , 36 , 33 , 47 , 13 , 14 , 48 , 49 ] | Heated bulbs, infrared clothing, learnable IR patches, blocks, curves, stickers | Which carriers can survive thermal imaging constraints and real night-time deployment? |
| Visible–infrared cross-modal attacks | [ 18 , 35 , 22 , 23 ] | Unified VI patch, dual-modal clothing, cross-channel physical designs | What does it take to evade both visible and thermal channels simultaneously? |
| Representative work | Year | Primary task | Sensing modality | Carrier type | Why it mattered for surveillance |
|---|---|---|---|---|---|
| Thys et al . [ 28 ] | 2019 | Person detection | RGB | Wearable adversarial patch | Established physical attacks directly against automated surveillance cameras. |
| Wiyatno and Xu [ 37 ] | 2019 | Visual object tracking | RGB video | Adversarial texture | Showed that temporal objectives in tracking differ from one-frame detector evasion. |
| Wei et al . [ 35 ] | 2023 | Cross-modal detection | Visible–infrared | Unified physical patch | Demonstrated joint visible–infrared attacks in the physical world. |
| Wei et al . [ 33 ] | 2023 | Thermal pedestrian detection | Infrared | Wearable HOTCOLD block | Highlighted practical thermal carriers for human-centered evasion. |
| PapMOT [ 21 ] | 2024 | Multi-object tracking | RGB surveillance video | Printable patch | Brought physical patch attacks to identity association in multi-object tracking. |
| Cdupatch [ 22 ] | 2025 | Dual-modal detection | Visible–infrared | Universal dual-modal patch | Emphasized detector transfer and scene-level universality across two sensing channels. |
| Stage 1 Digital tests Single model Per-frame metrics | Stage 2 Lab physical tests Printed or wearable carrier Short-range views | Stage 3 Operational variation Distance change Camera and ISP shifts | Stage 4 Temporal persistence Tracking and identity metrics Multi-frame success | Stage 5 Multimodal risk Visible + thermal On-demand activation |
Adversarial Attacks
Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.
See all 447 papers