Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection
Authors: Hui Wei
Zhixiang Wang
Kewei Zhang
Jiaqi Hou
Yuanwei Liu
Hao Tang
Zheng Wang
Venue: NeurIPS 2024 poster (2024)
Keywords: Physical Adversarial Attack
Person Detection
Adversarial Patch
Camera ISP
Primary area: safety_in_machine_learning
TL;DR: We propose a camera-agnostic physical adversarial attack, CAP (Camera-Agnostic Patch), addressing the oversight of camera influence in existing physical adversarial attack methods.

Abstract: Physical adversarial attacks can deceive deep neural networks (DNNs), leading to erroneous predictions in real-world scenarios. To uncover potential security risks, attacking the safety-critical task of person detection has garnered significant attention. However, we observe that existing attack methods overlook the pivotal role of the camera, involving capturing real-world scenes and converting them into digital images, in the physical adversarial attack workflow. This oversight leads to instability and challenges in reproducing these attacks. In this work, we revisit patch-based attacks against person detectors and introduce a camera-agnostic physical adversarial attack to mitigate this limitation. Specifically, we construct a differentiable camera Image Signal Processing (ISP) proxy network to compensate for the physical-to-digital transition gap. Furthermore, the camera ISP proxy network serves as a defense module, forming an adversarial optimization framework with the attack module. The attack module optimizes adversarial patches to maximize effectiveness, while the defense module optimizes the conditional parameters of the camera ISP proxy network to minimize attack effectiveness. These modules engage in an adversarial game, enhancing cross-camera stability. Experimental results demonstrate that our proposed Camera-Agnostic Patch (CAP) attack effectively conceals persons from detectors across various imaging hardware, including two distinct cameras and four smartphones.

Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection
Hui Wei
Zhixiang Wang?*
Kewei Zhang 1+
Jiaqi Hou'
Yuanwei Liu'
Hao Tang² Zheng Wang"
National Engineering Research Center for Multimedia Software,
School of Computer Science, Wuhan University
The University of Tokyo
SScoool of Computer Science, Peking University https:/ccamerr--anostii oithiii.
Abstract
Physical adversarial attacks can deceive deep neural networks (DNNs), leading erroneous predictions in real-world scenarios. To uncover potential security risks, attacking the safety-critical task of person detection has garnered significant attention. However, observe that existing attack methods overlook the pivotal role of the camera, involving capturing real-world scenes and converting them into digital images, in the physical adversarial attack workflow. This oversight leads to instability and challenges in reproducing these attacks. In this work, we re- visit patch-based attacks against person detectors and introduce camera-agnostic physical adversarial attack to mitigate this limitation. Specifically, we construct differentiable camera Image Signal Processing (ISP) proxy network to compen- sate for the poysiccl-to-diiite transition gap. Furthermore, the camera ISP proxy network serves as a defense module, forming an adversarial optimization frame- work with the attack module. The attack module optimizes adversarial patches maximize effectiveness, while the defense module optimizes the conditional parameters of the camera ISP proxy network to minimize attack effectiveness. These modules engage in an adversarial game, enhancing cross-camera stability. Experimental results demonstrate that our proposed Canora-Agnostic Patch (CAP) attack effectively conceals persons from detectors across various imaging hardware, including two distinct cameras and four smartphones.
1 Introduction
Adversarial attacks have emerged as a concerning threat to deep neural network (DNNs)-based models, casting a shadow over their reliability, particularly as certain attack methods extend beyond the digital space and prove effective in real-world scenarios [1. 5, 27]. Examples include wearing specialized glasses to mislead facial recognition models for impersonation attacks [26] or wearing clothing with adversarial textures to evade machine vision systems [14]. This category of attacks is commonly known as physical adversarial attacks [33].
Successfully executing physical adversarial attacks presents heightened challenges due to domain transitions and various dynamic physical factors encountered throughout the process from eraft- ing digital perturbations to launching real-world attacks. Existing attack methods against person detectors have demonstrated notable advancements [32]. and we categorize their efforts into two main types: (1) Transitioning from the digital to the physical domain. where techniques such as Non-Printability Scores (NPS) [26] are employed to mitigate color reproduction discrepancies caused
Equul contribution
CCoresppondigg author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Sony
Huawei
Samsung
(a) AdvPatch [29] attack. Successful attack rate: 1/6
Sony
Canon
Redmi (b) Our attack. Successful attack rate: 6/6
iPhone
Huawel
Samsung
Figure I: Illustration depicting the impact of camera on attack performance. The bounding boxes indicate the YOLOv5 [17] detector successfully detects the person. In each setting, we maintain scene consistency to minimize irrelevant influences. In contrast to the AdvPatch [29] attack, which is effective only on Samsung devices, our method successfully executes attacks across all six cameras.
by printers [29]. (2) Transformations in the physical domain, which involve using operations like rotations, scale variations, and others to simulate real-world variations [11, 28), leveraging Thin Plate Splines (TPS) to model cloth deformation [35], and utilizing fully-cover textures on clothing to handle multi-angle variations in the real world [13, 14]. Naturally, question aríses: Is it necessary to explore another transition, namely, transitioning from the physical to the digital domain?
In the journey from the physical scene to digital images, the camera plays crucial role. This aspect has been overlooked for an extended period. Therefore, shed light the aforementioned question. we evaluated the camera's 's impact on attack performance. Specifically, we captured the same physical scene using different cameras (Sony, Canon, iPhone, etc.) and observed that the detection results for non-attack persons remained relatively stable, whereas, for persons with adversarial patches, the confidence values exhibited considerable variations. Some of the results are shown in Figure la. These experimental results demonstrate that the physical-to-digita domain transition, specifically the camera imaging pipeline's transformation real-world scenes into digital counterparts, constitutes crucial factor that significantly impacts adversarial attack performance.
Inspired by this observation, are committed to designing camera-agnoste physical adversarial attacks. To maintain stable attack performance across variety of imaging devices in the real world, our method introduces a camera simulation into the adversarial patch generation pipeline. Here we emphasize the significance of the camera ISP, a pivotal component that connects the RAW sensor data captured by the camera to the ultimate processed image. Our analysis reveals that camera ISP processing inherently attenuates attack performance, highlighting the camera ISP's potential defensive role against adversarial attacks, effectively positioning it as a natural defender. This observation aligns with Zhang el al. [39]. who employed learned ISP pipelines to design off-the-shelff preprocessing module for defending against digital adversarial attacks. Consequently, we propose an adversarial optimization framework to generate camera- aggssicc adversarial patches. Specifically, a differentiable camera ISP proxy network functions as a defense module by adjusting conditional parameters to reduce the efficacy of adversarial patches. Conversely, the patch optimization module enhances attack performance by optimizing the patch itself. This adversarial optimization endows the generated patches with robust effectiveness across diverse camera hardware, illustrated in Figure 1b.
summary, our main contributions are as follows:
A complete modeling of the workflow for physical adversarial attacks that integrates camera modules previously overlooked in existing research. Our method unveils the significant impact of the imaging devices and integrates differentiable camera ISP proxy network into the attack pipeline.
A new adversarial patch generation framework gains cross-camera attack capabilities. Our method leverages the camera ISP module's s defense properties by optimizing conditional parameters to reduce patch effectiveness, establishing zero-sum game with the perturbation

