Title: AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches
Venue: NeurIPS 2025
Accepted: yes
Keywords: Physical attack; Concept learning; View-invariant adversarial patch;
Abstract: Cutting-edge works have demonstrated that text-to-image (T2I) diffusion models can generate adversarial patches that mislead state-of-the-art object detectors in the physical world, revealing detectors' vulnerabilities and risks. However, these methods neglect the T2I patches' attack effectiveness when observed from different views in the physical world (i.e., angle robustness of the T2I adversarial patches). In this paper, we study the angle robustness of T2I adversarial patches comprehensively, revealing their angle-robust issues, demonstrating that texts affect the angle robustness of generated patches significantly, and task-specific linguistic instructions fail to enhance the angle robustness. Motivated by the studies, we introduce Angle-Robust Concept Learning (AngleRoCL), a simple and flexible approach that learns a generalizable concept (i.e., text embeddings in implementation) representing the capability of generating angle-robust patches. The learned concept can be incorporated into textual prompts and guides T2I models to generate patches with their attack effectiveness inherently resistant to viewpoint variations. Through extensive simulation and physical-world experiments on five SOTA detectors across multiple views, we demonstrate that AngleRoCL significantly enhances the angle robustness of T2I adversarial patches compared to baseline methods. Our patches maintain high attack success rates even under challenging viewing conditions, with over 50% average relative improvement in attack effectiveness across multiple angles. This research advances the understanding of physically angle-robust patches and provides insights into the relationship between textual concepts and physical properties in T2I-generated contents. We released our code at https://github.com/tsingqguo/anglerocl.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe author propose a new adversarial attack (generating adversarial patches) using textual inversion to improve the efficacy of adversarial patches across different viewpoints. Specifically, the authors propose a method to guide the embedding of their chosen prompt concept <angle-robust> towards regions that result in more effective adversarial patches (generated by a prompted T2I model). Through experiments on various object detection methods, the authors demonstrate the effectiveness of their method compared to other adversarial patch attacks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The paper proposed a novel attack method, which is an interesting application of textual inversion for T2I models.\n- The authors provide useful figures to help describe their method and its results.\n- The authors conduct in expansive companrisons on several different object detection methods and adversarial patch attacks.\n\nWeaknesses:\n* At times the writing of the paper makes it difficult to follow:\n- Line 60 missing closing bracket *See Fig 1 (a)”\n- Lines 67-69: This sentence is not concise, the use of autonomous driving, classification and other domains seem random. I suggest that you replace the \n- Lines 125-141 are too short, making the text difficult to read, I would suggest either making Figure 2 smaller or placing it at the top of the page, covering the width of the page.\n- Lines 146-147 (point 3), the writing of this point is confusing, please re-write this objective.\n- Lines 187-188: “Concept embedding words” is unclear\n- Line 198, ‘we start with the input textual prompt with the A(T, C)’ \n\n* Within preliminaries, the authors spend most of the text discussing the problem and not the result of the study in Figure 2.\n* The paper would benefit from pseudo-code of the proposed method. The authors well describe the problem definition but only mention the the optimiser and learning rate. It would be useful to see some about the whole training process as an algorithm as well as their figure.\n\n* The experimental setup is largely focused on generating stop-signs, the paper would benefit from an explicit definition of the type of target objects they are generating in the experimental setup section.\n* The generation of stop signs is a core direction of this paper, it would be good to see expansion to other target objects.\n\nQUESTIONS:\nQuestions are included in the strengths and weaknesses section above.\n\nLIMITATIONS:\nThe authors highlight that the largest limitation of their proposed method is due to only sampling 9 viewpoint degrees during training. \n\nThere is a lack of discussion on the limitations of this method, or further research. \n\nThe paper proposed a novel attack that creates more potent adversarial patches, that not only work within the digital realm but also physical. However, there is little to no discussion on potential defence against this attack. I would encourage a more in-depth discussion about this within their broader impact statement.