UV-Attack: Physical-World Adversarial Attacks on Person Detection via Dynamic-NeRF-based UV Mapping
Authors: Yanjie Li
Kaisheng Liang
Bin Xiao
Venue: ICLR 2025 Poster (2025)
Keywords: Adversarial Attack; Person Detection; NeRF; UV-Mapping
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We propose UV-Attack, the first physical adversarial attack that has high attack success rate on person detection in large-action scenarios.

Abstract: Recent works have attacked person detectors using adversarial patches or static-3D-model-based texture modifications. However, these methods suffer from low attack success rates when faced with significant human movements. The primary challenge stems from the highly non-rigid nature of the human body and clothing. Current attacks fail to model these 3D non-rigid deformations caused by varied actions.
Fortunately, recent research has shown significant progress in using NeRF for dynamic human modeling. 
In this paper, we introduce \texttt{UV-Attack}, a novel physical adversarial attack achieving high attack success rates in scenarios involving extensive and unseen actions. We address the challenges above by leveraging dynamic-NeRF-based UV mapping. Our method can generate human images across diverse actions and viewpoints and even create novel unseen actions by sampling from the SMPL parameter space. While dynamic NeRF models are capable of modeling human bodies, modifying their clothing textures is challenging due to the texture being embedded within neural network parameters.
To overcome this, \texttt{UV-Attack} generates UV maps instead of RGB images and modifies the texture stacks. This approach enables real-time texture edits and makes attacks more practical. Finally, we propose a novel Expectation over Pose Transformation loss (EoPT) to improve the evasion success rate on unseen poses and views.
Our experiments show that \texttt{UV-Attack} achieves a 92.7\% attack success rate against the FastRCNN model across varied poses in dynamic video settings, significantly outperforming the state-of-the-art AdvCaT attack, which only had a 28.5\% ASR. Moreover, we achieve 49.5\% ASR on the latest YOLOv8 detector in black-box settings. The code is available at https://github.com/PolyLiYJ/UV-Attack

Published as a conference paper at ICLR 2025
UV-ATTACK: PHYSICAL- WORLD ADVERSARIAL AT- TACKS ON PERSON DETECTION VIA DYNAMIC-NERF- BASED UV MAPPING
Yanjie Li, Kaisheng Liang, Bin Xiao
Department of Computer Science, Hong Kong Polytechnic University yanjie li@connect. pol.u. cskliang& polyu. edu.hk hk b. xxiiioppollu...o edu. edu. hk
ABSTRACT
In recent research, adversarial attacks person detectors using patches static 3D model-based texture modifications have struggled with low success rates due to the flexible nature of human movement. Modeling the 3D deformations caused by various actions has been a major challenge. Fortunately, advancements in Neural Radiance Fields (NeRF) for dynamic human modeling offer new possibilities. In this paper, we introduce UV-Attack, a groundbreaking approach that achieves high success rates even with extensive and unseen human actions. We address the challenge above by leveraging Jynamic-NeRR-baaee
UV mapping. UV-Attack ck can generate human images across diverse actions and viewpoints, and even create novel actions by sampling from the SMPL parameter space. While dynamic NeRF models are capable of modeling human bodics, modifying clothing textures is challenging because they embedded in neural network parameters. To tackle this, UV-Attack generates UV maps instead of RGB images and modifies the texture stacks. This approach enables real-time texture edits and makes the attack more practical. We also propose novel Expectation over Pose Transformation loss (EoPT) improve the evasion success rate unseen poses and views. Our experiments show that UV-At t tack achieves 92.7% attack success rate against the FastRCNN model across varied poses dynamic video settings, significantly outperforming the state-of-the-an art AdvCamou attack, which only had a 28.5% ASR. Moreover, we achieve 49.5% ASR on the latest YOLOv8 detector black-box settings. This work highlights the potential of dynamic NeRF-based UV mapping for creating more effective adversarial attacks on person detectors, addressing key challenges in modeling human movement and texture modification. The code is available at
INTRODUCTION
Adversarial attacks have become significant concerns both digital and physical domains, impacting areas like facial recognition (Gong et al. 2023 Yang et al. 2023) and object detection (Huang et al.)
20033 Li et al., 2023c). To improve the physical attack success rate, researchers have attempted to use 2D transformations such translation, rescaling, and shearing (Zhong et al. )022) -and 3D modeling
(Huang et al. 2024 Suryanto et al., 2022) to simulate changes in viewpoints for objects like stop signs and cars. However, compared with attacks rigid objects, attacks non-rigid objects like human beings are more challenging because of the variability in clothing distortions and human poses. These non-rigid distortions are difficult to simulate using basic transformations or static 3D modeling. Consequently, previous attempts at person detection attacks often relied on adding an adversarial patch to the front of the T-shirt (Xu al. 2020 Wang et al., 2021b Lin et al. 2023) or assumed
minimal movement (Hu et al., 2022 2023). which limits the real-world attack success rate when the
subject undergoes significant movement and unseen poses.
"Corresponding Author

---

Published as a conference paper at ICLR 2025
To address these challenges, in this work, we propose the UV-Attack, which successfully addresses this challenge by incorporating dynamic NeRF-based UV mapping into the attack pipeline. Recent advancements have applied neural radiance fields (NeRF) (Barron et al. 2021) to dynamically
modeling human bodies (Ginn et al. 2023 Weng et al. 2022). These methods enable the modeling of human bodies neural networks and generate novel poses with minimal parameters. Nevertheless, directly modifying the texture of NeRF models is challenging due to the texture information being embedded within neural network parameters (Dong et al.) 2022). To solve this issue, inspired by the latest work of editable NeRF model (Chen et al. 2023c), we model the 3D human body's 's shape and textures respectively. Then we focus on editing the 3D textures through learnable Densepose- like UV-maps (Güler et al., 2018). This approach enables real-time editing of 3D textures without requiring gradient backpropagation on the NeRF model. Moreover, to improve the physical attack success rate on waseen poses, we sample novel poses from the SMPI. parameter spaces and generate human images with unobserved poses and viewpoints. Moreover, we propose a novel Expectation over Pose Transformation(EoPP] loss function to enhance the attack's 's effectiveness.
Furthermore, recent studies have explored the use of diffusion models to enhance the transferability of adversarial examples (Xue et al., 2023] Lin et al. 2023 Chen et al. 2023b). However, these methods show limited success in physical attacks due to restricted noise levels. To address this problem, we improve the physical attack success rate by expanding the perturbation space. By tweaking the starting point of the stable diffusion model and removing classifier-fres guidance, we achieve a higher ASR, as our method allows for the exploration of larger and less familiar areas in the latent space compared to previous approaches.
We compare UV Attack with the latest person detection attacks (Hu al. 2022 2023) and diffusion-based attacks (Xue et al., 2023 Lin et al. 2023). Our experiments demonstrate the superiority of our approach terms of evasion success rates in free-pose scenarios. As shown in Figure I we physically printed the Bohemian clothing and successfully fooled person detectors in dynamic video settings, even when the subjects were continuous and significant movement. Our key contributions are:
1. We propose novel person detection attack algorithm that effectively handles pose variation through UV mapping. Our method can generate unseen actions and can edit human clothes in real time. Moreover, we propose a novel Expectation over Pose Transformation loss (EoPT) to improve the evasion success rate on unseen poses and views.
2. We utilize the stable diffusion model to enhance the transfcrability of adversarial patches. We expand the search space by adjusting the starting point of the conditional latent diffusion model without employing classifier-free guidance, which results in higher physical ASR.
3. Our attack designed to be physically realizable. We manufacture adversarial clothing in the real world and achieve physical ASR of 85% in free-pose setting. This significantly surpasses the performance of the state-of-the-art adv-Camou (Hu et al., (023) attack, which attains only 25% ASR. Moreover, we achieve 49.5% ASR on the latest YOLOv8 detector in black-box settings.
BACKGROUND
Adversarial Attacks against Object Detection
Recent work has employed elaborate adversarial
examples to attack real-world image classifiers (Wang et al. 2023 Zhong et al. (022) and object
detectors (Zhang et al. 2023 Huang al.] 2023 Li et al.) 2023c] Wang et al. 2022). Unlike digital
attacks, physical attacks introduce greater complexity due to the physical variables. Early efforts to improve the efficacy using basic 2D transformations like translation, rescaling, and shearing (Zhao) et al. 2019: Zhong et al. (022). However, these approaches are largely effective only for planar objects such as stop signs. For 3D objects, more advanced techniques involving static 31) modeling and differentiable rendering have been employed to modify the textures (Wang et al. [022 202 Ravi et al.) 2020). However, such methods are generally limited to rigid objects and fail to adequately address the dynamic and non-rigid targets. Specifically, static 3D models do not effectively simulate human poses, and the use of 2D and 3D Thin Plate Splines (TPS) Xu et al. (2020) has only been successful in modeling minor clothing distortions, falling short in replicating the impact of diverse human poses. Consequently, most previous person detection attacks have merely added an adversarial patch to the front of the T-shirt Hu et al. (202T): Duan et al. (2022): Tan et al. (202 to avoid distortion
2

