用3D建模设计热成像对抗服装，可骗过人体检测器。
Physical Adversarial Examples for Person Detectors in Thermal Images Based on 3D Modeling
- 基于3D建模优化热成像对抗贴片布局，提升多角度仿真效果。
- 实测攻击成功率80.11%（室内）和76.85%（室外），显著高于随机贴片。
- 使用气凝胶材料制作，具备真实感与跨检测器迁移能力。
热成像检测广泛应用于自动驾驶、医疗AI等领域，但其安全性近来才受关注。本文提出一种基于3D建模的热成像对抗服装设计，用于在真实场景中规避人体检测器。相比2D建模，3D建模更易模拟多角度真实环境。通过对抗样本技术优化服装内侧气凝胶贴片的布局与方向，使其在热成像中呈现黑色方块。为增强真实感，提出利用真实红外照片构建红外3D模型，并生成随时间和地点变化的纹理图以模拟不同红外特性。物理实验中，对YOLOv9的攻击成功率分别达80.11%（室内）和76.85%（室外），远超随机贴片的26.53%和23.03%。该方法还通过集成攻击策略展现出对未知检测器的良好迁移性，验证了其有效性。
原文摘要 · Abstract (English)
Thermal Infrared detection is widely used in autonomous driving, medical AI, etc., but its security has only attracted attention recently. We propose infrared adversarial clothing designed to evade thermal person detectors in real-world scenarios. The design of the adversarial clothing is based on 3D modeling, which makes it easier to simulate multiangle scenes near the real world compared to 2D modeling. We optimized the black patch layout pattern of 3D clothing based on the adversarial example technique and made physical adversarial clothing using the aerogel. The idea is to paste a set of square aerogel patches, which display black squares in thermal images, in the inner side of clothing at specific locations with specific orientations. To enhance realism, we propose a method to build infrared 3D models with real infrared photos and develop texture maps for 3D models to simulate varied infrared characteristics over time and location. In physical attacks, we achieved an attack success rate of 80.11\% indoors and 76.85\% outdoors against YOLOv9. In contrast, randomly placed patches yielded much lower success rates (26.53\% indoors and 23.03\% outdoors). The adversarial clothing also showed good transferability to unknown detectors with an ensemble attack method, demonstrating the effectiveness of our approach.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。