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a solution for generating adversial patches that deceive pretrained models regarless of the angle of view considered for presenting the generated patch. Here the aim is to generate images that are completely different from the expected class while making the model predict the expected class. They focus on \"stop_sign\" class. They employ a T2I distilation model that is trained to generate angle robust adversial patches in presence of a \"robust_angle\" token. The training is completed in presence of projections of the adversial patch over the entire range of horizontal views : -90° to 90° with a step of 1°. Specific loss functions are defined for finding the suitable latent representation for the token \"robust_angle\" so that the generated projected patches always yield the \"stop_sign\" class.\n\nSTRENGTHS AND WEAKNESSES:\nThe authors add their contribution on top of state-of-the art generators and largely improve the performances obtained over large angle spans.\n\nThe paper is quite unclear on the objectives, the overall methodology and assumes a lot of preknowledge from a generic public as the one in NeurIPS. It took me reading the entire paper to understand that the aim is to generate patches that are not there to deceive the system in a sense where by ading patches to the image, the model stop predicting the expected class. They just imply the term \"misleading\" (line25) and discuss about \"erroneous ouputs\" (line 60).\n\nThe hyperparameters are set without proper explanation of the experimental settings in which they were set. Only mean pourcentages are provided with no idea on the variance observed through the runs.\n\nConcrete examples that could make things clear are only provided in the supplementary material. Supplementary material should be there to give more insights on specific aspects, but enough elements should be in the main paper in order to let the reviewer fully understand the contribution.\n\nThe authors criticize the existing STAR that they only focus on a set of restricted angles. But, they do quite the same, except that they are considering the full range of horizontal angles ranging from -90 to 90 with a step of 1. Would the other train extensively their models, couldn't we expect to obtain the same results ? The authors does not discuss the importance of the angle step considered, nor they try to reduce the angle span to see how much they approach can generalize to angles not seen for training the \"robust_angle\" tokens.\n\nQUESTIONS:\nFigures 1 and 2 are too small (very hard to read even with zoom and googles) with regard to all the information contained and are poorly commented in text. The are also elements in text, that are not at all visible on the figures (like for instance the % mentioned in line 60).\n\nSometimes the term patch is a bit ambigous. The patch is the region that is supposed to contain the object itself and it's not a part of the object. In the experimental section we understand that the patch is put in an image (or captured in real settings) and the aim is to detect it as an object. The video provided by the authors illustrate this clearly. But once again, it's not clear while reading the text.\n\nDetails about the projection function used are missing.\n\nThe authors claim that they could not replicate the digital protocol to real-world settings due to ressource contraints. More explanation should be provided. Is this related to the small number of K patches generated for the real world setting ? Once the data is collected processing it should take as much as in digital settings, no ?\n\n It's unclear why they had to reduce the angle span in real world settings from -90<->90 to -70<->70? Where the results worse ? The projection function used for training can still reflect real-world transformations when the angle values are beyond 70° ? \n\nWhat's the impact of choosing the CLIP embedding of <angle-robust> as an initializer ?\nThe choice of the token <angle-robust> seems quite random as results using the initial representation of the token do not seem conclusive. Choosing other tokens for this purpose is something that you estimate feasible ?\n\nHow do you explain the change in behaviour between Table 1 (where NDDA+AngleROCL seems dominant) and Table 1 (in the Supp Mat) where (MAGIC+AngleROCL) seems way much better.\n\nAuthors mention that they generate 50 patches for each \"remove text or pattern\" text prompt and randomly selecting 100 patches as their NDDA baseline. They only mention 100 patches for MAGIC. The overall results only accoung for 100 patches each ? What about the other 50 ? Please explain what -\"remove text or pattern\" text prompt\"- means.\n\nFor the physical part, what do you mean by 25 matched pairs of patches from each method.\n\nIn section 5.1 authors mention the normalized weight function, but do not define it precisely. Uniform weight ? Gausian centered in 0° ?\n\nThe discussion in section 6 (Embedding analysis) is quite unclear. As the Figure 4, is once again to small, the discussion about color/shape and angle robustness is a bit difficult  to follow.