---

Published as a conference paper at ICLR 2025
(a) Adv- Yolo
(b) Adv-T-shirt
(c) NaturalPatch
(d) Adv-Texture
(e) Adv-Camou
Ours (Frontl)
(g) Ours (Front2)
(h) Ours (Turn left)
(i) Ours (Back)
(i) Ours (Turn right)
Figure 1: Visualization of different person detector attacks. We compare our attack with different person detection attacks, including Yolo (Thys et al., 2019), Adv-Tshirt (Xu et al. 2020), NaturalPatch (Hu et al. (202T) Adv-Texture (Hu et al. (022) and Adv-Camou (Hu et al. 2023). Our attacks achieve higher ASR under diverse poses and viewpoints than previous attacks.
problems. More recent approaches have incorporated 3D texture-based modifications Hu et al. 2023 2022) to improve attack success rates from varying viewpoints. However, these approaches relied on static modeling and did not consider the influence of human poses. This highlights the critical challenge of creating novel attack techniques that effectively address the dynamic nature human movements and pose variations.
Adversarial Attacks based on NeRF Neural Radiance Fields (NeRF) (Mildenhall et al. 2021
have demonstrated significant potential in rendering free-view images, making them attractive for physical attacks. Recent methodologies have explored the integration of NeRF various adversarial contexts. ViewFool (Dong et al., 2022) leverages NeRF to find adversarial viewpoints that can generate adversarial images. does not modify the object itself. VIAT (Ruan et al., 2023) follows ViewFool by learning Gaussian mixture distribution of adversarial viewpoints cover multiple local maxima of the loss landscape. Adv3D (Li et al.) 2023a) utilizes Lift3l) (Li et al. 2023b) to alter the texture latent of NeRF models, specifically targeting the textures of cars. However, it only considers rigid objects and is not physically realizable. TT3D (Huang et al., 2024) also considers the rigid objects. modifies texture latent within grid-based NeRF architectures (Müller al. 2022). Their method can change the textures but cannot be applied to non-rigid objects. In contrast to previous methods, our attack is the first specifically designed target person detection. Unlike attacks focused on rigid objects, modeling a person is more challenging due to non-rigid deformations. UV-Atta ack the first to utilize dynamic NeRF and UV mapping non-rigid 3D adversarial attacks.
3 METHODOLOGY
In this section, we detail the proposed UV-Attack. UV-Attack adopts the dynamic NeRF to model humans as digital representations and perform the optimization in the latent space of the diffusion model to generate the adversarial textures. In the following, we first introduce the background knowledge of dynamic NeRF and then present our methodology.
3.1 PRELIMINARY: DYNAMIC NEURAL RADIANCE FIELDS
NeRF enables novel-view photorealistic synthesis by modeling 3D objects as continuous volumetric radiance field, allowing control over illuminations and materials (Mildenhall et al., 202T). can be formulated as F (x. d) + (c, σ), where F is MLP and takes the 3D coordinate view direction d E 3 as input and outputs the corresponding color e and volume density a. Then NeRF computes the pixel color C(r) by accumulating all colors along a ray r /d that emitting
R and the
3

---

Published as a conference paper at ICLR 2025
from the camera's original point and passing the pixel with near and far bounds t, and Ey.
L J( T() T() o((()) c(r((), d) dt, where T()) exp (-f (r((s)) )s),
c(r)-
c(r) -
(I)
where a is the volume density any point s along the ray. c(r(t), d) and (r((t) are the color and density for the 3D coordinate r(t) and view direction d.
More recently, dynamic NeRF models have been proposed to accurately depict non-rigid objects like human beings (Geng et al., 2023 Weng et al., 2022). In response to the need for fast rendering and editable textures, we utilize UV- Volume (Chen al. 2023c) to model the human body.
The core idea of UV- is to render a NeRF model into UV maps rather than RGB images. UV maps contain UV coordinates (or texture coordinates), which are assigned pixel coordinates of predefined texture image E. The UV mapping process assigns pixels in the predefined texture image to a rendered RGB image according to the UV coordinates. The UV-Volume input is the pose parameter 8, the camera position 7) and the light parameter т. It firstly computes pixel feature F(r) by a rendering equation similar to Eq. where r is a camera ray. Then F(r) is fed into a UV decoder and is decoded as part assignment and UV coordinates through (P(r), V(r)] = Mux (Frr). P a part assignment corresponding to different human body parts.
UV-volume also incorporates a texture generator, denoted by G, to generate texture stack images & G( k), where k is a one-hot vector that specifies the body part (e.g., arm. leg). A texture feature, ex. is then sampled from Eg based on the UV coordinate using the differentiable grid sampling: (r) = & (r), (r)). Finally, the RGB color for the camera ray is calculated as weighted sum of individual body part colors (x)r:: C(r) Σ Ps (r) Each Cx(r) is determined by an MI.,, Mc, which takes as input the UV coordinates (with positional encoding). the sampled texture feature, and the encoded view direction:
(x) Me (N(Ma(r), (r()) ex(r), kr)
where K is the total number of human body parts and 7--) a positional encoding function. The Ma is an MLP that maps UV coordinates, sampled texture pixels and view directions into RGB images.
3.2 THE PIPELINE OF UV-ATTACK
We present the pipeline of Uvtkt in Figure 2 lighting parameters to generate IUV maps and texture stacks. Then creates an adversarial patch using pre-trained Stable Diffusion model and uses it to modify the texture stacks. These textures are then applied to the IUV maps, resulting in a final adversarial image.
UV-At first samples poses, camera, and
GMM-based Pose Sampling To generate unseen poses for the target person,
Gaussian Mixture Model (GMM) to fit a human pose distribution on target person images and an annotated pose dataset MPII (Andriluka al. 2014). Then we sample pose parameters from this Gaussian Mixture distribution as the VV-uue model's input. Specifically, We first use the SPIN model (Kolotouros et al. 2019) to estimate the poses O and shapes parameters 9 from the target person's s video and add auxiliary poses from public annotated poses datasets like MPII (Andriluka et al. 2014). Then we parameterize the distribution p( 6)) by mixture of K Gaussian components and take the transformation of random variable approach ensure the support of p( (0 0)) in scope of 10min mazz] by
0 a Lanh(u)= + b, where p(u W Σ k=1
wnN pkx Ii
(3)
where a (0am- mmn) b (Bnes (0mm)) V = [wk, Pk: a Tk=1 are the parameters of the GMM with 2 weight We [0, 1] ΣK ck=1 Wh: = =1). The fa and or are parameters of k-th Gaussian component.
Real-Time Dynamic Texture Modification To improve the speed of adversarial attacks, it's crucial to efficiently modify and render clothing on 3D human models. We slightly adjust the UV-Volume
4

---

Published as a conference paper at ICLR 2025
Target video
Haman pose
Camera view sampling
Light condit.on sampling
Bac Backkround sampling
Xb
UV Valume
Volcme
GMM Distribution
Generator
P
sampling
-------
Texture
x
LUV
"Horse" Conditioning
Bilinear interpolation
Render
Finetuned Stable diffusion
Denoising U-Net
27
Po lac) .o.
Fuddv
TPS
Texture Stacks
(PS(C,
miiagr linde
Gradients
Re-ar-Ta--llle det(x]ky,, 0, 0,T,
Person Detector
The pipeline UV-Attack. UV-Attack first samples random pose parameters from Gaussian Mixture Model. We then use the sampled pose, camera, and light parameters to generate IUV maps and texture stacks. We employ a pre-trained stable diffusion model and modify the initial latent to generate adversarial patches. Finally, we modify the texture stacks using the adversarial patch and get the human image RGB space. The solid lines below indicate the direction of gradient propagation, while the dashed lines above do not require gradients.
Figure 2:
architecture to further improve the texture modification speed. Specifically. we firstly define linearly spaced vectors u, v E linespace N.). where N, is the texture's size. Then create 2D grids using mesh grid defined [2, VJ [1N, @ u, (1N, @ v''), where is 1y, column vector of ones with dimension N, and & denotes the Kronecker product. Then we remove the viewing direction d from 2 to generate the nie-independdet texture stacks Besides the texture stack C. we also generate IUV maps according to the pose, camera, and light parameters, which can be expressed JIuv = [P, i) Muv (Fo. where f is the pose parameter and 1), T are the camera and light parameters.
During the process of image rendering new actions, we randomly sample the camera views from different elevation and azimuth angles and different light positions and backgrounds. The rendered images can be expressed as
(( (PS xaav)) @ M an (1- M),
(4)
where Tade is adversarial patch generated by the latent diffusion model, is the camera and light parameters and M a human mask that can be estimated by the accumulated transmittance M exp (- - (x;));; We simply repeat the adversarial patch on the texture stacks, which have shown to be able to improve the attack robustness (Hu et al. 2022). Because the texture stacks are disentangled, we can easily modify any part of the human body. Then we distort the texture stacks through Thin Plate Spline (TPS) (Hu et al. (023) to simulate cloth distortions. Finally, we use the grid sampling function .(..)) to sample pixel colors from the modified texture stack according to the IUV map æuv and combine it with background image Tb.
Adversarial Patch Generation Diffusion models have been found to be able to enhance the
transferability adversarial examples (Xue et al.) 2023 Lin et al. 2023 Chen et al.) 2023b). However, previous work either modifying the intermediate latent (Chen al. 2023a b) or diffusing and denoising an initial image (Lin et al. 2023 Xue et al., 2023). which has limited noise levels, resulting impractical for physical adversarial attacks.
contaminates the initial, highly
noisy latent variable 27 of a pre-trained stable diffusion model (Rombach et al.) (022) and remove classifier-free guidance. These approaches facilitate more substantial modifications and explore
5

