Transferable Physical-World Adversarial Patches Against Pedestrian Detection Models

arXiv cs.CV / 4/27/2026

📰 NewsIdeas & Deep AnalysisModels & Research

共有:

Key Points

The paper highlights that physical adversarial patches can meaningfully undermine pedestrian detection systems, creating safety risks for surveillance and autonomous driving.
It identifies two practical gaps in prior physical attacks: insufficient disruption of the multi-stage detection pipeline (allowing later modules to recover) and weak robustness to real-world physical variability.
The proposed TriPatch method uses a multi-stage collaborative attack with a triplet loss that suppresses detection confidence, amplifies bounding-box offsets, and disrupts NMS to target several parts of the detection pipeline simultaneously.
To improve real-world adaptability, TriPatch adds an appearance consistency loss to stabilize the patch’s color distribution and uses data augmentation to withstand diverse physical perturbations.
Experiments report that TriPatch achieves a higher attack success rate across multiple pedestrian detector models than previous approaches.

Abstract

Physical adversarial patch attacks critically threaten pedestrian detection, causing surveillance and autonomous driving systems to miss pedestrians and creating severe safety risks. Despite their effectiveness in controlled settings, existing physical attacks face two major limitations in practice: they lack systematic disruption of the multi-stage decision pipeline, enabling residual modules to offset perturbations, and they fail to model complex physical variations, leading to poor robustness. To overcome these limitations, we propose a novel pedestrian adversarial patch generation method that combines multi-stage collaborative attacks with robustness enhancement under physical diversity, called TriPatch. Specifically, we design a triplet loss consisting of detection confidence suppression, bounding-box offset amplification, and non-maximum suppression (NMS) disruption, which jointly act across different stages of the detection pipeline. In addition, we introduce an appearance consistency loss to constrain the color distribution of the patch, thereby improving its adaptability under diverse imaging conditions, and incorporate data augmentation to further enhance robustness against complex physical perturbations. Extensive experiments demonstrate that TriPatch achieves a higher attack success rate across multiple detector models compared to existing approaches.