AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches
Authors: Wenjun Ji
Yuxiang Fu
Luyang Ying
Deng-Ping Fan
Yuyi Wang
Ming-Ming Cheng
Ivor Tsang
Qing Guo
Venue: NeurIPS 2025 poster ()
Keywords: Physical attack; Concept learning; View-invariant adversarial patch;
Primary area: deep_learning

Abstract: Cutting-edge works have demonstrated that text-to-image (T2I) diffusion models can generate adversarial patches that mislead state-of-the-art object detectors in the physical world, revealing detectors' vulnerabilities and risks. However, these methods neglect the T2I patches' attack effectiveness when observed from different views in the physical world (i.e., angle robustness of the T2I adversarial patches). In this paper, we study the angle robustness of T2I adversarial patches comprehensively, revealing their angle-robust issues, demonstrating that texts affect the angle robustness of generated patches significantly, and task-specific linguistic instructions fail to enhance the angle robustness. Motivated by the studies, we introduce Angle-Robust Concept Learning (AngleRoCL), a simple and flexible approach that learns a generalizable concept (i.e., text embeddings in implementation) representing the capability of generating angle-robust patches. The learned concept can be incorporated into textual prompts and guides T2I models to generate patches with their attack effectiveness inherently resistant to viewpoint variations. Through extensive simulation and physical-world experiments on five SOTA detectors across multiple views, we demonstrate that AngleRoCL significantly enhances the angle robustness of T2I adversarial patches compared to baseline methods. Our patches maintain high attack success rates even under challenging viewing conditions, with over 50% average relative improvement in attack effectiveness across multiple angles. This research advances the understanding of physically angle-robust patches and provides insights into the relationship between textual concepts and physical properties in T2I-generated contents. We released our code at https://github.com/tsingqguo/anglerocl.

AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant T2I Adversarial Patches
Wenjun Ji
Yuxiang Fu Luyang Ying! Deng-Ping Fan
Yuyi Wang'
Ming-Ming Cheng Ivor Tsang' Qing Guo 42-
NKIARI, Shenzhen Futian
VCII, CS, Nankai University 'CRRC Zhuzhou Institute *CFAR and IHPC, Agency for Science, Technology and Research (A*STAR)
wenjjema nankai edu.cn. tsingqguol eee.
Abstract
Cutting-edge works have demonstrated that text-to-image (T2I) diffusion models can generate adversarial patches that mislead state-of-ther arr object detectors the physical world, revealing detectors' vulnerabilities and risks. However, these methods neglect the T2I patches' attack effectiveness when observed from different views in the physical world (i.e., angle robustness of the T2I adversarial patches). In this paper, we study the angle robustness of T2I adversarial patches compre- hensively, revealing their angle-robust issues, demonstrating that texts affect the angle robustness of generated patches significantly, and task-specific linguistic instructions fail to enhance the angle robustness. Motivated by the studies, we introduce Angle-Robust Concept Learning (AngleRoCL), a simple and flexible approach that learns generalizable concept (i.e., text embeddings in implementa- tion) representing the capability of generating angle-robust patches. The learned concept can be incorporated into textual prompts and guides T2I models to generate patches with their attack effectiveness inherently resistant to viewpoint variations. Through extensive simulation and physical- woolld experiments on five SOTA detec- tors across multiple views, we demonstrate that AngleRoCL significantly enhances the angle robustness of T2I adversarial patches compared baseline methods. Our patches maintain high attack success rates even under challenging viewing conditions, with over 50% average relative improvement in attack effectiveness across multiple angles. This research advances the understanding of physically angle-robust patches and provides insights into the relationship between textual concepts and physical properties in T21 T21-generated contents. We released our code in https:/ / / tiu...ub.... com/ a winggguon/aaaaeeeooo //ggg//oo...........m.
1 Introduction
Recent advances in deep learning have revealed that text-to-image (T2I) diffusion models can generate adversarial patches capable of misleading sfate-of-the-arr object detectors physical environments [48, 58]. Unlike traditional optimization-ben based adversarial patch generation methods [4, 23, 62] that rely on gradient-based pixel manipulations and often struggle to transfer to physical settings and detection models due to environmental factors like printer's color shifting, T21 generation approaches offer significant advantages (e.g., low-cost, model-agnostic, and transferable) in the physical deployment [48, 58]. These patches exploit vulnerabilities in detection systems, creating significant security concerns for critical applications such as autonomous driving and surveillance. However, existing approaches to generating T21 adversarial patches have largely overlooked erucial real-world challenge: maintaining attack effectiveness when patches are viewed from different angles
"Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

AngleRoCL
Digital
Appalll ai "alle" us
Deployment
with
Stable Diffusion
Physical
SB
STP
NDG *Angleeiat
Angle: .00
Angle: -30"
Angle: 0
Angle:
Angle:
Intuitive Idwa
(b) Deployment Results
Statiatic Resdlts across anglee
Figure (a) Intuitive idea of AngleRoCI: incorporating the learned angle-robust concept into textual prompts to generate patches that maintain attack effectiveness across multiple viewing angles. (h) Digital and physical deployment results AngleRoCL patches (bottom rows) vs. NDDA baseline (top rows). (c) Statistical results across 15 angles, where orange intensity represents atlack success rates.
in physical environments. As shown in Fig. I, NDDA's patches can only mislead the stop sign detector (Y0LOv5) the front angles while failing other angles in both digital and physical settings.
In practical scenarios, adversarial patches are typically observed from various viewpoints, making angle robustness essential for sustained attack effectiveness. Current approaches predominantly generate patches that demonstrate attack capabilities only under fixed limited viewing angle ranges, significantly limiting their effectiveness in real-world applications. For example, patches designed to mislead stop sign detection may work when viewed head-on but fail when observed from oblique angles, reducing their practical impact.
In this paper, we first conduct comprehensive investigation into the angle robustness of T2I adversarial patches. Our study reveals several important findings: O the angle robustness of T2I adversarial patches varies significantly depending the textual prompts used; @ simply augmenting prompts with task specifie linguistic instructions (e.g., "detectable at multiple angles in all directions") fails to enhance angle robustness; and @ certain robust feature-related prompt elements have greater influence on angle robustness than others. Please refer to Sec. for details.
Motivated by these insights, introduce angle-robust concept learning (AngleRoCL), novel approach that learns a concept representing the capability to generate angle-robust adversarial patches. Unlike previous methods that require specific optimization for each patch/environment, our approach encodes angle robustness as a learned concept in the embedding space of T2I models. The learned concept can then be incorporated into any subject-related textual prompt, guiding diffusion models to generate patches with attack effectiveness that inherently remains robust across multiple viewing angles. AngleRoCL offers several key advantages over existing approaches: O environment- free learning that eliminates the need for user-provided environment images; @ detector- guided optimization that leverages feedback from target detectors to supervise the concept learning process; and @ consistent attack effectiveness maintained across diverse viewing angles. Through extensive experiments both digital and physical environments, we demonstrate that AngleRoCL significantly enhances the angle robustness of T2I adversarial patches compared to baseline methods (See Fig. (a)), achieving about relative improvement of 88.96% in digital environments and 82.41% % in physical environments in attack effectiveness across multiple viewing angles. This research advances the understanding physically robust adversarial patches and provides valuable insights into the relationship between textual concepts and physical properties in T21-generated content.
2 Related Works
Physical adversarial attacks. Latest research indicates that deep neural network (DNN)-base) object detection systems are vulnerable to adversarial patches that can induce erroneous outputs [13, 17, 36, 39, 41, 51, 19, 16, 60, 28, 30]. Physical adversarial patches pose severe threats to critical systems, including autonomous driving [55], classification models [5, 13, 63], and other safety-critical

---

domains [9, 10, 20, 50, 52]. These patches are highly reproducible and deployable [51], making it essential investigate their attack effectiveness [5. 52]. Given that these physical adversarial patches are highly reproducible and deployable [48], their attack effectiveness [5, 52, 22, 18], stealthiness [11, 23, 26, 54, 25], and scenario plausibility [6, 58] warrant in-depth investigation. However, achieving efficient physical adversarial attacks remains challenging. Taking physical attacks targeting stop sign as a representative case, existing studies predominantly generate adversarial patches that only demonstrate effective attack capabilities under fixed or narrow viewing angle ranges, thereby exhibiting constrained attack effectiveness in practical applications. To address this limitation, our research focuses generating angle-robust adversarial patches capable of maintaining attack efficacy across multiple viewing angles in physical deployment scenarios.
T2I generation for attacks. Traditional adversarial attacks predominantly operate within the digital domain, conducting targeted manipulations by introducing perturbations to image [7, 17, 39, 40, 41, 51] or by altering pixel values [. While these perturbations maintain visual imperceptibility to human observers, their efficacy degrades significantly when deployed in physical environments due to environmental factors [1, 35, 33, 59J. Recent advancements in diffusion models [21, 43, 45, 47J have enabled researchers to employ text-to-image (T2I) models for directly generating adversarial patches [38, 56, 34, 37, 31, 32]. Among them, the Natural Denoising Diffusion (NDD) attack [48, 58] achieves superior attack effectiveness compared to traditional methods in the physical world due to non-robust features that are predictive but incomprchensible to humans.
Angle robustness enhancements. The deployment of adversarial patches in practical physical environments necessitates systematic consideration of various complex environmental factors, with detector viewing angle variation constituting a critical influencing parameter. Previous research on angle robustness primarily focused on 3D object camouflage domains, where certain methods attempted to generate or modify surface textures of physical 3D objects to achieve multi-view disguise effects [2, 8, 12, 27, 42, 49, 64]. However, these specially engineered textures suffer from critical limitations including overfitting to specific viewing angles, poor transferability across objects, and visually unnatural appearances [8, 24]. In the 2D domain, existing studies primarily concentrate on evasion attacks such as attaching adversarial stickers to existing objects to disrupt detector recognition processes [13, 57]. Some approaches have explored transformation-avw optimization frameworks that incorporate diverse geometric and photometric variations to enhance adversarial patch robustness in real-world deployments [5, 3, 49], yet demonstrate inadequate angular robustness [9, 62]. To our knowledge, no prior work has formally conceptualized angular robustness for adversarial patches, nor successfully integrated this property into practical patch generation frameworks for physical deployment scenarios.
Preliminaries and Discussions
3.1 T2I Adversarial Patches
The recent work [48] demonstrates that text-to-image (T2I) models can generate patches capable of misleading object detectors in the physical world by simply modifying input text prompts to remove robust features. This operational pipeline can be formalized as follows: given a textual prompt T describing both the target subject (e.g., stop sign) and its associated robust features (e.g., shape, color, text, and pattern), a stable diffusion model M(-) processes T to generate a patch P, which can be formulated T to remove robust features, the T21 model generates patches that can effectively mislead various state-of-the- of-the-rrt object detectors in a black-box manner physical-wordh scenarios. We denote the patch as T2I adversarial patches to distinguish them from conventional adversarial patches.
P M(T). The work demonstrates that by modifying the textual prompt
3.2 Empirical Studies on Angle Robustness
Angle robustness testing. Although effective, previous works [48, 58] overlook the angle robustness of T2I adversarial patches-thels their effectiveness when viewed from different angles. To address this gap, we comprehensively evaluate the angle robustness of T21 adversarial patches. Specifically, we selected "stop sign" as our test subject, with the dual objective of generating patches that O appear non-suspicious to human observers and cause detectors to misclassify them as a stop sign. Following the NDDA method [48], we constructed prompt set (Tili E [1, .I., 15]} including 15
3