---

Table Summary of typical patch-based physical adversarial attacks against person defection. While existing attack methods have partially addressed the Digital -et--too-PPhhcc transition, none have systematically investigated the Physical-to-Digita transition, Our proposed CAP attack introduces a Camera Proxy Network to model this crucial transition and comprehensively evaluates attack performance across diverse unseen imaging devices.
Digitul-t-Physice transition
Physical transformation
Physical-to- -iiiita transition
Black-box cumera evaluation
Categories
Method
NAP (2021) [11]
X
Scule, angle, etc. Scule, angle, etc.
X
Stealthiness
LAP (2021) [28]
NPS Loss
AdyPatch (2019) [29]
NPS Loss
Scale, angle, etc.
X
X
AdvT-shirt (2020) [35]
Color Transformer
TPS deformation
X
Effectiveness
AdvClouk (2020) [34]
Rendering Function
TPS deformation
Robustness
TC-EGA (2022) [14]
X
TPS deformation
X
T-SEA (2023) [15]
X
Patch Cutout
X
CAP (Ours)
NPS Loss
Scale, angle, etc.
Camera ISP Net
optimization module. This interaction ultimately strengthens the camera-agnostic robustness of the generated adversarial patch.
Improved attack efficacy and heightened stability gains over existing methods. Real-world experiments demonstrate that our approach consistently and effectively achieves attack objectives across various imaging devices, including two typical cameras (Sony and Canon) and four smartphone cameras (iPhone, Redmi, Huawei, and Samsung).
2 Related Work
Physical Adversarial Attacks on Vision Tasks Compared to digital adversarial attacks [2, 27, 36], physical adversarial attacks are more threatening because they can deceive DNNs-based models the real world. Sharif et al. [26] achieved the first implementation of physical adversarial attacks, targeting facial recogmition systems. Since then, researchers have been designing attacks for various computer vision tasks, including classification [1], detection [29], segmentation [22], depth estimation [3], and image captioning [38]. In general, these methods generate perturbations in the digital domain, then transform them into tangible physical entities, deploy them in real-world scenarios, capture them with cameras, and finally return to the digital domain to complete the attack² In this process, two domain transitions are experienced. The first, namely segital-too-hysiiee has been addressed by some works [16, 26). However, the second, namely physical-to-digiin resulting in existing attack methods being unstable and difficult to reproduce. Our approach instead addresses this absence by incorporating a differentiable camera ISP network, thus constructing a more comprehensive perturbation generation pipeline.
has been always overlooked,
Adversarial Patches for Person Detection Due to the significance of human privacy and secu- rity, adversarial patches widely employed for attacking person detection models in real-world scenarios [32]. We summarize recent work on patch-based physical adversarial attacks targeting person detection in Table 1. Although existing methods have made significant progress in terms of effectiveness [29, 34, 35], stcalthiness [11, 28], and robustness [14, 15]. they all overlook the widespread scenario of cross-camera attacks in the physical world. They assume a white-box camera system, which diminishes their effectiveness in real-world scenarios with unseen cameras. Therefore, we advocate for treating the camera system as a black box and propose a method for designing aamera-agnostic adversarial patches.
Camera Image Signal Processing Pipeline In the journey from the physical scene to digital RGB images, the camera's 's internal Image Signal Processing (ISP) pipeline plays a crucial role. The ISP pipeline is tasked with converting the RAW measurements captured by camera sensors into high- quality RGB images that are suitable for further analysis and human perception. It employs range of techniques and algorithms, such as demosaicing [7, 18), denoising [9, 37], white balancing [10, 12], to enhance acquired data, mitigate noise artifacts, and correct for optical aberrations. Intuitively, Zhang
Refer to Supplementary Material Figure A for illustration of the workflow of physical adversarial attacks.
3

---

Attacker
Praxy
Person Detector
parameters
BENIGN
IPERTURE
PPERTUREE
fISP
Proxy
Defender
ISP parameters
BENIGN
PERTURE
fIsP
g
L
PERTURB
Figure 2: Overview of our adversarial optimization framework. The framework comprises two mutually adversarial parts: Attacker and Defender. The attacker optimizes adversarial perturbations maximize attack effectiveness, while the defender optimizes the conditional input hyperparameter of the ISP proxy network to minimize attack effectiveness. The two parts cyclically alternate during the optimization stage.
et al. [39] discovered that the camera's ISP weakens the effectiveness of adversarial perturbations and developed off-the-shelf preprocessing adversarial defense method. Inspired by this insight, our approach incorporates a differentiable camera ISP network as a defense module, designing an adversarial optimization framework ensure attack robustness of generated adversarial perturbations across different camera ISP configurations.
Camera-Agnostic Attack
3.1 Problem Definition
camera system plays a transformational role converting the physical scene ISCENE into its digital counterpart THGB- Subsequently, the digital image JRGB serves input for well-trained downstream DNNs-based models g. producing predictions y that closely align with the ground truth (Yer). Our goal is to generate adversarial patches P and apply them ISCENE to attack the model g to incorrect predictions y'. Unlike existing camera-specific physical adversarial attack methods, our approach aims to maintain stable performance across various cameras. In our attack setting, regard the imaging process (from /SCENE to JRGB) as a black box.
3.2 Overall Framework
To enable the generated adversarial patches to adapt to various cameras, we introduce novel adversarial optimization framework (see Figure 2). consists two mutually adversarial parts: Attacker and Defender. The attacker has an ISP proxy network top of existing attacking strategies. The ISP network maps adversarial perturbations to the RGB space based on conditional input hyperparameters. The processed adversarial perturbations are subsequently applied to benign samples and fed into the target detection model to get predictions. The attacker iteratively optimized adversarial perturbations to deliberately deviate the person detector's output from the ground-truth labels through gradient descent [19]. The defender employs the same structure but different optimization strategy. It optimized the conditional hyperparameters perturbations. During the attacker optimization phase, we freeze the conditional ISP hyperparameters, and similarly, during the defender optimization phase, we freeze the adversarial perturbations.
minimize the attack effectiveness of adversarial
3.3 Differentiable Camera ISP Simulation
The camera ISP responsible for converting the raw measurements of camera sensors into high- quality RGB images suitable for further analysis and human perception. It consists range of

---

Algorithm 1 The proposed adversarial optimization ( Attacker and Defender)
1: Given source image data X. targeted person detector and the trained camera ISP network fisP;
2: Initialize the adversarial patch P and input hyperparameters @ of fisP;
3: for f. 1,,...... do
4: // Optimiiee the adversarial patch P marimize attack effectiveness
5: for batch 1,2,..., MM do
6:
Sample a batch data Xs from X; Xado + apply(Xx (x,, PRCB), PRGB = fisP (P;
7:
8:
Xade are fed into the person detector to obtain predictions and compute the loss L;; Update the adversarial patch P via Eq. 1;
10:
end for
11:
// Optimize input hyperparameters θ to minimize the attack effectiveness
12:
for batch b 1, ........ M do
13:
Sample batch of data 2a from X;
Xade f- apply(a*, PROB). PRGB = fisr O):
15:
Xado are fed into the person detector to obtain predictions and compute the loss L;
16:
Update the input hyperparameters O via Eq. 2;
17:
end for
end for
techniques and algorithms, such as demosaicing [7, 18], denoising [9, 37], white balancing [10, 12], to enhance acquired data, mitigate noise artifacts, and correct for optical aberrations.
Traditional ISPs are typically based on hand-crafted modules that are not differentiable [39]. There- fore, they are not able to be incorporated into the adversarial pattern design. We propose a differ- entiable camera ISP proxy fisT that can simulate arbitrary parameterized configurations, which inspired by the literature of ISP optimization [25, 31]. Specifically, we trained variant of the U-Net CNN architecture [24] using data [SCENE, JRGB: ) obtained from traditional ISPs. Our network took the measurement ISCENE as the input, hyperparameters @ of the camera ISP as the condition, and was trained by minimize the reconstruction error between its prediction and /RGB. The training utilized 2,270 data pairs generated by an open-source undifferentiable camera ISP simulator [23] and the COCO dataset [20].
Since the hyperparameters of camera ISP can vary from one implementation to another, and are often specific the hardware and software used in a particular camera system [31], we opt for representative parameters that have a significant impact on the final imaging and attack performance. We empirically select six parameters from the Color and Tone Correction module and the Denoising module in the camera ISP. To this end, we represent the camera ISP pipeline as a function fisP parameterized by the conditional physical parameter =< a, b, 7, c, d, >. To enable the ISP proxy network to accommodate conditional input hyperparameters, we normalize the 6-dimensional hyperparameter to the [0, 1] interval and concatenate them to the feature variables of the encoder.
3.4 Adversarial Optimization
Our objective is twofold: (1) to optimize adversarial perturbations for optimal attack effectiveness against the target neural network and (2) optimize the input hyperparameters of the ISP proxy network for optimal defense effectiveness. Since two optimizations engage in a zero-sum game, follow the same training strategy in the GAN framework [8] to simultaneously optimize both parameter sets. The optimization algorithm is illustrated in Algorithm 1. In practice, we employ iterative updates
implement alternating training. The process alternates between kn steps of optimizing the adversarial perturbation P and h2 steps of optimizing ISP conditional parameters (< a. b, y, c, d, >). We set h k2 20. This strategy, validated through experiments, ensures the optimal optimization of both attack and defense, maintaining proximity to their peak values.
So, the goal can be described as follows:
P" = arg max (g fisp ()), Yer), +
(I)
where we find optimal adversarial patches P by maximizing the discrepancy L between the predictions of the model g and the ground truth YGr.
Additionally, we treat fIsP as a defense module, with the objective:
arg min L(g JisP (P Q)), YeT),
5