---

Published as a conference paper at ICLR 2025
broader latent spaces and less familiar areas, resulting in significantly higher physical attack success rates while maintaining transferability. However, due to the larger optimization space, relying solely gradient-base based algorithms may lead to local minima. To enhance optimization efficiency, we combined black-box and white-box algorithms. Initially, we employed the Particle Swarm Optimization (PSO) algorithm find suitable starting point. Subsequently, optimizer to fine-tune this point to further decrease the loss. To exclude the influence of stable diffusion prompts, we evaluated the average ASR by using different class labels except "person" " in the COCO dataset as prompts.
utilized the Adam
The Expection over Pose Transformation Loss Suppose the victim detector D takes the rendered image x as input and outputs set of bounding boxes b,()) with confidence Conf.") and class label we define the detection loss as dett = Conf where 1" = arg max; loU(gt", bb)" The adversarial
loss Lade be expressed as the expectation
sampled pose parameters (0), camera parameters (17), light parameters (T), and background images (z²). The objective function is
min Lads == 18g-8 -000--..-H.TTTTTae
(C)et(1227) 2T, 0, 17 Tb)]
(5)
By minimizing Lade with respect to 2r, find texture that makes the detector fail under variety of realistic scenarios. Sampling over the camera and light parameters, including the camera and light positions and light intensity, improve the attack success rate in real-world situations.
The final attack algorithm shown in Algorithm
Algorithm 1
The UV-Attack
Require:
Target detector D. pretrained latent diffusion model ø, GMM parameters O background images B, number of PSO iterations Tpso, number of PSO swarms Npso, number of Adam iterations Adam- pretrained UV-Volume model Muv. batchsize Nbatck-
Initialize Neso particle swarms with random positions 2 and velocities e4
2: for = ,, do
3: Update velocities ((++1) wo! (t) + cari
2(") + 02 2
4: Update positions (1+1) 2, + ((+1)
5: Evaluate fitness (- Ludv) of particles and update p(") and (t))
6: end for
7: Initialize 27 with the best position found by PSO: 28 + (Tio))
8: for t = ,,...,,TAar. Adam do
9:
Generate aade through denoising Fado Decoder Decoder(Roo.... (R T), 11)....0)) Sampling 0 ~ O, d D,T T, B with number Nbathh
10:
11:
Generate Nbateh image through Eq.
12:
Compute adversarial loss through Eq. 5
13:
Update 27 using Adam optimizer
14:
end for
15:
return Adversarial patch Fadv
EXPERIMENTS
4.1 EXPERIMENTAL SETTINGS
Training Details. We evaluate the success rate of digital attacks on the ZJU-Mocap dataset (Peng et al. (02T). For the physical attack, we collected videos of five individuals and used SPIN and DensePose to extract SMPI. parameters and pseudo-supervised IUV maps for training the UV- Volumes. The model training and attack implementation are conducted on single Nvidia 3090 GPU. We utilize pretrained stable-diffusion model finetuned on 256 images. The diffusion process was set to 10 steps. The Particle Swarm Optimization (PSO) ran for 30 epochs with 50 swarms, and the Adam optimizer ran for 300 epochs. We collected 100 different backgrounds from both indoor and outdoor scenarios. For each epoch, randomly sampled 100 poses, camera and light positions, and backgrounds for training. The camera sampled from azim E [-180%, 180%] and elev E , 30%).

---

Published as a conference paper at ICLR 2025
Table 1: Comparison of different methods' ASR (%) the multi-pose datasets using FastRCNN and YOLOv3. The confidence threshold Toonf is set as 0.5.
Victim Models
FastRCNN
YOLOv3
7lUU
IoU0.01
IoU0.1
IoU0.3
IoU0.5
IoU0.01
IoU0.1
IoU0.3
IoU0.5
YdvYolo
15.05
16.20
16.45
16.40
13.25
14.05
14.20
14.30
AdvTshirt
10.20
11.30
12.15
12.50
8.35
10.30
10.35
10.50
NatPatch
12.40
13.20
14.35
15.20
10.50
11.40
12.55
12.60
AdvTexture
1.50
6.75
10.05
17.90
1.40
8.40
14,50
18.10
AdvCamou
24.40
25.50
25.60
28.50
22.50
23.40
23.60
24.00
Diff2Conf
10.30
12.60
12.65
14.25
19.20
20.00
20.05
20.35
DidPGD
12.40
12.70
12.80
13,40
15.10
17.50
17.80
19.40
LDM
24.50
25.40
25.45
25.50
26.40
27.50
28,30
28.45
OurSeideo
82.50
82.50
84.30
85.60
80.25
82.10
83.40
84.20
OurSGMm 85.65
85.80
86.65
92.75
84.50
88.40
89.50
90.40
Victim Models and Evaluation Metries. To evaluate the attack success rate transferability of our attack, we trained the adversarial textures on FastRCNN (Girshick] 2013) and YOLOv3 (Redmon variety of the person detectors. including MaskRCNNHe et al. (2018). Deformable DETR (Zuu et al, 2020), RetinaNet (Lin et al. 2018), SSD (Liu et al., 2016), F FCOS et al. 2019) and the most recent YOLO variant, YOLOO88 (Jocher et al. 2023). To evaluate the effectiveness of our attack, we measure the attack success rate (ASR) in both the digital world and the physical world. Most previous attacks the IoU threshold ToU as 0.5, which overestimated the attack effectiveness. In this work, we test the ASR under different IoU thresholds from 0.01 to 0.5. To exclude the influence of stable diffusion prompts, we evaluated the average ASR by using all class labels except "person" in the COCO dataset as prompts. This approach ensures that the ASR not biased by specific prompts and provides more generalized measure of the attack's 's effectiveness.
& Farhadi 2018) respectively, and tested the transferability
Baseline attacks. We compared our attack with different person detection attacks, including Yolo (Thys et al. [2019). AdvTshirt (Xu et al.] 2020),, AdyTexture (Hu et al.) (022), AdyCamou (Hu ct al. 2023), and the latest cefffusion-moellee
attacks, including Dift2Conf (Lin et al.) 2023) and Di (Xue et al. 2023). We also compared our method with a GAN- attack, NatPatch (Hu
et al. 2021). AdvTexture (Hu et al., 2022) and AdyCamou (Hu et al., 2023) are both texture- based attacks that can be directly compared. For AdvTshirt, Diff2Conf, and DiffPGD, which only add single patch on the T-shirt, the attack performance drops significantly when the viewing angles change. Therefore, tiled the patches produced by them onto the texture stacks for fair comparisons.
4.2 DIGITAL ATTACK RESULTS
Evaluation on the Unseen Pose Dataset (A) Dataset and baseline settings. To evaluate the ASR of different attacks under unseen pose scenarios, we randomly sample 1000 poses from the GMM and combine them with difffrrent backgrounds and camera and light conditions construct unseen pose dataset. Then we evaluate the average ASR on five different individuals from the ZJU-Mocap dataset, shown in Figure 6 Because previous attacks did not consider the multi-post posee scenarios, they cannot be directly evaluated. Therefore, we combine their methodologies with the UV-Volume model to generate images under different poses for testing. For AdyCamou (Hu et al. 2023 first train a Voronoi diagram using their methods and then apply it to the texture stacks under a fixed pose. Then we test the generated Voronoi diagram on the multi-pose dataset. For other patch-based attacks, we use a fixed pose and put the generated patch on the texture stacks for training, followed by testing on the multi-pose dataset. Additionally, we added two additional baselines. One is to use the latent diffusion model with fixed poses to train the adversarial textures, referred to as the LDM attack. The other is to sample frames from multi-pose video and then extract the pose parameters for the UV- Volume, referred to as OurSvideo- (B) Results analysis. We present the test ASRs under different IoU thresholds in Ta All attacks were trained and tested on the same detectors. It indicates that attack significantly outperforms previous attacks under unseen pose scenarios. Additionally, attack maintains consistently high ASRs as the loU thresholds decrease, in contrast to some previous attacks like Adv AdyTexture, which significantly drops in performance. Experimental results demonstrate
7