---

1.00
HDDA
1.00
Teskoppaliic wnw.eceeogeeeeeee.......
Poders
Slage
DeP
Eti00a prongt
Rdlddd wordsbii thc
DHS
2.50
0.99
0.2
0.25
DIPVT
DIG-T
Pedn]
90
Figure 2: Average detection confidence (Re. (T)) at different viewing angles (i.., 9) across image sets (i.e., (1:5) generated by given attack strategy (i E [l..... 15). E [l.... K0 (-90", ,9"), V0 19). The y-axis labels indicate average detection confidence and the x-axis labels indicate different viewing angles. The rightmost panel demonstrates removed features: Color (C), Pattern (P), Shape (S), and Text (T). Patch generated
by (a) NDDA prompt and (b) Task-specific instruction prompt.
types of prompt by removing different robust features from benign stop sign descriptions 2. 2.See supp. for more details. For each prompt Tr we generated K patches (Pilj E [1, K]]. For each patch P we inserted it into an environment and captured images (()) from various angles 6, spanning the range E (-909, 90%) with a sampling interval of V8 = 1 An angle of zero (i.e., 0 = 0%) represents a frontal view (See Fig. (b)). We then fed each image ((.)) into object detector and recorded the false-positive confidence score sg (1.5) (i.e., probability of misclassification as "stop sign"). This procedure generated 180 test images per patch P.,, resulting in K 180 evaluations per prompt Tr We defined the angle robustness metric for prompt Ti at viewing angle 0 as the average of sg (1.)) across K adversarial patches, i.e., RT( = * ビド $q (i.J) We evaluated the 15 prompt types by setting K 50 and digitally inserting the generated patches into environmental images.
We show the visualization of $ (i-s) Fig. (a), and observe that: Most prompts Ti display centripetal confidence increase across 180 viewing angles ; @ Attack efficacy roughly presents an inverse correlation with the number of ablated features @ For Ti that removed the same counts of features, the performance differences are still significant O Only minority of prompts achieve statistically significant attack success. The experimental results demonstrate significant variance in attack efficacy across different prompts Ti under varying viewing angles.
Task-specific instruction for angle robustness enhancement. To investigate potential improvements. we implemented another attack strategy: augmenting the original prompts in [T.li E [L,... 15] with task-oriented narrative instructions, such as appending the phrase "detectable at multiple angles in all directions". Three modified prompt configurations were engineered: O Prefix-enhanced: (Tp + Ti). @ Infix- inteeratt:::::::: (T,+ + Tm + Ti). @ Suffix- appended:::: (T++ T.). All other experimental parameters remained unchanged except sample size K (Ø E (-90", 909), vA 19). As illustrated in Fig. 2 (b), the augmented prompts exhibited significant degradation in angular robustness metrics. This empirical evidence suggests that simply incorporating task-specific linguistic instructions fails to enhance the angle robustness. Consequently, we conclude that current T2I text encoders lack the capacity to interpret abstract, goal-oriented narrative commands for angle-robust purposes.
4 Methodology: Angle- Concept Learning (AngleRoCL)
Our analyses show different textual prompts significantly affect angle robustness, while simple task- specific linguistic instructions fail to enhance this property. To address this limitation, we propose AngleRoCI. to encode angle robustness as a latent concept, which can be plugged into textual prompts and guide T2I to generate patches that maintain attack efficacy across viewpoint variations while preserving physical deployability. Fig. 3 shows our AngleRoCL's pipeline.
'In NDDA, we have an original prompt for "stop sign". i.e., "a photo of stop sign". We can remove robust features (i.e., color (C), pattern (P). Shape (S), and Text (T)) by adding constraints into the standard description.

---

(a) AnglooRRobust Concept Learning (AngieRoCL)
Text Encoder
[Shspe]
[Dekr]] [butyent]
(Se (peec)
[11 peigleett
Takenar
with "abod" on
50
with (oottimn paint ce.1
Prompt
Tranfommatio
Arbianry (Butgecljeeaneed Prompi with Learned pippernbbrr Aphote of's motur stop with "saod" on photo of (inpherdonni stop sigh with porkudee puint on photo of jingleroban with "halle"
SD
HELD
FROST
A photo of jingletbbail stop sign chaclerboard paint
(b) AngleRoCL- Inference
Figure 3: (a) Pipeline our angle-robust concept learning (AnglcRoCL), The latent code represents the Iearned concept
(b) shows the inference results when we use the learned concept.
4.1 Problem Formulation
Given pre-trained stable diffusion model MM(), generate an adversarial patch by feeding the model with texture prompt T containing the subject and related constraints, such that P = MM()). When this generated patch P is inserted into environment denoted E, it produces from observation angle 9, that is, Ig = Obs(P, P.P. E, 0). Our objective is to ensure the patch consistently misleads object detectors across various viewing angles. Intuitively, following the existing solution, we can add optimized adversarial noise to the generated patch to achieve the goal [62]. However, such solution needs perform the optimization for each patch, and the optimized noise hardly be transferred into the physical world and keep attack effectiveness against different detectors. In this work, we propose to learn a concept to represent the capability of generating angle-robust adversarial patches, and the learned concept could be defined through new "words" in the embedding space and be inserted into any existing subject-related prompts to generate angle-robust patches. We can formulate the angle robust concept learning (AngleRoCL) as
image
C = arg min E-~(-900 30a) Laa (Obs(P, P, F, 0), y)d0, subject to, = M()(T,C.))
(1)
where C denotes the words representing the learned angle-robust concept and A(T, C.)) the function to insert the concept words into the textual prompt. The loss function (.e(.) measures whether the attack objective indicated by y has been achieved, for example, the generated patch is misdetected as "Stop Sign". Once we obtain C, we can incorporate it into any subject-related textual prompts to generate patches that maintain robust performance across multiple viewing angles (See Fig. 3 (b)).
4.2 AngleRoCL the Angle-aware Textual Inversion
Textual inversion was proposed for personalizing diffusion-based generation, enabling the model to learn specific concept of an object style from user-provided images [15]. This technique allows for consistent regeneration of the same object by simply incorporating the concept's learned token embedding into the generation model's input prompt. Inspired by this approach, we formulate angle-robust concept learning as textual inversion problem. Unlike previous work, AngleRoCL should have the following key properties: 1 Environment-free learning. Rather than requiring user-provided images of a concept, our learned angle-robust concept remains effective across any environment without relying on specific environmental images. @ Detector-guided optimization. AngleRoCL should leverage feedback from the target detector to directly supervise the optimization of the angle-robust concept. Consistent attack effectiveness across viewing angles. During the learning process, we optimize not only for image quality but specifically for adversarial per- formance maintained across multiple angular perspectives. Our method should uniquely combine angle-awareness with environment-free concept learning through detector feedback across diverse observation angles.
Specifically, start with the input textual prompt with the A(T,C, C) where we tend to insert the targeted C (i.e., "aagglerrouut") into existing textual prompt T. Then, we have text encoder like CLIP to extract the embeddings of A(T,C) C) and get F7 and Fc. Here, aim to learn new
5

---

embedding of C to replace the original one (i.e., Fc), which denotes the angle-robust concept and should make the subsequent patch generation angle-robust. Then, we can reformulate the Eq. (1)
F arg min (e-(- 900) Sun P. E, 0), y). subject to, P = M, Fc.l).
(2)
Fc.
However, it requires high costs to sample different angles during the optimization. Hence, we perform the projective transformation on the image captured at the angle 0 = 0 to produce the images captured at other angles. Then, the Eq. (2) is reformulated as
F arg min Eo ( (900,900))
Cae (Proj (Io- v),
(3)
Fe.
subject to, Io Obs E, 0*), ). P M(F Fc-]), where Proj(.) denotes the projective transformation corresponding to the observation angle.
Angle robustness loss. We adopt loss function (ax to maximize the adversarial effect across
multiple viewing angles, which is defined as follows
(5) where Det(Ia) is the confidence score of a detector on the interested category (e.g., "stop sign") "). Here, YOLOv5. y is the detection threshold and À is a scaling factor. This loss penalizes viewing perspectives where detection confidence falls below the threshold, encouraging wide-angle effectiveness. By minimizing this loss across different angles, we optimize the Fe to guide the patch generation that maintains high detection confidence across all viewing angles.
Lae (Io. y) = max(y - Det(Io). ^,
Angle-robust patch generation. Once the angle robustness concept is learned and encapsulated in the <angle-noboaa robust> token, generating angle-robust adversarial patches becomes remarkably straightforward. Our method's key advantage lies in its plug-and-play nature, requiring minimal modifications to existing eext-to-image workflows. To generate angle-robust patches, users simply need to load our trained embedding into Stable Diffusion and incorporate the <angle-robust> placeholder into their existing attack prompts. For example, a standard NDDA prompt like "a blue square stop sign" can be enhanced to "a <angle-robust patch with inherent angle robustness. This approach is compatible with various Natural Denoising Diffusion (NDD) attack frameworks, including NDDA [48] and MAGIC [58), without requiring any architectural modifications or additional optimization steps.
blue square stop sign" to produce
4.3 Implementation Details and Physical Deployment
Implementation details. We implement our approach using the Stable Diffusion v1.5 as the base diffusion model with DPMSolver++ for denoising. We set the classifier free guidance scale to 7.5 and use 25 denoising steps. For the angle-robust concept, we use CLIP embedding of <angle serrobust> as the initialization. Focusing on the stop sign category, we utilize a total of 39 NDDA prompt templates that incorporate various robustness features including shape (e.g., square, triangle), color (e.g., blue, yellow), text (e.g., "hello", "abed", "world"), and pattern (checkerboard, polkadot). Examples include "a blue square stop sign". "a stop sign with 'hello' on it", and "a yellow triangle stop sign with polkadot paint on it" (see supp. for more details). During the training process, we sample 9 angles, i.e., (-72", -540, 366 - 188, 0% 18 360 54", 72%), J. which are symmetrically and equally spaced within the range from -90" to 90" (excluding the endpoints). The detection loss parameter y and the scaling factor À are respectively set to 0.8 and 10. We train for 50,000 steps using Adam W optimizer with learning rate 10 updating only the <angle- angll-robust> embedding while keeping all other parameters frozen.
Physical deployment. The physical deployment of our angle-robust patches follows straightforward process validating their real- world effectiveness. We directly print the generated adversarial patches using a standard color printer on regular office paper, without requiring specialized printing techniques or materials. These patches are then affieed to target objects (stop signs) in various environments.
5
Experimental Results
5.1 Setups
Digital& & Physical environments. Following the evaluation protocol in [58], we adopt the nulmage dataset [14], selecting one representative image from each of the six car- car-mounted camera views (front,

