Full-Distance Evasion of Pedestrian Detectors in the Physical World
Authors: Zhi Cheng
Zhanhao Hu
Yuqiu Liu
Jianmin Li
Hang Su
Xiaolin Hu
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial Attacks
Pedestrian Detection
Primary area: safety_in_machine_learning

Abstract: Many studies have proposed attack methods to generate adversarial patterns for evading pedestrian detection, alarming the computer vision community about the need for more attention to the robustness of detectors. However, adversarial patterns optimized by these methods commonly have limited performance at medium to long distances in the physical world. To overcome this limitation, we identify two main challenges. First, in existing methods, there is commonly an appearance gap between simulated distant adversarial patterns and their physical world counterparts, leading to incorrect optimization. Second, there exists a conflict between adversarial losses at different distances, which causes difficulties in optimization. To overcome these challenges, we introduce a Full Distance Attack (FDA) method. Our physical world experiments demonstrate the effectiveness of our FDA patterns across various detection models like YOLOv5, Deformable-DETR, and Mask RCNN. Codes available at https://github.com/zhicheng2T0/Full-Distance-Attack.git

Full-Distance Evasion of Pedestrian Detectors in the Physical World
Zhi Cheng'. Zhanhao Hu?, Yuqiu Liu', Jianmin Li Hang Su', Xiaolin Hu!
Department of Computer Science and Technology, Tsinghua University, Beijing, China Department of Electrical Engineering and Computer Sciences, UC Berkeley *Department of Technology, Beijing Forestry University, Beijing, China zhicheng mail @ 126.com, huzhanhao @ berkeley.edu, yuqiu99 @ bjfu.edu.en, (lijianmin, suhangss, xlhu @ maii..tinggua.ede.
Abstract
Many studies have proposed attack methods to generate adversarial patterns for evading pedestrian detection, alarming the computer vision community about the need for more attention to the robustness of detectors. However, adversarial pat- terns optimized by these methods commonly have limited performance medium to long distances in the physical world. To overcome this limitation, we identify main challenges. First, in existing methods, there is commonly appearance gap between simulated distant adversarial patterns and their physical world coun- terparts, leading incorrect optimization. Second, there exists conflict between adversarial losses at different distances, which causes difficulties in optimiza- tion. To overcome these challenges, we introduce Full Distance Attack (FDA) method. Our physical world experiments demonstrate the effectiveness of our FDA patterns across various detection models like YOLOv5, Deformable-DETR, and -istaatne
Mask RCNN. Codes available at Attack.git
Introduction
Currently, various adversarial attack methods have been proposed to evade deep-neural-netwolee beap-eeuurdd-ettwor--baaedd pedestrian detectors in the physical world 34
42 by crafting patches or clothes covered with adversarial patterns. These works have alarmed the computer vision community on the robustness of the existing Deep Nerual Network based detectors (37] 26
17
43 However, as shown previous works [77 (23) common limitation of the existing attack methods is that the generated adversarial patterns are not adversarially effective medium to long distances (see also Figure [a)). This limitation might brings false impression to the computer vision community that existing pedestrian detectors are robust physical world attacks such distances.
In this study, we find that the major cause of the aforementioned limitation is the naive distant image simulation technique used when optimizing the adversarial patterns. More specifically, as demonstrated in Figure [bb), to simulate the appearance of a distant adversarial pattern during optimization, the existing attack algorithms usually naively downscale and apply the adversarial patterns according to the size of the pedestrians [34] 42 [7 Such a naive technique creates widnnnng appearance gap between the simulated patterns and their real-world counterparts as distance increases. This leads to the optimization of incorrect adversarial patterns.
* Corresponding Author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

3.5m
6.0m
12.0m
18.0m
32.0m
41.0m
Resize & apply digitally
4.0m
Baselina
Naive Sim.
FDA
Print
Physical
world
hold
(b)
Figure I: Illustratin FDA. (a) Visualizing attack performance of baseline [42] and FDA pattern. Red
boxes are detection results from YOLOv5 [2] with confidence greater than 0.5. (b) Appearance gap
between the naively simulated patch and its physical world counterparts at different distances.
To solve this problem, we propose Distant Image Converter (DIC) to convert images of short- distance objects into appearance similar their physical world counterparts long distances. In DIC, We find it necessary to simulate three factors in the physical world that contribute to the appearance gap. These factors include the effect of atmospheric perspective which changes object colors due to increasing scattering of light as distance increases, the effect of camera hardware which blurs the field of light projected from the target object form digital image, and the effect of the default effect filters commonly installed in digital cameras which change the color and texture details of the captured images for better visual appearances.
By applying the DIC during optimization, we found that different low frequency patterns were required at short and long distances, causing a conflict, hindering full distance attack (FDA) pattern optimization. To overcome the difficulty, we propose Multi-Frequency Optimization (MFO) technique.
By combining DIC and MFO, form the FDA method which generates effective adversarial patterns for evading pedestrian detectors at varying distances. Our physical world experiments demonstrate the effectiveness our FDA patterns across various detection models like YOLOv5 21 Deformable-DETR 43 and Mask RCNN [14.
2 Background and Related Work
Atmospheric Perspective. Atmospheric perspective refers to the phenomenon that as distance increases, the observed color of a target object exponentially shifts toward the color the skylight (color of the sky in the direction of the object) due to the scat- tering of light by air molecules, dust and moisture as distance increases. Figure (a) illustrates the phenomenon and Figure 2 (b) gives an intuitive example, where trees with a color of green and yellow appear blue at long distances due to atmospheric perspective.
Environmental illumination
Observer + Direct transmission
Target
scattering
Rog
Sea level
(a)
(b)
Figure 2: Atmospheric perspective. (a) Illustrating the
phenomenon. (b) An example.
Camera Imaging Pipeline. To form an image, camera receives an input light field and processes through various lenses, including an anti-aliasing filter that blurs the light to prevent aliasing. Aliasing occurs when the camera's 's sensors naively sample the analog light field, leading to the incorrect recording of non-existent moiré patterns (e.g., Figure (b)) B2). The intuition of the phenomenon is illustrated in Figure (c) with a I-D example. That is, if the high-frequency blue curve is sampled at a low frequency, it can be inaccurately recorded as the red dotted curve with a wrong frequency. If a camera has limited sampling rate, may inaccurately sample high-frequency light information, resulting in moiré patterns. To prevent aliasing, anti-aliasing filters, or blurring filters, are commonly

---

applied before the imaging chip to filter out the high-freen frequenyy information that the imaging chip cannot correctly sample. In Figure an example image obtained by applying the anti- aliassnn filter before sampling is demonstrated. After different lenses, the light field would pass through the aperture and shutter, and get sampled by the imaging chip with an array of rectangular light sensors. In the imaging chip, each sensor produces an RGB value by averaging the light projected onto it, resulting in an output image [32 that further blurred relative to the field light from the anti-aliasing filter.
Effect Filters. After obtaining digital image with the imaging chip, digital cam- eras typically apply a variety of effect fil- ters to enhance the visual appeal of the im- ages [32]. Common effect filters include brightness, saturation, sharpening, expo- sure, contrast, highlight, shadow, vibrance, color temperature and so See Figure (d) and (e) for visualization on the effect of applying the sharpening and contrast fil- ters.
Sample,
Anti-alias
Effect
&sample
filters
(d)
(e)
Figure 3; Factors influencing image effect. (a) Original
light field, represented with an image. (b) Aliasing ef-
fects (simulated by applying sampling). (c) 1D aliasing. (d) Applying anti-aliasing before sampling. (e) Apply- ing effect filters of sharpening and contrast, Images are from
Physical World Attacks with Adversar- ial Pattern. well-known limitation deep learning models 13,
6
30
37 26
14
43
that they are vulnerable to ad-
versarial attacks [39 9 5
28 2. Such a
limitation makes crafting adversarial pat-
terns effective for evading pedestrian detectors possible. Adv-Patch (34] is one of the earliest works that discovered adversarial patterns can disrupt detector decisions the physical world. After that, many methods have been proposed to keep adversarial patterns effective when printed onto clothing (Adv-Tshirt [42)). to improve adversarial clothing performance at different angles (TCA [17) and to improve naturalness of the adversarial clothing [33] 16 18 [0]. In addition, many physical adversarial attack methods have been proposed for attacking vehicle detectors (35] 20) BT) 40),
person re-identificatio models (88 and object tracking models 41 4 However, to the best of our knowledge, few works have addressed the decline of attack performance when distance increases.
Distant Image Converter
To bridge the appearance gap be- tween distant adversarial pedes- trian images in the physical and digital worlds, we propose to im- plement Distant Image Con-
Distant image dataset labels
20m
verter (DIC). An intuitive solu- tion is train multiple neural networks, each specialized for image conversion at specific dis- tances. However, this approach demands large training set due to the large amount of parame- ters involved. In this work, we address this by implementing a physics-based DIC, leveraging principles of physics and cam- era hardware design. This en- sures realistic image conversion with only 15 learnable parame-
Print
Skylight
Turbidity
Distance (d)
(psh6)
(T)
DIC
label
Sim.
Output
image
Atm. Pers.
AAF
Effect filter 0s
MSE
Sim.
Sim.
loss
0c
Digital Image
SGD
Figure 4: The overall pipeline of the DIC. The continuous arrows indicate the inference pipeline. The dashed arrows are used during training.
ters. Specifically, when given an input image, target distance, and environmental parameters like skylight RGB and turbidity values, the DIC should produces an output image that simulates the visual effect of positioning the input image at the target distance.