---

Original
ISP ISP
ISP
ISP
Benign
T-SEA
OuIs
Figure 3: Illustration of digital-space attacks under different ISP settings. The bounding boxes indicate the detector successfully detects the person instances, ie., the attack fails. Due to space constraints, we only present one comparative method, T-SEA [15]. For additional results, please refer to the Supplementary Material.
where we find optimal conditional parameter θ by minimizing the discrepancy L.
4 Experiments
4.1 Experimental Setup
We use the INRIAPERSON dataset [4, 30] to evaluate digital-space attacks. For physical- space attack, aiming to showcase the camera-agnostic nature of our approach, we collected data using six distinct hardware imaging devices, including two cameras - Sony 77R and Canon DS126231 and four mobile phone cameras iPhone 15, RedmiK20, HuaweiP50, and SamsungS22.
Datasets
Compared Methods We compare proposed method with seven mainstream patch-based methods, including AdyPatch [29], AdyT-shirt [35], AdvCloak [34], NAP [11], LAP [28], TC- EGA [14], and T-SEA [15]. For fair comparison, we control the size of these patches to be the same, set at 0.2 times the height of the person.
Metries We evaluate attack effectiveness using two primary metries: Average Precision (AP%) and Attack Success Rate (ASR%). AP assesses detection model accuracy, where lower values indicate superior attack performance. ASR defined as 1 TP' TP'/T,, /TP, where TP denotes the number True Positive detections without attacks and TP' represents those with attacks; higher ASR values indicate better attack performance.
For digital-space evaluation, we utilize the INRIAPerson dataset, which consists of 613 training images with 3,019 person instances and 288 test images containing 855 person instances. The ASR in the digital space is therefore calculated based on these 855 person instances across 288 test images. In the physical-space evaluation, we conducted data collection using 6 cameras across 4 temporal sessions to minimize confounding factors. For each patch configuration, we captured 5 images per camera per session, yielding 120 images (6x4x5) per patch. With 6 distinct adversarial patches evaluated in the physical domain, our analysis encompasses total of 720 images, forming the basis for physical-spe space ASR calculations.
Implementation Details Our implementation utilizes PyTorch on a Linux server equipped with dual NVIDIA GeForce RTX 3090 GPUs The adversarial patches are configured with dimensions of 300xx3000 and we employ a YOLOv5 [17] model pre-trained on the COCO dataset [20) and subsequently fine-tuned on INRIAPerson [30] as our victim detector. The detector processes input images resolution of 640 640, and adversarial training proceeds for 100 epochs.

---

Table 2: Quantitative results of different attack methods under various ISP settings in digital space, Our CAP attack surpasses
Matn standard devistion of
1000 uufii web IF
all existing methods in terms of attack success rate (ASR%). The
70-
100e ustor w/ medeom ISs
reason T-SEA [15] performs well in Average Precision (AP%) but poorly in ASR is due the multiple bounding box detections. We
60-
50
discuss this conflict in Subsection 4.2.
30
Original
ISP 1
ISP
ISP 3
ISP 4
Method
APL
ASRI
APL
ASRI
APL
ASRI
ASRI
APL
ASR
20
Confidence
threshold 0.001,
IoUl
threshold = 0.6
10
Random Noise
81.7
7.3
79.3
14.9
80.2
11.0
10.9
80.1
8.5
AdvPatch [29]
67.7
19.7
60.4
38.3
65.8
30.4
64.5
28.2
68.6
22.9
Ads 28
Adrl 4097-4bb
Adciial
MAP
LAP
TC-EGA
TSEA
Oun
AdVT-shitt [35]
76.6
14.6
73.0
21.9
76.1
18.8
71.7
21.2
76.5
14.1
AdvClook [34]
70.5
12.6
30.4
68.9
25.0
68.6
15.8
NAP [11]
81.3
7.4
76.8
16.9
79.1
12.9
76.5
13.8
80.2
8.8
Figure 4: Comparison of ASR (%). We evaluate various adver-
LAP [28]
81.0
5.6
76.3
17.2
78.6
11.6
77.8
12.1
79.4
10.1
TC-EGA [14]
79.9
8.8
71.3
20,3
76.4
14.4
75.6
17.1
76.8
13.3
T-SEA [15]
21.2
44.5
27.0
53.0
22.8
52.7
26.3
44.7
24.7
47.4
sarial patches under 50 random
CAP (Ours)
37.7
54.4
24.3
64.5
25.7
73.8
37,8
57.4
31.8
68.2
camera ISPs in digital space.
Rancom Nome
AdvP atch
T-SEA
W/O Camera ISP
W/D Adm-Upbmzaton
Our Full Method
100
100
100
100
ASR 130
72
31
Sony
Canen
iPone
Reard
Huawe
Samming
Sony Canon
Phone Reend
Huwwe
Samning
Sony Canon
Phone Reemi Huwwll Samsing
Sony Canto Phone
Reami
Huswal Sammung
Sony Canon
Phone Reami
Huavel
Sampung
Sony Canon Prone Reani
Huswei
Sammung
Figure 5: Quantitative results of different attack methods in physical space. For each adverariaal patch, we evaluate its ASR (%) across six different cameras, including two typical cameras (Sony and Canon) and four smartphone cameras (iPhone, Redmi, Huawei, and Samsung).
4.2 Camera-Agnostic Attack in Digital Space
To intuitively demonstrate the impact of camera ISP on digital imaging and attack effectiveness, we selected 4 distinct camera ISP parameters for visualization (see Figure 3). We observe that different camera ISPs have little effect the benign image, as the detector successfully detects person instances at all 4 camera ISP settings with little change in confidence. These results indicate that the detector is inherently robust, having camera-agnostic detection capabilities. The comparison method, T-SEA [15]. failed to successfully attack all four camera ISPs. However, the confidence of person instances showed significant fluetuations. For instance, the confidence score of the person decreased from 0.92 (ISP 2) to 0.71 (ISP 3). In contrast, our method maintains stable attacks across all ISP settings, successfully concealing the person.
Table 2 reports the AP and ASR results of typical patch-based attack methods. We observe that the ASR of our CAP attack surpasses that of all comparison methods across all camera ISP settings. However, in terms of AP, T-SEA shows a more pronounced decrease compared to our method in most cases. Generally, greater decrease in AP signifies poorer detector performance, typically accompanied by a higher ASR. However, T-SEA deviates from this trend. To explore the reasons, we visualize the attack results of T-SEA and find severe multi-box detection issue (refer Supplemen- tary Material Section C). A significant number of False Positive samples contribute to the decrease in AP, rather than effectively concealing person instances.
Furthermore, we present a comparison of the ASR for each adversarial patch in two settings: without camera ISP and with 50 random camera ISPs preprocessing (see Figure 4). This comparison illustrates that our approach mitigates the instability of cross-camera attacks and enhances the attack efficacy of adversarial patches.
4.3 Camera-Agnostic Attack in Physical Space
Our CAP attack is designed for real-world scenarios where the target system's 's camera is unknown. Therefore, we compare the physical-space attack performance of different adversarial patches across six hardware cameras, including two typical cameras (Sony and Canon) and four smartphone cameras
7

---

Fur Method
Canon
hone
Redmi
Huawei
Samsung
Figure 6: Physical-space attacks across six different cameras. Our method removing the camera ISP module only achieves successful attacks on specific cameras. Our method removing the adver- sarial optimization slightly outperforms the former. In contrast, our full method achieves successful attacks across all six cameras.
(iPhone, Redmi, Huawei, and Samsung). In the capture scenario, one participant carried various adversarial patches, while another participant, serving as the control, did not carry any adversarial patches (see Figure 1 and Figure 6). To eliminate interference, we captured 20 images for each adversarial patch setting and calculated the ASR (%). For further demonstrations of physical-space attacks, please refer to the Supplementary Material. Here, we only evaluate two comparison methods, AdvPatch [29] and T-SEA [15]. since they primarily target attack performance (as evident from Table 2), unlike other methods [11, 28] that also consider stealthiness.
Figure presents the quantitative results of the effectiveness of the attack for different adversarial patches. We observe that random noise-bases patches exhibit no attack effectiveness in real-world scenarios. The attack performance of AdvPatch exhibits significant fluctuations. It achieves an ASR of 35% on Canon cameras, while it is 0% on iPhone cameras. Unlike its impressive performance in the digital space, T-SEA shows poor attack performance in the physical space, mostly unable to execute successful attacks. This is due to the multi-box detection issue. When computing ASR, we consider a sample as a failed attack if detected, even the detection bounding box only covers half of the complete body. Our method achieves ASR of more than 90% in all cameras, reaching 100% ASR on the iPhone and Huawei. These results demonstrate the excellent camera-agnostic attack performance of our method in physical space.
4.4 Ablation Study
To demonstrate the effectiveness of each component in our attack method, we perform two variants of our method, i.e. ours w/o the camera ISP module and ours w/o adversarial optimization, as shown in Figure 6. Note that the latter refers to retaining the camera ISP module in our pipeline but refraining from optimizing its conditional input parameters. Instead, during the perturbation optimization process, we randomly adjust the input parameters.
From Figure 6, we observe that (1) "ours w/o camera ISP" exhibits the greatest fluctuation. This is evident from the confidence scores of the persons with the adversarial patches. reaches as high as 0.92 on Redmi devices, while it drops below 0.25 on iPhone devices (indicating the disappearance of detection boxes). (2) The attack effectiveness of "ours w/o adversarial optimization" surpasses that of the former group. succeeds in attacking both the Redmi and Samsung devices, with noticeable reduction in the confidence fluctuations of the victim person. (3) Our full method achieves successful attacks across all six cameras. Additionally, Figure presents the quantitative comparison of ASR across different cameras for three settings. Compared to the two variants, our method achieves higher and more stable ASR. These results demonstrate that incorporating the camera ISP module solely into the adversarial perturbation pipeline offers limited improvement in attack performance, while our proposed adversarial optimization design enhances cross-camera attack capability and stability in the real world.
8