---

front left, front right, back, back left, back right) for digital evaluation. We also validate AngleRoCL in real-world scenarios, which are collected by ourselves. The main paper presents results from one physical environment, while cross-scene validation across three physical environments is provided in the supplementary material. See supp. for more details.
Baseline methods. To demonstrate the effectiveness of AngleRoCL in improving angle robustness for physical adversarial patches, we establish comparisons with four baseline methods: one traditional physical adversarial patch approach (AdvPatch [5]) and two NDD attacking methods (NDDA [48] and MAGIC [58]). O For the traditional methods, we generate AdvPatch with Adversarial Robustness patch from each method for evaluation. @ For NDD attacking methods, we follow the methodology outlined in previous work [58], generating 50 patches for each "remove text or pattern text prompt, and randomly selecting 100 patches as our NDDA baseline set. @ For MAGIC, we utilize its generation component to produce 100 patches for each digital environment using identical prompt configurations to ensure fair comparison. To isolate the effect of our proposed approach, NDDA+AngleRoCL and MAGICAAngleRoCI patches were generated concurrently with the same seed and generator. The only difference in the generation process was the inclusion of our angle-robust embedding in the text prompt. We extend our evaluation from digital to physical environments, acknowledgin the higher cost and complexity of physical experimentation. For physical validation, we selected 25 matched pairs of patches from each method (NDDA, NDDA+AngleRoLL, MAGIC, and MAGIC+AngleRoCLL)
Toolbox, selecting only the
Generator & Detectors. For consistency with prior work [48, 58], we employ Stable Diffusion v1.5 [46] as our image generator. Our evaluation spans multiple object detection architectures, including YOLOv5 [29]. YOLOv3 [44], Faster R-CNN [44]. and RT-DETR [61]. We additionally evaluate against YOLOv [53], more robust contemporary detector, as our primary benchmark. For traditional adversarial patches, we use the same detectors for both training and evaluation as in their original works to ensure fair comparison. For implementation frameworks, YOLOv5 and YOLOv10 10 are evaluated using the API from ultralytics, while Faster R-CNN, YOLOv3, and RT-DETR are implemented through the MMDetection framework to ensure consistent evaluation procedures.
Evaluation metrics. Previous studies have primarily relied on Attack Success Rate (ASR) to evaluate adversarial patch effectiveness. However, this conventional metric typically assesses perfor- mance only under fixed or limited viewpoints, failing to capture robustness across diverse viewing angles-a a critical factor for real-world deployment. To address this limitation, we introduce novel evaluation metric: Angle-Aware Attack Success Rate (AASR). This metric comprehensively quantifies patch's 's effectiveness across varied viewing perspectives. Let Ω represent the complete angular space of interest. The AASR is defined as a weighted integral of ASR across this angular domain: AASR So w0))- (SR d0 x 100% where ASR(O) represents the traditional attack success rate when patches are viewed at angle 0 E Ω and w(0) is a normalized weighting function such that Sn w0) - d0 = 1. In our evaluation, we adopt uniform weighting, iee, mn(0)= = ア all angles, ensuring equal contribution from each viewing angle to the AASR calculation. This generalized formulation allows for evaluation across arbitrary angular domains, accommodating various real-world deployment scenarios.
J for
5.2 Digital Comparative Results
We evaluate AngleRoCL in digital environments across multiple detectors, comparing 4 T21-based attacks (NDDA, NDDA AngleRoo,, MAGIC, MAGIC+AngIeRoCL) with a traditional physical adversarial approach (AdvPatch). Our evaluation simulates angles from -90" to 90" using projective transformations, with patches placed at environment centers to eliminate positional bias. Table 1 summarizes the AASR performance across 5 detectors and environments. We have the following ob- servations: O AngleRoCL significantly outperforms traditional physical adversarial approach. While AdvPatch only achieves 5.54% average AASR with substantial fluctuations across environments (0.00% to 14.21 1)), our NDDA+AngleRoCI. reaches 66.02% and MAGIC+AngleRoCY 32.51 %. Ø AngleRoCL consistently enhances angle robustness of NDD-based methods, increasing NDDA's average AASR from 23.79% to 36.02% (51.4% improvement) and MAGIC's from 26.26% to 32.51 % (23.8% improvement).
Improvements persist across diverse environments, from 47.61% % AASR in favorable Environment @ to 24.24% in challenging Environment @ O AngleRoCL enhances perfor- mance across all detection architectures, including Y0LOv10 (72.8% improvement) and YOLOv5 (81.2% improvement), validating its cross-detector transferability.
7

---

Table 1: Angle-Awe Aware Attack Success Rate (AASR) in digital enviromments. Results across five detectors in six environments, measured from -90" to 90" with 1 intervals. Best average highlighted red, second best blue. Best detector results underlined+ second best bold.
Environment
Method
Faster R-CNN
YOLOv3
YOLOv5
RT-DETR
YOLO.
Avg.
AdvPatch
11.51%
2.52%
0.00%
0.00%
0.00%
0.78%
NDDA
25.96%
1.88%
14.62%
14.57%
10.02%
13.41%
Environment
ADDA+AngLCRoLL
39.79%
6.38%
36.58%
19.30%
23.82%
25.17%
MAGIC
29.35%
1.97%
18.55%
25.52%
11.67%
17.41%
MAGIC+AngleRoCI.
39.72%
5.94%
34,08 %
30.07% %
20.24%
26.01%
AdvPatch
23.31%
43.53%
2.25%
1.97%
0.00%
14.21%
NDDA
41.64%
32.86%
29, 999
45,43%
28.99%
35.78%
Environment ?
ADDAeAngICRoCL
50.67%
50.76 %
46.04 %
47.64 St
42.95 %
47.61%
MAGIC
44.22%
34.94%
30.76%
42.80%
31.12%
36.77%
MAGIC+AngleRoCL
45.45%
43,34% %
42.32%
44.29 %
39.98% %
43.08%
AdvPatch
8.99%
15.73%
8.71%
0.00%
0.00%
6.69%
NDDA
30.27%
10.60%
25.67%
23.81%
22.18%
22.51%
Environment !
AngleRRlI
43.94%
25.74%
43.38%
33,40 %
36.11% %
36. 51%
MAGIC
31.13%
14.01%
32.46%
25.29%
24.70%
25.52%
MAGIC+AngleRuCL
36.04%
25.99%
42.71 %
31.11%
34.16% %
34 00%
AdvPatch
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
NDDA
20.80%
3.61%
10.31%
18.07%
13.11%
13.18%
Environment &
NDDA+AngIoRoCL
31.25%
6.74%
27.34 %
29.99% %
25.87 %
24.24%
MAGIC
21.24%
3.71%
14.46%
22.90%
15.98%
15.66%
MAGIC+AngleRoCL
28.42%
6.75%
22.68 %
31.0%%
22.24 %
22.22%
AdvPatch
9.55%
10.11%
0.00%
6.46%
0.00%
5.22%
NDDA
38.70%
12.41%
29.07%
52.45%
21.93%
30.91%
Environment
ADDA+AngIcRoCL
47.52%
26.26 %
42.80
54.23%
36.50% %
41.46%
MAGIC
38.04%
14.67%
53.77 %
33.51%
MAGiC~AngIcRoCL
41.44%
24.38%
38.74%
53.28%
31.76%
37.92%
AdvPatch
0.56%
31.15%
0.00%
0.00%
0.00%
6.34%
NDDA
28.55%
25.95%
20.17%
39.56%
20.46%
26 .4%
Environment (
NDDA+
42.02%
43.05 %
39.14%
45.13%
36.41 %
41.15%
MAGIC
30.53%
28.56%
24.40%
35.49%
24.58%
28.71%
MAGIC+AngleRoCL
29.72%
33.24%
31.81% %
37.16%
27.33%
31.85%
Table 2: Angle-Aware Attack Success Rate (AASR) in physical environment. Results across five detectors. measured from -70" to 70 with 10" intervals. Best average highlighted in red, second best in blue. Best detector results underlined+bold, second best bold.
Environment
Method
Faster R-CNN
YOLOv3
YOLOvv5
RT-DETR
YOLOOv1
Avg.
AdvPatch NDDA
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
40.27%
7.73%
15.20%
56.27%
22.40%
28.37%
Environment ?
ADDAeAggI
69.87%
16.00%
60.80%
69.87% %
42.20%
51.75%
MAGIC
39.73%
4.27%
17.33%
42.67%
9.60%
22.72%
MAGIC+AngleRoCL
83.73%
27.73%
72.53%
89.60 %
55.73%
65.86%
5.3 Physical Comparative Results
To validate findings in same six methods as in the digital environment. We printed patches on standard paper and deployed them in regular road to college. Due to the higher costs of physical experiments, a reduced angular sampling strategy compared to the digital evaluation. Observations were made at fixed distance across 15 viewing angles from -70% to 70 10 intervals. Table 2 summarizes the AASR performance across five detectors. The evaluation reveals two findings: AngleRoCI.
scenarios, conducted physical experiments comparing the
employed
significantly outperforms traditional approach in physical environments. While AdvPatch completely failed in physical settings (0.00% AASR), our methods demonstrated robust performance with NDDA+AngleRoCI. achieving 51.75% and MAGIC+AngicRoCL reaching 65.86% AASR. This stark contrast highlights the superior moysical-workee transferability of our approach compared to traditional methods that are highly sensitive environmental changes. @ AngleRoCL consistently enhances NDD methods in physical settings, with NDDA+AngleRon achieving 51.75% AASR compared to 28.37% for vanilla NDDA (82.4% improvement), and MAGIC+AngleRoCI reaching 65.86% versus 22.72% for original MAGIC (189.95) 98.9% improvement). These substantial enhancements were consistent across all viewing angles, confirming that our learned angular robustness concept transfers effectively to real-world scenarios without environment-specinn optimization.

---

Stup Sign Detertion Confidence Comparionn
Conrept Similarity sanglerehmp>
-2"
1>
*
drd
VOLOKIO
R-DON
Calarria
Vinal
VORONS
Traning Angle
VOLON3
Fiad Viea
Spural
DETA
Feleel
44
4-111
04
81:04
Sagle (degrwe)
Steilarity
Figure 4: (a) Direct optimization shows severe overfitting to training angles (orange) and trained detector
(YOLOv5). (b) Cosine similarity between Iearned kangle-robuse embedding and top cop-correlated tokens.
6 Ablation Study and Discussion
Ablation study. To validate approach, we compared AngleRoCL with direct optimization method that applies gradients directly to patch pixels instead of performing AngleRoCL. In Fig. 4, while directly optimized patches achieved high attack rates at trained angles and trained detectors, they performed poorly on unseen angles and detectors. In contrast, AngleRoCL, maintained consistent performance across all conditions, confirming that our embedding- based concept learning enables critical cross-angle and cross-detector generalization for real-world applications.
Embedding analysis. In Fig. 4, the cosine similarity analysis shows <angle longle--obust concept has developed meaningful associations with robustness-related features. Color tokens show the highest correlations (red: 0. 1.1434, green: 0.0968, blue: 0.0948), while shapes show interesting patterns with circle being positive (0.0483) and square/triangle negative. To further validate these embedding insights, regenerated the NDDA dataset using learned angle-robust concept. Following the original NDDA methodology, we generated patches for all 39 prompts (50 patches per prompt) with and without the <angle-robut digitally placing them in the center of blank environments across multiple viewing angles. The results are presented in Table The embedding analysis results align with the experimental results. For NDDA on YOLOv5, removing color features caused the most significant performance drop (from 56.64% 21.17%), matching our embedding analysis which identified color tokens having the highest correlation with our concept. Moreover, AngleRoCI maintains a 62.33% detection rate even without color features 41.16 percentage point improvement over NDDA, confirming our approach effectively compensates for the removal of critical robustness features.
token, and evaluated their angle robustness by
The correlations clearly show learned concept captures essential visual attributes proportional to their importance for achieving angle robustness. This explains our method's 's effectiveness and further suggests angle robustness is fundamentally related to visual elements that maintain distinctive properties across different viewpoints.
Table 3: Angle-Aware Attack Success Rate (%) comparison hetween NDDA and AngleRoCI, when robust. features removed. Each row indicates which features removed from the prompt (checkmark means removed). For each detector and configuration, best performance highlighted bold.
Removed Robust Features
Object Detectors
Shupe
Color
Text
Pattern
Faster R-CNN
YOLOv3
YOLOv5
RT-DETR
YOLOv10
Avg-
59.58%
57.98%
56.64%
74.96%
52.57%
60.35%
30.38%
28.0%
27.78%
44.50%
23.52%
30.84%
49.24%
21.17%
71.75%
44,91%
NDDA
51.39%
53. 33.69%
43.84%
60.30%
39.04%
49.65%
41,95%
41.26%
29.69%
47.94%
27.98%
37.76%
38.83%
31.09%
6.86%
52.43%
9.44%
27.73%
74.16%
77.16%
77.07% %
72.96
76.19%
37.09% %
44.11 1%
40.75%
54.40 %
38.69 %
43.01% %
64.08 %
66,89 %
62.33%
71.54%
60.46%
65.06
AngleRoCI.
53.50%
62.31
66.33%
62.43%
51.14%
62.47%
58.38 %
56.81% %
54.74%
56.71%
41.60% %
46.12 %
44.50%
57.01%
40.70%
45.99