---

Simulating blurring performed by AAF
Simulating blurring
performed by IC
la
tride =Aa
n=2,y=5 y=5
n=2,
to
Input
la
Output
Averaging in AAF sim.
Distance d
sensor locations
Averaging
= y=5
n= y=11
IC sim.
(b)
Figure 5: Camera simulation module. (a) An illustration the blurring operations performed by the camera simulation module. (b) Visualizing outputs of function f with different parameters.
The inference pipeline of our DIC illustrated in Figure 4 That is, the DIC converts an input image with the atmospheric perspective module, the camera simulation module. and the filter module, simulating the physical world factors contributing to the appearance gap in sequence. We make the unknown physical world parameters controlling the effect of each module A. fc, fc.02 0 learnable so that they can be effectively estimated through Stochastic Gradient Descent (SGD) with some training data. In the following, we first introduce each module then the training method.
3.1 Atmospheric Perspective Module
As demonstrated in Figure 2 (a), when observer takes photos of distant target at distance d, the ray of lights emitted from the target toward the observer (represented by image r E p3xwxh and h being image width and height respectively) would be scattered away by molecules in the air, causing a decrease in brightness. At the same time, skylight with RGB values of psky E R would be scattered toward the observer, shifting the target object's 's observed color towards the skylight.
To simulate the effect, we implement an atmospheric perspective module FA following previous The inputs of the module include image Tobj of the target object, a turbidity value T representing air quality, The module produces an output image MM that simulates the effect of the target object at distance by processing Jobj with
works 29 12).
target distance convert the image, and the skylight RGB value peky
= = (Ibbi, T. ssky A r TT)
(ile( (1 ((0x.T)d)
(1)
where file the tiling function that repeats peky to form an image with the same shape of Tobl A represents the estimated physics-related parameters and the ,3 function represents the decay rate. See Appendix A for more details on A and
3.2 Camera Simulation Module
To simulate the blurring effect introduced by the Anti-Aliasing Filter (AAF) and the Imaging Chip (IC) in camera, model the camera using convolutional layers in sequence. The blurring done by the layers is illustrated Figure 5 a).
Convolutional Layer Kernel Generation. rays within a certain radius and the sensors on the IC to form their outputs by averaging all light rays projected onto them. To simulate their effects, convolutional layers with blurring kernels that take averages within circular and square regions in their local input windows at each stride should be used 32 Additionally, since the camera simulation module needs approximate the unknown AAF blurring strength and IC sensor size of different target cameras, the amount of pixels averaged by the kernels should be learnable through propapropa.ttion.
The AAF blurs each ray of light with neighboring light
To achieve this goal, although there are many alternative ways, we found that an effective approach is to implement unified kernel generation function for both the AAF and IC simulation layers.

---

That is, as illustrated in Figure 5 b), we first implement function f. which outputs values close to 1 when the L norm of the coordinate (i.j) within the kernel is less than 3 and outputs values near otherwise:
i,,,,,, = sigmoid((1" + )² + 2) * + sigmoid (v" + j²)
(2)
Then, we take the normalized version of f as the function f that generates the j value in the zth row of the kernel weight w 12**k, That is, we let
M(a. i,j. E. +E= -) i,j,))
Way flr.k,iiiii..
By setting n = 2, the generated kernel takes averages within circular regions in its local input windows at each stride, allowing it to approximate the blurring done by the AAF. By setting n co, the kernl takes averages within rectangular regions in its local input windows at each stride, mimicking the blurring done by the IC sensors. Moreover, by adjusting the learnable parameter y, the number of pixels averaged by the kernel within its local input windows at different strides is altered, allowing for the simulation of various blurring strengths in the AAF and sensor sizes in the IC.
Simulating AAF, target distance to simulate the effect of the AAF averaging every incoming light ray with neighboring light rays within its blurring radius, we set the stride of the corresponding convolutional layer to 1, and generate the different entries of the kernel w within the layer using the function f with n 2. That is, we let
w Wais f(rā kid (.
4
Simulating Imaging Chip. Similarly, simulate the effect of IC target distance d with another convolutional layer. To simulate the effect that when a digital image with height to is placed at a long distance d, the imaging chip would capture it with fewer sensors form a smaller image with height la. as illustrated in Figure we set the stride of the convolutional layer to Ia = lo/la- a- To simulate the blurring done by the square imaging sensors, we generate different entries of its kernel u using function f with n 20, that is
W Wd.i. f(rà k. j,
(5)
Implementation of camera blurring strengths vá and 7.- To set proper blurring strength vá and Td for simulating the AAF and IC at different distances, we observe that in the physical world, more distant objects are smaller relative to the fixed physical blurring strength in AAF (9A) and IC (59). That is, the blurring strength (5) to image height (la) ratio increases distance increases.
In the digital world, when given a digital input image with height lo, to consistently simulate the aforementioned ratio at different distances, we set 7 = 7 x and 7 = xa. In this way, blurring strength image height ratio in the digital world (Ma/lo = 7 x va/l)) is identical to that in the physical world (5/la) since la lo/za. A more detailed explanation with visualization is provided in Appendix B
By setting O = IiAA | and optimizing Oc. the camera simulation module can be trained to approximate the blurring effect of any target camera.
Implementation of camera simulation module. We express the camera simulation module FC with two channel-wise convolutional layers in sequence simulating the effect of AAF and IC distance d as
IG = F d, w ( = ( 1, w = w = Id, w
where I is the output of the atmospheric perspective module, and indicate the stride and kernel size of the two convolutional layers.
3.3 Effect Filter Simulation Module
In this module, we let fe denote the mapping function of a specific effect filter, and FE denote the mapping performed by sequence of effect filters. We define FE as:
I
F (F (I) 0.),...,))))) 0.),
(7)
5

---

where I& is the ouiput of the camera simulation module, 0g = [01..... Sel is the learnable parameter that controls the output effect of each effect filter, 1g is the input RGB image from the camera simulation module and L is the output image. By identifying the effect filters commonly involved in the target cameras and obtaining appropriate value for F the influence of effect filters can be simulated. Please refer to Appendix C for the exact computation of each effect filter.
3.4 Distant Image Converter Training
We collect small distant image dataset and optimize the DIC to obtain appropriate DIC parameter values (. Cc. g) As illustrated in Figure we first printed images on papers, then by photograph- ing the printed images at different distances and extracting crops that capture the same content as the original digital world images, we collected pairs between digital world images and their distant versions in the physical world. With this dataset, the parameters of the DIC can be optimized with stochastic gradient descent (SGD) using Mean Square Error (MSE) loss as the objective function, where the MSE loss is calculated between the DIC outputs and the corresponding physical world ground truth images with identical shape.
Full-Distance Attack
The optimization pipeline of the FDA method is illustrated in Figure [6] The adversarial patterns are first randomly cropped (as explained in Section 4.1 and applied onto short-distance pedestrian im- ages. With the sub-patches applied, the pixels of the adversarial pedestrian are ex- tracted (e.g. based on pedestrian masks generated with segmentation models). The extracted pixels are transformed by the DIC into their distant counterpart and su- perimposed onto randomly selected back- ground images, generating a batch dis- tant adversarial pedestrian images. Within the same batch, different pre-selected dis- tances are used to perform the distant im- age conversion. The parameter T and kyy
Pedestrian
Backkround dataset
dataset
Multi-scale cropping
Buj e lmg. ... T Buuj
Te.
DIC
Adversarial loss
20m
detector
T,,4
Imi.
DIC
40me
T
DIC
Adv. patch
N
Figure 6: FDA overall optimization pipeline. T₁ and r-ky are randomly sampled turbidity and skylight values. for DIC (from Equation ([) are obtained by random sampling, allowing the FDA pattern optimized to be effective not only under different distances, backgrounds but also under different atmospheric conditions. Also, we apply EOT' [ on . Oc and fg to make the resulting FDA pattern robust against potential physical world disturbances. By feeding the current batch of adversarial pedestrian images into the target detector and calculating the loss function for performing the adversarial attack, the FDA pattern can be optimized through SGD.
At D different simulated distances, we minimize the confidence e and IOU u of all correctly predicted pedestrian bounding boxes generated by the target detector. That is,
D Na
K
Ladv
(8)
K
k=1
where >e and A are manually set parameters balancing the two terms, N₂ the number of images generated with adversarial pedestrians at distance d.
Please note that, without the green box part, the pipeline in Figure degenerates to the Adv-Tshirt pipeline 42
with the only difference being that we sample random sub- sub-patches of different sizes.
4.1 Multi-Frequency Optimization
Empirically, we found that by optimizing the FDA pattern with our proposed pipeline, there was conflict in performance between short and long distances. We conjecture that this conflict might be due to the following two properties:

---

At short distances, with a high resolution, both the low frequency patterns (or overall patterns) and high frequency patterns (or fine textures) can be optimized for performing attacks.
At long distances, due to the reduced resolution, only the low frequency patterns remain, so only the low frequency patterns can be optimized for performing attacks.
A conflict could be resulted if the required low frequency patterns at short distances and long distances different. To address this problem, we propose two Multi-Frequena Optimization (MFO) techniques to encourage the low frequency components of the adversarial patterns to be optimized for long distance attacks and the high frequency patterns to be optimized for short distance attacks.
Multi-Scale Cropping (MSC) technique. We set a smaller crop and patch application size for the adversarial patch when optimizing at short distances. In this way, it is harder for the short-distance optimization objectives to alter the overall pattern of the patch, preserving the low frequency patterns for long distance attacks.
Two Stage Optimization (TSO) technique. In TSO, we divide the optimization pipeline into two stages. In the first stage, the patch optimized with a larger bias on long distances to obtain low frequency components for long distance attack by optimizing with more long distance images. In the second stage, the patch is optimized with larger bias to obtain high frequency component for short distance attack by optimizing with more short distance pedestrian images. In addition, in the second stage, we add a loss function term that restrict the low-frequency components of the patch to remain unchanged. The loss function term introduced is described in Appendix D
Experiments
Subjects. To evaluate the performance of different adversarial patterns in the physical world, we recruited five subjects (three males and two females with age ranging from 25 to 55) to collect test images and form demo videos. The recruitment and study procedures were approved by the Department of Psychology Ethics Committee, Tsinghua University, Beijing, China.
Experiment settings. Unless otherwise stated, we present our results with YOLOv5 21 as the target model, the camera used capture the physical world testing images the back camera of Xiaomi-CIV smart phone. For optimization details, we used configurations of Ady-Tshirt [42) and
TCA 17 for patch and clothing experiments respectively. Given that all models failed to detect pedestrians reliably beyond around 41 meters, we optimized the adversarial patterns at simulated 4m, 8m, 14m, 20m, 26m, 34m and 40m, tested the patterns at 3.5m, 6m, 12m, 18m, 24m, 32m and 41m in the physical world unless otherwise stated. Appendix [ provides a detailed analysis on the choice of the current distance range and the influence of holding a patch. To report reliable results, all physical world attack results reported are averaged over three trials, each trial had a different subject and a different location.
Evaluation Metric. rate (ASR) across different distances. The ASR certain distance is defined as 1 TP denotes the number of True Positives and GT denotes the number of Ground Truths. Following TCA [17, we set both the IOU and confidence thresholds for calculating TP to be 0.5.
We evaluated the performance of adversarial patterns with average attack success
QT where TP
Distant Image Dataset. To form a distant image dataset to train the DIC (Figure we printed 45 training images and 9 testing images onto papers, collected photos of all printed images at 7 distances (4m, 8m, 14m, 20m, 26m, 34m, 40m) in 5 days and removed ones with noises (c.g. reflections and shadows). When photographing, skylight RGB values of the days were also recorded. Samples of training, test and skylight images are provided in Appendix F We empirically found that though the dataset was small, it was enough train a good DIC as the DIC only has 15 parameters (Section [.1)
Datasets for Pedestrian Attack. To optimize the FDA patterns in the digital world, we created a pedestrian dataset and a background dataset. 1100 pedestrian images were extracted from existing datasets (INRIA 3, PennFudan (36) and COCO (4)). Additionally, we gathered 1000 more pedestrian images from online sources to boost diversity. We manually selected all images to ensure
they had a similar resolution and scale to the 4-meter pedestrian images. Samples from the dataset are provided in Appendix F We used the background dataset provided by existing work [18). To
7