---

Table Defenses against CAP aftacks. We report the AP in digital space and the ASR in physical space for three defense strategies: JPEG compression [6], SAC [21]. and adversarial training [40].
(a) AP (%) in digital space
(h) ASR (%) in physical space
Attack method
Attack method
Non-attack
CAP
CAP
CAP
CAP"
CAP
CAP
Defense strategy
Defense stralegy
Non-defense
85,0
52.8
45,5
37.7
Non-defense
70.0
68.3
95.8
JPEG compression [6]
84.7
52.7
45.8
36.8
JPEG compression [6]
90.8
89.2
93.3
SAC [21]
85.0
56,2
52.2
46.0
SAC [21]
70.0
68.3
95.8
Adversarial truining-CAP"
84.1
95.7
91.7
94.3
Adversarial training- CCP'
0.0
4.2
1.7
Adversarial training CAP
84,0
95.4
Adversarial training-CAP
5.8
0.0
10.8
Adversarial training-CAr
84.6
94.2
91.6
96.3
Adversarial training
CCP CAP
5 Discussions
Defense We compared three types of defense methods against CAP attacks: (1) modifying input images using JPEG compression [6], (2) adversarial patch detection and removal via SAC [21], J, and (3) adversarial training [40]. To understand the effectiveness of existing defenses against our attack, we evaluated our method and its two variants under three defense strategies. CAP* refers to our method without the camera ISP module, CAP refers to our method without adversarial optimization, and CAP refers to our full method. In Table 3, we report the AP in the digital space and the ASR in the physical space for each case.
Overall, we observe that JPEG compression is ineffective against all three attack settings. This indi- cates that minor pixel-level modifications cannot defend against our CAP attacks. SAC demonstrates some defensive capability in digital space, slightly increasing the AP, but is ineffective physical space. In contrast, adversarial training effectively defends against CAP attacks with minimal loss in detector accuracy (within 1%). Furthermore, adversarial training shows defensive transferability in all three attack settings. One of the primary objectives of our study is to enhance the robustness of person detection models. The above results indicate that adversarial training is reasonable and effective method to improve the robustness of detectors against CAP attacks.
Limitations Our study mainly focuses on utilizing a camera ISP proxy network for camera simula- tion, handling the transition from physical to digital domains. Building comprehensive, end-to-end differentiable camera simulator that includes features such as exposure time, aperture size, and ISO is challenging. Despite this, believe that the conclusions and insights of this work generalizable. This study successfully exposes previous methodological flaws and emphasizes the importance of considering the camera erucial module in the workflow of physical adversarial attacks.
Ethics Statement Our work successfully achieves physical adversarial attacks in person detection tasks. Given the effectiveness of our attack method across various imaging devices, its real-world application is feasible. This exposes potential security risks in existing DNNs- based applications, particularly when the technology leveraged for malicious purposes. We advocate for the responsible and ethical use of technology. Furthermore, we offer comprehensive methodological descriptions and openly address the implications of our work, encouraging discourse within and beyond the scientific community to contribute to the advancement of trustworthy and dependable Al.
6 Conclusion
In this paper, we have proposed a cross-camera physical adversarial attack, CAP (Camera- Agnostic Patch) attack, against person detection. Unlike previous methods that overlooked the crucial role of the camera in the real-world attack workflow, our method incorporates a differentiable camera Image Signal Processing (ISP) proxy network to compensate for the Ahysical-to-diginn transition gap. Furthermore, leveraging the attenuating effect of camera ISP on attack performance, we construct an adversarial optimization framework. In this framework, the attack module optimizes adversarial perturbations, aiming to maximize attack effectiveness, while the defense module optimizes the input parameters conditionally, aiming to minimize attack effectiveness. The two modules alternate optimization, encouraging the generated adversarial patches to exhibit stability across camera attacks.

---

Extensive experiments conducted in both digital and physical spaces demonstrate that our CAP attack enhances the effectiveness and reliability real-world scenarios, encountering diverse camera configurations. In the future, we will continue to explore the role of cameras, design defense strategies based on imaging devices, and develop more robust detection models.
Acknowledgements
This work was supported by Hubei Key R&D Project (2022BAA033), National Natural Science Foundation of China (62171325).
References
[1] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. In Proceedings of the Advances in Neural Information Processing Systems Workshop. 2017.
[2] Zikui Cai, Xiaxin Xie. Shasha Li. Mingjun Yin, Chengyu Song, Srikanth V Krishnamurthy, Amit K Roy-Chowdhurr, and M Salman Asif. Context-aware transfer attacks for object detection. In AAAI Conference on Artificial Intelligence, 2022.
[3] Zhiyuan Cheng, James Liang, Hongjun Choi, Guanhong Tao, Zhiwen Cao, Dongfang Liu, and Xiangyu Zhang. Physical attack monocular depth estimation with optimal adversarial patches. In European Conference on Computer Vision, pages 514-532. Springer, 2022.
[4] Navneet Dalal and Bill Triggs. Histograms of oriented gradients for human detection. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, volume 1, pages 886-893. IEEF, 2005.
[5] Yinpeng Dong, Shouwei Ruan, Hang Su, Caixin Kang, Xingxing Wei, and Jun Zhu. Viewfool: Evaluating the robustness of visual recognition to adversarial viewpoints. Advances in Neural Information Processing Systems, 35:36789-36883 2022.
[6] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression adversarial images. arXiv preprint arXiv:660..00853 2016.
Michaël Gharbi, Gaurav Chaurasia, Sylvain Paris, and Frédo Durand. Deep joint demosaicking and denoising. ACM Transactions on Graphics (ToG), 1-16) 2016.
[8] lan Goodfellow, Jcan Pouget-Abadic, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
[9] Shi Guo, Zifei Yan, Kai Zhang, Wangmeng Zuo, and Lei Zhang. Toward convolutional blind denoising of real photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pages
2019.
[10] Eugene Hsu, Tom Mertens, Sylvain Paris, Shai Avidan, and Frédo Durand. Light mixture estimation for spatially varying white balance. In ACM SIGGRAPH 2008 papers, pages 1-7, 2008
[11] Yu-Chih-Tuaa Hu, Ha-Han Kung, Daniel Stanley Tan, Jun ChenChen Chen, Kai- Kang Hua, and Wen-Huang Cheng. Naturalistic physical adversarial patch for object detectors. In IEEE/CVF International Conference Computer Vision, 2021.
[12] Yuanming Hu, Baoyuan Wang, and Stephen Lin. Fe4: Fully convolutional color constancy with confidence- weighted pooling. Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4085 4094. 2017.
[13] Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural-looking clothing textures evade person detectors via 3d modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16975 16984, 2023.
[14] Zhanhao Hu, Siyuan Huang. Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13307-13316. 2022.
10