---

Cross-Detector generalization While AngleRoCL improves angle robustness across multiple de- tectors, the degree varies between architectures. As shown in Table 3, different detectors show varying sensitivities to specific robustness features- color features are removed, YOLOv5 shows dramatic improvement with our method (21. to 62.33%), while RT-DETR shows minimal change (71.75% to 71.54%). Since our framework uses only YOLOv5 for feedhack during training, the resulting concept inherently captures YOLOv5's definition of robustness, explaining the most pronounced improvements YOLOv5 (81.2% relative improvement). This detector-specifie bias, while still enabling cross-detector generalization, limits achieving optimal universal robustness. Limitations. We trained with only 9 sampled angles in the horizontal plane, which simplifies but doesn't fully capture continuous 3D angle variations, including vertical perspectives in real-world scenarios. While experiments show AngleRoCL significantly enhances patch robustness even with this limited sampling, the optimal angle sampling density and distribution remain unexplored.
7 Conclusion
In this paper, we introduced Angle-Robust Concept Learning (AngleRoCL)) addressing the critical challenge of maintaining attack effectiveness across multiple viewing angles for T21 adversarial patches. Our comprehensive experiments in both digital and physical environments demonstrate that AngleRoCL significantly outperforms baseline methods without requiring environmental opti- mization. By encoding angle robustness as a learned concept, our method enables the generation of physically robust adversarial patches with consistent performance across viewpoints. The plug- and-play nature of our approach allows seamless integration with existing T2I attack frameworks. Beyond technical contributions, this work advances understanding of textual concepts and physical properties in diffusion- -egnerrtee content, providing valuable insights for developing more robust defense mechanisms against angle-invariant adversarial attacks in real-world environments.
Acknowledgments
This research was supported by the NSFC (No. 62476143), Shenzhen Science and Technology Program (No. JCYJ20240813/ 44237048). "Science and Technology Yongjiang 2035" key tech- nology breakthrough plan project (No. 2025Z053), and Chinese government-guin -uuided local science and technology development fund projects (scientific and technological achievement transfer and transformation projects) (No. 25420102G). This research is supported by the National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: AISG4-GC-2023-- IB), and National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative. Any opinions, findings and conclusions or recommendations expressed in this material those of the author(s) and do not reflect the views of National Research Foundation, Singapore, Cyber Security Agency of Singapore, and Infocomm Media Development Authority.
References
[1] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: survey. leee Access, 6:14410- 14430, 2018. 3
[2] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing rohust adversarial examples. In International conference on machine learning, pages 284-293. PMI.R, 2018. 3
[3] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. 2018. 3
Tom B Brown, Dandelion Mané, Aurko Roy, Martín Ahadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.0666. 2017. 1
[5] Tom B. Brown. Dandelion Mané, Aurko Roy, Martin Abadi, and Justin Gilmer. Adversarial patch. In NewrIPS 2017 Workshop on Machine Learning and Computer Security, 2017. 2, 3,
[6] Yue Cao, Yun Xing, Jie Zhang, Di Lin, Tianwei Zhang, Ivor Tsang, Yang Liu, and Qing Guo. Scenetap: Scene-coheree typographic adversarial planner against vision-language language models in real world environments. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages
2025.
10

---

[7] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In Symposium Security and Privacy (SP), pages 39-57. leee, 2017. 3
[8] Meng Chen, Jiawei Tu, Chao Qi Yonghao Dang. Feng Zhou, Wei Wei, and Jianqin Yin. Towards physicallyrealizzale adversarial attacks embodied vision navigation. arXiv preprint 2409. 1007,, 2024. 3
[9] Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Homg Chau. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 52 68. Springer, 2018. 3
[10] Nhat Chung, Sensen Gao, Tuan-Anh Vu, Jie Zhang, Aishan Liu, Yun Lin, Jin Song Dong, and Qing Guo. Towards transferable attacks against vision-llmy in autonomous driving with typography. arXiv preprint arXiv:2405. 14169, 2024. 3
[11] Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A Kai Qin, and Yun Yang. Adversarial camouflage: Hiding physical-world attacks with natural styles. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1000-1008, 2020.
[12] Mchmet Ergezer, Phat Duong, Christian Green, Tommy Nguyen, and Abdurrahman Zeybey. One noise to rule them all: Multi-view adversarial attacks with universal perturbation. In International Conference on Artificial Intelligence and its Application, pages 515-527. Springer, 2024. 3
[13] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-worid attacks on deep learning visual classification. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 1625-1634,
2018. 3,
[14] Whye Kit Fong, Rohit Mohan, Juana Valeria Hurtado, Lubing Zhou, Holger Caesar, Oscar Beijbom, and Abhinav Valada. Panoptic nuscenes: A large-scale benehmark for lidar panoptic segmentation and tracking. RA-L, 2022. 6, 17, 19
[15] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Patashnik, Amit Haim Bermano, Gal Chechik, and Daniel Cohen-or. An image is worth one word: Personalizing text-to-image generation using textual inversion. In International Conference on Learning Representations, 2023. 5
[16] Sensen Gao, Xiagjum Jia, Xuhong Ren, Ivor Tsang, and Qing Guo. Boosting transferability in vision- language attacks via diversification along the intersection region of adversarial trajectory. In European
Conference on Computer Vision, pages 442-460. Springer, 2024. 2
[17] lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamnessing adversarial examples. In International Conference on Learning Representations, 2015, 2,
[18] Qi Guo, Shanmin Pang. Zhikai Chen, and Qing Guo. Towards robust deepfake distortion attack via adversarial autoaugment. Neurocomputing. 617:129011, 2025.
[19] Qi Guo, Shanmin Pang, Xiaojun Jia, Yang Liu, and Qing Guo. Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusson models. IEEE Transactions on Information Forensics and Security, 20:1 1333-1348, 2024. 2
[20] Qing Guo, Xiaofei Xic, Felix Juefei-Xu, -u, Lei Ma, Zhongguo Li, Wanli Xue, Wei Feng, and Yang Liu. Spark: Spatial-aware online incremental attack against visual tracking. In European conference on computer vision, pages 202-219, 219. Springer, 2020. 3
[21] Jonathan Ho. Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840 -851, 2020. 3
[22] Yang Hou, Qing Guo, Yihao Huang, Xiaofei Xie, Lei Ma, and Jianjun Zhao. Evading deepfake detectors via adversarial statistical consistency. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12271-12280, 2023.
[23] Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lang Hua, and Wen-Huang Cheng. Naturalistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7848-7857, 2021. 1,3
[24] Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang. Bo Zhang, and Xiaolin Hu. Physically realizable natural-looking clothing textures evade person detectors via 3d modeling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16975-16999 16984, 2023. 3
11

---

[25] Yihao Huang, Felix Juefei-Xu, Qing Guo, Geguang Pu, and Yang Liu. Natural & adversarial bokeh rendering via circle-of-confusion predictive network. IEEE Transactions on Multimedia, 26:5729-5740, 2023. 3
[26] Yihao Huang. Liangru Sun, Qing Guo, Felix Juefei-Xu, Jiayi Zhu, Jincao Feng, Yang Liu, and Geguang Pu. Ala: Naturalness-aware adversarial lightness attack. In Proceedings of the 31 ACM International Conference on Multimedia, pages 2418-24266 2023. 3
[27] Matthew Hull, Zijie J Wang, and Duen Horng Chau. Revamp: Automated simulations of adversarial attacks on arbitrary objects in realistic scenes. arXiv preprint urXiv:2310.1224: 2023. 3
[28] Xiaojun Jia, Jindong Gu, Yihao Huang. Simeng Qin, Qing Guo, Yang Liu, and Xiaochun Cao. Transegngd: Improving transferability of adversarial examples on semantic segmentation. arXiv preprint arXiv:2312.02200 2023. 2
[29] Glenn Jocher. Ultralytics yolov5, 2020. 7, 19
[30] Dehong Kong, Siyuan Liang, Xiaopeng Zhu, Yuansheng Zhong, and Wenqi Ren. Patch is enough: Natu- ralistic adversarial patch against rision-languag pre- training models. arXiv preprint arX1v:2410.04884 2024. 2
[31] Hui Kuurila-Zhang, Haoyu Chen, and Guoying Zhao. Venom: Text-driven unrestricted adversarial example generation with diffusion models, 2025. 3
[32] Jin Li, Ziqiang He, Anwei Luo, Jian-Fang Hu, Z. Jane Wang, and Xiangui Kang. Advad: Exploring non-parametric diffuuson for imperceptible adversarial attacks, 2025. 3
[33] Jinlong Li, Baolu Li, Zhengzhong Tu, Xinyu Liu, Qing Guo, Felix Juefei-Xu, Runsheng Xu, and Hongkai Yu. Light the night: multi-condition diffusion framework for unpaired low-light enhancement in autonomous driving. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pages 15205-15215, 2024. 3
[34] Shuo-Yer Lin, Emic Chu, Che-Hsien Lin, Jun- Jun-Cheng Chen, and Jia-Ching Wang. Diffusion to confusion: Naturalistic adversarial patch generation based on diffusion model for object detector, 2023. 3
[35] Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. No need to worry about adversarial examples in object detection in autonomous vehicles. arXiv preprint arXiv: 1707.03501 2017.
[36] Chenggi Lyu, Wenwei Zhang. Haian Huang, Yue Zhou, Yudong Wang. Yanyi Liu, Shilong Zhang, and Kai Chen. Rtmdet: An empirical study of designing real-time object detectors. arXiv preprint 222.:2221.007784, 2022, 2
[37] Linye Lyu, Jiawei Zhou, Daojing He, and Yu Li. Cnea: Toward customizable and natural generation of adversarial camouflage for vehicle detectors, 2024. 3
[38] Yasamin Medghalchi, Moein Heidari, Clayton Allard, Leonid Sigal, and llker Hacihaliloglu. Prompt2perturb (p2p): Texi-guided diffusion-based adversarial attacks on breast ultrasound images. arXiv preprint arXiv:2412.09910, 2024. 3
[39] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adver- sarial perturbations. In Proceedings of the IEEE conference computer vision and pattern recognition, pages
2017. 2,3
[40] Seyed-Mohsen Moosavi- -ezzool,,,,,, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574-2582, 2016. 3
[41] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEFE conference on computer vision and pattern recognition, pages 427-436, 2015. 2,3
[42] Scott Oslund, Clayton Washington, Andrew So, Tingting Chen, and Hao Ji. Multiview robust adversarial stickers for arbitrary objects in the physical world. Journal of Computational and Cognitive Engineering, 154-155, 2022. 3
[43] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint 261,05204 1(2):3 2022.
12