---

Input
Naive
FCN
DIC
R.W. label
Naive
0.16
FCN
DIC
(dey1)
0.12
12
(day2)
0.10
20m
20
30
40
(day2)
Distance (m)
(a)
(b)
Figure 7: DIC results. (a) Performance different distant image conversion methods on the test set of the distant image dataset. (b) Visualization of distant image conversion results. R. W. indicates real world.
1.00
0.75
FDA (74%)
ASR
0.50
Adv-T. (22%)
Random (5%)
Normal (0%)
10
20
30
40
FDA patch
Adv-Tshirt patch
Random patch
Ensemble patch
Distance (m)
(a)
(b)
Figure 8: Physical world patch attack results. (a) ASR of different attack methods. Average ASRs of each curved reported in the brackets of the legend. (b) Adversarial patterns generated by different methods.
eliminate the potential for FDA patterns to over-fit to elements in our local environment, we excluded self-collected background images and self-collected 4-meter pedestrian images during optimization.
Digital Patch Attack Evaluation Configuration. To evaluate the average ASR of patch in the digital world, we applied the patch onto 300 held out testing pedestrian images and converted them into their distant versions different distances as in the training pipeline in Figure 6 By feeding the distant adversarial pedestrian images into the detector, the digital world ASRs of the patterns could be calculated.
5.1 DIC Results
We compared the performances of DIC and the naive distant image conversion method (achieved through image size reduction). In addition, we trained seven Fully Convolutional Network (FCN) 27 to convert distant images, each designed for specific distance (See Appendix G details). We used the 12-norm error between labeled images from the physical world and the conversion results as the evaluation metric. As illustrated in Figure 7 (a), the DIC obtained stable 12-norm enror of around 0.11 across different distances, where the 22-norm error of the FCN and the naive method increased from around 0.11 to 0.16 as distance increased.
Figure (b) visualizes the results different methods. At different distances and on different days, can be observed that compared to the conversion results generated by the naive method and the FCN method, the results generated by the DIC had the closest visual effect the real world images.
5.2 Adversarial Patch Attack in the Physical World
Settings. Using adversarial patches, we evaluated the performance of patterns optimized with our FDA method against patterns obtained with different baseline methods the physical world. For all patterns, we set patch size of 200 x 133 and printed it onto piece of paper with size of 72 cm x

---

Target
YOLOv5
Mask RCNN
Mask RCNN
FIRCNN 8
RetinaNet (PVT)
YOLOv8
D-DETR
Source
21
(ResNet) [4]
(SWIN)
22
43
Random
5%
7%
12%
9%
19%
4%
6%
YOLOv5
74%
34%
29%
26%
34%
49%
63%
Ensemble
79%
74%
71%
77%
87 %
80%
75%
Table 1: Physical world black-box attack results. Source indicates the models that the FDA patterns
were optimized against, target indicates the model attacked by the FDA patterns, random indicates random pattern and ensemble indicates ensemble attack. Black-box attack results with average ASRs 2 50% are highlighted in bold face. White-box attack results are indicated with blue italic font.
50 cm. Each patch was tested at seven distances between 3.5 and 41 meters, with about 30 images collected at each distance within each trail (out of three trails) to calculate distance specific ASRs.
Main Results. Figure X (a) shows the ASR of our (YOLOv5) FDA pattern with respect to distance. For comparison, we also plot the results of the normal pedestrian (without holding adversarial patch), a random pattern (formed by random RGB blocks) and an Ady-Tshirt pattern [42]. The patterns generated are visualized in Figure 8 (b). The FDA pattern achieved the highest average ASR of 74%. The corresponding digital world evaluation result is presented in Appendix [H] We have also reproduced N6P and T-SEA[19 and tested the patterns under comparable setting. The two patterns obtained average ASRs of 19% and 42% respectively. For visualization on FDA performance, we included demo videos in the supplementary material.
Generalizing Across Scenarios. When we used the back camera of Huawei-Nova-I 1-SE and OPPO-A9 smart phones when obtaining the testing images, the FDA pattern obtained average ASRs of 68% and 72% respectively. When the FDA pattern was tested under eight new test distances neighboring our original test distances, it obtained an average ASR of 76% (More details are provided in Appendix D Such results demonstrate that the FDA pattern generalizes well across different scenarios.
Ady-Tshirt with EOTs, To investigate if it is possible to achieve FDA with a strong EOT [ that might cover the effect of increased distance, optimized three Adv-Tshirt patterns with EOTs in color and noise that were time, 3 times and 10 times larger relative to the original strength. The corresponding patches only obtained average ASRs of 22%, 10% and 8% respectively, demonstrating that a larger EOT not helpful for performing FDA.
Ablation Studies. To evaluate the influence of different design components, we first removed both DIC and MFO. The resulting FDA pattern obtained an average ASR of 22%. By adding the DIC and MFO back into the optimization pipeline, the average ASR of the resulting patterns increased to 65% and 74% respectively, indicating that they both contributed to the performance of FDA. Analysis on the influence of different components in DIC and MFO, together with analysis on the presence of
conflict in attack performance between short and long distances are provided in Appendix []]
Black-Bor Attacks. To investigate the generalizability of FDA patterns across detectors, we trans- fered the FDA pattern optimized for YOLOv5 to attack black-box models (as shown in Table T).
Without specific designs for boosting transferability. the FDA pattern did not achieve good ASRS except on the Deformable DETR. We then integrated FDA with ensemble attack (25) (by optimizing the FDA pattern to be effective for both Mask RCNNs with ResNet backbone [14] and Swin backbone
(26), the resulting FDA pattern achieved good black-box attack performance, obtaining average
ASRs of more than 75% on all black-box models. The FDA pattern optimized for ensemble attack is visualized in Figure (b).
5.3 Clothing Attacks in the Physical World
To optimize the FDA pattern for clothing attacks, we incorporated toroidal cropping 17 into the FDA pipeline. We followed the process outlined in Figure with the sole modification that we tiled the adversarial patch prior to multi-scale cropping by tripling the patch both vertically and horizontally. By integrating toroidal cropping, we enabled the FDA clothing to attack from angles as for the
TCA clothing (we leveraged TCA instead of TC-EGA since we found the TCA method to be more effective on YOLOV5). Different clothing tested targeting YOLOV5 are illustrated Figure (b). The clothing tailoring process and different adversarial patterns tested are provided in Appendix K

---

1.0
(76%)
TCA (37%)
ASR
0.6
Normal (0%)
0.4
0.0
10
20
Distance (m)
FDA
TCA
Random
Normal
(a)
(b)
Figure 9: Clothing attack. (a) Attack results. (b) Front and side view of different clothing.
In the experiments, we tested the FDA clothing, TCA clothing [17 random clothing and normal clothing. Each clothing was tested at seven distances between 3.5 and 41.0 meters, with about 30
images collected within each trail (out of three trails) at each distance to calculate the ASRs.
As demonstrated in Figure (a), when targeting the YOLOVV5 21 model, in the front and back view, both the random clothing and the normal clothing had near zero attack performance. By covering the entire body of the subject, the TCA clothing obtained an average ASR of 37%. The FDA clothing outperformed the TCA clothing with an average ASR of 76%. Similarly, in the side view, the FDA clothing obtained average ASR of 61%, being 15% higher than TCA, while the random and normal clothing had average ASRs of 0%.
Additionally, when treating the Deformable DETR 43 and the RetinaNet with PVT backbone [37 as the target model, in the front and back view, the FDA clothing has also attacked the target models effectively by obtaining average ASRs of 71 % and 73% respectively.
we calculate the mean average ASRs across confidence thresholds of 0.1, 0.2, 0.9, when targeting YOLOV5, in the front and back view, the mean average ASR of the FDA clothing, TCA clothing, random clothing and normal clothing was 78%, 43%, 9% and 3% respectively. Analysis on the performance of different FDA clothing under different IOU thresholds is included in Appendix
The results confirm that our proposed method has the ability boost FDA performance all angles and the FDA method is effective for clothing attacks.
Limitation and Potential Social Impact
As described in Appendix K depending on the target model and attack method used, if abstract human-like patterns appear on the FDA pattern, the detector may generate small pedestrian bounding boxes for these patterns, even when the actual pedestrian subjects are not detected. This could lead to a decrease FDA performance on some models when smaller IOU threshold applied. However, this is not specific to the FDA method human-like patterns have appeared in previous attack methods 34 17
Physical-world adversarial attack research can lead to unwanted applications in real-world scenarios such as evading security cameras, but we publish our work inspire researchers to propose more reliable detectors with adversarial defense mechanisms. We also urge readers and future researchers to set strict access controls for adversarial patterns and pattern generation codes targeting detectors in security-sensitie areas. This may include user authentication, licensing agreements, and usage monitoring.
7 Conclusion
In this work, we bridge the appearance gap between the digital world and the physical world by proposing the DIC. Moreover, we avoid conflicts that impede optimization by proposing two MFO optimization techniques. Together, the FDA patterns gained high ASRs targeting different detectors within a wide range of distances in the physical world.
10