---

Published as a conference paper at ICLR 2025
Table 2: The white-box ASR (%) and transferability of different attacks. The IOU threshold set as 0.1 and the confidence threshold is set as 0.5. Numbers with underline are white-box attacks. We disable pose sampling the training and test process this table for fair comparison.
Victim Models
Method
FRCNN
YOLOv3
DDETR
MRCNN
Retina
FCOS
SSD
YOLOv8
AdyTshirt
61.04
17.02
12.90
56.10
25.00
24.00
15.05
15.20
AdyTexture
22.54
10.01
9.05
15.30
8.00
15.60
8.24
6,50
AdyCamou
97.20
28.50
67.50
92.20
45.65
35.20
20.24
25.25
Diff2Conf
31.45
12.10
10.05
27.15
19.34
10.50
11.45
7.90
DiffPGD
35.37
16.24
13.40
29.50
16.18
12.43
14.29
10,50
Ours
98.36
50.45
68.18
93.50
75.95
64.50
38.50
49.50
AdyTshirt
11.03
75.00
15.44
8.20
18.32
15.40
10.05
16,50
AdyTexture
16.54
45.89
10.55
13.28
11.30
11.40
5,50
6,40
AdyCamou
24.40
93.18
16.38
22.57
25.40
22.66
25.40
18.30
Diff2Conf
15.45
42.10
10.20
18.40
15.20
6.40
12.47
10.02
DifiPGD
14.37
46.40
10.40
16.40
18.08
5.20
10.40
9.55
Ours
23.26
97.21
48.03
31.60
35.80
37.40
39.25
58.55
that method can significantly improve attack resilience against pose variations. In addition, is shown that sampling pose parameters from a GMM distribution rather than from video frames can improve the ASR. This is because
synthesize unseen poses for training.
Transferability (A) We trained our attacks on FastRCNN and YOLOv3, respectively, and tested the transferability on various person detectors. Because AdyCamou is based on a static 3D model, disable pose sampling in the training and testing in this table for fair comparisons. As shown in T our attack trained on FastRCNN has high transferability on Deformable-DETR. MaskRCNN, and RetinaNet. It is also shown that previous diffusion-basee attacks, Diff2Conf and DiffPGD, have very low ASRs in our attack settings, even on the white-box models. We think this is because only adding noise to an initial image and then denoising can not fully explore the LDM's latent space and, therefore, cannot find an optimum latent. In addition, our attack achieves high ASRs on the latest YOLOv8 detector (Jocher al. 2023). while previous attacks did perform very well on
4.3 PHYSICAL ATTACK RESULTS
To evaluate the physical ASR, first capture videos from targets and then estimate the pose and camera parameters to train the UV-Vulume. In contrast to AdvCamou which requires calibrated 3D meshes, our approach only needs short video of the target, thus simplifying the attack process. We find that the trained textures are transferable to different people, thereby allowing us to fine-tune the latent 2y trained on the ZJU-Mocap datasets instead of training from scratch, which greatly reduces the training time. We set the finetuning epoch as 100 in the physical attacks. Then we print the textures on fabric materials and manufacture long sleeves and pants. As shown in Figure [ our attack is robust to changes in pose, view, and distance. For quantitative analysis, we compute the ASR through ASR total frames, respectively. We trained the texture on FastRCNN and tested the real-world ASRs multiple detectors. The physical attack success rate with different detectors and confidence thresholds is shown in Figure We achieved high success rate FastRCNN (0.82), MaskRCNN (0.78), and Deformable DETR (0.65) when Tconf is 0.5 and is consistent when Teoer changes, while RetinaNet, FCOS and YOLOv88 relatively sensitive to Teont's 's change. The ASR for SSD is relatively low, which can be attributed to their fundamentally different model architectures.
Nuuccest//ooo where N and Nonal represent the number of succeeded and
Table 3: Attack performance on different body parts.
Body Parts
UpperBody
UpperBody+Amss UpperBody Thighs
UpperBody+Amm-+TTiigh
RCNN
23.26
47.38
$6.39
84.35
YOLOv3
41.16
64.67
66.93
87.68
8

---

Published as a conference paper at ICLR 2025
Affaci Success Kate Model and Contidence Level
Ciattd
FACNN
V00 DvA
DOTTR
MRCNN
Beiita
PO0K
VOLLOS
Mudch
Figure 3: Physical attack success rates with different detectors and confidence thresholds. The attack trained on the FastRCNN model, and the IoU threshold set as 0.5.
mAP Model
MASK RCNN
RETINA Modal
30
Epocts
Epochs
mAP SSD Model
2.. YOLOVe Model
mAP oc PCOS Model
Ipw
Uppn Digle
Caddeoc
wit
Wab
Figure 4: Visualization of adversarial textures and rendering results for dif- ferent body parts.
Figure 5: The impact of classifier-fres guidance the mAP (lower is better). The adversarial patch is trained on the FastRCNN model. The IoU threshold is set 0.5, It is shown that without the guidance (the blue line), the mAP drops more significantly.
4.4
ABLATION STUDY
The influence of modifying different body parts. Benefiting from the disentangled texture stacks, can render arbitrary body parts, shown in Figure 4 We evaluate the ASR of modifying different body parts and present these results in Table As the coverage area of the adversarial textures increases, the attack success rate also progressively increases.
The influence of classifier-free guidance. We tested the impact of classifier free guidance on the ASRs. We plot the mAP with and without classifier-fre guidance the white-box FastRCNN and the black-box objection detection models as the epochs progress, as shown in Figure S] We observe that the diffusion model without classifier-free guidance can achieve lower mAP the white-box and black-box models than using classifier-free guidance. We think this due to the truncation effect, which normalizes the latent representations within the high-probability areas improve image quality. This normalization restricts the generated images' noise levels and also reduces the transferability of untargeted attacks.
Table 4: Physical ASR in different scenes
Outdoor
Indoor
Scene
10am
2pm
6pm
Classroom
Home
Office
ASR
0.94
0.98
0.92
0.92
0.96

---

Published as a conference paper at ICLR 2025
GArBOn 1,00
Derson 1.00
CArsOn 1,00
1.00
cerson DOL
bockpock 0.99
bockpock 0.96
bockpock 0.95
backpock 0.97
Figure 6: Compare with normal images and adversarial images in digital attacks.
The influence of physical environment. To test the Attack Success Rate (ASR) under more complex real-world environments, compared the effectiveness of our attack in both indoor and outdoor scenes. For indoor scenes, data were collected from three different locations: a classroom, a home, and office. For outdoor scenes, three videos captured at 10 am, 2 pm, and 6 pm. Videos were recorded from various distances (1-5 meters) and included different poses, with 100 frames extracted from each video. The results are presented in Table demonstrating that our attacks effective across different scenes. We used RCNN as both the training and victim model.
The influence of different NeRF models. We compare the time needed edit the clothing textures for different dynamic NeRF models (Weng et al.) 20222; Geng et al. [023 Shao et al. 2024). Our method, based the UV- Volume, has the fastest speed among previous methods.
Table 5: Time required to edit clothing textures for different dynamic NeRF models
Method
Control4D
HumanNeRF
Fust-HumanNeRF
Ours
Render time for one image
~5h
~2h
~ ~1mmi
<0.5s
5 CONCLUSION
We introduce UV-Attack, novel physical adversarial attack leveraging dynamic NeRF-based UV mapping. Unlike previous methodologies that struggled with dynamic human poses, UV-Attack acc computes the expectation loss on the pose transformations, making our attack achieve high ASR to variable human poses and movements. The use of UV maps to directly edit textures without the need for gradient calculations of the NeRF model significantly enhances attack feasibility in worl-world scenarios. Our experimental results show that UV-At ack outperforms the state-of-u -otee------hrrr method by large margins Ultimately, our attack not only advances the research of person detection attacks but also introduces a new methodology for real-world adversarial attacks non-rigid 3DD objects.
pose datasets, achieving high ASRs diverse and challenging conditions.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGE
This work was supported in part by HK RGC GRF under Grant PolyU 15201323. Additionally, we would like thank Wenxuan Zhang Hong Kong Polytechnic University for his assistance with the ablation experiments.
REFERENCES
Mykhaylo Andriluka, Leonid Pishchulin, Peter Gehler, and Bernt Schiele. 2d human pose estimation: New benchmark and state the art analysis. IEEE Conference on Computer Vision and Puttern Recognition (CVPR), June 2014.
Jonathan T Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Bruall and Pratul P Srinivasan. Mip-nerf: A multiscale representation for anti-aliasing neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 5855-5864 2021.
Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. arXiv preprint arXiv:2305.08192 2023a.
Kai Chen, Jiaqi Wang, Jiangmiao Pang. Yuhang Cao. Yu Xiong, Xiaoxiao Li, Shuyang Sun, Wansen Feng, Ziwei Liu, Jiarui Xu, Zheng Zhang, Dazhi Cheng, Chenchen Zhu, Tianheng Cheng, Qijie Zhao, Buyu Li, Xin Lu, Rui Zhu, Yue Wu, Jifeng Dai, Jingdong Wang, Jianping Shi, Wanli Ouyang, Chen Change Loy, and Dahua Lin. MMDetection: Open mmlab detection toolbox and benchmark. arXiv preprint arXiv: / 901900066.7.. 2019.
Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Adydiffuser: Natural adversarial example synthesis with diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4562-45777 2023b.
Yue Chen, Xuan Wang, Xingyu Chen, Qi Zhang, Xiaoyu Li, Yu Guo, Jue Wang, and Fei Wang. Uv volumes for real-time rendering of editable free-view human performance. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 16621-16631, 2023c.
Yinpeng Dong, Shouwei Ruan, Hang Su, Caixin Kang, Xingxing Wei, and Jun Zhu. Viewfool: Evaluating the robustness of visual recognition to adversarial viewpoints. Advances in Neural Information Processing Systems, 35:36789-3668 2022.
Yexin Duan, Jialin Chen, Xingyu Zhou, Junhua Zou, Zhengyun He, Jin Zhang, Wu Zhang, and Zhisong Pan. Learning coated adversarial camouflages for object detectors, 2022.
Chen Geng, Sida Peng, Zhen Xu, Hujun Bao, and Xiaowei Zhou. Learning neural volumetric representations of dynamic humans in minutes. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8759-8770 2023.
Ross Girshick. Fast r-cnn. Proceedings of the IEEE international conference on computer vision, pp. 1448, 2015.
Huihui Gong, Minjing Dong, Siqi Ma. Seyit Camtepe, Surya Nepal, and Chang Xu. Stealthy physical masked face recognition attack via adversarial style optimization. IEEE Transactions on Multimedia, 2023.
Amira Guesmi, Ruitian Ding. Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14595-24604 2024.
Riza Alp Güler, Natalia Neverova, and lasonas Kokkinos. Densepose: Dense human pose estimation in the wild. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 7297-7306, 2018.
Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn, 2018
11