---

[15] Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang, T-sea: Transfer-based self- ensemble attack object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 20514-20523, 2023.
[16] Steve TK Jan, Joseph Messou, Yen-Chen Lin, Jia-Bin Huang, and Gang Wang. Connecting the digital and physical world: Improving the robustness of adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 962-969, 2019.
[17] Glenn Jocher. Ultralytics yolov5, 2020.
[18] Daniel Khashabi, Sebastian Nowozin, Jeremy Janesary, and Andrew Fitzgibbon. Joint demosaicing and denoising via learned nonparametric random fields. IEEE Transactions on Image Processing, (3)):4996 4981, 2014.
[19] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In 3rd International Conference Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
[20] Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitmick. Microsoft coco: Common objects in context. In European conference on computer vision, 2014.
[21] Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chellappa. and Soheil Feizi. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 14973-14982, 2022.
[22] Federico Nesti, Giulio Rossolini, Saasha Nair, Alessandro Biondi, and Giorgio Buttazzo. Evaluating the robustness of semantic segmentation for autonomous driving against real-world adversarial patch attacks. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 2280 2289,
2022.
[23] Jueqin Qiu. Fast open image signal processor (fast-openisp). httpp////gthub..om//iubbaae fast-openISP, 2021.
[24] Olaf Ronneberger, Philipp Fischer, and Thomas Brox, U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assiset Intervention-MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18, pages 234-241. Springer, 2015.
[25] Eli Schwartz, Raja Giryes, and Alex M Bronstein. Deepisp: Toward learning an end-to-end image processing pipeline. IEEE Transactions on Image Processing, 28(2):912 923, 2018.
[26] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to crime: Real and stealthy attacks state-of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and communications security, pages 15481 2016.
[27] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Gaodfellow, and Rob Fergus. Intriguing properties of neural networks. Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
[28] Jia Tan, Nan Ji, Haidong Xie, and Xueshuang Xiang. Legitimate adversarial patches: Evading human eyes and detection models in the physical world. In ACM International Conference Multimedia, 2021.
[29] Simen Thys, Wiebe Van Ranst. and Toon Goedemé. Fooling automated surveillance cameras: adversarial patches attack person detection. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition workshops, pages 0-0, 2019.
[30] Pascal to Yolo. Inria person detection dataset dataset. https://univeree http://mmiverrse.rbofooooo www.ooow.ooooooo..ooo..oooo..ww. com/ dataset, dec 2022. visited on 2023-10-28.
pascal-to-yolo-8yygee http:/iirraa-prrs---eeeeeeeeeeee
[31] Ethan Tseng, Felix Yu, Yuting Yang, Fahim Mannan, Karl ST Amaad, Derek Nowrouzezahrai, Jean- François Lalonde, and Felix Heide. Hyperparameter optimization in black-box image processing using diffcrentiable proxies. ACM Trans. Graph., 38(4):27-1,
[32] Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang. Hanxun Yu, Zhubo Li, Shin'ichi Satoh, Luc Van Gool, and Zheng Wang. Physical adversarial attack meets computer vision: A decade survey. IEEE Transactions Pattern Analysis and Machine Intelligence, 2024.

---

[33] Xingxing Wei, Bangzheng Pu, Jiefan Lu, and Baoyuan Wu. Visually adversarial attacks and defenses in the physical world: A survey. arXiv preprint arX1::2111.0167,, 2022.
[34] Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein. Making invisibility cloak: Real world adversarial attacks object detectors. In European Conference Computer Vision, 2020.
[35] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in physical world. In European conference on computer vision, 2020.
[36] Qiuling Xu, Guanhong Tao, Siyuan Cheng, and Xiangyu Zhang. Towards feature space adversarial attack by style perturbation. AAAI Conference on Artificial Intelligence, volume 35, pages 10523-10531, 2021.
[37] Kai Zhang, Wangmeng Zuo, and Lei Zhang. Fidnet: Toward fast and flexible solution for enn-based image denoising. IEEE Transactions on Image Processing, 27(9))4608 4622, 2018
[38] Shibo Zhang, Yushi Cheng, Wenjun Zhu, Xiaoyu and Wenyuan Xu. Capatch: Physical adversarial patch against image captioning systems, 2023.
[39] Yuxuan Zhang. Bo Dong, and Felix Heide. All you need is raw: Defending against adversarial attacks with camera image pipelines. In European Conference on Computer Vision, pages 323-343. Springer, 2022.
[40] Dawei Zhou, Nannan Wang, Bo Han, and Tongliang Liu, Modeling adversarial noise for adversarial training. In International Conference on Machine Learning, pages 27353-27366. PMLR, 2022.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and introduction clearly articulate the contributions of this paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of this work the Limitations section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
13

---

Justification:
We provide comprehensive hypotheses and proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proof' can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification:
This paper provides detailed explanations and instructions to ensure the reproducibility of experimental results. The source code will be made available upon
acceptance of the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
14

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The source code will be made available upon acceptance of the paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /nips. wttpcccppppc//eeeeeee.eec...lele gguides/CodeSiiee stibbbmmssiooooiccyy.. for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: This paper provides implementation details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We initialized the random seed and conducted multiple experiments to average results experiments involving randomness.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
15

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide an explanation of the computational resources in the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: / /ttp///eerrpp.eeeee
Answer: [Yes]
Justification: Our work adheres to the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss relevant aspects in the Ethics Statement section.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
16

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: The paper discusses strategies for defending against the proposed CAP attack.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We explicitly mention the assets used and list their associated licenses in the supplementary material.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
17

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We will provide relevant documentation.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This work does not involve crowdsoureing experiments research with human subjects. All participants are co-authors the paper.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [Yes]
Justification: Our research adheres to the NeurIPS Code of Ethics and the guidelines of our institution.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
18