---

Acknowledgments
This work was supported by the National Natural Science Foundation of China under grants U2341228 and 92370124.
References
[1] A, Athalye, L. Engstrom, A. Ilyas, and K. Kwok. Synthesizing robust adversarial examples. In J. G. Dy and A. Krause, editors, Proceedings the 35th International Conference on Machine Learning, ICML 2018, Stockhelmsmässunn Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pages 284-293. PMLR, 2018.
[2] N. Carlini and D. A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22.26, 2017, pages 39-57. IEEE
Computer Society, 2017.
[3] Y.-T. Chen, C.-S. Chen, Y.-P. Hung, and K.-Y. Chang. Multi-class multi-instance boosting for part-based human detection. 2009 IEEE 12th International Conference on Computer Vision Workshops, ICCV Workshops, pages 1177-1184, 2009.
[4] L. Ding. Y. Wang, K. Yuan, M. Jiang, P. Wang, H. Huang, and Z. J. Wang. Towards universal physical attacks on single object tracking. Proceedings of the AAAI Conference on Artificial Intelligence, 35(2): 1236-1245, May 2021.
[5] Y. Dong, F. Liao, T. Pang. X. Hu, and J. Zhu. Discovering adversarial examples with momentum. CoRR, abs/1710.06081 1, 2017. URL httllhhtt://aat httt:://arzi..orr//b////01 06081
[6] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenbom, X. Zhai, T. Unterthiner, M. Dehghani, M. Min- derer, G. Heigold, S. Gelly. J. Uszkoreit, and N. Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale. CoRR, abs/2010.
2020. bttpp:tt:
org/ abs/ 2010. 11929
[7] Y. Duan, J. Chen, X. Zhou, J. Zou, 7. He, J. Zhang, W. Zhang, and 7. Pan. Learning coated adversarial camouflages for object detectors. In L. D. Raedt, editor, Proceedings of the Thirty-Fire Fiirty-First International Joint Conference Artificial Intelligence, IJCAI-22. pages 891-897. International Joint Conferences on Artificial Intelligence Organization, 2022. Main Track.
[8] R. Girshick. Fast R-CNN. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), pages 1440- 1448, December 2015.
[9] Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015, Ittp:://// orgg/bs///ieeeoooeo/ggeoeee hetp///ss/41....../ 6572
[10] A. Guesmi, I. M. Bilasco, M. Shafique, and I. Alouani. Advart: Adversarial art for camouflaged object detection attacks. ArXiv, abs/2303.01 .1,44, 2023.
[11] D. M. Hanumantharaju, G. Vishalakshi, S. Halvi, and S. Satish. A novel fpga based reconfigurable architecture for image color space conversion. Communications Computer and Information Science, 270, 12 2.1
[12] K. H., J. Sun, and X. Tang. Single image haze removal using dark channel prior. In 2009 IEFF Conference on Computer Vision and Pattern Recognition (CVPR), pages 1956-1963, 2009.
[13] K. Hc, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[14] K. He, G. Gkioxari, P. Dollar, and R. Girshick. Mask r-cnn. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), pages 2961-2969, Oct 2017.
[15] S. Hoory, T. Shapira, Shabtai, and Y. Elovici. Dynamic adversarial patch for evading object detection models. ArXiv, abs/2010.1300 13070, 2020.
[16] Y.-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, and W.-H. Cheng. Naturalistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 7848-7857, October 2021.
[17] Z. Hu, S. Huang. X. Zhu, F. Sun, B. Zhang, and X. Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 13307-13316 June 2022.
[18] Z. Hu, W. Chu, X. Zhu, I.. Zhang, B. Zhang, and X. Hu. Physically realizable natural-looking clothing textures evade person detectors via 3d modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16975 16984, June 2023.
[19] H. Huang, Z. Chen, H. Chen, Y. Wang, and K. Zhang. T-SEA: Transfer- based self- ceff-ensemble attack on object detection, 2022. https::s::/ //arxiv wwggabs/////eeeeooogoo......sera absaa/as//// 2221100973
11

---

[20] L. Huang. C. Gao, Y. Zhou, C. Xie, A. L. Yuille, C. Zou, and N. Liu. Universal physical camouflage attacks object detectors. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
[21] G. Jocher. Ultralyties yolov5, 2020, URL
[22] G. Jocher, A. Chaurasia, and Qiu.
Ultralytics yolov8, 2023. URL htttp:://githi ctob..cc...bboo/oo
altrralyticcsulltralyyta.
[23] T. Kim, Y. Yu, and Y. M. Ro. Multispectral invisible coating: Laminated visible-thermal physical attack against multispectral object detectors using transparent low-e films. Proceedings of the AAAI Conference on Artificial Intelligence,
Jun. 2023.
[24] T. Lin, M. Maire, S. J. Belongie, L. D. Bourdev, R. B. Girshick, Hays. P. Perona, D. Ramanan, P. Doll'a and C. Zitnick. Microsoft COCO: common objects in context. CoRR, abs/1405.0312, 2014, URL
http://arrs http//aii..o./aaaaaaa www./o//.aaa///e.ooo/oooo.. 1atpa//405.00122 0312
[25] Y. Liu, X. Chen, C. Liu, and D. Song. Delving into transferable adversarial examples and black-box attacks.
In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26,
2017, Conference Truck Proceedings. OpenReview.nel 2017.
[26] Z. Liu, Y. Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang. S. Lin, and B. Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 10012 10022, October 2021.
[27] J. Long, E. Shelhamer, and T. Darrell. Fully convolutional networks for semantic segmentation. In The IEEE/CVF Conference Computer Vision and Puttern Recognition (CVPR). June 2015.
[28] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver BC, Canada, April 30- May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
[29] C. Morales, T. Oishi, and K. Ikeuchi. Real-time rendering of aerial perspective effect based on turbidity estimation. IPSJ Transactions on Computer Vision and Applications, 9. 12 2017.
[30] J. Redmon, Divvala, Girshick, and A. Farhadi. You only look once: Unified, real-time object detection. In In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 779-788, Los Alamitos, CA, USA, jun 2016. IEEE Computer Society.
[31] N. Suryanto, Y. Kim, H. Kang, H. Larasati, Y. Yun, T.-T.-H. Le, H. Yang, S.-Y. Oh, and H. Kim. Dta: Physical camouflage attacks using differentiable transformation network. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15305-15314 15314, June 2022.
[32] R. Szeliski. Computer vision algorithuns and applications. Springer, London; New York, 2011. ISBN 9781 9781848829343 1848829345 978 1488299550 1848829353.
[33] J. Tan, N. Ji, H. Xie, and X. Xiang. Legitimate adversarial patches: Evading human eyes and detection models in the physical world. In Proceedings of the 29th ACM International Conference on Multimedia, MM '21. page $307-5315, New York, NY, USA, 2021, Association for Computing Machinery. ISBN 9781 9781450386517.
[34] S. Thys. W. V. Ranst, and T. Goedemé. Fooling automated surveillance cameras: Adversarial patches attack person detection. CVPR Workshops, pages 49-55. Computer Vision Foundation IEEE, 2019.
[35] J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 8565 8574, June 2021.
[36] L. Wang, J. Shi. G. Song, and L.-f. Shen. Object detection combining recognition and segmentation. In Y. Yagi. S. B. Kang, I. S. Kweon, and H. Zha, editors, Computer Vision - ACCV 2007, pages 189-199, Berlin, Heidelherg, 2007. Springer Berlin Heidelherg. ISBN 978-3-440-76386-4
[37] W. Wang, E. Xie, X. Li, D.-P. Fan, K. Song, D. Liang, T. Lu, P. Luo, and L. Shao. Pyramid vision transformer: A versatile backbone for dense prediction without convolutions. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), pages 548-558, 2021.
[38] 7_ Wang, S. Zheng, M. Song, Q. Wang, A. Rahimpour, and H. Qi. adypattern: Physical-world attacks on deep person re-identification via adversarially transformable patterns. In Proceedings of the IEFF/CVF International Conference on Computer Vision (ICCV), October 2019.
[39] H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang. Physical adversarial attack meets computer vision: A decade survey. IEEE Transactions on Puttern Analysis and Machine Intelligence, pages 1 20, 2024,
[40] H. Wen, S. Chang. and L. Zhou, Light projection prajed Ahysical-worke vanishing attack against car detection. In ICASSP 2023 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1 1-5, 2023.
12

---

[41] R. R. Wiyatno and A. Xu. Physical adversarial textures that fool visual object tracking. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), October 2019.
[42] K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P. Chen, Y. Wang, and X. Lin. Evading real-time person detectors by adversarial t-shirt. CoRR, abs/1910.1109,, 2019. URL http://arxiv. org/ abs/
1910. 11099
[43] X. Zhu. W. Su, L. Lu, B. Li. X. Wang, and Dai. Deformable detr: Deformable transformers for end-to-end object detection. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021, 2021.
13