---

[44] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in Neural Information Processing Systems, 28, 2015. 7, 19
[45] Robin Rombach, Andreas Blattmann, Dominik Lorenz. Patrick Esser, and Bjömn Ommer. High- figh-resolution image synthesis with latent diffusion models. In Proceedings of the IEFF/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[46] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models, 2022.
[47] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to- image diffusion models with deep language understanding. Advances in neural information processing systems,
2022.
[48] Takami Sato, Justin Yue, Nanze Chen, Ningfei Wang, and Qi Alfred Chen. Intriguing properties of difflusin models: An empirical study of the natural attack capability in text-to-image generative models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 24635-24644,
2024. 1, 3. 7, 19
[49] Samridha Shrestha, Saurabh Pathak, and Eduardo K Viegas. Towards a robust adversarial patch attack against unmanned acrial vehicles object detection. In 2023 JEEF/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 3256-3263. IEEE, 2023. 3
[50] Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Harashta Tatimma I Larasati, Youngyeo Yun, Thi- Thi-Thu-Huong
Le, Hummin Yang. Se- Yoon Oh, and Howon Kim. Dta: Physical camoutlage attacks using differentiable transformation network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15314, 2022. 3
[51] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014. 2,3
[52] Simen Thys, Wiebe Van Ranst. and Toon Goedemé. Fooling automated surveillance cameras: adversarial patches to attack person detection. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 0-0, 2019. 3
[53] Ao Wang, Hui Chen, Lihao Liu, Kai Chen, Zijia Lin, Jungong Han, al. Yolov10: Real-time end-to-end object detection. Advances in Neural Information Processing Systems, 37:107984-108011 2024. 7, 19
[54] Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8565 8574,55722222 2021. 3
[55] Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, and Qi Alfred Chen. Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4412-4422 2023. 2
[56] Zhixiang Wang. Xingjun Ma, and Yu-Gang Jiang. Badpatch: Diffusion-based generation of physical adversarial patches, 2025. 3
[57] Xingxing Wei, Ying Guo, and Jie Yu. Adversarial sticker: stealthy attack method in the physical world. IEEE Transactions on Pattern Analysis and Machine Intelligence 45(3):2711 2022. 3
[58] Yun Xing. Nhat Chung, Jie Zhang, Yue Cao, Ivor Tsang, Yang Liu, Lei Ma, and Qing Guo. Magic Mastering physical adversarial generation in context through collaborative Ilm agents, 2025. 1, 3, 6, 7, 17, 19
[59] Liming Zhai, Felix Juefei-Xu, Qing Guo, Xiaofei Xie, Lei Ma, Wei Feng, Shengchao Qin, and Yang Liu. It's raining cats or dogs? adversarial rain attack on dnn pereeption. arXiv preprint 290.000009. 2020.
[60] Qian Zhang, Qing Guo, Ruijun Gao, Felix Juefei-Xu, Hongkai Yu, and Wei Feng. Adversarial relighting against face recognition. IEEE Transactions on Information Forensies and Security, 2024. 2
[61] Yian Zhao, Wenyu Lv, Shangliang Xu. Jinman Wei, Guanzhong Wang, Qingqing Dang, Yi Liu, and Jie Chen. Detrs beat yolos on time object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16965-16974, 2024.7 7
13

---

[62] Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen, Seeing isn't believing: Towards robust adversarial attack against real world object detectors. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pages 1989-2004, 2019. 1.3,
[63] Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows be dangerous: Stealthy and effective physical-wond world adversarial attack by natural phenomenon. Proceedings of IEEE/CVF conference on computer vision and pattern recognition, pages 15345-15354, 2022. 2
[64] Zijian Zhu, Xiao Yang. Hang Su, and Shibao Zheng. Camoenv: Transferable environment-cconisie adversarial camouflage in autonomous driving. Pattern Recognition Letters, 188:95 102, 2025, 3
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly state the claims made, including the contributions made in the paper and the scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed the limitation in Sec. 6.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proof' can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We have described the proposed method in Sec. 4 and the corresponding implementation details in Sec. 4.3. Additionally, the code and models will be made publicly available.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
16

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We use publicly available assets, including evaluation protocol [58] and the nulmage dataset [14], both of which are released under open-access licenses. All relevant licenses are respected and cited the paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https: /tpps://nipp... cc/
pub public//a /gwi//uuisssee/eee Soome ss cessoooooiinn
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips.co cttccc//pue pttppppblcccccco gu des /CodeSumm as onPol P icy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: All training details including data splits, hyperparameters, and optimization methods are specified Section 4.3 and Appendix ??. Complete implementation code is provided in repository.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments in Section 5.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
17

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Experiments ran on 2 NVIDIA 3090 GPUs.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https:/ /tterr/////uii.p.eee
Answer: [Yes]
Justification: Our research fully conforms to the NeurlPS Code of Ethics in all aspects of methodology and reporting.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: This paper studies physical attack on object detector. It reveals the potential flaws of the existing object detectors and provides our perspective for subsequent research.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
18

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: The data release complies with the open-source agreement.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We use publicly available assets, including the evaluation protocol from NDDA [48] and MAGIC [58], the nulmage dataset [14], and various detector implementations (YOLOv5 [29]. YOLOv10 [53], Faster R-CNN [44], etc.). All assets are properly cited with their original publications. For detector implementations, we used the official releases from Ultralytics (for YOLOv5/v 10) and MMDetection (for others) under their respective open-source licenses. The Stable Diffusion v1.5 model was used under the CreativeML Open RAIL-M license. All licenses and terms of use were respected throughout our research.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
19

---

The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. popular datasets, papers thoode. . com da sets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We introduce new concept embedding for angle robustness (<angle-robuste robuss>>, which will be released as part of our code repository. The repository includes comprehensive documentation detailing the model architecture, training procedures, hyperparameters, and usage instructions. We also provide the trained embedding weights, sample prompts, and evaluation scripts to reproduce our results. The code repository is structured facilitate both immediate application and further research extensions. All assets are released under the MIT license, and we have anonymized the repository link for the submission process.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification:
This paper does not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Bthies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
20

---

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification; this research does not involve LLMs any important, original, non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non non-standary components.
Please refer to our LLM policy (https //eurrrripp psrpppp.. cc/ Conferencess// / 2025/ LLM) for what should or should not described.
21