Reviews:
[{"review_id": "CFmaxZ3WVi", "reviewer": "Reviewer_xDi9", "summary": "The paper \"Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection\" addresses the limitations of current physical adversarial attack methods, which often fail to consider the variability introduced by different camera Image Signal Processing (ISP) pipelines. This oversight leads to instability and reduced effectiveness of attacks in real-world scenarios.\nThe authors propose a novel approach that incorporates a differentiable camera ISP proxy network into the adversarial patch generation process. This network models the transformations that images undergo when captured by different cameras, making the adversarial patches more robust and effective across various camera systems. The approach involves an adversarial optimization framework with two key components: an attack module that generates adversarial perturbations and a defense module that optimizes the ISP parameters to mitigate the attack's effectiveness.", "questions": "1. Does the method in this paper have any differences from mainstream patch-based methods in terms of the patch training process?\n2. Is this paper primarily considering targeted attacks or untargeted attacks? In equation 1, it seemes to be an untargeted attack, however, the goal of concealing person instances is more likely to be a targeted objective. If considering untargeted attacks, it is more appropriate to use AP (Average Precision) as a metric. If considering targeted attacks, ASR (Attack Success Rate) is more relevant.", "limitations": "The authors deserve commendation for their transparency and integrity in acknowledging the limitations of their work and the potential ethical issues associated with their research.", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "By introducing a differentiable camera Image Signal Processing (ISP) proxy network, the authors address a critical and previously overlooked aspect of these attacks: the variability introduced by different camera systems. This novel inclusion significantly enhances the robustness and generalizability of adversarial patches, marking a substantial departure from traditional methods that often neglect the role of the camera.", "weaknesses": "1. Some typographical errors: The citation in line 52 is incorrect; citation [22] should be changed to [40]. There are similar errors with multiple citations throughout the paper. It is recommended to thoroughly check each citation to avoid confusion. Moreover, there is a duplication error in line 255.\n2. The method flowchart is not very clear and does not seem related to attacking person detection. It is recommended to be more specific and should include detailed training methods and more details about the ISP proxy network.\n3. Although different smartphone cameras and typical cameras were tested, object detection is often used in autonomous driving or video surveillance. It is recommended to expand the testing to include cameras commonly used in these systems and to focus on these cameras.\n4. The paper is overly focused on engineering aspects and lacks thorough theoretical analysis. For example, it is recommended to explain in detail why the training strategy in the GAN framework is effective.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: Typographical errors [...].**\n\nA1: We have made the following corrections:\n\n- Corrected the citation in line 52: Zhang *et al.*[40] employed [...].\n- Corrected the citation in line 129: as Zhang *et al.*[40] demonstrated [...].\n- Removed the duplication in line 255.\n\nWe will thoroughly proofread the paper.\n\n**Q2: Flowchart.**\n\nA2: Thanks for your feedback. The revised flowchart can be found in the one-page PDF file.\n\n**Q3: Although different smartphone [...].**\n\nA3: Thanks for your comment. Smartphone and consumer cameras are portable and widely used but less reliable in harsh environments (e.g., high temperatures, electromagnetic interference) compared to industrial cameras used in autonomous driving and surveillance. Exploring their security implications is crucial, so we initially validated our method on these cameras.\n\nTo substantiate the claim in the paper, our approach introduces a wide parameter space for the ISP proxy network and uses six different cameras, offering a broad sampling space for training and evaluating.\n\nIn future work, we plan to include industrial cameras to enhance applicability in autonomous driving and surveillance. The following table lists commonly used industrial cameras we have surveyed.\n\n| Manufacturer | Model | Application Areas |\n|---|---|---|\n| Sony | IMX415 | Autonomous vehicles, robotics |\n| ON Semiconductor | AR0132 | Surveillance, drones |\n| Hikvision | DS-2CD2043G1-I | Surveillance |\n\n**Q4: Theoretical analysis.**\n\nA4: As outlined in Sections 3.2 and 3.4, our approach is inspired by the GAN theoretical framework. Attacker acts as Generator, producing adversarial perturbations, while Defender acts as Discriminator, optimizing hyperparams. Our alternating optimization mirrors GAN convergence analysis. We provide detailed theoretical proof:\n\n**Global Optimality of the Adversarial Optimization Framework**\n\nWe begin by analyzing the optimal Defender strategy given any Attacker strategy.\n\n**Proposition 1:** For fixed Attacker strategy, optimal Defender strategy minimizes adversarial perturbation effectiveness.\n\n**Proof:** Attacker aims to maximize error induced by adversarial perturbations, while Defender aims to minimize this error. Formally, let $P$ represent the perturbations and $\\theta_d$ the hyperparams. Attacker's objective:\n\n$$\nL_A = \\max _P \\mathbb{E} _{x \\sim p _\\text{data}} \\left[ \\ell(f(x + P), y) \\right]\n$$\n\nwhere $\\ell$ is the loss function, $f$ is the neural network, and $y$ are the GT labels.\n\nThe Defender seeks to minimize the effectiveness of these perturbations by optimizing $\\theta_d$:\n\n$$\nL_D = \\min _{\\theta_d} \\mathbb{E} _{x \\sim p _\\text{data}} \\left[ \\ell(f(g(x + P; \\theta_d)), y) \\right]\n$$\n\nwhere $g$ represents the ISP proxy network processing.\n\nThe optimal Defender strategy $\\theta_d^*$ satisfies:\n\n$$\n\\theta_d^* = \\arg \\min_{\\theta_d} L_D\n$$\n\nGiven this optimal strategy, the Attacker's objective function becomes:\n\n$$\nL_A^* = \\max_P L_D(\\theta_d^*)\n$$\n\nThe interplay between the Attacker and Defender can be modeled as a minimax game:\n\n$$\n\\min _{\\theta _d} \\max _P \\mathbb{E} _{x \\sim p _\\text{data}} \\left[ \\ell(f(g(x + P; \\theta_d)), y) \\right]\n$$\n\nSince the ISP proxy network aims to minimize the impact of adversarial perturbations, the optimal strategy for the Defender minimizes the Attacker's maximum achievable loss, concluding the proof.\n\n**Convergence of the Optimization Algorithm**\n\n**Proposition 2:** If Attacker and Defender have sufficient capacity, and at each iteration of optimization algorithm, Attacker and Defender optimize respective objectives, adversarial perturbations converge to equilibrium where effectiveness is minimized by ISP proxy network.\n\n**Proof:** The optimization algorithm follows an alternating training strategy, akin to the GAN. At each step, Attacker optimizes the perturbations $P$ while keeping the ISP parameters $\\theta_d$ fixed, and vice versa.\n\nAttacker’s update rule is:\n\n$$\nP^{(t+1)} = P^{(t)} + \\alpha \\nabla_P L_A\n$$\n\nDefender’s update rule is:\n\n$$\n\\theta_d^{(t+1)} = \\theta_d^{(t)} - \\beta \\nabla_{\\theta_d} L_D\n$$\n\nBy iteratively updating $P$ and $\\theta_d$ in this manner, the algorithm performs gradient descent on a convex-concave function, ensuring convergence to a local Nash equilibrium. At this equilibrium, the adversarial perturbations $P^*$ are countered effectively by the optimized ISP parameters $\\theta_d^*$, concluding the proof.\n\n**Q5: Differences of the patch training process?**\n\nA5: Mainstream patch-based methods apply a random patch to the target image and update it to maximize the discrepancy between predictions and GT, analogous to the Attacker in our method. Our approach further introduces a Defender, represented by a ISP proxy network. This addition enables the Attacker and Defender to form an adversarial optimization framework, enhancing the attack transferability across different cameras.\n\n**Q6: Targeted or untargeted attacks.**\n\nA6: Our approach is an  **untargeted attack**. In classification tasks, targeted attacks mislead the classifier into categorizing the target instance as a specific incorrect class, while untargeted attacks cause the classifier to misclassify the target instance into any incorrect class. Based on this criterion, we tend to classify the task of concealing person instances as an untargeted attack.\n\nOur method, as an untargeted attack, was evaluated using AP. However, AP alone can be misleading, especially in multi-box detection scenarios where AP may be low despite ineffective attacks (see Section B of our supplementary material). ASR compensates for this limitation of AP, as it is not affected by an increase in True Positive samples. Thus, we employ both AP and ASR.\n\nLastly, we would like to thank you for acknowledging the strengths of our method, as you noted: (1) a **critical** [...] and (2) This **novel** [...]. We hope our responses address your concerns and contribute to an improved rating for our paper.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uqd2CXKHBH", "reviewer": "Reviewer_N8jz", "summary": "The authors present an improved method for human-detection-blocking adversarial patch attacks, with a particular focus on ensuring said attacks are robust to changes in camera. This approach is motivated by a study of the impact of camera Image Signal Processing (ISP) pipelines, which the authors show is a considerable factor in the inconsistency of real-world adversarial patch attacks. The authors’ proposed Camera-Agnostic Patch (CAP) attack uses a proxy network to simulate the ISP, and said network is optimized through an adversarial learning approach to make patches that are robust across different cameras. The authors demonstrate this with real data collected with 6 different imaging devices.", "questions": "I note that the supplemental material includes an additional visualization video, and I am aware that videos have their own unique artifacts due to their encoding. Does the difference between video capture and image capture have an impact on attack effectiveness? Does CAP help improve the generalization of attacks from image to video?", "limitations": "The authors have discussed some limitations of the work, which include other camera settings like exposure time and aperture size, which are not modelled in their current approach. As this is a work presenting an adversarial attack, the authors have also discussed the potential risks of such attacks and they have also presented some defense evaluations also.\n\nThe authors present results with six different imaging devices. This number could of course be increased, though this is not strictly necessary in my opinion.\n\nAs this is a work focused on presenting an adversarial attack, there is some risk for negative societal impact.\n\nThe statement about the random seed (line 189) may not be necessary in the main paper.\n\nThere is duplicated text on lines 254-255.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "The author’s motivation is well presented and well justified, as they point out that much research has been invested into converting adversarial perturbations from digital to physical, but little research focuses on the impact of the camera, which converts the physical patch back into a digital image before it is actually fed into the network.\n\nThe CAP method is effective and achieves the stated goal of making attacks robust to changes in camera. This also helps to address significant limitations in the reproducibility of prior works with physical adversarial patches.\n\nThe authors present comprehensive experiments, including digital and physical evaluations, along with ablations and adversarial defenses.\n\nThe authors also include insightful analysis of the best performing baseline (T-SEA) and show that while it does disrupt the detections, it does not fully remove them and instead fragments them into smaller pieces.\n\nOverall, the work is clear and well presented.", "weaknesses": "While the authors experimental evaluation is quite comprehensive, one aspect they did not test for was differences in target model, as the same victim detector is used in all experiments. This could potentially be improved by demonstrating CAP attacks for different models. In addition, it would be interesting to see if the CAP attacks are any better at generalizing across target models, such as for black-box style attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: While the authors experimental evaluation is quite comprehensive [...].**\n\nA1: Thank you for your valuable feedback. We acknowledge that evaluating the performance of our approach on other detectors would be meaningful. To address your concerns, we have conducted additional experiments, as detailed in the table below.\n\nYOLOv3:\n\n| Method | AP (the lower the better) | ASR (the higher the better) |\n| ------- | ------- |------- |\n|     Random Noise    |    71.3     | 11.3 |\n|     AdvPatch    |   48.1      | 33.3 |\n|     AdvT-shirt    |    55.8     | 24.4 |\n|     AdvCloak    |     52.7    | 30.5 |\n|     NAP    |     66.2    | 14.0 |\n|     LAP    |    65.2     | 14.6 |\n|     TC-EGA    |   56.9      | 24.7 |\n|      CAP (Ours)    |   **41.5**   | **43.3** |\n\nYOLOv8:\n\n| Method | AP (the lower the better) | ASR (the higher the better)  |\n| ------- | ------- |------- |\n|     Random Noise    |     77.9    | 4.0  |\n|     AdvPatch    |    75.6     | 8.8  |\n|     AdvT-shirt    |    77.2     | 6.2  |\n|     AdvCloak    |    73.7     | 10.1 |\n|     NAP    |    78.1    | 5.0  |\n|     LAP    |     78.6    | 4.6 |\n|     TC-EGA    |   77.3      | 6.7  |\n|      CAP (Ours)    |   **60.5**   | **14.7** |\n\nThe above comparative evaluations were conducted under a black-box setting. The detection models were pretrained on the COCO dataset and then fine-tuned on the INRIAPerson dataset. We observe that, although the effectiveness of our CAP attack decreases compared to white-box attacks (see Table 3 in the paper), it still outperforms other methods.\n\nYour suggestion is valuable and has inspired us to not only consider the black-box camera setting but also the black-box model setting. In future work, we will explore physical adversarial attacks under a double black-box scenario.\n\n**Q2: Video artifacts.**\n\nA2: Thank you for your insightful comment. The difference between video capture and image capture indeed affects attack effectiveness. The key distinction lies in the inherent camera and scene motion in video, which leads to scene shifts and introduces motion blur-related artifacts that significantly impact attack effectiveness. We observed that attacks sometimes failed in the presence of blur.\n\nOur CAP attack focuses on images because detectors like the YOLO series and Faster R-CNN are image-based. Consequently, we did not consider the effects of video artifacts. However, to enhance the generalization of the adversarial perturbations, we incorporated tricks such as (1) adding random noise and (2) applying random rotations during the optimization process.\n\nYour comment provides valuable insights for future research, especially regarding physical adversarial attacks on video detection models. To the best of our knowledge, no work has been done in this area. The generalization from images to videos remains an open problem. We believe that modeling video motion and considering temporal frame consistency during training are promising approaches.\n\n**Q3: Camer number.