---

A Details for the Atmospheric Perspective Simulation Module
Following existing formulations
29 12 calculate AT) in Equation (1 by
3 - Ar) + (0, TT)
(9)
where A T describes the scattering effect caused by air molecules and AM (θ.. the scattering effect caused by moisture and dust. More specifically, (R A. T) and (xr(0 TT are:
A. T) describes
(n² 1)2
6 6 3pm
BR(OA,T)
)e
Bno
(10)
3N
Tpm
and
Brr (0,, 0.434 (0.6544T 0.6510) c. T( 2T ,2 0.67 E Miro
(11)
A;
where n 1.0003 is the refractive index of air in the visible spectrum, N is the molecular density of air, Pv. 0.035 is the depolarization factor of air, the altitude at the scattering point, H 7994m is the scale height for Rayleigh scattering, H 1200m is the scale height for Mie scattering, A, is the wavelength captured to be the output the current 7th camera channel, T the turbidity and is empirical parameter.
Since the molecular density N depends on environmental conditions such as atmospheric pressure, we initialize N with the molecular density of standard atmosphere 2.545 x 1025mm3 and set it to be learnable to estimate its value by optimization. Since imaging chips from different brands capture lights with different wavelengths the RGB channel outputs, we set A; representing the unknown light wavelength captured by camera channels to be learnable parameter. Since the parameter e has been estimated to be in vastly different values in different works (29), to estimate its value in our local physical world environment, we set it to be learnable. That is, we let 0 A [N, c, AR, Àç. AB]. In addition, set the turbidity T during DIC training and randomize T during FDA optimization to improve the robustness of the FDA pattern toward turbidity changes in the physical world.
Digital image
Distance O
Distance
Sim. distance
x
10
lo
la
O Y
Figure S1: visualizing relationships between 7, 7, vd, and la.
B More Details on and g0
As illustrated in Figure SI suppose have digital image with a height of to pixels and when placed at distance O in the physical world, the captured image also has a height of lo pixels. In the physical world, as distance increases to distance d, the height of the image would reduce to la. Since the AAF and IC in cameras are implemented by hardware, their physical blurring strength A and &C stay identical regardless of d, as the height of the image decreases to with increasing d, the ratio //la increases.
In the digital world, when implementing the camera simulation module, our goal is to accurately simulate the camera's 's imaging pipeline of first performing blurring by AAF then down-sampling with IC. Thus, it is inappropriate to use naive simulation pipeline such first down-scaling the digital image to height la and then applying AAF and IC simulation with blurring strengths 7 and 70, it would introduce incorrect aliasing effects and sample incorrect information.
When the target distance is d, the digital image with height physical world image, to perform the simulation correctly, we apply blurring kernels with xa times larger blurring strength by letting 7 7 Fg and 7 5c x xa for the AAF and IC simulation layers. This ensures that the blurring strength to image scale ratio matches the corresponding scenario in the physical world, allowing the blurring effect to be correctly and consistently simulated across different distances.
xa times larger than the corresponding

---

C Details for Effect Filter Simulation Module
We used eight effect filters fe in the ef- fect filter simulation module and opti- mized their parameters A.. The parame- ters were initialized such that the filters approximate identity mappings.
(a)
(b)
The first effect filter fi alters the bright- ness of images. first converts the RGB image Ism into the HSV space (H for hue, for saturation, for value) [T]. then multiplies the value of channel V by learnable parameter 01, and con- verts the resulting HSV values back to the RGB space. This filter performs the computation of
Increased value
Increased saturation
W sharp
-1
(c)
-1
0
-1
Before
After sharpening
sharpening
pot = fi 01)
(d)
(g)
(12)
Increased exposure
where Iout is the output image of the fil- ter, H-V(-) is the function that converts
RGB image into the HSV space .Τ.. V(.) is the function that multiplies the value channel of the image the HSV space by 0j. Clamp is the function that clamps the HSV value be within the range of [0.1] and RGB(.) is the func- tion that converts image in HSV space back to the RGB space [[]] See Fig- ure S2 (a) for visualization. With larger 0,, the output images are brighter.
(e)
Increased vibrance
Increased contrast
Warmer color temperature
(h)
Cooler color temperature
Stronger shadow and highlight effect
The second effect filter is the satura- tion filter that alters the colorfulness of images. Similar to the value filter, the effect filter f2 first converts the RGB image I'n into the HSV space, then mul- tiplies the saturation channel by learn- able parameter 12 and converts the sulting HSV values back to the RGB space. This filter performs the computation of
Figure S2: Effect of applying different effect filters.
pout f2( 02) (CGB(Caan((((HSSV((")). 0,0))),
(13)
where S(.) is the function that multiplies the saturation channel of the image in the HSV space by 02. See Figure S2 (b) for visualization. With larger 02, the output images more colorful.
The third effect filter / is sharpening filter. The filter transforms its input image I by performing two convolutions (Φ) in sequence, the first performing sharpening, the second performing blurring. The blurring layer has its blurring strength controlled by the learnable parameter 0g so that the sharpness of the output image can be manipulated. More specifically. the computation is
Tut fa(Tin 02) = d(o(Te, = = Wsharp), 1, w Wggans) )
(14)
where ((-) is the channel- -iiee convolution operation, s is the stride of the convolution operation.
Wsharp is the sharpening kernel demonstrated Figure (c), Wgaus is the Gaussian kernel generated by function g(0z) and 0g is the standard deviation of the Gaussian kemnel. See Figure S2 (c) for visualization. With the sharpening filter applied, highlight and shadow bands are added onto the color boundaries of the input image.

---

The fourth effect filter fa is the exposure filter that increases the brightness of the input image I'm exponentially according its learnable parameter 04. This filter performs the computation of
Tout fa(("m 02) Clamp([ 2**)..
(15)
See Figure S2 (d) for visualization. With larger 82. more pixels would become exposed by having values closer to I in all channels.
The fifth effect filter fs is the contrast filter that increases the brightness gap between brighter and darker pixels according to the learnable parameter 03. This filter performs the computation of
fo 0s) = Clamp(( 0.502) 1.015 (0s + 1)
Iout
(16)
1.015 0g
See Figure S2 (e) for visualization. With O3 increased, the brightness gap increases, which causes the details within the image to become more salient.
The sixth effect filter fe is the highlight and shadow filter. The effect of the filter is controlled by the learnable parameters low and 6 bigh. The filter all entries within the imput image Ism that have values lower than fe to be O, all entries higher than high to be 1, and increases the contrast of entries that have values between lo. and fighigh- This filter performs the computation of
I 0s.low
Tot
fo 1o, (6,high) = Clamp( Do.high 0s,tow
(17)
(f) for visualization. With larger Og, and lower 0o. it causes the darker and brighter details in the images to be more salient.
See Figure S2
The seventh effect filter fr is the vibrance filter that alters the contrast in saturation. This filter forms the output by first transforming the input RGB image into the HSV space, then altering contrast in the channel according to the learnable parameter 0, and forming the output by converting the altered HSV values back to the RGB space. This filter performs the computation of
put fi 0r) (GII( 07)))
(18)
where function B is the function that processes each channel IHSS of the input image in the HSV space independently (i indicates the channel) and forms the corresponding output channels iHSv following
HSV if i H V
HSV B(1.sV)
(19)
(L+e d--a -.65. if i ==== S.
See Figure S2 (g) for visualization. By having a smaller value in 07, pixels that were originally over-saturated obtain normal saturation.
The last effect filter fs the color temperature filter that shifts the image toward warmer or cooler colors according to the learnable parameter 0g E IR, This filter performs the computation of
out
fa II 0s) Clamp(I'n tile(0s)).
(20)
where tile the function that repeats the three dimensional parameter 0g into shape identical to Iin See Figure S2(() (h) for visualization. By having a larger value in the R channel of 0s. the image would have warmer color temperature, by having a larger value in the B channel of 0s, the image would have a cooler temperature.
D Loss Function for TSO
In the second stage of TSO, we propose to use the loss function of
[stago2 adv
Ladv + Σ oh VolllV((((PP.. 0b)) V(b(Ps,, 222)
(21)
Within Equation 21 P&I is the patch obtained stage (fixed in stage 2), Ps2 the patch to be optimized in stage 2 (initialized as P.t). The first term in Equation 21 is the adversarial attack loss

---

in equation 8 the function is the Gaussian blur operation that extracts low frequency information, where the band width (or the range of low frequency information) extracted depends on the standard deviation &, V is the function that vectorizes images, db is the parameter that controls the importance of maintaining patterns in different low frequency bands to be unchanged in the second stage. B is the number of different low frequency bands to maintain within the second stage. By setting ob corresponding to larger òg to larger values, the goal of maintaining the low frequency part within Ps1 to be relatively unchanged in the second stage can be achieved.
E Analysis on Experiment Settings
To determine an appropriate experiment distance range, we assessed the detection success rates of YOLOv5 (2D) Mask RCNN [14] and Deformable-DETR 43 across distances ranging from 3.5 to 50 meters. demonstrate that the random patches can not influence the performance of the models, we include detection results on both normal clothing and results on subjects holding a random patch. The results are included in Figure S3 the patch used is illustrated in Figure (b).
Distance Range. From Figure S3 (a), it can be observed that the performance of all mod- els starts to slightly degrade at around 32 to 41 meters. Beyond 41 meters, the detection suc- cess rate of most models fell below 60%, failing to make robust decisions. To demonstrate FDA method's 's effectiveness in performing at- tack, conducted experiments within the 41 meters range.
Detection Success Rate
1.0
0.8
0.6
YOLOVS-rand (Avg: 0.85)
YOLOVS-normal (Avg: 0.86)
0.4
MRCNN-rand (Avg: 0.78)
MRCNN-normal (Avg: 0.84)
DDETR-rand (Avg: 0.54)
DDETR-normal (Avg: 0.91)
0.0
Influence of Holding a Patch. Figure S3
30
40
50
shows that the performance of different detec- tors on normal clothing and random patches was comparable. The average detection success rate difference between the two cases is less than 7% across all models, where the difference typically occurs at distances beyond 41 meters where model performance is unstable. This re- sult confirms that without adversarial pattern, the patches could not reduce the detection suc-
Distance (m)
Figure S3: Evaluating the detection success rate of YOLOv5, Mask RCNN and Deformable-DETT on pedestrian subjects with normal clothing or holding random patches at different distances. "Normal" indicates experiments with normal clothing, "rand" indicates experiment with the pedestrian subject holding a random patch. cess rates of different detectors within selected distance range.
F
Details for Datasets
Distant Image Dataset. When selecting the digital training and testing images of the distant image dataset, we selected images from different distributions. The training images were collected by cropping randomly generated color plates at different scales and different orientations. The testing images were obtained by extracting crops of randomly selected adversarial patterns targeted on the RetinaNet [37]. See Figure S4 (a) and (b) for training and testing images in the dataset. To prevent the DIC from overfitting to certain day, we collected our distant image dataset under different skylights in days. See Figure 54 (c) for different skylight samples. To calculate the skylight RGB value psky of day, we took the image crop of the sky (near the horizon) and took an average over all pixels in the crop.
Dataset for Pedestrian Attack. The pedestrian images obtained from the COCO dataset, the INRIA pedestrian dataset and PennFudan dataset are illustrated Figure S4 (d), (e) and (f) respectively. The images collected contain pedestrians with different genders, races and ages. Samples of pedestrian images collected from online sources for increasing dataset diversity are demonstrated in Figure (g).

