提出通用红外干扰贴片,可让行人检测系统失效
Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems
- 用曲线块建模冷贴片,优化一次即可跨场景使用
- 实测攻击成功率92.59%,在多个数据集和模型上均有效
- 揭示红外检测系统普遍存在物理级漏洞,适合安全评估者参考
红外行人检测系统广泛应用于全天候感知,但其对物理对抗攻击的鲁棒性仍不充分。现有红外物理攻击多为实例特定,需针对特定样本、姿态或场景重新优化,难以适应部署环境变化。本文提出通用物理贴片攻击(UPPA),基于红外扰动应利用平滑低频热结构而非可见光纹理的观察,将攻击载体表示为拓扑约束的贝塞尔曲线块,实现紧凑且可制造的几何参数化,并通过粒子群优化(PSO)在薄板样条(TPS)变形与期望变换(EOT)成像变换下优化单一共享扰动。优化后的图案可作为可穿戴冷贴片部署,无需样本特异性重优化。在五个红外数据集和九个行人检测器上的实验显示,数字攻击表现一致,具备强跨数据集与跨模型迁移能力,真实物理实验中攻击成功率达92.59%。消融、可视化与防御分析表明,曲线块破坏行人热特征聚合,且图像恢复类防御难以消除。结果揭示当前红外行人检测系统存在实际通用物理漏洞,并提供鲁棒性评估基准。
原文摘要 · Abstract (English)
Infrared pedestrian detectors are increasingly deployed in all-weather perception systems, but their robustness against physical adversarial attacks remains insufficiently understood. Existing infrared physical attacks are mostly instance-specific, requiring perturbations to be optimized for particular samples, poses, or scenes, which limits scalability under changing deployment conditions. This paper proposes Universal Physical Patch Attack (UPPA), a universal cold-patch framework for infrared pedestrian detection. UPPA is built on the observation that infrared physical perturbations should exploit smooth, low-frequency thermal structures rather than visible-light texture patterns. It represents the attack carrier as topology-constrained Bézier Curved-Blocks, providing a compact and manufacturable geometric parameterization, and optimizes one shared perturbation with Particle Swarm Optimization (PSO) under Thin Plate Spline (TPS) deformation and Expectation over Transformation (EOT) imaging transformations. The optimized pattern is then deployed as wearable cold patches without sample-specific re-optimization during deployment. Experiments on five infrared datasets and nine pedestrian detectors show consistent digital attack performance, strong cross-dataset and cross-model transferability, and a 92.59\% attack success rate in real-world physical experiments. Ablation, visualization, and defense analyses show that Curved-Blocks disrupt pedestrian thermal feature aggregation and remain difficult for image-restoration-style defenses to remove. These results reveal a practical universal physical vulnerability in current infrared pedestrian detection systems and provide a benchmark for robustness evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。