Organizations: Beijing University of Technology · Peking University · National Key Laboratory of Space Integrated Information System, Institute of Software, Chinese Academy of Sciences · Intelligent Science & Technology Academy of CASIC
Visible-infrared object detectors are used for robust perception under challenging illumination and weather conditions. Current physical attacks apply conspicuous patches to spatially aligned target regions, which are noticeable to human observers. Meanwhile, most of these methods only perturb the appearance within the aligned region, without explicitly targeting the correspondence between modalities or the fusion process. In this paper, we propose CamoShift, an adversarial framework for visible-infrared object detection. By combining visual camouflage with object-level infrared shifting, CamoShift breaks cross-modal spatial alignment and disrupts fusion. Specifically, the Semantic Camouflage Module (SCM) generates a stealthy camouflaged patch that can be attached to the host object and maintains its effectiveness in the infrared branch through an RGB-IR adapter. The Object-level Spatial Decoupling Module (OSDM) shifts the infrared target evidence in a scale-aware manner, so as to break object-level correspondence and disrupt cross-modal fusion. Then, the Harmonic Adversarial loss (HarAdv loss) further balances attack strength and visual stealth during optimization. To the best of our knowledge, we are the first to target both visual stealthiness and attack success in visible-infrared object detection. Extensive experimental results show that CamoShift achieves a superior balance between attack effectiveness and visual stealth. Code and models will be available on GitHub.
Figures & tables
Figure 1: Comparison of adversarial attacks on cross-modal detectors. (a) Single-modal attacks manipulate only visible textures, inherently failing in the infrared domain. (b) Cross-modal adversarial attacks rely on conspicuous artificial patterns and strictly maintain object-level spatial alignment, failing to disrupt the fusion mechanism. (c) Our framework achieves both visual stealthiness and high attack success. It combines semantic camouflage with object-level spatial decoupling to break cross-modal alignment, successfully misleading the detector.
Figure 2: Performance comparison of visual stealthiness and attack success on the DroneVehicle dataset.
Figure 3: Overview of our CamoShift framework. SCM generates a visually stealthy patch and its valid infrared counterpart via an RGB-IR adapter. Concurrently, OSDM utilizes an FPN to compute a spatial offset for the infrared target, using inpainting and recomposition to break cross-modal spatial alignment. Finally, a harmonic adversarial loss is introduced to dynamically balance the attack effectiveness and visual stealthiness during optimization.
DroneVehicle [ 26 ]
M3FD [ 19 ]
LLVIP [ 11 ]
VEDAI [ 22 ]
Method
YOLOv8
C2Former
COMO
YOLOv8
C2Former
COMO
YOLOv8
C2Former
COMO
YOLOv8
C2Former
COMO
Clean
84.09
91.03
88.14
77.02
70.37
85.78
92.47
89.23
92.80
88.86
84.63
86.27
RandomPatch † [ 1 ]
4.76/80.07
5.39/87.66
3.28/85.30
2.02/76.53
2.21/68.54
2.88/84.71
4.02/90.76
3.76/87.20
7.22/90.51
17.56/79.56
13.36/78.18
9.38/74.27
DPatch † [ 20 ]
5.29/80.62
5.85/86.63
5.34/84.52
8.04/75.59
8.12/68.62
7.77/84.55
9.33/90.35
9.51/86.51
9.42/90.77
25.78/67.27
24.05/66.23
28.39/59.73
stAdv † [ 38 ]
46.92/65.98
27.85/83.91
29.82/75.99
44.09/56.70
46.14/47.97
34.55/70.43
25.85/80.97
18.03/75.87
10.65/89.79
54.44/59.32
55.95/53.55
55.40/59.63
AdvCam † [ 4 ]
43.39/70.23
60.15/70.05
53.74/67.22
61.02/46.39
38.92/53.11
41.23/64.23
29.67/79.75
15.68/77.23
32.70/80.35
40.67/75.88
30.92/71.91
56.40/73.99
Table 1: Overall comparison on four visible-infrared datasets. The Clean row reports mAP 50 (%). All attack rows report Strict-ASR (%) / post-attack mAP 50 (%). Methods marked with † are single-modal attacks adapted to the visible-infrared setting.
Figure 4: Qualitative results of CamoShift against the COMO detector. To better visualize the attack effects, visible-light images are utilized as the base for daylight scenarios, whereas shifted infrared images are employed for dark environments.
IR-Ada
Camo
Spat
HarAdv
Strict-ASR ↑
SSIM ↑
32.3
0.972
✓
53.1
0.892
✓
✓
44.2
0.937
✓
✓
✓
60.2
0.923
✓
✓
✓
✓
64.2
0.975
Table 2: Ablation study. Strict-ASR is reported in percent. IR-Ada denotes the RGB-IR adapter; Camo, semantic camouflage; Spat, OSDM; and HarAdv, the harmonic adversarial loss.
Method
SSIM ↑
LPIPS ↓
HOTCOLD [ 33 ]
0.8855
0.1484
DPatch [ 20 ]
0.9303
0.0724
UNIPatch [ 36 ]
0.9390
0.0921
CDUPatch [ 21 ]
0.9464
0.0920
AdvCam [ 4 ]
0.9476
0.0938
YOLOPatch [ 28 ]
0.9483
0.0808
Table 3: Stealthiness comparison on DroneVehicle using COMO. SSIM and LPIPS compare the patched and original regions.
Figure 5: Qualitative results of CDUPatch and our CamoShift across diverse environments.
Style
Strict-ASR ↑
mAP 50 ↓
SSIM ↑
LPIPS ↓
Rust texture
66.21
22.57
0.9738
0.0602
Dried mud
65.42
22.62
0.9735
0.0592
Urban camo
65.28
22.51
0.9732
0.0603
Floral pattern
66.19
22.56
0.9734
0.0610
Table 4: Effect of different camouflage styles on COMO. Strict-ASR and mAP 50 are reported in percent.
Source model
YOLOv8 [ 12 ]
C2Former [ 42 ]
COMO [ 17 ]
YOLOv8 [ 12 ]
88.86
90.61
59.26
C2Former [ 42 ]
82.78
91.26
63.95
COMO [ 17 ]
78.44
86.96
64.23
Table 5: Evaluation of cross-model adversarial transferability. Rows denote source models and columns denote target models. Results are evaluated by Strict-ASR (%).
School of Artificial Intelligence (School of Software), Yanshan University, Qinhuangdao 066004, China. · Fusion Intelligence Laboratory, Department of Computer Science, University of Exeter, EX4 4RN, United Kingdom.