Reviews:
[{"review_id": "eQ1MSaGpAV", "reviewer": "Reviewer_T7Kc", "summary": "This paper identifies a key limitation of current Text-to-Image (T2I) adversarial attacks that their effectiveness drops sharply when viewed from different angles. The authors propose Angle-Robust Concept Learning (AngleRoCL), a plug-and-play approach that learns a textual embedding  \"angle-robust\" representing angle robustness, which can be inserted into any T2I prompt to guide the generation of patches that maintain attack efficacy across a wide range of viewing angles. Experiments show that the proposed approach achieves the strong attack success rate of 65.86% (Table 2), significantly outperforming baseline methods.", "questions": "- Since your concept embedding \"angle-robust\" is trained with YOLOv5's feedback, have you attempted training with multiple detectors jointly or rotating detectors during training? This might reduce potential detector-specific bias and improve generalization. Did you explore this possibility?\n - Recent works like DiffPatch [1] and Diffusion to Confusion (2023) also use diffusion models to generate physically robust adversarial patches. Could you clarify how your method compares in terms of real-world robustness and patch realism.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n - The reviewer likes the idea of AngleRoCL’s “angle” robustness for physical-world attacks proposed in the paper as most methods generally focus on realism without any concrete definition. Further, AngleRoCL’s textual embedding-based approach is compatible with any prompt and attack pipeline (e.g., MAGIC, NDDA), and is model-agnostic. \n - Experiment-wise, the authors conducts large-scale experiments across digital and real-world physical environments, including deployment via printed patches, on five detectors (YOLOv3, v5, v10, Faster R-CNN, RT-DETR), using a new angle-aware metric (AASR), which integrates attack success over continuous viewing angles. For example, MAGIC+AngleRoCL improves physical-world AASR from 22.72% to 65.86%.\n\n----\n**Weaknesses:**\n - AngleRoCL uses YOLOv5 alone for training supervision, which biases the learned embedding toward this detector’s feature sensitivities. Although generalization to other detectors is tested, improvements are uneven, e.g., larger for YOLOv5 than for RT-DETR. This compromises the method’s claim of full model-agnosticism.\n - While it is novel in angle robustness, the paper does not compare directly to methods like DiffPatch [1] or Diffusion to Confusion [2], which also use diffusion models for generating robust patches in physical environments. Even if their objectives differ (stealth vs. view-invariance), a head-to-head comparison would better position AngleRoCL and strengthen claims of superiority.\n\n----\n[1] DiffPatch: Generating Customizable Adversarial Patches using Diffusion Models, arXiv 2024 \\\n[2] Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detector, arXiv 2023", "was_revised": true, "final_justification": "The authors have alleviated all of the reviewer's concerns. Hence, the reviewer will maintain the rating.", "rebuttal": "### 1. YOLOv5 Training Bias, Model-Agnosticism Claims, and Multi-Detector Training\n\n**Response**:\n\nThank you for this insightful question about detector-specific bias. We appreciate your observation and would like to clarify our claims and provide a detailed analysis.\n\n**Clarification of Model-Agnosticism Claims:** Our original claim about the \"model-agnostic\" referred to the ability to achieve consistent angle robustness improvements across unseen, black-box detectors during testing, rather than uniform improvement magnitudes across all architectures. The terminology may be misleading, and we will revise our manuscript to provide a clearer characterization of our approach's capabilities and limitations. While we use YOLOv5 to guide concept learning during training, we evaluate on four additional detectors (Faster R-CNN, YOLOv3, RT-DETR, and YOLOv10) that provide no guidance information during the generation process. As demonstrated in Table 1 in the submission, AngleRoCL enhances performance across all tested detectors in six environments, demonstrating cross-detector transferability.\n\n**Regarding Multi-Detector Training:** Intuitively, training with multiple detectors should enable learning a concept that achieves robust enhancement across different detector architectures. However, our implementation revealed that multi-detector training using both YOLOv5 and RT-DETR simultaneously encounters significant optimization challenges, with the loss function failing to converge effectively. As demonstrated in Table R-1, our single-detector training approach achieves substantially higher Angle-Aware Attack Success Rates (AASR) compared to the multi-detector variant, suggesting that naively combining multiple detector objectives creates conflicting optimization signals. These findings indicate that developing effective multi-detector training strategies represents an important avenue for future research, as the challenge likely stems from fundamental differences in how various detector architectures process visual features. While our current single-detector approach demonstrates strong cross-detector generalization, developing truly detector-agnostic angle-robust concepts remains an open challenge.\n\n**Table R-1: Multi-detector training vs single-detector training across detectors**\n\n|Training Strategy|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Single-Detector Training|NDDA|34.34%|11.82%|11.45%|25.16%|18.20%|**20.19%**|\n||NDDA+AngleRoCL|54.12%|33.49%|47.17%|44.87%|43.05%|**44.54%**|\n|Multi-Detector Training|NDDA|34.34%|11.82%|11.45%|25.16%|18.20%|**20.19%**|\n||NDDA+AngleRoCL|25.67%|8.45%|2.21%|12.15%|4.41%|**10.58%**|\n\n_Note: All experiments in Table R-1 were conducted in Digital Environment 1. For each NDDA prompt, we generated 5 patches using the trained robust concept, and the reported results represent the average performance across all generated patches._\n\n### 2. Comparisons with Recent Diffusion-based Methods\n\n**Response:**\n\nThank you for providing two related works. However, **DiffPatch and Diffusion to Confusion (D2C) address fundamentally different research objectives compared to our method.** DiffPatch and D2C focus on generating adversarial patches for human evasion (e.g., T-shirt patches to avoid person detection), while our work specifically targets angle robustness for object detection attacks—a previously unexplored dimension in T2I adversarial patch generation.\n\n**Our Comparison Strategy:** While direct comparison is challenging due to divergent objectives, we evaluate these methods on angle robustness using our proposed AASR metric to demonstrate the critical gap in existing T2I adversarial patch methods.\n\n**Implementation and Initial Results:** We contacted both research teams for code access. The DiffPatch authors graciously provided their implementation, enabling us to reproduce their results and evaluate the generated patches for angle robustness under our experimental protocol. Unfortunately, the D2C authors have not responded and no public code is available, limiting our comparison scope to DiffPatch.\n\n**Table R-2: Angle Robustness Comparison with DiffPatch**\n\n|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|DiffPatch|0.00%|11.89%|33.81%|0.00%|1.88%|**9.52%**|\n|NDDA+AngleRoCL|54.12%|33.49%|47.17%|44.87%|43.05%|**44.54%**|\n\n_Note: The experiments in Table R-2 were conducted using patches trained on the INRIA person dataset with YOLOv5 as the target detector. We applied horizontal projective transformations same as our AngleRoCL to the patches and evaluated them against test set images as backgrounds to assess angle robustness performance._\n\nOur results in Table R-2 demonstrate that DiffPatch exhibits significant angle robustness limitations when evaluated across multiple viewing angles—performing similarly to baseline methods like NDDA that lack angle-aware optimization. **This comparison validates our core contribution: existing T2I adversarial patch methods, regardless of their sophistication in other dimensions, fail to address the critical challenge of maintaining attack effectiveness across diverse viewing angles in physical deployments.**\n\n**Future Work Integration:** The complementary nature of these approaches presents exciting opportunities for future research. Our angle-robust concept learning could be integrated with DiffPatch's customization framework to create patches that are simultaneously natural-looking, customizable, and angle-robust. Additionally, comprehensive evaluation including patch realism assessments using user preference studies and naturalness metrics would provide a more complete comparison framework. We will add the discussion into our revision and cite the two works."}, {"review_id": "mXZEKY3u8C", "reviewer": "Reviewer_KqvV", "summary": "The paper addresses an interesting problem about viewpoint-invariant adversarial attacks. NDDA method generates adversarial images that remove distinctive features while misleading object detectors. However, in real-world settings, the attack success rate drops significantly when the image is viewed from non-frontal angles. To address this, the authors propose a method to generate angle-robust adversarial images. Specifically, they introduce a new concept word \"angle-robust\" trained via textual inversion, and use it during inference. The training leverages feedback from YOLOv5. For physical deployment, the generated images can be printed and attached to the target object using a standard printer.", "questions": "- In the left side of Figure 4 (ablation study), what exactly does “direct optimization” refer to in terms of training setup?\n- Was there a specific reason for choosing textual inversion over other fine-tuning methods such as LoRA?", "limitations": "yes; The authors well addressed their limitations.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The paper points out a novel and overlooked problem and provides experimental evidence that NDDA attacks are less effective from non-frontal viewpoints.\n- The idea of learning an angle-robust concept using textual inversion without requiring separate training for each angle is novel and interesting.\n- The method shows consistent improvement across multiple detectors. The authors also provide extensive analysis to support and clarify the approach.\n\nWeaknesses\n- While the reviewer agrees that the identified problem is novel, it is unclear how critical it is from a safety standpoint. For example, in the case of stop signs, only frontal views are typically relevant for driving decisions, so the practical risk may be limited.\n- The proposed method is evaluated only on stop signs. It is unclear whether the same angle-dependent issue arises for other objects. In contrast, NDDA includes experiments on a broader set of objects.", "was_revised": true, "final_justification": "The problem posed is interesting and it has been addressed well. However, the reviewer still find the scope of the problem to be somewhat narrow (although the reviewer thanks for the author responses which read carefully), so I will maintain my original rating.", "rebuttal": "### 1. Practical safety significance of multi-angle attacks\n\n**Response**:\n\nThank you for this thoughtful concern about practical safety implications. While frontal views are indeed primary for driving decisions, angle robustness represents a significant real-world security challenge supported by both practical scenarios and extensive research attention.\n\n**Angle Robustness is Safety-Critical in the Real World:**\n\n- **Traffic signs at intersections are viewed from various angles as vehicles approach from different directions.** For example, in the highway merging and lane changes, drivers observe traffic signs at oblique angles when merging or changing lanes around construction zones and temporary traffic control.\n\n- **Autonomous vehicle sensor arrays**: Modern AVs like Tesla, Waymo use 8+ cameras covering 360° views, continuously processing visual information from multiple perspectives simultaneously—angle-robust patches could compromise their entire perception system.\n\n- **Even \"frontal\" approaches involve angle variations due to road curvature, vehicle positioning, and sensor placement.** In particular, for the **emergency scenarios**: First responders and emergency vehicles often approach intersections from non-standard angles where traditional patches would fail.\n\n**Extensive Research Validation:** The critical importance of angle-robust adversarial attacks has been acknowledged by substantial research investment: multi-view adversarial examples [2, 12], 3D adversarial patches [7, 21], viewpoint-invariant adversarial noise [35]. This sustained research focus across premier venues (CVPR, ICCV, USENIX Security, NeurIPS) demonstrates that the research community recognizes angle robustness as a fundamental security challenge requiring urgent attention, rather than merely a theoretical concern.\n\n### 2. Attack results on other objects\n\n**Response:**\n\nThank you for the insightful question. To address the concern, we conducted additional experiments on two other target objects to demonstrate the broader applicability of our method.\n\n**Experimental Design:** Following NDDA's evaluation scope, we selected fire-hydrant and horse as additional target objects to evaluate object-specific training capabilities. These objects represent different categories—urban infrastructure (fire-hydrant) and natural subjects (horse)—allowing us to assess our method's versatility across diverse visual domains.\n\n**Object-Specific Training Experiment:** We trained dedicated angle-robust concepts for the two target objects, respectively, using their respective NDDA prompt templates. Then, we embed the learned angle-robust concepts into the NDDA prompt to generate angle-robust adversarial patches. **Table R-3** presents the comparative results with/without AngleRoCL:\n\n**Table R-3: Object-Specific Angle-Robust Concept Evaluation**\n\n|Target Object|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Fire-hydrant|NDDA|16.78%|3.63%|5.50%|23.39%|11.51%|**12.16%**|\n||NDDA+AngleRoCL|23.95%|6.62%|12.89%|27.14%|19.84%|**18.09%**|\n|Horse|NDDA|19.91%|12.59%|10.32%|26.74%|13.58%|**16.63%**|\n||NDDA+AngleRoCL|31.86%|23.34%|21.94%|44.70%|24.64%|**29.30%**|\n\n_Note: All experiments in Table R-3 were conducted in Digital Environment 1. For each NDDA prompt, we generated 5 patches, and the reported results represent the average performance across all generated patches._\n\nThe results demonstrate that our framework successfully generates effective angle-robust concepts across different target objects, achieving consistent improvements in all categories. This validates that the angle robustness challenge is not unique to stop signs but represents a broader limitation in existing T2I adversarial patch generation methods.\n\n### 3. \"Direct Optimization\" definition in ablation study\n\n**Response**:\n\nThank you for your comments. \"Direct optimization\" refers to a baseline approach like [35] where we directly optimize adversarial patch pixels using backpropagation to maximize detection confidence across multiple viewing angles, rather than learning a reusable text embedding concept. To further address the concerns, here are the setup details of the baseline:\n\n**Training Setup:**\n\n- **Optimization Target**: Patch pixel values (3×512×512 tensor) vs. AngleRoCL's text embeddings\n- **Loss Function**: Same loss function as AngleRoCL\n- **Angles**: Same training angles as AngleRoCL\n- **Detector**: Same YOLOv5 feedback as AngleRoCL\n- **Optimizer**: Adam optimizer vs. AngleRoCL's AdamW on embeddings\n\n### 4. Choice of textual inversion instead of LoRA\n\n**Response**:\n\nThank you for this insightful question. We chose textual inversion over LoRA for several principled reasons related to our method's core objectives and practical considerations.