**\n\nA3: Thank you for your valuable comment. We chose to design and validate our method on smartphone cameras (iPhone, Redmi, Huawei, and Samsung) and typical consumer cameras (Sony and Canon) first because these cameras are portable, widely used, and more susceptible to attacks. In contrast, they are less reliable than industrial cameras, especially in challenging environments like high temperatures, humidity, and electromagnetic interference.\n\nWe agree that expanding the range of cameras would further enhance the applicability of our method. In future work, we plan to extend our evaluation by using industrial cameras to validate the attack's effectiveness. The following table lists industrial cameras commonly used in autonomous driving and video surveillance that we have surveyed.\n\n| Manufacturer | Model | Application Areas |\n|---|---|---|\n| Sony | IMX415 | Autonomous vehicles, robotics |\n| ON Semiconductor | AR0132 | Surveillance, drones |\n| Hikvision | DS-2CD2043G1-I | Surveillance |\n\n**Q4: Negative societal impact.**\n\nA4: We fully acknowledge it is crucial to consider these potential negative societal impacts. The ethical statement about our work is given below:\n\nOur work successfully achieves physical adversarial attacks in person detection tasks. Given the effectiveness of our attack method across various imaging devices, its real-world application is feasible. This exposes potential security risks in existing DNNs-based applications, particularly when the technology is leveraged for malicious purposes. We advocate for the responsible and ethical use of technology. Furthermore, we offer comprehensive methodological descriptions and openly address the implications of our work, encouraging discourse within and beyond the scientific community to contribute to the advancement of trustworthy and dependable AI.\n\nAdditionally, to mitigate the potential risks of our CAP attacks, we discuss defense strategies in Section 4.5 of the paper. Through evaluation across three defense strategies, the experimental results indicate that adversarial training effectively mitigates our CAP attack in both digital and physical spaces. Moving forward, we will actively collaborate with the security community to explore the broader implications of our work and identify further mitigation strategies.\n\n**Q5: Random seed.**\n\nA5: Thank you for your careful review. As per your suggestion, we will remove the statement about the random seed from the main paper and include it in the appendix, leaving more space in the main text for more valuable discussions.\n\n**Q6: There is duplicated text on lines 254-255.**\n\nA6: Thank you for bringing this to our attention. We will eliminate the redundancy and thoroughly proofread the entire paper to ensure clarity throughout.\n\nWe appreciate your high praise for our work and the valuable suggestions for our future research. We believe that the new perspective offered by our method will significantly contribute to the field.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "w7iJW61WC6", "reviewer": "Reviewer_eDby", "summary": "This paper proposed a cross-camera physical adversarial attack, Caera-Agnostic Patch (CAP) attack against person detection. \nThis method incorporates a differentiable camera Image Signal Processing (ISP) proxy network to compensate for physical-to-digital domain transition gap. Additionally, the camera ISP proxy network serves as a defense module, forming an adversarial optimization framework with the attack module. The attack module optimizes adversarial perturbations to maximize effectiveness, while the defense module optimizes the conditional parameters of the camera ISP proxy network to minimize attack effectiveness. Experimental results demonstrate the effectiveness of the proposed Camera-Agnostic Patch attack on different hardware.", "questions": "See weakness.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper focuses on a commonly overlooked aspect of adversarial attacks—the ISP—and demonstrates good performance across different devices.\n\nThe experiments are comprehensive. Good quantitative results are observed even in challenging physical world evaluation.", "weaknesses": "1, In the experimental setup, only the patch size is provided, while the input image size is missing.\n\n2, Some key experimental settings are missing. The total number of images used to calculate ASR is not provided.\n\n3, The robustness of the proposed CAP against real-world disturbances (e.g., random noise, blur, etc.) should also be discussed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: In the experimental setup, only the patch size is provided, while the input image size is missing.**\n\nA1: Thank you for your careful review of our paper. The input image size we used is **640x640**, consistent with the official YOLOv5 repository. It is worth noting that YOLOv5 supports both 640x640 and 1280x1280 input image sizes, and we used the former. We will include the specific input image sizes used in our experiments in the revised version of the paper.\n\n**Q2: Some key experimental settings are missing. The total number of images used to calculate ASR is not provided.**\n\nA2: Thank you for your valuable feedback.\n\nIn the **digital-space** evaluation, we used the publicly available INRIAPerson dataset, which consists of 613 training images and 288 test images. Specifically, the training set contains 3,019 person instances, while the test set contains 855 person instances. Therefore, the ASR in the digital space is calculated based on **288 images containing 855 person instances**.\n\nIn the **physical-space** evaluation, we collected images using 6 cameras at 4 different times to avoid interference from unrelated factors. For each patch setting, 5 images were captured per camera per session, resulting in 6x4x5=120 images per patch. We compared 6 adversarial patches in the physical domain, yielding a total of 6x120=720 images. The ASR in the physical space is thus calculated based on these  **720 images**.\n\nWe will clarify the specific number of images in the revised version of the paper.\n\n**Q3: The robustness of the proposed CAP against real-world disturbances (e.g., random noise, blur, etc.) should also be discussed.**\n\nA3: Thank you for your insightful comment. We acknowledge the importance of robustness in real-world disturbances. During the training of CAP, we implemented techniques to enhance robustness, specifically (1) adding random noise and (2) adding random rotations. These measures strengthen the robustness of the CAP attack, supporting its effectiveness in real-world scenarios, as demonstrated in Section 4.3 of the paper.\n\nBlur, commonly caused by camera motion in videos, was not considered in our evaluation as the detectors we targeted, such as the YOLO series and Faster R-CNN, are image-based. Your comment highlights an important area for future research, particularly the impact of blur on physical adversarial attacks. To the best of our knowledge, this has not been explored extensively. In future work, we plan to investigate physical adversarial attacks on video detection models and evaluate the effects of blur. We believe that modeling video motion and incorporating temporal frame consistency during training are promising approaches.\n\nWe appreciate your positive feedback on our work and the valuable suggestions for our future research. We believe that the new perspective offered by our method will significantly contribute to the field.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DaOtViGrjA", "reviewer": "Reviewer_ai8f", "summary": "The authors note that existing physical adversarial attack methods overlook the transitioning from the physical domain to the digital domain, which involves the camera. Therefore, they propose a camera-agnostic attack to enhance the stability of adversarial patches across different cameras. The proposed adversarial optimization framework employs a differentiable camera ISP proxy network as a defender, engaging in a zero-sum game with the attacker to enhance the attack performance of adversarial patches. Experimental validation across multiple imaging devices demonstrates the effectiveness of the proposed approach in this paper.", "questions": "1. While introducing a camera ISP module is reasonable, the authors chose 6 hyperparameters for the camera ISP proxy network and listed their corresponding ranges. What criteria guided the selection of these hyperparameters and their ranges?\n\n2. Could the authors provide more disscussion on the threat model and the black-box model scenario?", "limitations": "The authors discuss the limitations of this paper, specifically regarding the simulation of the camera module.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors identify a flaw in the existing pipeline of physical adversarial attack methods, specifically the oversight of transitioning from the physical domain to the digital domain, which they assert is mediated by the camera. They subsequently evaluate the camera's influence on the performance of physical adversarial attacks. Their research approach is logical and well-founded.\n\n2. The adversarial optimization framework proposed in this paper, utilizing a camera ISP proxy network as a defender, is concise and intuitive.\n\n3. The multi-box detection issue introduced in this paper is a significant problem worthy of attention.", "weaknesses": "1. Explanation of hyperparameters and their value ranges for the camera ISP proxy network are needed.\n\n2. Essentially, this paper aims to address the issue of camera black-box attacks. However, the authors overlook another black-box scenario, namely the model. The transferability of attack methods across different models is also an important research direction. This paper lacks discussion on the model black-box aspect.\n\n3. Placing Figure A from the supplementary materials into the main text can help readers better understand the motivation behind this paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: Explanation of hyperparameters and their value ranges for the camera ISP proxy network are needed.**\n\nA1: Thank you for your insightful comment regarding the hyperparameter selection for our camera ISP proxy network.\n\nCamera ISPs consist of multiple processing stages. Tseng *et al.*[1] summarize common imaging pipelines into the following stages: (1) Optics, (2) White Balance & Gain, (3) Demosaicking, (4) Denoising, (5) Color & Tone Correction, and (6) Color Space Conversion & Compression. The first three stages pertain to RAW data acquisition and processing, while the latter three involve operations on RGB values. Since our task primarily focuses on images in RGB format, we chose conditional parameters for the proxy network from the latter three stages. We selected six parameters that significantly impact visual attributes, such as Brightness Contrast Control and Gamma Adjustment, as detailed in Table 2 of the paper. Empirical evaluations demonstrate that these six parameters affect attack performance.\n\nWe observed that certain combinations could lead to complete information loss in the image. To balance the quality and diversity of the images generated by the ISP proxy network, we selected the ranges specified in Table 2 of the paper.\nFor parameter $a$, values below 64 may result in images being too dark. For parameter $b$, values below 64 may cause colors to appear washed out. For the $\\gamma$ setting, values above the specified range may introduce noise in dark areas, while values below the range can reduce image contrast. For parameter $c$, deviations from the specified interval may lead to poor image quality. For parameter $d$, values below the specified range may result in insufficient spatial filtering, causing excessive noise. For parameter $e$, values less than 1 may not effectively remove noise\n\nWe will include a more comprehensive discussion of this topic in the revised manuscript.\n\n[1] Hyperparameter optimization in black-box image processing using differentiable proxies. ACM TOG 2019.\n\n**Q2: Essentially, this paper aims to address the issue of camera black-box attacks. However, the authors overlook another black-box scenario, namely the model. The transferability of attack methods across different models is also an important research direction. This paper lacks discussion on the model black-box aspect.**\n\nA2: Thank you for your insightful comment. We agree that exploring the transferability of our proposed attack method across different models is an important avenue for future research. We have therefore included additional experiments with other detectors, as shown in the table below.\n\nYOLOv3:\n\n| Method | AP (the lower the better) | ASR (the higher the better)  |\n| ------- | ------- |------- |\n|     Random Noise    |    71.3     | 11.3 |\n|     AdvPatch    |   48.1      | 33.3 |\n|     AdvT-shirt    |    55.8     | 24.4 |\n|     AdvCloak    |     52.7    | 30.5 |\n|     NAP    |     66.2    | 14.0 |\n|     LAP    |    65.2     | 14.6 |\n|     TC-EGA    |   56.9      | 24.7 |\n|      CAP (Ours)    |    **41.5**   |  **43.3** |\n\nYOLOv8:\n\n| Method | AP (the lower the better) | ASR (the higher the better)  |\n| ------- | ------- |------- |\n|     Random Noise    |     77.9    | 4.0  |\n|     AdvPatch    |    75.6     | 8.8  |\n|     AdvT-shirt    |    77.2     | 6.2  |\n|     AdvCloak    |    73.7     | 10.1 |\n|     NAP    |    78.1    | 5.0  |\n|     LAP    |     78.6    | 4.6 |\n|     TC-EGA    |   77.3      | 6.7  |\n|      CAP (Ours)    |   **60.5**   | **14.7** |\n\nThe above comparative evaluations were conducted under a black-box setting. The detection models were pretrained on the COCO dataset and then fine-tuned on the INRIAPerson dataset. We observe that, although the effectiveness of our CAP attack decreases compared to white-box attacks (see Table 3 in the paper), it still outperforms other methods.\n\nYour suggestion is valuable and has inspired us to not only consider the black-box camera setting but also the black-box model setting. In future work, we will explore physical adversarial attacks under a double black-box scenario.\n\n**Q3: Placing Figure A from the supplementary materials into the main text can help readers better understand the motivation behind this paper.**\n\nA3: Thank you for your detailed comment. We agree that including Figure A in the main text would offer a more direct and intuitive understanding of the motivation behind our work. We will carefully consider your suggestion.\n\n**Q4: Discussion on the threat model.**\n\nA4: Thank you for your careful review. We discuss the threat model from the following three aspects:\n\n- **Attack Goal**: Our method aims to make the target person evade detection. This is achieved by applying a carefully crafted adversarial perturbation to the target individual's physical appearance, ensuring that the perturbation remains effective across various camera settings.\n- **Adversary Capability**: The adversary has: (1) knowledge of the object detection model and (2) the ability to generate and physically realize adversarial perturbations.\n- **Design Requirements**: (1) The method must be physically realizable and (2) maintain effectiveness across different imaging devices.\n\nWe appreciate your high evaluation of our work and the valuable suggestions for future improvements. We believe that the novel perspective introduced by our approach will significantly contribute to the field.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank the reviewers for their insightful and constructive comments. As summarized by reviewers xDi9, eDby, and ai8f, our work focuses on a critical and previously overlooked aspect—the impact of camera variability on physical adversarial attacks—and proposes an effective and robust adversarial patch capable of cross-camera attacks. To the best of our knowledge, ours is the first work to design and evaluate across multiple imaging devices, aligning with real-world scenarios.