---

Published as a conference paper at ICLR 2025
Yu-Chih-Tuaii Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen- Huang Cheng. Naturalistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 7848-78577 2021.
Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang. and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 13307-13316, 2022.
Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural-looking clothing textures evade person detectors via 3d modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 16975-16984 2023.
Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-sea: Transfer-based self-ensemble attack on object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20514 20522,, 2023.
Yao Huang, Yinpeng Dong, Shouwei Ruan, Xiao Yang, Hang Su, and Xingxing Wei. Towards transferable targeted 3d adversarial attack the physical world. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, 2024.
Glenn Jocher, Ayush Chaurasia, and Jing Qiu. Ultralytics YOLO. https://github.cmm com/ ultrralyricssmltraaltt.... 2023.
Nikos Kolotouros, Georgios Pavlakos, Michael J Black, and Kostas Daniilidis. Learning to recon- struct 3d human pose and shape via model-fitting the loop. Proceedings of the IEEF/CVF international conference computer vision, pp. 2252-2261, 2019.
Leheng Li, Qing Lian, and Ying-Cong Chen. Adv3d: Generating 3d adversarial examples in driving scenarios with nerf. arXiv preprint 2XXiv:339.0135// 2023a.
Leheng Li, Qing Lian, Luozhou Wang, Ningning Ma, and Ying-Cong Chen. Lift3d: Synthesize 3d training data by lifting 2d gan to 3d generative radiance field. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 332-341, 2023b.
Yanghao Li, Hanzi Mao, Ross Girshick, and Kaiming He. Exploring plain vision transformer backbones for object detection. In European conference on computer vision, pp. 280-296. Springer, 2022.
Yanjie Li, Yiquan Li, Xuelong Dai, Songtao Guo, and Bin Xiao. Physical Phyld optical adversarial attacks on 3d face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 14699-24708 2023c.
Shuo- Yen Lin, Ernie Chu, Che- HiseH Lin, Jun- lun-Cheng Chen, and Jia-Ching Wang. Diffusion to confusion: Naturalistic adversarial patch generation based on diffusion model for object detector. arXiv preprint arXiv:2307.08000 2023.
Tsung-Yo Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense object detection, 2018.
Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng- Yang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In Computer Vision-ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part 14, pp. 21-37. Springer, 2016.
Chengqi Lyu. Wenwei Zhang, Haian Huang, Yue Zhou, Yudong Wang. Yanyi Liu, Shilong Zhang, and Kai Chen. Rtmdet: An empirical study of designing real-time object detectors. arXiv preprint arXiv:2212.00774, 2022.
Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view synthesis. Communications of the ACM, 65(1):99-106, 2021.
12

---

Published as a conference paper at ICLR 2025
Thomas Müller, Alex Evans, Christoph Schied, and Alexander Keller. Instant neural graphics primitives with a multiresolution hash encoding. ACM transactions on graphics (TOG), 41(4): 1-15, 2022.
Sida Peng. Yuanqing Zhang, Yinghao Xu, Qianqian Wang. Qing Shuai, Hujun Bao, and Xiaowei Zhou. Neural body: Implicit neural representations with structured latent codes for novel view synthesis of dynamic humans. In CVPR, 2021.
Ariadna Quattoni and Antonio Torralba. Recognizing indoor scenes. In 2009 IEEE conference on computer vision and pattern recognition, pp. 413-420. IEEE, 2009.
Nikhila Ravi, Jeremy Reizenstein, David Novotny, Taylor Gordon, Wan- Yen Lo, Justin Johnson, and Georgia Gkioxari. Accelerating 3d deep learning with pytorch3d. arXiv preprint arXiv:2007.08520 2020.
Joseph Redmon and Ali Farhadi. arXivv1804.02767, 2018.
Yolov3: An incremental improvement. arXiv preprint
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Shouwei Ruan, Yinpeng Dong, Hang Su, Jianteng Peng, Ning Chen, and Xingxing Wei. Towards viewpoint-invariant visual recognition via adversarial training. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 4719-4719, 2023.
Ruizhi Shao, Jingxiang Sun, Cheng Peng, Zerong Zheng, Boyao Zhou, Hongwen Zhang, and Yebin Liu. Control4d: Efficient 4d portrait editing with text. 2024.
Naufal Suryanto. Yongsu Kim, Hyoeun Kang, Harashta Tatimma Larasati, Youngyco Yun, Thi-Thu Huong Le. Hunmin Yang, Se- Yoon Oh, and Howon Kim. Dta: Physical camouflage attacks using differentiable transformation network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15305-15314, 2022.
Jia Tan, Nan Ji, Haidong Xie, and Xueshuang Xiang. Legitimate adversarial patches: Evading human eyes and detection models in the physical world. In Proceedings of the 29th ACM international conference on mullimedia, pp. 5307-5315, 2021.
Simen Thys, Wiebe Van Ranst, and Toon Goedemé. Fooling automated surveillance cameras: adversarial patches to attack person detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pp. 0-0, 2019.
Zhi Tian, Chunhua Shen, Hao Chen, and Tong He. Fcos: Fully convolutional one-stage object detection, 2019.
Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. Fea: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pp-
2414-2422, 2022.
Donghua Wang, Wen Yao, Tingsong Jiang, Chao Li, and Xiaoqian Chen. Rfla: A stealthy reflected light adversarial attack in the physical world. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4455-4465, 2023.
Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8565-8574, 2021a.
Yajie Wang, Haoran Lv, Xiaohui Kuang, Gang Zhao, Yu-an Tan, Quanxin Zhang, and Jingjing Hu. Towards a physical-worlee adversarial patch for blinding object detection models. Information Sciences, 556:459 2021b.
13

---

Published as a conference paper at ICLR 2025
Chung- Yi Weng, Brian Curless, Pratul P Srinivasan, Jonathan T Barron, and Ira Kemelmacher- Shlizerman. Humannerf: viee-vie rendering of moving people from monocular video. In Proceedings of the IEEE/CVF conference computer vision and pattern Recognition, pp. 16210-16220, 2022.
Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin- Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in physical world. In Computer Aision-ECCI 2020: 16th European Conference, Glasgow. UK, August 23-28. 2020, Proceedings, Part V 16, pp. 665-681. Springer, 2020.
Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample gen- eration for improved stealthiness and controllability. Advances in Neural Information Processing Systems, 36, 2023.
Xiao Yang, Chang Liu, Longlong Xu, Yikai Wang. Yinpeng Dong, Ning Chen, Hang Su, and Jun Zhu. Towards effective adversarial textured 3d meshes on physical face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 41 4119-4128, 2023.
Yu Zhang, Zhiqiang Gong, Yichuang Zhang, Kangcheng Bin, Yongqian Li, Jiahao Qi, Hao Wen, and Ping Zhong. Boosting transferability of physical attack against detectors by redistributing separable attention. Puttern Recognition, 138: 109435, 2023.
Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen. Seeing isn't believing: Towards more robust adversarial attack against real world object detectors. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp. 2019.
Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15345-15354, 2022.
Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable detr: Deformable transformers for end-to-end object detection. arXiv preprint arXiv:2010.04159, 2020.
Liang Lin Ziyi Dong, Pengxu Wei. Adversarially-aww aware robust object detector. In Proceedings of the European Conference on Computer Vision, 2022.
Zhuofan Zong, Guanglu Song, and Yu Liu. Detrs with collaborative hybrid assignments training. In Proceedings of the IEEE/CVF international conference computer vision, pp. 6748-6758, 2023.
A ADDITIONAL EXPERIMENT RESULTS
A.1 ATTACK RESULTS ON MORE OBJECT DETECTION MODELS
To evaluate the transferability of our attack, we trained the adversarial textures on FaStRCNN (Girshick 2015) and tested their transfcrability across variety of person detectors with diverse backbones. These include models such as Deformable DETR (Zhu et al. 2020), RetinaNet (Lin et al. 2018). SSD (Liu al. 2016). FCOS (Tian al., 2019), as well more recent detectors like R XTMDET (Lyu et al. 2022), YOLOV8 (Jocher et al. 2023), VITDET (Li et al.] 2022). ) and Co-DETR Zong et al. (002).. Notably, Co-DETR achieves the highest mean Average Precision (mAP) of 66% on the COCO object detection task. ViTDET, which employs the Vision Transformer as its backbone, allows us to further assess the attack's effectiveness across different backbone architectures. Co-DETR also supports different backbones. Our experiment tests Co-DETR on two different backhones, ResNet50 and Swin Transformer. We implement Co-DETR and VITDET using the MMDET toolbox (Chen et al. 2019).
To evaluate the attack effectiveness, we adopt two different metrics, ASR and mAP The ASR is defined as:
ASR
1
Σ I (3b; E B, :oU(b, gi) > Tou A Conf(b:) > TConf A label(b.) person) (6)
D
iED
14