---

(d)
(a)
(b)
(c)
(f)
(g)
Figure S4: Samples from different datasets. (a) Training images of the distant image dataset. (b)
Testing image of the distant image dataset. (c) The skylight samples collected when collecting the distant image dataset. (d) Samples of pedestrian images selected from the COCO dataset (24). (c)
Sample of pedestrian images selected from the INRIA dataset [3. (f) Sample of pedestrian images selected from the Penn-Fudan dataset 36). (g) Samples of pedestrian images extracted from online sources.
1.00
0.75
ASR
(73%)
0.50
AdvTshirt (28%)
0.25
0.00
10
20
30
40
Distance (m)
Figure S5: Digital world attack performance of FDA patch and AdvTshirt patch.
G FCN for Distant Image Conversion
trained 7 FCNs, each dedicated performing distant image conversion at specific testing distances. The choice of FCN architecture was motivated by its translation invariant property, which simulates the spatial invariant mapping performed by the physical world imaging pipeline. All FCNs used a three-layer design. The first and second layers were ReLU layers, each with 250 neurons, the output layers were Sigmoid layers with output dimension of 3. These three output dimensions correspond to the RGB channels of the output images. The skylight RGB value psky, turbidity value were also fed into the kernel of the first layer. For FCNs dedicated to longer distances, we used kernels with larger width w and stride in the first layer, allowing smaller output images to be encoded, simulating the effect of scale decrease increases. More specifically, we set the (w, s) pairs for the input layers to be (4,1), 1), (7.3), (9.5), (13,7), (15,11), (18,13) and (21,15) for the distances of 4, 8, 14, 20, 26, 34 and 40 meters, respectively. To train the FCNs, we leveraged the training pipeline illustrated in Figure 4 (a).
For experiments in Section 5.1
distance
H Digital World Results for FDA Patch Attack
To further demonstrate the effectiveness of our DIC simulation, we include the digital world attack result the FDA patch and AdyTshirt patch Figure S55 73% and 28% respectively, comparable to the corresponding physical world attack results in Figure
The two patches obtained average ASRs of
5

---

5m
9m
15m
21m
28m
38m
45m
50m
Avg.
Patch
(%)
(%)
(%)
(%)
(%)
(%)
(%)
(%)
(%)
FDA
39
41
98
93
97
73
63
100
76
Rand
0
0
0
15
20
100
17
None
0
29
98
16
Table S1: ASRs of different patches at distances neighboring the ones used in the main paper. "Rand"
indicates tests performed with random patch, "None" indicates patch applied during the test.
I Generalizing Across Different Distances
As demonstrated in Table when we generalized the FDA pattern to distances different from the ones we used in the main paper, the FDA pattern obtained average ASR 76%, comparable the average ASRs at the original testing distances. This result indicates that while our method optimizes the FDA pattern for equidistant points within the attack range, the design still allows the pattern be effective across the entire range.
J Ablation Study on FDA
Ablation Study on DIC. To evaluate the contribution of different design component within the DIC, following the testing configurations in Section 5.1] we evaluated the average 12-norm error of the DIC across different distances with different design components removed one after another. With the full DIC, the average 22-orm error was 0.11. With the effect filter simulation module, the camera simulation module and the atmospheric perspective module removed, the average 22-norm error of the DIC increased to 0.12, 0.13 and 0.14 respectively. The result confirms that all design components within the DIC have their contribution to performing better distant image conversion.
Ablation Study on MFO. To evaluate the contribution of different design components within the MFO, we obtained the average ASRs of FDA patterns optimized with different MFO components removed using digital world tests. Empirically, we found that with the complete MFO design, the FDA pattern optimized obtained an average ASR of 73%. With the MSC removed, the average ASR of the resulting FDA pattern decreased to 66%. With the TSO further removed, the average ASR of the resulting FDA pattern decreased to 56%. The results confirm that all design components within the MFO have their contribution to boosting FDA pattern performance.
Presence of Conflict in Attack Performance. To demon- strate there is a conflict in attack performance between short and long distances that is impeding FDA pattern op- timization, we optimized two FDA patterns without MFO (with identical optimization configuration but different initialization) and compared their performance against the pattern optimized with MFO using digital world tests. From Figure [6 it can be observed that without MFO, the two patches with different initialization performed better either at long distances or short distances and obtained relatively low average ASRs of 56% and 43%, demon- strates that the conflict in performance between short and long distances exists. This result demonstrates that the MFO successfully boosted FDA performance by resolving the conflict.
MFO (56%)
W/ MFO (43%)
W MED (73N)
ASR
0.4
0.2
0.0
5
10
15
20
25
30
35
40
Distance(m)
Figure S6: Digital world performance of patterns obtained with or without MFO.
K More Details on Adversarial Clothing
Adversarial Clothing Tailoring. Figure S7 (a) illustrates the adversarial clothing tailoring pipeline in the physical world. That is, the adversarial patches were first tiled and scaled so that their scale relative to the pedestrian subjects match the corresponding scale used when optimizing the patterns. Following the boxes indicated in Figure S7 (a), the crops for forming the trunk of the shirt, the sleeves of the shirt and the trousers were extracted. These crops were then printed onto clothes and tailored by professional tailors to create the final clothing. The adversarial patches optimized for FDA

---

Sieeve
clothes
Trunk
Repeat
Crop
clothes
Tailor
print
Trouser
cloth
Figure S7: Adversarial clothing. (a) Clothing tailoring pipeline and FDA clothing pattern targeting YOLOV5, (b) TCA clothing adversarial pattern targeting YOLOVS, (c) Random clothing pattern. (d) FDA clothing pattern targeting Deformable DETR. (e) FDA clothing pattern targeting RetinaNet with PVT backbone.
Target
loU=0.5
1oU/0.44
loU=0.3
lol/=0.2
loU=0.1
loU=0.0
Mean
Model
(%)
(%)
(%)
(%)
(%)
(%)
(%)
YOLOV5
21
76
73
65
40
39
38
55
D-DETR 43
71
70
68
68
68
68
69
RetinaNetPVT)
73
73
72
70
69
67
71
Table S2: Average ASRs (across different distances) of FDA clothing targeting different white-box
models evaluated at different IoU thresholds. Mean indicates mean over Average ASRs at different IOU thresholds.
clothing targeting different detectors, TCA clothing targeting YOLOV5 and the random clothing are illustrated in Figure [S]]
FDA Clothing Performance Evaluated at Different IoU Thresholds. the main paper, we followed the convention from the baseline TCA paper [17] by using an IOU threshold of 0.5 to evaluate the performance of our FDA clothing. For readers interested further details, we also include the average ASRs of the three clothing evaluated in the main paper IOU thresholds of 0.5, 0.4, 0.3, 0.2, 0. 1, and 0.0, with their corresponding mean values across different thresholds in Table S2 We found the average ASR of the FDA clothing to be stable across different IOU thresholds on most models. As the IOU threshold decreased, the average ASR of the FDA clothing targeting Deformable DETR and RetinaNet remained stable around 70%. However, when the target model was YOLOV5, the average ASR the FDA clothing dropped from 76% to 38%. We found this drop to be due to the presence of small, abstract human- like patterns the adversarial pattern (illustrated in Figure S7 a)). At small IOU thresholds, if the abstract human-like patterns were detected, the corresponding small bounding box for the pattern would cause the attack be considered a failure, even when the actual pedestrian subjects were not detected. In contrast, the drop in performance did occur for Deformable DETR and RetinaNet, since, illustrated in Figure (7 and (e). the FDA patterns were formed by abstract Teddy bear nose patterns and abstract donut patterns, respectively.

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The claims made in the abstract and introduction supported with experi- ments.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We have included limitation section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]

---

Justification:
This work does not provide new theories.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We have provided necessary details to reproduce the work. Codes are also provided for interested readers.
Guidelines:
The answer NA means that the paper does include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?

---

Answer: [Yes]
Justification: We have included the github link to codes related to our key results. We have also provided detailed instructions how run the codes.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurlPS code and data submission guidelines (https
wttpg//dddd//oeuuuunnnnn ssicnpolicy) for more details. hetpolliicggiddeeCoooooo
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer:
[Yes]
Justification: detailed description can be found the beginning of Section Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: Considering the large amount of results to be analyzed, we have only included the mean values for better readability.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
10

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [No]
Justification: The amount of computational resources used commonly not considered or evaluated in the field of physical world adversarial attack.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics htttpp///eerriis..ccopbbb///eee
Answer: [Yes]
Justification:
We checked and followed NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: have provided our discussion in Section 6
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
11

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system Iearns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: When scrapping pedestrian images to form the dataset in this work, followed copyright requirements of the websites. In the github link that we publish our dataset and codes, declared CC BY-NC-SA 4.0 license.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cited the existing datasets used in work and followed the requirements in their license.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperswithcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
12

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: When scrapping pedestrian images to form the dataset in this work, we followed copyright requirements of the websites. In the github link that published our dataset, we protected it by declaring a CC BY-NC-SA 4.0 license.
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details the dataset/code/model as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [Yes]
Justification: We have recruited volunteers for our physical world tests. As stated in Section 5.2 our recruitment and study procedure has been approved by ethics committee in our institution.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [Yes]
Justification: As stated in Section 5.2 our recruitment and study procedure has been approved by the ethics committee in our institution.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
13