All reviewers acknowledged the value of our work. We are pleased that most reviewers agreed that:

* Incorporating a differentiable camera ISP proxy network into the adversarial patch generation process is a **novel** approach. This inclusion significantly **enhances** the robustness and generalizability of adversarial patches. [reviewer xDi9]
* Our motivation is **well presented** and **well justified**. [reviewer N8jz]
* The experiments are **comprehensive**. [reviewers N8jz and eDby]
* The research approach is **logical** and **well-founded**. The framework is **concise** and **intuitive**. [reviewer ai8f]

We have provided point-by-point responses to each reviewer's comments. Specific feedback will be addressed in our individual responses. We hope to demonstrate the validity of our claims through detailed discussions and additional experiments.

Meta-review: This work focuses on a critical and previously overlooked aspect—the impact of camera variability on physical adversarial attacks. The authors have proposed an effective and robust adversarial patch capable of cross-camera attacks. 

Reviewer xDi9 has raised two main questions: (1) regarding difference of the proposed method from mainstream patch-based methods in terms of patch training process, and (2) targeted attack or untargeted attack. 

The authors have responded in Q5 and Q6 in their rebuttal of Reviewer xDi9. For (1), the main difference is that the proposed method introduces a Defender, which is represented by an ISP proxy network. This addition enables the attacker and defender to form an adversarial optimization framework. The authors have shown further analysis of the global optimality of the adversarial optimization framework in Q4 response. 

Reviewer xDi9 followed up with additional concerns on (1) “the decision to focus on consumer cameras, while partially justified, leaves room for further improvement in demonstrating the method's applicability to more relevant scenarios, such as autonomous driving and surveillance. The effectiveness of the approach may not be fully validated until these additional tests are conducted.” and (2) “I recognize that the proposed approach makes a significant contribution to the field by addressing an important and previously overlooked aspect of adversarial attacks. However, the novelty and effectiveness of the method could be better demonstrated with additional experimentation and theoretical justification.”

I think for (1), focusing on consumer cameras is a pretty solid scope already, and extending to autonomous driving and surveillance could be a next follow-up work. For (2), I think the authors have done an OK job demonstrating the proposed method via experimentation and theoretical justification.

Given that Reviewer xDi9’s concerns are mostly addressed and the other 3 reviewers (Reviewer N8jz, Reviewer eDby, and Reviewer ai8f) are all trending towards the positive side, I am inclined to accept this work.
Decision: Accept (poster)