---

Published as a conference paper at ICLR 2025
where (D) is the total number of images in the dataset, B, is the set of predicted bounding boxes for image i. The II(() is the indicator function that returns 1 if the condition inside is true, and otherwise. In the experiment, we set both ToU and TCoef 0.5. Since ASR is influenced by the confidence threshold (Teouf), we use another metric, mAP, to measure the strength of the attack. mAP is calculated the area under the Precision- Recall curve across different thresholds. The greater the drop in mAP, the more effective the attack is.
We compare our methods with two state-of-the-ar person detection attacks (Adv-Camou (Hu et al. 2023) and DAP (Guesmi et al. 2024)) across 250 epochs. 7 presents different models. We trained the adversarial patch using Fast-RCNN and evaluated its transferability to other detectors. The results demonstrate that our method significantly outperforms both Adv- Camou and UV-Attack in terms of transferability on a variety of detectors with different backbones. For instance, our approach achieves an ASR of 0.6 on the ViTDET model, which uses the Vision Transformer (ViT) as its backbone. Additionally, our attack shows a relatively low ASR on the state- of-the-art Co-DETR-SWE
pressenss the ASR results across
model, indicating that the Co-DETR- SWIN model is more robust against adversarial examples, but still outperforms DAP and Adv-Camou. Figure X shows the mAp results across different models. It is shown that although DAP can quickly reduce mAP, its transferability is significantly lower than our method, especially on models with different architectures, such as Retina, SSD, FCOS, DETR and VITDET.
ASR FAST RCWN Model
ASR MASK ACNN Model
ASR RETINA Model
ASR Model
Camis
DAP
DAP
0.7
0.3
350
300
250
c0
150
250
0.
350
200
250
0.0
1E0
150
200
Epochs
Epochs
Esochs
Epocts
ASR FCDS Model
ASA DETI
ASR
YOU
1.0
Ice
AdyCamou
Corree
Lbe
0.3
100
200
Z50
150
200
350
150
200
100
200
Epscha
Epocta
Eoochs
Spscha
VITDET
on RTNOET Nocel
Model
ASR DETR-SSIINN
1.0
Cares deliging P
Adedaves
DAP
Det
DAt
DeP
0.
150
Epocho
Epocts
Ecochs
Epochs
Figure 7: Comparison of the white-box ASR (on Fast-RCNN) and black-box ASRs (on the other nine detectors) of our proposed attack Attck) and two sfate-of-the-art person detection attacks (Adv-Camou (Hu et al. 2023) and DAP (Guesmi et al. (024)) across 250 epochs. We attack a static person for a fair comparison. For DAP, we repeat the adversarial patch on clothes to make cover the whole body. All adversarial patches are trained on the FCNN model.
B ADDITIONAL ABLATION STUDIES
B.1 THE INFLUENCE OF ENVIRONMENTS
To evaluate the attack performance in different environments, we test the attack success rate and mAP on a new indoor dataset (Quattoni& & Torralba 2009), which contains 67 Indoor categories, and a total of 15620 images. The number of images varies across categories, but there are at least 100 images per category. We select 13 common scenarios: bedroom, airport, office, etc. The attack results are shown in Figure I0 It is shown that all scenarios achieve high ASR when the confidence threshold is set as 0.5. For the mAP, all scenarios are less than 0.2, and 6 scenarios are less than 0.1, including bedroom, bathroom, airport, office, library, and church.
15

---

Published as a conference paper at ICLR 2025
mAP FAST-RCNN Modal
RETINA
Model
1.0
ADHCATCA
0.2
0.3
250
200
250
LS0
230
150
60-
100
200
Epscte
Epocts
Esocho
Epocts
ICDS
mAP
mAp
1.0
Lew Carce
DAP
Spachs
Spoche
Ezechs
Tpoche
VITDET Modal
mAP on RTNDET Model
on Model
msP DETR
1.0
10:
Paysss
Adodancu
240
AdrCamou
Epocho
Epocts
Boodhs
Epachs
Figure 8: Comparison of the mAPs different detectors of our proposed attack (UV-Attack) and two state-of-the-art person detection attacks (Adv-Camou (Hu et al. 2023) and DAP (Guesmi et al. 2024)) across 250 epochs. We attack a static person for fair comparison. The adversarial patch is trained on the Best-RCNN model. Compared with the previous attacks, our attack significantly decreases the mAP different backbones, especially on ViTDET.
1.0
1.0
0.99
0.99 1.0 1.0 0.99
0.99 0.99
1.0
1.0
0.99
1.0
ASR
MAP
0.6
Values
0.2
0.19
0.1
0.12
0.13
0.2
0.17
0.11
0.15
0.07
0.03
0.02 library
0.02
0.0
bedroom
bathroom
airport inside
clothingstore
office
subway
museum
artstudio
bar church inside
dining_ room
hospitalroom
Indoor Scenarios
Figure 9: The attack success rate and mAP on new indoor dataset (Quattoni Torralba 2009). It is shown that all scenarios achieve high ASR when the confidence threshold is set as 0.5. For the mAP, we achieve mAPs of less than 0.1 on 6 out of 10 scenarios, including bedroom, bathroom, airport, office, library, and church.
B.2 THE SENSITIVITY OF ASR TO DIFFERENT POSES
As shown in Figure we analyze the sensitivity of ASR to different poses sampled from a GMM distribution. Specifically, 2000 examples were randomly sampled from a GMM with 10 components. The red line represents the number of examples corresponding to each component, while the blue bars indicate the ASR of the samples within each component. The results demonstrate that high
16

---

Published as a conference paper at ICLR 2025
ASR is consistently achieved across poses belonging to different components. For component because no poses are sampled, the ASR is also zero.
Moreover, evaluate the sensitivity of ASR to different poses sampled from video in the ZJU- Mocap dataset, as shown in Figure 12 A total of 20 poses were selected by sampling every 20th frame from video containing 400 frames. For each pose, 10 images were captured from different view angles. The results show that the ASR ranges from 0.76 to 0.92, with an average ASR of 0.82.
To explain why GMM can effectively model the distribution of poses, plotted histograms of the 72-dimensional pose vector. Due to space constraints, we visualized dimensions 51-60. As shown in the Figure, most pose dimensions exhibit unimodal or bimodal distributions, which makes GMM an effective choice for modeling.
Figure 10: The distribution histograms of the pose vectors.
ASR Action Index
250
0.90
150
0.88
0.00
0.84
150
0.82
0.2
30
0.0
100
1.50
200
250
350
Action
Figure 12: Illustration of ASR sensitivity to different poses sampled from video from the ZJU-Mocap dataset. A total 20 poses were sampled from video with 400 frames with an interval of 20 frames. For each pose, we capture 10 images from different view angles. It is shown that the ASR varies from 0.76 to 0.92 with an average of 0.82.
Figure 11: Illustration of ASR sensitivity dif- ferent poses sampled from GMM distribution. A total of 2000 examples were randomly sam- pled from a GMM with 10 components. The red line shows the number of examples per ponent, while the blue bars represent the ASR for each component. High ASR values are ob- served across multiple pose components.
B.3 THE INFLUENCE OF THE GUIDANCE OF STABLE DIFFUSION MODEL
Figure 13 presents the generated patches with and without classifier-free guidance. The top row uses "Dog" as the prompt, while the bottom row uses "Horse" as the prompt. The results indicate that although frrsifier-frre guidance produces more natural-looking images, it leads to slower convergence the adversarial loss. Interestingly, when using "Horse" " as the prompt, the adversarial loss for the guidance setup is initially lower than for guidance. We attribute this to the better
17

---

Published as a conference paper at ICLR 2025
starting point provided by the guidance. However, training progresses, the adversarial loss for the no- go-duuddace setup decreases more rapidly, ultimately yielding a stronger attack.
Figure 20 presents comparisons of transferability under naturalness constraints. In this experiment, we incorporate classifier- free guidance to generate more natural adversarial patches. The results show that method, even with naturalness constraints previous state-of-the-art methods (e.g., DAP) in terms of transferability on models like Retina, SSD, and DETR. Additionally, our method demonstrates competitive performance on YOLOv3 and FCOS. This indicates that UV-Attack maintains strong transferability while achieving greater visual stealth through naturalness constraints.
ww--Attack-guianne
still outperforms
Eparh
Fpoch
Epoch
Epoch 180
Prompt: Dog
Guidance
NoGuidence
Lass
0.6
No Geldance
200
Epochs
Epech
Prompt: Horse
Guidance
NoGuidance
0.8
Ado Loss
Epoch 20
Epech 60
Epoch 100
Epoch 140
Epoch L80
0.2
200
No
Epochs
Figure 13: Visualization of generated patches with and without classificr free guidance. The top row uses "Dog" the prompt. and the bottom uses "Horse" as the prompt. Although classifier-fre free guidance generates more natural-looking images, the adversarial loss converges more slowly. In the case of the "Horse" prompt, the adversarial loss with guidance starts lower than without guidance, likely due to a better initialization. However, as training progresses, the no- no-guidance setup achieves a faster decrease loss, indicating stronger attack.
B.4 THE INFLUENCE IMAGE COMPLEXITY ON THE ATTACK EFFECTIVENESS
Figure illustrates the changes in total variance (TV) and mAP as the number of training epochs increases. In the initial few epochs, TV increases rapidly and then stabilizes, while mAP continuously decreases, indicating that more complex images have higher attack success rate. In Figure 12, visualize the temporal changes of the adversarial patch. It can be observed that during the early stages of training, the image changes significantly. followed by little no change. Particularly in the last row, the image starts off relatively simple, so the loss does not decrease. As the complexity increases, the loss quickly converges to a smaller value.
B.5 THE ATTACK RESULTS ON ROBUST MODELS.
Figure 15 illustrates the attack results on the robust model. We test attack on the RobustDet
Ziyi Dong 2022 We use the VGG version of the pretrained RobustDet model. The RobustDet is adversarially trained PGD and DAG attacks. We train the adversarial patch Fast-RCNN and test the mAP on the black-box box RobustDet. The results show that although RobustDet is resistant to PGD and DAG attacks, its mAP drops from 1.0 0.85 in adversarial examples.
18