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
14


Reviews:
[{"review_id": "LplLzUeZqK", "reviewer": "Reviewer_e7ej", "summary": "The presents an adversarial attack that works in real world at different distances and fools object detectors. The method utilizes several advanced techniques like atmospheric perspective, camera and filter simulations, multi-frequency optimization to bring the method closer to real-world scenarios. The method is evaluated to fool YOLO-V5, Mask RCNN, and Deformable DETR.", "questions": "1) Did you consider variation not across distance, but across different angle of views, or other variations? If a person wearing the proposed adversarial clothes is still going to be adversarial if they change their pose, angle towards camera, etc?\n2) How are you going to propagate gradients for the detectors that use some non-differentiable operations like in MTCNN?\n3) How long does it take to optimize an attack?", "limitations": "Authors mention some limitations in the NeurIPS checklist and potential social impact is discussed in the Appendix L.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) Easy-to-follow writing with vivid illustrative figures and clear background and all text. It really helps to grasp the ideas.\n2) The change of the image from different distances is indeed a problem for fooling deep detectors. This paper leverages principles of physics and camera hardware design to transform patch-based digital attacks, that do not usually transform to physical world, to real-world scenarios.\n3) The method is accessed across different kinds of detectors and it seems it works at different distances most of the time. Evenmore, the crafted clothes fool across networks, making them black-box. Several ablations studies in the appendix are also interesting.", "weaknesses": "1) The adversarial patches/clothes are really massive.\n2) At some distances (5-10m) adv tshirt is better than the proposed FDA", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Question: The adversarial patches/clothes are really massive.\n\nAnswer: \n\nWe used relatively large patches and full-body clothing in our experiments for two reasons. First, it is now a common practice to employ large adversarial patterns such as full-body clothing [5][6] or fully-covered car paint [3][4], to conduct adversarial attacks. Second, considering the goal of this study is to enhance attack performance under a wide range of distances, when the subject is far away, due to the scale reduction, the blurred small patch or small piece of cloth cannot contain a sufficiently complex pattern for performing an adversarial attack. \n\nAs demonstrated in Figures 8(a) and 9(a), when printed with random patterns, at the current sizes, the patches and clothing had negligible attack performance. Additionally, at the current patch and clothing sizes, the baseline methods had limited full distance attack performance. This indicates that the current patch and clothing sizes do not contribute much to our full distance attack performance.  \n\n\nQuestion: At some distances (5-10m) adv tshirt is better than the proposed FDA.\nAnswer: Yes, you are right. Please note the goal of this study is to maximize the average ASR across different distances, so we find it acceptable for the proposed method to not perform perfectly at a small number of distances. But your comment reminds us that there is space for further improvement, and we’ll explore it in the future. \n\n\nQuestion: Is the FDA clothing adversarial under different angles and poses?\nAnswer: Yes, the FDA clothing is adversarial under different angles and poses. Regarding different angles, other than evaluating the clothing from the front and back view, we have also evaluated the performances of FDA, TCA and random clothing from the side view. The average ASRs were 61%, 46% and 0% respectively (lines 336-337 of the paper). Regarding different poses, when performing the clothing experiments, at various distances, we asked the subjects to walk with their arms swinging to collect the testing images. Therefore, the results in Figure 9 (a) were already averaged over different poses. \n\n\nQuestion: How are you going to propagate gradients for the detectors that use some non-differentiable operations like in MTCNN? \nAnswer: To the best of our knowledge, over the last 5 years, most mainstream detectors are differentiable, which is why we performed FDA by gradient backpropagation. But we found that there are several potential ways to perform FDA if there are any non-differentiable operations in the target model. Firstly, by using the ensemble attack method [1], FDA patterns that generalize well across detectors can be generated, enabling attacks on models with non-differentiable operations. Additionally, there are works that estimate adversarial attack gradients (BPDA) [2], generate attack gradients with a surrogate network [3], perform attacks using search algorithms [4], or propose a general adaptive attack method [7] designed accounting for the presence of non-differentiable operations. These approaches can potentially be leveraged to craft FDA patterns for models with non-differentiable operations.\n\n\nQuestion: How long does it take to optimize an attack?\nAnswer: It usually takes about 16 hours on a single NVIDIA 3090 GPU to optimize an FDA pattern. With the same set of code, the AdvTshirt and TCA patterns also required a comparable amount of time to properly optimize. We note that the optimization speed was not our main concern in this work and it could certainly be improved.\n\n\n[1] Yanpei Liu, Xinyun Chen, Chang Liu, & Dawn Song (2017). Delving into Transferable Adversarial Examples and Black-box Attacks. In International Conference on Learning Representations.\n\n[2] Anish Athalye, Nicholas Carlini, & David A. Wagner (2018). Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples. In International Conference on Machine Learning.\n\n[3] Yang Zhang, Hassan Foroosh, Philip David, & Boqing Gong (2019). CAMOU: Learning Physical Vehicle Camouflages to Adversarially Attack Detectors in the Wild. In International Conference on Learning Representations.\n\n[4] Tong Wu, Xuefei Ning, Wenshuo Li, Ranran Huang, Huazhong Yang, & Yu Wang (2020). Physical Adversarial Attack on Vehicle Detector in the Carla Simulator. ArXiv, abs/2007.16118.\n\n[5] Hu, Z., Chu, W., Zhu, X., Zhang, H., Zhang, B., & Hu, X. (2023). Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 16975-16984).\n\n[6] Jing Li, Sisi Zhang, Xingbin Wang, and Rui Hou. 2023. Mimic Octopus Attack: Dynamic Camouflage Adversarial Examples Using Mimetic Feature for 3D Humans. In Information Security and Cryptology: 18th International Conference, Inscrypt 2022, Beijing, China, December 11–13, 2022, Revised Selected Papers. Springer-Verlag, Berlin, Heidelberg, 429–444. https://doi.org/10.1007/978-3-031-26553-2_23\n\n[7] Yao, C., Bielik, P., Tsankov, P., & Vechev, M. (2021). Automated Discovery of Adaptive Attacks on Adversarial Defenses. In Advances in Neural Information Processing Systems (pp. 26858–26870). Curran Associates, Inc..", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WHeQ7gkhD1", "reviewer": "Reviewer_vR4J", "summary": "To achieve full-distance attacks, the authors summarize three factors that distort the performance including atmospheric, camera hardware, and effect filters. Then, the authors simulate these factors in the digital world via DIC. To overcome the conflict of different distances requiring different low-frequency patterns, the authors further propose a Multi-Frequency Optimization (MFO) technique.", "questions": "Please refer to the weakness.", "limitations": "The authors didn't provide the limitations. But they have explained their reason in the checklist, which sounds acceptable.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The summarized factors for full-distance attack are precise and important, and the DIC simulation for these factors conducted by the authors looks reasonable.\n2. The victim detectors used in this paper are advanced, which better illustrates the effectiveness of the proposed method.", "weaknesses": "Weakness:\n1. The best-performing approach in refer [1] is TC-EGA, while TCA is the suboptimal one. Why does this paper use TCA as a comparison method instead of TC-EGA? Additionally, why does this paper not adopt the TC-EGA approach to generate Expandable FDA, which is supposed to yield better results?\n2. In Fig. 9, I notice that the FDA pattern looks like many abstract human heads stacked together, and the detector might also perceive it as a combination of multiple small human heads. Considering that the IoU threshold for calculating ASR in this paper is only IoU > 0.5, these small human heads do not meet this condition and are therefore directly filtered out. However, these heads can indeed impact the attack's effectiveness. Namely, if the heads are detected, the attack should also be considered a failure. Therefore, using a single IoU threshold to measure ASR may not accurately reflect the attack's effectiveness. I hope the authors can address this issue, for instance, by providing ASR results at different IoU thresholds.\n3. The pattern of FDA appears very different with and without TC. Does this imply that FDA has a considerable number of different local optima during optimization?\n4. Compared to ASR, mASR (mean ASR with different confidence scores) [1] can more comprehensively reflect the attack's effectiveness.\n5. Providing experimental comparison results in the digital world can better illustrate the simulation effectiveness of the proposed method during training.\n\n[1] Hu Z, Huang S, Zhu X, et al. Adversarial texture for fooling person detectors in the physical world[C]//CVPR 2022.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Question: Why does this paper not adopt the TC-EGA approach as a baseline and generate an Expandable FDA?\nAnswer: Unlike the adversarial texture paper [1] which used the YOLOV2 and V3 models as the target models, we used YOLOV5 as our main target model. Table S3 of the NAPGuard Appendix [4] shows that TC-EGA performed poorly against YOLOV5, as it was only able to reduce the model’s AP from 100\\% to 65\\%. We confirmed this in our own experiments, making TC-EGA unsuitable as our baseline. In contrast, TCA obtained a good AP of 36\\% on YOLOV5 and it also supports full-angle clothing attacks, so we used TCA as our baseline method.\n\nQuestion: The FDA pattern looks like many abstract human heads stacked together, which might cause small detection boxes to show up. So, using a single IoU threshold to measure ASR may not accurately reflect the attack's effectiveness. \n\nAnswer: \n\nFirst of all, please note that it is a convention to use an IoU threshold of around 0.5 in physical attack evaluations [1,5], since in the literature of detectors, if a predicted bounding box has a small IoU relative to the ground truth, it is conventionally considered a false positive. We had to follow this convention to reproduce existing results and perform comparisons with the baselines.\n\nSecond, please note that with the TC (toroidal cropping) design, depending on the target model used, it is common for abstract human-like patterns to show up on adversarial patterns. For example, in Figure S1 (d), (f), (g) and (h) of the TCA paper’s Appendix [1], the adversarial pattern targeting YOLO, FasterRCNN and MaskRCNN are formed by abstract human heads and trunks stacked together. In contrast, when we changed the target model to be Deformable DETR or RetinaNet with PVT backbone, no human-like patterns showed up (Figs. 1 and 2 of the rebuttal PDF uploaded). \n\nSo, we found that when we used YOLOV5 as the target model, due to the presence of abstract human heads, as the IoU threshold decreases from 0.5 to 0.4, 0.3, 0.2, 0.1 and 0.0, more and more small detection boxes corresponding to the abstract human heads were no longer filtered out, causing the average ASRs to decrease from 73\\% to 65\\%, 40\\%, 39\\% and 38\\% respectively (the average ASR of normal clothing was 0\\% regardless of the IoU threshold used). Please note that even at the most extreme case of using an IoU threshold of 0, where the attack would be considered a failure if any small bounding boxes showed up on the subject due to the abstract human heads, the FDA pattern still obtained an average ASR of 38\\%. Additionally, on detectors where abstract human heads did not appear in the optimized adversarial pattern, the average ASR did not drop significantly as IoU threshold decreased. That is, when treating Deformable DETR as the target model, at IoU thresholds of 0.5, 0.4, 0.3, 0.2, 0.1 and 0.0, the average ASRs were 71\\%, 70\\%, 68\\%, 68\\% and 68\\% respectively. Similarly, when treating RetinaNet with PVT backbone as the target model, the average ASRs were 73\\%, 73\\%, 72\\%,70\\% and 67\\% respectively.