\n\n**1. Plug-and-Play Capability:** **Textual Inversion** enables seamless integration without affecting base model functionality - users simply load our trained embedding and modify prompts from \"a blue square stop sign\" to \"a `<angle-robust>` blue square stop sign\" to activate angle robustness. **LoRA**, despite using low-rank adaptation theory (decomposing weight updates as ΔW = BA where B∈R^(d×r), A∈R^(r×k), r<<d), modifies UNet layers and affects all generations even when angle robustness is not desired, compromising the model's normal text-to-image capabilities.\n\n**2. Concept Interpretability:** **Textual Inversion** enables direct semantic analysis of learned robustness concepts through embedding analysis, as demonstrated in our discussion (Line 329 - 349) where we show the learned concept develops meaningful associations with color and shape features, providing insights into which visual attributes contribute to angle robustness. **LoRA** distributes learned features across multiple transformer layers, making it significantly more challenging to isolate and interpret the specific concept being learned.\n\n**3. Training Stability and Parameter Efficiency:** **Textual Inversion** only trains the `<angle-robust>` embedding approximately 768 parameters while preserving all other embeddings and network parameters. **LoRA** trains more parameters (797,184 parameters, 0.09% of UNet with rank=4). However, we observed poor fitting performance that led to severe concept drift during our preliminary experiments - the learned representations progressively deviated from stop sign generation, resulting in images that could barely be detected as stop signs, severely compromising generation quality. We believe a novel learning strategy should be studied for the LoRA for angle-robust generation.\n\nOur approach prioritizes learning transferable, interpretable concepts that enhance rather than modify the base model's capabilities, making textual inversion the better choice for our angle robustness objective."}, {"review_id": "WhVTwho53m", "reviewer": "Reviewer_he3u", "summary": "The authors propose a solution for generating adversial patches that deceive pretrained models regarless of the angle of view considered for presenting the generated patch. Here the aim is to generate images that are completely different from the expected class while making the model predict the expected class. They focus on \"stop_sign\" class. They employ a T2I distilation model that is trained to generate angle robust adversial patches in presence of a \"robust_angle\" token. The training is completed in presence of projections of the adversial patch over the entire range of horizontal views : -90° to 90° with a step of 1°. Specific loss functions are defined for finding the suitable latent representation for the token \"robust_angle\" so that the generated projected patches always yield the \"stop_sign\" class.", "questions": "Figures 1 and 2 are too small (very hard to read even with zoom and googles) with regard to all the information contained and are poorly commented in text. The are also elements in text, that are not at all visible on the figures (like for instance the % mentioned in line 60).\n\nSometimes the term patch is a bit ambigous. The patch is the region that is supposed to contain the object itself and it's not a part of the object. In the experimental section we understand that the patch is put in an image (or captured in real settings) and the aim is to detect it as an object. The video provided by the authors illustrate this clearly. But once again, it's not clear while reading the text.\n\nDetails about the projection function used are missing.\n\nThe authors claim that they could not replicate the digital protocol to real-world settings due to ressource contraints. More explanation should be provided. Is this related to the small number of K patches generated for the real world setting ? Once the data is collected processing it should take as much as in digital settings, no ?\n\n It's unclear why they had to reduce the angle span in real world settings from -90<->90 to -70<->70? Where the results worse ? The projection function used for training can still reflect real-world transformations when the angle values are beyond 70° ? \n\nWhat's the impact of choosing the CLIP embedding of <angle-robust> as an initializer ?\nThe choice of the token <angle-robust> seems quite random as results using the initial representation of the token do not seem conclusive. Choosing other tokens for this purpose is something that you estimate feasible ?\n\nHow do you explain the change in behaviour between Table 1 (where NDDA+AngleROCL seems dominant) and Table 1 (in the Supp Mat) where (MAGIC+AngleROCL) seems way much better.\n\nAuthors mention that they generate 50 patches for each \"remove text or pattern\" text prompt and randomly selecting 100 patches as their NDDA baseline. They only mention 100 patches for MAGIC. The overall results only accoung for 100 patches each ? What about the other 50 ? Please explain what -\"remove text or pattern\" text prompt\"- means.\n\nFor the physical part, what do you mean by 25 matched pairs of patches from each method.\n\nIn section 5.1 authors mention the normalized weight function, but do not define it precisely. Uniform weight ? Gausian centered in 0° ?\n\nThe discussion in section 6 (Embedding analysis) is quite unclear. As the Figure 4, is once again to small, the discussion about color/shape and angle robustness is a bit difficult  to follow.\n\nHow the approach might work on other target objects ? Does it generalize ? \n\nIt would have been interesting to quantify the overhead brought by exploring extensively all the angles. Running time of individual runs for training the \"robust_angle\" would be interesting to report and compare with equivalent works from the state of the art.", "limitations": "The authors mention that they work only considers horizontal angles. But, their approach seems quite generic and in presence of a projection function that can transform the patch considering a 3D angle, 3D angle variations might be addressed. Do the authors forseen others limitations then the extensive training required for more angles ?", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The authors add their contribution on top of state-of-the art generators and largely improve the performances obtained over large angle spans.\n\nThe paper is quite unclear on the objectives, the overall methodology and assumes a lot of preknowledge from a generic public as the one in NeurIPS. It took me reading the entire paper to understand that the aim is to generate patches that are not there to deceive the system in a sense where by ading patches to the image, the model stop predicting the expected class. They just imply the term \"misleading\" (line25) and discuss about \"erroneous ouputs\" (line 60).\n\nThe hyperparameters are set without proper explanation of the experimental settings in which they were set. Only mean pourcentages are provided with no idea on the variance observed through the runs.\n\nConcrete examples that could make things clear are only provided in the supplementary material. Supplementary material should be there to give more insights on specific aspects, but enough elements should be in the main paper in order to let the reviewer fully understand the contribution.\n\nThe authors criticize the existing STAR that they only focus on a set of restricted angles. But, they do quite the same, except that they are considering the full range of horizontal angles ranging from -90 to 90 with a step of 1. Would the other train extensively their models, couldn't we expect to obtain the same results ? The authors does not discuss the importance of the angle step considered, nor they try to reduce the angle span to see how much they approach can generalize to angles not seen for training the \"robust_angle\" tokens.", "was_revised": true, "final_justification": "Although the responses where convincing, the original paper requires a lot of improvements in my opinion before publication and I m not certain that the camera ready will be able to fully all concerns raised by the reviewers, even though elements of answers are presented in the rebuttal.", "rebuttal": "**Important Clarifications on Factual Errors:**\n\nWe appreciate your detailed review, but we must first address significant misunderstandings in your summary: (1) **Distillation Model Misconception**: We employ textual inversion, not distillation models. (2) **Training Angle Sampling**: We use 9 fixed angles during training, not -90° to 90° with 1° step (that's our testing protocol in Section 5.1). The response to the main concerns is as follows:\n\n### 1. **Paper clarity and methodology description**\n\n**Objective:** We generate standalone adversarial patches using T2I models that fool object detectors across multiple viewing angles in digital & physical environments. These patches cause misclassification—making detectors incorrectly identify our generated patch as a legitimate target object (e.g., \"stop sign\"). **The term `adversarial patch'** refers to a standalone image/object that is generated to be detected as a target object, rather than a modification applied to an existing object.\n\n**Motivation:** Existing T2I patches only work within narrow viewing ranges. Current methods like NDDA succeed at frontal views (0°) but fail at oblique angles (±60°+), limiting real-world applicability (See Fig. 1). Task-specific instructions fail to improve robustness.\n\n**Methodology:** AngleRoCL learns an <angle-robust> token that, when incorporated into prompts like \"a photo of a <angle-robust> stop sign,\" guides diffusion models to generate patches maintaining effectiveness across wide viewing angles.\n\nWe will revise the paper for broader accessibility.\n\n### 2. **Hyperparameter discussion**\n\nOur approach builds upon textual inversion with task-specific hyperparameters: sampled angles and <angle-robust> token initialization. The results in the following two Tables show that 9 sampled angles provide better performance, and \"robust\" significantly outperforms alternatives by 20+ percentage points due to the alignment with the desired property.\n\n**Table R-4: Ablation study on different numbers of training angles for concept learning against YOLOv5. The AASR is the evaluation metric.**\n\n|Training Angles|Final AASR|Improvement vs. Baseline|\n|:-:|:-:|:-:|\n|1 angle|12.20%|+1.48%|\n|3 angles|20.12%|+9.40%|\n|5 angles|53.85%|+43.12%|\n|7 angles|68.45%|+57.73%|\n|**9 angles** (ours)|**81.82%**|**+71.10%**|\n|11 angles|81.96%|+71.24%|\n|13 angles|80.94%|+70.22%|\n\n**Table R-5: Ablation study on different initialization tokens for <angle-robust>. **\n\n|Initialization Token|Final AASR|Improvement vs. Baseline|\n|:-:|:-:|:-:|\n|**robust** (ours)|**81.82%**|**+71.10%**|\n|stable|61.07%|+50.35%|\n|recognizable|20.59%|+9.87%|\n|perspective|18.88%|+8.16%|\n|angular|17.87%|+7.15%|\n|visible|11.75%|+1.03%|\n\n### 3. **Physical experiment constraints**\n\nWe'd like to clarify the distinction between digital and physical experimental constraints, as the primary bottleneck lies in **data collection**rather than processing.\n\n**Scale Comparison:**\n- Digital: 1,268,505 automated evaluations (1,401 patches × 181 angles × 5 detectors)\n- Physical: Manual printing, positioning, and photographing from multiple angles. Testing 40 patches requires 2 full days. Replicating a digital scale would need ~70 working days plus significant resources.\n\n**Validation Purpose:** Physical experiments demonstrate real-world transferability under authentic conditions (printing artifacts, lighting variations), not statistical equivalence to digital experiments. Our 180 physical patches significantly exceed existing literature validation while remaining feasible.\n\n### 4 **Generalization to other target objects**\n\nTo demonstrate broader applicability, we conducted experiments on two additional objects (fire-hydrant and horse). Table R-3 shows consistent improvements across different object categories. Please refer to the response to the 2nd response to Reviewer KqvV.\n\n### 5. **Projective transformation function details**\n\nWe provide the mathematical description of our projective transformation function Proj(·) used in Eq. (3).\n\n**Mathematical Formulation:**\n\nThe function Proj( )  transforms the frontal-view image $\\mathbf{I}_{0^\\circ}$ \n\nto simulate angle $\\theta$ observations via homography matrix $\\mathbf{H}_\\theta$. We have\n\n$\\mathbf{I}_\\theta (x, y) = \\mathbf{I}_0^\\circ \\left( x',  y' \\right)$\n\nwhere\n\n$$\nx' = \\frac{M_{11}^{-1} x + M_{12}^{-1} y + M_{13}^{-1}}{M_{31}^{-1} x + M_{32}^{-1} y + M_{33}^{-1}},\ny' = \\frac{M_{21}^{-1} x + M_{22}^{-1} y + M_{23}^{-1}}{M_{31}^{-1} x + M_{32}^{-1} y + M_{33}^{-1}}\n$$\n\nwhere $M_{ij}$ are elements of $\\mathbf{H}_\\theta$.\n\n**$\\mathbf{H}_\\theta$ Calculation Steps:**\n1. Calculate camera position from angle $\\theta$;\n2. Compute view matrix $\\mathbf{V}$ (world-to-camera coordinates);\n3. Obtain projection matrix $\\mathbf{P}$ (camera-to-2D coordinates);\n4. Combine $\\mathbf{V}$ and $\\mathbf{P}$ for $\\mathbf{H}_\\theta$.\n\nThis framework maintains differentiability for gradient optimization during AngleRoCL training.\n\n### 6. **Patch selection in experiment and completed results**\n\n**\"Remove Text or Pattern\" prompt definition:** These prompts are sourced from the NDDA dataset and involve modifications that remove robust features from stop signs, as detailed in our supplementary materials.\n\n**Patch selection process:** Following NDDA and MAGIC protocols, we generated 50 patches for each of the 8 prompts, totaling 400 patches. We randomly selected 100 patches from this pool for our main experiments.\n\n**Complete Dataset Validation:** We conducted supplementary experiments using the complete 400-patch dataset to address the concern. **Table R-6** demonstrates that the results via our randomly sampled patches accurately represents the complete dataset performance.\n\n**Table R-6: Complete Dataset Validation**\n\n|Environment|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Environment 1|NDDA|21.60%|1.49%|12.53%|13.11%|8.69%|**11.48%**|\n||NDDA+AngleRoCL|40.38%|5.19%|35.34%|25.26%|22.56%|**25.75%**|\n|Environment 2|NDDA|36.12%|29.06%|26.71%|41.62%|27.07%|**32.12%**|\n||NDDA+AngleRoCL|52.48%|48.07%|48.56%|48.19%|44.31%|**48.32%**|\n|Environment 3|NDDA|25.49%|9.11%|23.09%|21.98%|20.48%|**20.03%**|\n||NDDA+AngleRoCL|44.37%|24.55%|45.11%|33.46%|37.10%|**36.92%**|\n|Environment 4|NDDA|16.94%|3.04%|8.98%|16.01%|11.95%|**11.38%**|\n||NDDA+AngleRoCL|30.59%|5.94%|25.87%|29.14%|25.85%|**23.48%**|\n|Environment 5|NDDA|33.32%|11.09%|25.28%|48.36%|21.73%|**27.96%**|\n||NDDA+AngleRoCL|49.27%|24.13%|45.04%|54.34%|37.71%|**42.10%**|\n|Environment 6|NDDA|24.00%|18.02%|18.02%|36.45%|18.99%|**23.10%**|\n||NDDA+AngleRoCL|41.61%|39.38%|39.38%|45.40%|36.70%|**40.49%**|\n\n### 7. **Performance difference between Table 1 and Supp Mat Table 1**\n\nPerformance differences between digital (Table 1) and physical environments stem from substantial environmental variations.\n\n**Environmental Factors:** Digital uses the nuImage dataset scenes while physical experiments use different geographic locations (different countries), weather conditions, and camera specifications.\n\n**Cross-Validation:** We digitally evaluated patches in physical environment images to verify consistency:  In Table R-7, when physical environments are evaluated digitally, performance ranking (MAGIC+AngleRoCL > NDDA+AngleRoCL) matches physical results, confirming environmental factors drive differences.