---

Published as a conference paper at ICLR 2025
B.6 THE INFLUENCE ON DIFFERENT PROMPTS
Figure 17 shows the training loss curves across epochs under different prompts. Although the convergence speed varies slightly among different prompts, they all converge to relatively small value. This indicates that our method is effective across different prompts.
B.7 THE TRANSFERABILITY OF ENSEMBLE METHOD
The ensemble method is widely used improve transferabilityy However, found that direct training on RCNN and YOLOv3 resulted in slow loss convergence. To address this issue, we first trained RCNN for 300 epochs and then trained both RCNN and YOLOv3 for additional 20 epochs. Figure 18 illustrates the mAP degradation across different methods. The ensemble method achieved lower mAP five out of six models, indicating that the ensemble approach effectively reduces mAP.
B.8 THE TRANSFERABILITY ON UNSEEN SUBJECTS
Figure 19 shows the attack results on unseen subjects. We train the adversarial patch on subject and then test the ASR on subject The attack success rate decreased by 20%-35%. We believe this is due to significant differences in body shapes and motion habits between different subjects, which caused the drop in success rate.
1.0
3.0
0.
1900
0.5
0.-
1602
0.6
0.4
0.4
1400
02-
Rosusthet mi
0.0
ROWK
Eoochs
250
200
200
Epochs
Figure 14: Illustrations on the changes in total variance (TV) and mAP as the number of train- ing epochs increases. In the initial few epochs, TV increases rapidly and then stabilizes, while mAP continuously decreases, indicating that more complex images have higher attack suc- cess rate.
Figure 15: The attack results the RobustDet (Ziyi Dong 2022). We use the VGG version of the pretrained RobustDet model. The model is adversarially trained on PGD and DAG attacks. The results show that RobustNet is relatively resistant to our attack.
C ADDITIONAL EXPERIMENTS IN THE PHYSICAL ENVIRONMENTS
We demonstrate the attack effects in three different scenarios: hallway, a lawn, and a library. For each scenario, we recorded video of approximately minute with frame rate of 30 FPS, using an iPhone 13 as the recording device. The confidence threshold is set as 0.5. The results are shown in Figure 16 The adversarial patch is trained the Faster-RCND model. In these three scenarios, achieve ASR of 0,84, 0.83, and 0,80, respectively. The experiments show that we can successfully fool Faster- Rester-RCNN in various scenarios.
19

---

Published as a conference paper at ICLR 2025
Figure 16: The attack effects are demonstrated in three different scenarios: a hallway, a lawn, and library. For each scenario, recorded video of approximately minute with frame rate of 30 FPS, using an iPhone 13 as the recording device. The confidence threshold is set as 0.5. The experiment shows that we can successfully fool Faster R-CNN in various scenarios.
Loss Over Training Epochs
1.0
Prompt Train
Motorcycle
Promot
Promot Banana
Training Loss
0.6
0.2
50
100
150
200
250
300
Epoch
Figure 17: Visualization of the training loss changing with the epochs for different prompts.
20

---

Published as a conference paper at ICLR 2025
training more 1c1n
yelov3 essemble
0.
mAr
0.0
RETISA
PoLOvD
co
CD OETR Stold
VITDET
Architectures
Figure 18: Comparison of the transferability on different white-box models. The ensemble method achieves lower mAp on out of 6 Maxk-box models. The Y-axis is the mAP.
ASR Comparison Between
1.0
0.8
0.6
0.4
0.2
0.0
Icom
NETRA
VoLov
commm
Co-DETR-SW Swn
WITES
Figure 19: The attack transferability unseen subjects. We train the adversarial patch subject and then test the ASR on subject 2. The white-box model is Master-RCNy, The Y-axis is the attack success rate.
D VISUALIZATION OF ATTACK TRANSFERABILITY ON UNSEEN POSE SEQUENCES
We evaluate the transferability of attack using video sequences from the 7JU-Mocap dataset, which were not seen during the training phase. Figure 21 compares the ASR of three meth- ods-Random, DAP (Guesmi al. 2024) and UV-Attack across five pose sequences (#386, #387, #390, #392, #394) from the ZJU-Mocap dataset. UV-Attack consistently achieves the highest ASR, peaking at 0.91 on #387, while DAP shows moderate performance and Random performs poorly. This highlights the effectiveness of UV-Attack on unseen datasets. We also visualize some results in Figure 22 The first column displays the original pose images. By extracting the pose parameters, we generate human images wearing normal clothing and adversarial clothing. The results demon- strate that our attack achieves high success rate, with an average ASR of 79% across five unseen pose sequenees, even previously unobserved poses, significantly outperforming the SOTA DAP attack (Guesmi et al,, 2024), which achieves an ASR 38%. This highlights our approach's strong effectiveness and robustness in real-worke scenarios.
21

---

Published as a conference paper at ICLR 2025
mAP
0.4
E4
UV WuRttck guidircs
DAP
0.7
02-
Epechs
Fpocts
Eoochs
Fpochs
YOLOVS Model
MAP on
1.0
10-
0.0
200
230
150
Figure 20: Comparisons of transferability with the naturalness constraints. Here we add the classifier- free guidance to generate natural images. is shown that our method outperforms previous SOTA methods regarding transferability on Retina, SSD, and DETR and shows competitive results on YOLOv3 and FCOS.
Attack Success Rate (ASR) Comparison Across Real-World Pose Datasets
Random
0.91
UV-Attack
0.84
0.80
0.8
ASR
0.51
0.4
0.33
0.13
0.01
0.00
0.00
0.01
0.00
0.0
#386
#387
# #390
#392
#394
Datasets
Figure 21: Comparison of ASR across different real-world pose sequences (#386. #387, #390, #392, #394) from the Moc-p for three methods: Random, DAP, and UV-Attack. All these pose sequences are unseen during the training. UV-Attack achieves the highest ASR consistently across all datasets, demonstrating its effectiveness compared to the other methods.
22

---

Published as a conference paper at ICLR 2025
cerson
0.85
bockpack 0.96
person 1.00
person 0.95
bockpock 0.95
person 1.00
person 0.93
0.99
cot 0.89
bockpack
Figure 22: Visualization of attack results sequences from the ZJU-Mocap dataset, which were not seen during the training phase. The first column displays the original pose images. By extracting the pose parameters, we generate human images wearing normal clothing (shown in the second column). The third and fourth rows are the adversarial clothes generated by the DAP and UV-Attack. The results demonstrate that our attack achieves a higher success rate than previous SOTA DAP attacks, even on unseen poses, highlighting its effectiveness in real-world scenarios.
poses of DAP and attack using video
23