\n\nQuestion: The pattern of FDA appears very different with and without TC. Does this imply that FDA has a considerable number of different local optima during optimization?\nAnswer: Please note that with and without TC, the feasible region of optimization is different (TC imposes a constraint on the feasible region), so it is quite normal to obtain different adversarial patterns in the two situations. It implies that multiple points in the feasible region of the unconstrained FDA optimization problem are effective in attacking the detectors. So, your hypothesis might be correct, but it requires additional analysis to confirm.\n\nQuestion: Compared to ASR, mASR can more comprehensively reflect the attack's effectiveness.\nAnswer: Following the TCA paper [1], we calculated the mean average ASRs across confidence thresholds of 0.1, 0.2, …, 0.9. The mean average ASR of the FDA clothing and TCA clothing was 78\\% and 43\\%, respectively.\n\nQuestion: Providing experimental comparison results in the digital world can better illustrate the simulation effectiveness of the proposed method.\nAnswer: For the result in Figure 8(a), the corresponding digital-world ASRs of the FDA pattern at different distances (4m, 8m, 14m, 20m, 26m, 34m and 40m) were 79\\%, 53\\%, 76\\%, 88\\%, 66\\%, 64\\%, 88\\%, which resulted in an average ASR of 73\\%. The digital-world ASRs of the Adv-Tshirt pattern at different distances were 83\\%, 66\\%, 17\\%, 8\\%, 3\\%, 8\\%, 13\\%, which resulted in an average ASR of 28\\%. We observed that the physical-world attack results were consistent with the digital-world attack results. We will include this result in the final paper.\n\n[1] Hu, Z., Huang, S., Zhu, X., Sun, F., Zhang, B., & Hu, X. (2022). Adversarial Texture for Fooling Person Detectors in the Physical World. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 13307-13316).\n\n[2] Wang, W., Xie, E., Li, X., Fan, D.P., Song, K., Liang, D., Lu, T., Luo, P., & Shao, L. (2021). Pyramid Vision Transformer: A Versatile Backbone for Dense Prediction Without Convolutions. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) (pp. 568-578).\n\n[3] Xizhou Zhu, Weĳie Su, Lewei Lu, Bin Li, Xiaogang Wang, & Jifeng Dai (2021). Deformable \\DETR\\: Deformable Transformers for End-to-End Object Detection. In International Conference on Learning Representations.\n\n[4] Wu, S., Wang, J., Zhao, J., Wang, Y., & Liu, X. (2024). NAPGuard: Towards Detecting Naturalistic Adversarial Patches. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 24367-24376).\n\n[5] Zhu, X., Hu, Z., Huang, S., Li, J., & Hu, X. (2022). Infrared Invisible Clothing: Hiding From Infrared Detectors at Multiple Angles in Real World. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) .", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DuxNs9dA2Z", "reviewer": "Reviewer_ouf1", "summary": "This paper is dedicated to improving the field of physical adversarial attacks on pedestrian detection, focusing on the robustness of attack performance over distance. To bridge the appearance gap caused by distance between the digital and physical spaces, the authors propose a distant image converter (DIC). To address the inconsistency of features required for short and long distances, the authors propose multi-frequency optimization (MFO). The authors tested the attack performance in the physical world at distances ranging from 4 to 40 meters. Experiments show that the proposed DIC and MFO can improve the attack success rate in scenarios with varying distances.", "questions": "Please address the weakness raised in *Weaknesses*.", "limitations": "The authors discussed limitations and societal impact.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors focused on a key factor affecting the performance of physical adversarial attacks: distance. This is an important exploration.\n2. The authors conducted ablation experiments and comprehensive evaluations of the DIC and MFO modules, making the method's design convincing.\n3. The DIC designed by the authors considers atmospheric conditions, camera effects, and effect filters, which is a reasonable and thorough modeling approach.\n4. The method proposed in this paper has been validated through extensive experiments in the physical world, and the authors provided a quantitative evaluation by collecting data from the physical world.", "weaknesses": "1. From the videos provided in the supplementary materials of this paper, the performance of the attack does not seem to be as good as claimed in the paper. For example, in 8m.mp4 and 14m.mp4, in most frames, the model can detect pedestrian instances with adversarial patches, indicating that the attack failed. In the quantitative evaluation of the paper, the ASR at a distance of 14 meters reached over 50%. This inconsistency undermines the effectiveness of the proposed method.\n2. This paper lacks a comparison with other popular methods, such as AdvPatch [1], Adv-Tshirt [2], NAP [3], and T-SEA [4].\n3. The DIC proposed in this paper is physics-based modeling. Such modeling generally involves non-differentiable operations. The authors used SGD during the training of DIC, and gradient propagation is also required when updating the patch. How did the authors address this issue?\n4. From the code provided in the supplementary materials, it can be seen that the method proposed in this paper appears to be related to YOLOv2. However, YOLOv2 is not mentioned in the paper. Please explain this issue.\n5. Unclear description: It's not clear what \"D\" refers to on line 205.\n6. Some writing issues: on line 32, \"In DIC, We find...\". Some abbreviations are not explained the first time they appear, such as \"DNN\" on line 18 and \"FDA\" on line 39.\n7. Lack of important references, such as [4, 5].\n\n\n[1] Thys S, Van Ranst W, Goedemé T. Fooling automated surveillance cameras: adversarial patches to attack person detection[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops. 2019: 0-0.  \n[2] Xu K, Zhang G, Liu S, et al. Adversarial t-shirt! evading person detectors in a physical world[C]//Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16. Springer International Publishing, 2020: 665-681.  \n[3] Hu Y C T, Kung B H, Tan D S, et al. Naturalistic physical adversarial patch for object detectors[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021: 7848-7857.  \n[4] Huang H, Chen Z, Chen H, et al. T-sea: Transfer-based self-ensemble attack on object detection[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2023: 20514-20523.  \n[5] Wei H, Tang H, Jia X, et al. Physical adversarial attack meets computer vision: A decade survey[J]. arXiv preprint arXiv:2209.15179, 2022.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Question: From the videos provided in the supplementary materials of this paper, the performance of the attack does not seem to be as good as claimed in the paper at 8m and 14m. \nAnswer: We have extracted all frames in the 8-meter and 14-meter demonstration videos and evaluated the ASRs by counting. At 8 meters, the attack was successful in 54 out of 132 frames, resulting in an ASR of 41\\%. At 14 meters, the attack succeeded in 111 out of 171 frames, yielding an ASR of 65\\%. Both results were comparable to the results reported in Figure 8(a). Please note that because of the persistence of vision, the bounding boxes would linger in our perception longer than they do in the videos. This phenomenon may explain why the subject holding the patch seemed to be detected in most frames of the 14-meter demonstration video.\n\n\nQuestion: This paper lacks a comparison with other popular methods, such as AdvPatch, Adv-Tshirt, NAP, and T-SEA.\nAnswer: Please note that in Figure 8(a), we conducted a head-to-head comparison between FDA and Adv-Tshirt. In Figure 9(a), we compared FDA with TCA [r1], which is also a commonly used attack method for full-angle clothing attack. According to your suggestion, we obtained the AdvPatch, NAP, and T-SEA patterns targeting YOLOV5 by either utilizing the patterns provided in the respective papers or executing the codes provided. These patterns were evaluated following the physical-world patch attack setting described in Section 5.2, where the results were averaged over three different pedestrians. The AdvPatch, NAP, and T-SEA patterns achieved average ASRs of 19\\%, 19\\% and 42\\%, respectively, all of which were lower than the 75\\% average ASR achieved by the FDA pattern. We will include these results in the final paper.\n\n\nQuestion: The DIC proposed in this paper is physics-based modeling. Such modeling generally involves non-differentiable operations. How did the authors propagate gradient through the DIC?\nAnswer: In our work, we implemented all three modules in DIC with differentiable computations. The atmospheric perspective module is a differentiable function (Equation 1, line 119). The camera simulation module is constructed using two convolutional layers (Equation 6, line 170). The style filter simulation module comprises a sequence of differentiable functions that simulate various style filters (Equation 7, line 175). If there are any details that require clarification, please feel free to discuss them with us during the discussion period.\n\n\nQuestion: Please explain the YOLOV2 related codes in the supplementary material.\nAnswer: We built our code based on the TCA [r1] code which treated the YOLOV2 detector as the main target model. In our experiment, we forgot to remove some YOLOV2-related codes imported by the TCA authors and leveraged some general utility functions they provided. Please note that since YOLOV2 is now commonly considered outdated, we have not performed any experiments on the model. A tidier version of the code will be included in the final paper.\n\n\nQuestion: Unclear description: It's not clear what \"D\" refers to on line 205.\nAnswer: D refers to the number of distances optimized. We will clarify it in the final version.\n\n\nQuestion: Some writing issues: on line 32, \"In DIC, We find...\". Some abbreviations are not explained the first time they appear, such as \"DNN\" on line 18 and \"FDA\" on line 39.\nAnswer: Thank you for your careful reading. We will correct them in the final version.\n\n\nQuestion: Lack of important references, such as [4, 5].\nAnswer: Thank you for highlighting the two interesting pieces of research. We will discuss our work in respect to the two papers in the final version.\n\n\n[r1] Hu, Z., Huang, S., Zhu, X., Sun, F., Zhang, B., & Hu, X. (2022). Adversarial Texture for Fooling Person Detectors in the Physical World. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 13307-13316).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We sincerely appreciate the time and effort the reviewers have put into this manuscript, which will help us improve the quality of the revised paper. It is encouraging that the reviewers find our work to be “important” [vr4j, ouf1], our design to be “reasonable” and “convincing” [vr4j, ouf1], our presentation to be “vivid” and “clear” [e7ej]. We addressed the concerns in each reviewer’s individual rebuttal area and the paper will be updated accordingly. We hope you are satisfied with our response. We welcome any further comments and we would be happy to answer them in the discussion period. Please note that the PDF file uploaded is to provide supporting figures in response to a question from reviewer vr4j.

Meta-review: The rebuttal addressed most of the concerns raised by the reviewers and now all reviewers support accepting the paper. Hence, it will be accepted. The reviewers particularly liked that the paper identified an interesting problem and solved it effectively and presented various experiments showing its effect.
Decision: Accept (poster)