\n\n**Table R-7: Digital-Physical Environment Cross-Validation. AASR is as the metric**\n\n|Environment|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Environment 7|NDDA|21.46%|1.56%|21.51%|15.39%|14.55%|**14.89%**|\n||NDDA+AngleRoCL|28.76%|14.43%|50.16%|33.03%|31.44%|**31.56%**|\n||MAGIC|14.55%|1.27%|22.35%|5.61%|12.80%|**11.32%**|\n||MAGIC+AngleRoCL|41.01%|15.61%|45.84%|39.83%|31.62%|**34.78%**|\n|Environment 8|NDDA|24.88%|6.91%|25.56%|23.70%|21.85%|**20.58%**|\n||NDDA+AngleRoCL|44.71%|13.59%|39.71%|28.48%|31.57%|**31.61%**|\n||MAGIC|32.97%|6.23%|28.25%|2.52%|20.73%|**18.14%**|\n||MAGIC+AngleRoCL|52.75%|13.59%|44.38%|39.55%|35.33%|**37.12%**|\n|Environment 9|NDDA|48.48%|12.19%|34.38%|55.16%|24.88%|**35.02%**|\n||NDDA+AngleRoCL|51.01%|24.66%|53.37%|59.26%|37.30%|**45.12%**|\n||MAGIC|40.89%|18.48%|42.24%|39.43%|22.97%|**32.80%**|\n||MAGIC+AngleRoCL|58.03%|43.87%|63.53%|63.25%|42.86%|**54.31%**|\n\n### 8. **Angle span reduction in real-world settings**\n\nThe angle span reduction from ±90° to ±70° was based on two key considerations: efficiency optimization and empirical observations from our digital experiments.\n\n**Justification:** Figure 2 shows most methods have substantially reduced performance beyond ±75°, where geometric visibility constraints dominate over patch design differences. The ±70° range captures meaningful performance variations. Given the significant time and labor costs of physical experiments (as discussed in our previous response), we prioritized the angle ranges where method differences are most pronounced rather than testing angles where all methods uniformly fail.\n\n**Extended Validation:** We tested the full ±90° range to address concerns. The results show that including extreme angles has minimal impact on conclusions, validating our original angle range selection.\n\n**Table R-8: Extended physical validation (-90° to 90°)**\n\n|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|-|-|-|-|-|-|-|\n|NDDA|31.80%|6.10%|12.00%|44.42%|17.68%|**22.40%**|\n|NDDA+AngleRoCL|55.16%|12.63%|48.00%|55.16%|33.30%|**40.85%**|\n|MAGIC|31.36%|3.37%|13.68%|33.68%|7.58%|**17.93%**|\n|MAGIC+AngleRoCL|66.05%|21.89%|57.26%|70.74%|43.95%|**51.98%**|\n\n### 9. **Justifications**\n\n(1). \"25 matched pairs\" means pairs with identical settings except for our <angle-robust> token presence/absence.\n(2). Normalized weight in Sec. 5.1 means uniform weighting: $w(\\theta) = \\frac{1}{|\\Omega|}$ for all angles, meaning equal contribution to AASR calculation.\n(3). Figure 4 concludes that the `<angle-robust>` concept is associated with visual features. We will improve all figures for better readability."}, {"review_id": "8tTS1uYe0u", "reviewer": "Reviewer_uf9C", "summary": "The author propose a new adversarial attack (generating adversarial patches) using textual inversion to improve the efficacy of adversarial patches across different viewpoints. Specifically, the authors propose a method to guide the embedding of their chosen prompt concept <angle-robust> towards regions that result in more effective adversarial patches (generated by a prompted T2I model). Through experiments on various object detection methods, the authors demonstrate the effectiveness of their method compared to other adversarial patch attacks.", "questions": "Questions are included in the strengths and weaknesses section above.", "limitations": "The authors highlight that the largest limitation of their proposed method is due to only sampling 9 viewpoint degrees during training. \n\nThere is a lack of discussion on the limitations of this method, or further research. \n\nThe paper proposed a novel attack that creates more potent adversarial patches, that not only work within the digital realm but also physical. However, there is little to no discussion on potential defence against this attack. I would encourage a more in-depth discussion about this within their broader impact statement.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper proposed a novel attack method, which is an interesting application of textual inversion for T2I models.\n- The authors provide useful figures to help describe their method and its results.\n- The authors conduct in expansive companrisons on several different object detection methods and adversarial patch attacks.\n\nWeaknesses:\n* At times the writing of the paper makes it difficult to follow:\n- Line 60 missing closing bracket *See Fig 1 (a)”\n- Lines 67-69: This sentence is not concise, the use of autonomous driving, classification and other domains seem random. I suggest that you replace the \n- Lines 125-141 are too short, making the text difficult to read, I would suggest either making Figure 2 smaller or placing it at the top of the page, covering the width of the page.\n- Lines 146-147 (point 3), the writing of this point is confusing, please re-write this objective.\n- Lines 187-188: “Concept embedding words” is unclear\n- Line 198, ‘we start with the input textual prompt with the A(T, C)’ \n\n* Within preliminaries, the authors spend most of the text discussing the problem and not the result of the study in Figure 2.\n* The paper would benefit from pseudo-code of the proposed method. The authors well describe the problem definition but only mention the the optimiser and learning rate. It would be useful to see some about the whole training process as an algorithm as well as their figure.\n\n* The experimental setup is largely focused on generating stop-signs, the paper would benefit from an explicit definition of the type of target objects they are generating in the experimental setup section.\n* The generation of stop signs is a core direction of this paper, it would be good to see expansion to other target objects.", "was_revised": true, "final_justification": "The authors have addressed my concerns and questions, which has increased by confidence in my rating. However, the recent results of different type objects introduced new concerns of its generalisability. I believe the study would be improved with more diverse experiments with different objects also.", "rebuttal": "### 1. Attack results on other target objects\n\n**Response**:\n\nThank you for the insightful question. To address the concern, we conducted additional experiments on two other target objects to demonstrate the broader applicability of our method.\n\n**Experimental Design:** Following NDDA's evaluation scope, we selected fire-hydrant and horse as additional target objects to evaluate object-specific training capabilities. These objects represent different categories—urban infrastructure (fire-hydrant) and natural subjects (horse)—allowing us to assess our method's versatility across diverse visual domains.\n\n**Object-Specific Training Experiment:** We trained dedicated angle-robust concepts for the two target objects, respectively, using their respective NDDA prompt templates. Then, we embed the learned angle-robust concepts into the NDDA prompt to generate angle-robust adversarial patches. **Table R-3** presents the comparative AASR results with/without AngleRoCL:\n\n**Table R-3: Object-Specific Angle-Robust Concept Evaluation**\n\n|Target Object|Method|Faster R-CNN|YOLOv3|YOLOv5|RT-DETR|YOLOv10|Avg.|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Fire-hydrant|NDDA|16.78%|3.63%|5.50%|23.39%|11.51%|**12.16%**|\n||NDDA+AngleRoCL|23.95%|6.62%|12.89%|27.14%|19.84%|**18.09%**|\n|Horse|NDDA|19.91%|12.59%|10.32%|26.74%|13.58%|**16.63%**|\n||NDDA+AngleRoCL|31.86%|23.34%|21.94%|44.70%|24.64%|**29.30%**|\n\n_Note: All experiments in Table R-3 were conducted in Digital Environment 1. For each NDDA prompt, we generated 5 patches, and the reported results represent the average performance across all generated patches._\n\nThe results demonstrate that our framework successfully generates effective angle-robust concepts across different target objects, achieving consistent improvements in all categories. This validates that the angle robustness challenge is not unique to stop signs but represents a broader limitation in existing T2I adversarial patch generation methods.\n\n\n### 2. Pseudo-code and algorithmic details\n\n**Response**:\n\nThank you for this valuable suggestion. We present the complete pseudo-code for our AngleRoCL training process as follows:\n\nThe training process follows a standard textual inversion framework but incorporates angle-aware supervision. For each training iteration, we generate adversarial patches using the learned concept embedding, apply perspective transformations to simulate multi-angle observations (lines 1-20), and optimize the embedding based on detection feedback across all angles (lines 14-16). The key advantage is that only the concept embedding is updated while preserving all original model parameters, ensuring stability and enabling the learned concept to generalize across different prompts and environments.\n\n**Algorithm: Angle-Robust Concept Learning (AngleRoCL)**\n\n```\nInput:\n  - Pre-trained Stable Diffusion model M (text encoder, UNet, VAE)\n  - NDDA prompt templates P = {p_1, p_2, ..., p_N}\n  - Training angles Θ_train = {θ_1, θ_2, ..., θ_V}\n  - Placeholder token <angle-robust>, initializer token \"robust\"\n  - YOLO detector D, perspective transformer T\n  - Detection threshold τ, scaling factor λ\n  - Repeat factor R for data augmentation\n\nInitialization:\n1. Add <angle-robust> token to tokenizer vocabulary\n2. Initialize embedding E_<angle-robust> ← E_robust (copy initializer embedding)\n3. Freeze all model parameters except E_<angle-robust>\n4. Create training dataset: D_train = {(p_i, r) | p_i ∈ P, r ∈ [1,R]}\n\nTraining Loop:\nfor epoch = 1 to max_epochs do:\n    for each batch in DataLoader(D_train) do:\n        // Text encoding with learned concept\n        1. angle-robust_embed ← TextEncoder(<angle-robust>)\n        \n        // Diffusion-based patch generation\n        2. Initialize random latents z_0 ~ N(0,I)\n        3. z_0 ← z_0 * scheduler.init_noise_sigma\n        4. for timestep t in scheduler.timesteps do:\n        5.     z_input ← concat([z_0, z_0])  // For classifier-free guidance\n        6.     z_input ← scheduler.scale_model_input(z_input, t)\n        7.    ε_pred ← UNet(z_input, t, angle-robust_embed)\n        8.    ε_uncond, ε_text ← chunk(ε_pred, 2)\n        9.    ε ← ε_uncond + γ * (ε_text - ε_uncond)  // CFG with scale γ\n        10.    z_0 ← scheduler.step(ε, t, z_0).prev_sample\n        11. end for\n        12. P ← VAE.decode(z_0 / 0.18215)  // Generated adversarial patch\n        \n        // Batch multi-angle transformation\n        13. transformed_views ← T(P, Θ_train)  // Transform to all V angles simultaneously\n        \n        // Detection and loss computation\n        14. detection_output ← D(transformed_views)\n        15. confidences ← ExtractMaxProb(detection_output)\n        16. loss ← mean(max(τ - confidences, 0)) * λ\n        \n        // Backpropagation\n        17. loss.backward()\n        18. optimizer.step()  // Update only E_<angle-robust>\n        19. optimizer.zero_grad()\n        \n        // Preserve original embeddings\n        20. E_other ← freeze(E_original[other_tokens])\n    end for\nend for\n\nOutput: Learned embedding E_<angle-robust>\n```\n\n### 3. Discussion on potential defense solutions\n\n**Response**:\n\nThank you for this valuable suggestion. Indeed, it is meaningful to discuss potential defense solutions in the broader impact statement. Based on previous works and our preliminary studies, we identify the following defense approaches: (1) Adversarial training methods that fine-tune detectors using our generated adversarial patches. However, this solution may reduce detection accuracy on other object categories and introduce new vulnerabilities. (2) Data purification methods that pre-process input images to disable adversarial patches by removing adversarial patterns. While effective for noise-like adversarial examples, our preliminary results show limited effectiveness against our patches. (3) Adversarial patch detection models that identify and crop patches to avoid their influence. However, this approach requires the detection model to be computationally efficient and demonstrate high generalization across unknown adversarial patches, which necessitates further careful study. We will incorporate and expand upon these defense discussions in our broader impact statement to provide a more comprehensive treatment of both the risks and potential mitigation strategies associated with our work.\n\n### 4. Writing quality and formatting issues\n\n**Concern**: Various writing issues, including missing closing bracket on Line 60, unclear sentences on Lines 67-69, short paragraphs on Lines 125-141, making text difficult to read, and confusing point descriptions.\n\n**Response**:\n\nWe appreciate the reviewers' detailed feedback on specific issues, including missing brackets, unclear sentences, and fragmented paragraphs. We will thoroughly polish the manuscript to address these writing issues and ensure a consistent, clear presentation throughout the submission to avoid similar situations in the revised version.\n\nFor example, we will revise the unclear sentences (Lines 67-69) as:\n\nPhysical adversarial patches pose severe threats to critical systems, including autonomous driving [42], classification models [4, 12, 47], and other safety-critical domains [8, 9, 16, 36, 38]. These patches are highly reproducible and deployable [34], making it essential to investigate their attack effectiveness [4, 38], ....\n\n### 5. More limitations discussion\n\n**Response**:\nThank you for the suggestions. In our original submission, we discussed the limitations on line 367 to 371. To further enhance this part, we have the following revision:\n\n**Limitations.** Although our method significantly enhances the angle robustness of generated patches, the current version has several limitations that warrant further investigation. (1) Our training is constrained to only 9 sampled angles in the horizontal plane, which simplifies the optimization process but does not fully capture continuous 3D angle variations, including vertical perspectives commonly encountered in real-world scenarios. (2) The current version employs only YOLOv5 for the objective function, which may limit performance improvements on other detection architectures. Our preliminary exploration indicates that combining different detectors during concept training fails to achieve higher angle robustness, suggesting that a deeper study of multi-detector optimization strategies is required. (3) The learned concept presents low transferability across distinct object categories, indicating that developing methods with higher cross-category transferability represents an important direction for future research."}]

Author rebuttal:

Meta-review: This paper addresses an interesting problem about viewpoint-invariant adversarial attacks using text-to-Image (T2I) generated patches. The authors propose Angle-Robust Concept Learning (AngleRoCL), a plug-and-play approach that learns a textual embedding "angle-robust" representing angle robustness, which can be inserted into any T2I prompt to guide the generation of patches that maintain attack efficacy across a wide range of viewing angles. The training leverages feedback from YOLOv5. For physical deployment, the generated images can be printed and attached to the target object using a standard printer. 

The submitted paper shows results only on STOP signs. However, in rebut, the authors provided results on additional objects though the range is still very limited. The authors also clarified that the method uses YOLOv5 during training but the attack also applies to other detectors. Overall, the reviewers have a more positive view of the papers after rebut discussions but there is concern if those additional clarifications and experiments will be incorporated in the final version. There also lingering concerns about the generality and applicability of the method.

The ACs recommend that the paper be accepted but the authors need to take care that the revised version includes the key elements from the rebut discussion.
Decision: Accept (poster)