arXiv:2603.00266cs.CV2026-03

提出联合位置颜色优化方法,生成可同时干扰可见光与红外图像的对抗补丁。

Adversarial Patch Generation for Visual-Infrared Dense Prediction Tasks via Joint Position-Color Optimization

  • 通过联合优化补丁位置与颜色,实现对双模态输入的统一扰动。
  • 在多个视觉-红外稠密预测模型上均实现强攻击效果,且补丁更隐蔽。
  • 无需模型内部信息,适用于黑盒攻击,适合评估多模态系统的鲁棒性。

针对稠密预测任务中的多模态对抗攻击仍处于探索阶段的问题,本文针对视觉-红外(VI)感知系统特有的光谱异质性和模态特异性强度分布,提出一种联合位置-颜色优化框架(AP-PCO)。该方法通过基于模型输出设计的适应度函数,同步优化补丁的位置与颜色组成,使单一补丁能有效干扰可见光与红外模态。为缓解跨光谱差异,引入跨模态颜色自适应策略,在约束补丁红外灰度表现的同时保持可见光域的强扰动能力,从而降低跨光谱显著性。优化过程不依赖模型内部信息,支持灵活的黑盒攻击。在多个视觉-红外稠密预测任务上的大量实验表明,所提方法在多种架构下均表现出一致的强攻击性能,为VI感知系统的鲁棒性评估提供了实用基准。

原文摘要 · Abstract (English)

Multimodal adversarial attacks for dense prediction remain largely underexplored. In particular, visual-infrared (VI) perception systems introduce unique challenges due to heterogeneous spectral characteristics and modality-specific intensity distributions. Existing adversarial patch methods are primarily designed for single-modal inputs and fail to account for crossspectral inconsistencies, leading to reduced attack effectiveness and poor stealthiness when applied to VI dense prediction models. To address these challenges, we propose a joint position-color optimization framework (AP-PCO) for generating adversarial patches in visual-infrared settings. The proposed method optimizes patch placement and color composition simultaneously using a fitness function derived from model outputs, enabling a single patch to perturb both visible and infrared modalities. To further bridge spectral discrepancies, we introduce a crossmodal color adaptation strategy that constrains patch appearance according to infrared grayscale characteristics while maintaining strong perturbations in the visible domain, thereby reducing cross-spectral saliency. The optimization procedure operates without requiring internal model information, supporting flexible black-box attacks. Extensive experiments on visual-infrared dense prediction tasks demonstrate that the proposed AP-PCO achieves consistently strong attack performance across multiple architectures, providing a practical benchmark for robustness evaluation in VI perception systems.

对抗攻击多模态红外感知黑盒攻击

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。