Reviews:
[{"review_id": "d5b10BuDKe", "reviewer": "Reviewer_1muW", "summary": "The paper presents UV-Attack, a novel physical-world adversarial attack for person detection systems. The core idea is leveraging dynamic Neural Radiance Fields (NeRF) for UV mapping to generate adversarial images across varying human actions and viewpoints. The attack modifies clothing textures through UV maps rather than traditional RGB images, allowing real-time, practical texture edits. A new Expectation over Pose Transformation (EoPT) loss is introduced to improve the attack's success rate for unseen human poses. The paper highlights the potential of using dynamic NeRF and UV mapping for adversarial attacks on non-rigid objects like human bodies.", "questions": "In addition to the weaknesses, please refer to the following:\n\n1. How sensitive is the attack to the specific poses, say sampled from the Gaussian Mixture Model (GMM)? Would other pose distributions significantly affect the results? There is limited statistical insight in the paper.\n\n2.  Does the complexity of clothing textures (e.g., different patterns or colors) impact the effectiveness of the attack? \n\n3. How well does UV-Attack generalize to detection models not tested in the paper, particularly beyond YOLO and FastRCNN variants? Could there be a model-specific bias in the attack’s success rate? This needs to be addressed in detail.\n\n4. There is limited discussion on potential defenses against UV-Attack, which is crucial for the broader adversarial machine learning community. A discussion or experiment on how robust the attack is to adversarial training or other defenses would make the paper more impactful.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The use of dynamic NeRF-based UV mapping for adversarial attacks is an innovative approach, addressing the challenge of human movement.\n\n2. The approach can generate adversarial textures in real-time, making it feasible for real-world attacks\n\n3. The proposed method outperforms previous adversarial attacks, achieving a high ASR across varied poses and detectors, particularly in free-pose settings.\n\n4. The method’s ability to handle diverse human poses through EoPT and UV mapping may enhance its robustness", "weaknesses": "1. The method heavily depends on pretrained stable diffusion models for generating adversarial patches, which might limit its generalizability to other model architectures.\n\n2. The attack pipeline involves multiple steps, including dynamic NeRF, UV mapping, and diffusion models, which increases the complexity and may pose practical limitations in some applications.\n\n3. While the paper claims success in physical-world attacks, the physical-world experiments are limited to a few environments and detection models. \n\n4. The paper shows good results on some detectors but does not fully address how transferable the attack is to other models not tested in the experiments. The impact of domain shift (e.g., different datasets) is also not well explored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DpdMAdQIEm", "reviewer": "Reviewer_knkd", "summary": "This paper introduces a novel adversarial attack pipeline for person detection, termed UV-Attack. First, it innovatively incorporates a NeRF-based UV mapping method into the person detection adversarial attack pipeline, enabling the generation of diverse human UV maps and textures with varying poses and camera perspectives. Second, it leverages a diffusion model to generate adversarial patches, which are then interpolated with textures produced by 3D human models to render adversarial human images. Finally, comprehensive experiments are conducted across various mainstream detectors and scenarios, benchmarking the proposed method against existing approaches.", "questions": "1. In your training for a specific detector, you mentioned that you collected 100 different backgrounds from both indoor and outdoor scenarios. Could you provide more details about this data and its sources? In other words, how significantly does this data impact the effectiveness of the adversarial sample generation?\n2. Your pipeline requires sampling SMPL pose parameters from a Gaussian Mixture Model (GMM). When modeling the GMM, you need to input the target video and the human pose dataset. What is the purpose of including the target video?\n3. When validating the ASR, you average class labels except for \"person\" in the COCO dataset. During training, is the diffusion model condition kept consistent throughout?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper presents a novel approach to generating adversarial samples for human detection. Firstly, it cleverly utilizes the UV map and texture of the human model to introduce adversarial patches, enabling efficient rendering onto RGB images of the human figure for multi-view attacks. Secondly, it leverages the robust generative priors of diffusion models to perform interpolation at the texture level. Finally, this method achieves significant accuracy improvements in dynamic and multi-pose scenarios by sampling various human poses and perspectives, further validating the effectiveness of the proposed approach.", "weaknesses": "This paper has shortcomings in the presentation of experimental details and data, which may lead to confusion regarding the reproducibility and generalizability of the findings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "H3g4J1YLCl", "reviewer": "Reviewer_mhf9", "summary": "The authors propose a novel method to attack person detectors for various human poses in the physical world. They incorporate dynamic NeRF-based UV mapping and the Gaussian Mixture Model to sample and generate unseen human poses with editable textures. The texture is generated by a latent diffusion model. They then combine PSO and Adam optimizer to find the optimal diffusion latent variable for the adversarial texture. The adversarial texture outperforms multiple baselines in both the digital and the physical world.", "questions": "1.\tWhat is the training dataset? Does it include the videos recorded by the authors? If so, the authors should make a split on the training and test dataset that consists of different subjects and backgrounds.\n2.\tAre the training datasets for digital and physical evaluation different? If so, why? What is the physical adversarial effectiveness of the digitally optimized patterns?\n3.\tIs the SMPL modeling for each subject the same? What's the transferability to unseen subjects? Does this mean that this method requires training a UV-volume model and optimizing for each person who is going to wear the adversarial clothes? If so, this method seems to have a great limitation; how to address this?\n\nI'm happy to raise the score if these concerns are addressed.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1.\tThe writing is clear and easy to understand.\n2.\tThe goal of this paper is important to this area, and the solution is technically sound.\n3.\tThe experiments are comprehensive. The authors evaluate the adversarial effectiveness of the adversarial patterns under various parameters, including poses, viewing angles, and IoU thresholds. White box and transfer study are both included.", "weaknesses": "1.\tThe digital test setting seems a little problematic. The test poses are generated by GMM, which could be unreal. This raises the training-test contamination issue since a GMM-based model is also included in the model comparison. I suggested using videos from a different source.\n2.\tIt lacks a null model for comparison: a non-adversarial pattern, such as an everyday clothes pattern, or a generated pattern from a random initial point.\n3.\tThe training detail section is confusing; please see the questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "u26uZrPjWq", "reviewer": "Reviewer_3gqc", "summary": "This paper introduces UV-Attack, a novel adversarial approach using dynamic-NeRF-based UV mapping to achieve high ASRs on person detectors across diverse human actions and viewpoints. By generating UV maps rather than static RGB images, UV-Attack enables real-time texture modifications, making it practical and adaptable to unseen poses. Experiments show a 92.75% ASR against FastRCNN and 49.5% on YOLOv8, significantly surpassing prior methods and showcasing the potential of dynamic NeRF for effective adversarial attacks on moving human targets.", "questions": "Please refer to the weakness. If my questions are addressed, I will raise the score.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The idea of expanding the perturbation space by removing classifier-free guidance is interesting and brings a fresh perspective for boosting the transferability in the physical world.\n2. The experiments are comprehensive, covering both digital and physical environments for thorough validation.\n3. The paper is well-organized, with a clear and logical flow.", "weaknesses": "1. I’m a bit unclear on the Expectation over Pose Transformation (EoPT) loss. How does it differ from the standard Expectation over Transformation (EoT)? From Equation (5), it seems that the transformations traditionally applied at the image level have been shifted to include pose, camera, and lighting changes.\n2.  Why do you choose YOLOv3 and Faster R-CNN as the target models rather than other, potentially more recent models?  Is there an underlying reason for this choice?\n3. In line 431, the paper mentions that structural differences between models like SSD and the target model lead to limited transferability. Why not try a model ensemble approach to boost transferability, which is often used in physical attacks?\n4. Could you clarify how the target model is set up? Is it just a pretrained model, or is it fine-tuned on a specific dataset? Additionally, how do each of the models perform on clean samples? This would serve as an important comparison, especially for physical-world testing. Since factors like distance, angle, and setting can greatly impact a detector’s performance in the physical world, poor performance on clean samples would reduce the significance of the attack itself.\n5. For the physical experiments: (1) there is no mention of how many frames were captured in the video used to calculate ASR; if the frame count is too low, the results may lack credibility; (2) the physical-world attack examples are limited in the current draft—please provide a more complete set.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WKf4rzRmEH", "reviewer": "Reviewer_qDwz", "summary": "The paper presents UV-Attack, a method designed to generate effective physical adversarial attacks targeting person detection systems by leveraging dynamic Neural Radiance Fields (NeRF) and UV mapping. This approach allows adversarial textures on clothing to adapt seamlessly to various human poses, addressing the challenges posed by non-rigid human movement. UV-Attack introduces two key components: a custom Expectation over Pose Transformation (EoPT) loss function to enhance attack success across diverse poses and viewpoints, and adjustments to the diffusion model to improve the transferability of adversarial examples to different detection systems.", "questions": "Check weakness", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper introduces a novel application of dynamic NeRF and UV mapping, addressing the challenge of generating adaptable adversarial textures for non-rigid objects like human bodies. \n- The authors propose an Expectation over Pose Transformation (EoPT) loss, which improves the patch’s robustness by ensuring its effectiveness across a wide range of poses.\n- Extensive experiments across multiple person detection models and in various settings, including both white-box and black-box scenarios.\n- The physical testing on printed clothing showcases UV-Attack’s applicability in real-world scenarios.\n- The writing and presentation are clear and easy to follow.", "weaknesses": "- The paper focuses heavily on maximizing attack success rates against person detection models but does not address visual inconspicuousness or stealth. For a physical adversarial attack to be practical in real-world scenarios, it should evade not only machine detection but also appear natural and undetectable to human observers. UV-Attack’s textures might draw attention due to potentially unnatural patterns, especially in public settings where they could be easily noticed.\n\n=> Action: I recommend introducing constraints that limit the patch’s appearance to more natural or common textures, to balance adversarial effectiveness with visual stealth. This could improve the applicability of UV-Attack in sensitive contexts, such as surveillance evasion, where inconspicuousness is essential.\n\n- The authors report success rates for state-of-the-art attacks that differ significantly from those in the original publications. This inconsistency complicates direct comparisons and may impact the perceived credibility of UV-Attack’s comparative performance. Additionally, some state-of-the-art techniques apply constraints on patch appearance to ensure inconspicuousness, making comparisons with unconstrained approaches potentially unfair.\n\n=> Action: To improve clarity and credibility, the authors should explicitly document the reasons behind any benchmarking deviations and, where possible, apply similar constraints to UV-Attack’s patches for fair comparison. Aligning evaluation protocols with prior works or noting significant differences in approach would enhance the validity of the comparison.\n\nLess Important:\n\n- The paper overlooks relevant related work, particularly “DAP: A Dynamic Adversarial Patch for Evading Person Detectors,” which similarly aims to create patches that are robust to non-rigid transformations. Including this work in the literature review would help contextualize UV-Attack’s contributions within the existing research.\n\n=> Action: Discussing DAP and other similar methods would provide readers with a clearer understanding of UV-Attack’s novelty and advancements, especially in handling non-rigid transformations.\n\n- The use of dynamic NeRF in UV-Attack is computationally intensive, which could limit applicability in scenarios requiring frequent re-designs of the patch for different targets or environments. While this is less relevant for single, offline generation, the computational demand could become a significant limitation if applications required ongoing adaptations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)