\n\nHow the approach might work on other target objects ? Does it generalize ? \n\nIt would have been interesting to quantify the overhead brought by exploring extensively all the angles. Running time of individual runs for training the \"robust_angle\" would be interesting to report and compare with equivalent works from the state of the art.\n\nLIMITATIONS:\nThe authors mention that they work only considers horizontal angles. But, their approach seems quite generic and in presence of a projection function that can transform the patch considering a 3D angle, 3D angle variations might be addressed. Do the authors forseen others limitations then the extensive training required for more angles ?", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper addresses an interesting problem about viewpoint-invariant adversarial attacks. NDDA method generates adversarial images that remove distinctive features while misleading object detectors. However, in real-world settings, the attack success rate drops significantly when the image is viewed from non-frontal angles. To address this, the authors propose a method to generate angle-robust adversarial images. Specifically, they introduce a new concept word \"angle-robust\" trained via textual inversion, and use it during inference. The training leverages feedback from YOLOv5. For physical deployment, the generated images can be printed and attached to the target object using a standard printer.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- The paper points out a novel and overlooked problem and provides experimental evidence that NDDA attacks are less effective from non-frontal viewpoints.\n- The idea of learning an angle-robust concept using textual inversion without requiring separate training for each angle is novel and interesting.\n- The method shows consistent improvement across multiple detectors. The authors also provide extensive analysis to support and clarify the approach.\n\nWeaknesses\n- While the reviewer agrees that the identified problem is novel, it is unclear how critical it is from a safety standpoint. For example, in the case of stop signs, only frontal views are typically relevant for driving decisions, so the practical risk may be limited.\n- The proposed method is evaluated only on stop signs. It is unclear whether the same angle-dependent issue arises for other objects. In contrast, NDDA includes experiments on a broader set of objects.\n\nQUESTIONS:\n- In the left side of Figure 4 (ablation study), what exactly does “direct optimization” refer to in terms of training setup?\n- Was there a specific reason for choosing textual inversion over other fine-tuning methods such as LoRA?\n\nLIMITATIONS:\nyes; The authors well addressed their limitations.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper identifies a key limitation of current Text-to-Image (T2I) adversarial attacks that their effectiveness drops sharply when viewed from different angles. The authors propose Angle-Robust Concept Learning (AngleRoCL), a plug-and-play approach that learns a textual embedding  \"angle-robust\" representing angle robustness, which can be inserted into any T2I prompt to guide the generation of patches that maintain attack efficacy across a wide range of viewing angles. Experiments show that the proposed approach achieves the strong attack success rate of 65.86% (Table 2), significantly outperforming baseline methods.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n - The reviewer likes the idea of AngleRoCL’s “angle” robustness for physical-world attacks proposed in the paper as most methods generally focus on realism without any concrete definition. Further, AngleRoCL’s textual embedding-based approach is compatible with any prompt and attack pipeline (e.g., MAGIC, NDDA), and is model-agnostic. \n - Experiment-wise, the authors conducts large-scale experiments across digital and real-world physical environments, including deployment via printed patches, on five detectors (YOLOv3, v5, v10, Faster R-CNN, RT-DETR), using a new angle-aware metric (AASR), which integrates attack success over continuous viewing angles. For example, MAGIC+AngleRoCL improves physical-world AASR from 22.72% to 65.86%.\n\n----\n**Weaknesses:**\n - AngleRoCL uses YOLOv5 alone for training supervision, which biases the learned embedding toward this detector’s feature sensitivities. Although generalization to other detectors is tested, improvements are uneven, e.g., larger for YOLOv5 than for RT-DETR. This compromises the method’s claim of full model-agnosticism.\n - While it is novel in angle robustness, the paper does not compare directly to methods like DiffPatch [1] or Diffusion to Confusion [2], which also use diffusion models for generating robust patches in physical environments. Even if their objectives differ (stealth vs. view-invariance), a head-to-head comparison would better position AngleRoCL and strengthen claims of superiority.\n\n----\n[1] DiffPatch: Generating Customizable Adversarial Patches using Diffusion Models, arXiv 2024 \\\n[2] Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detector, arXiv 2023\n\nQUESTIONS:\n- Since your concept embedding \"angle-robust\" is trained with YOLOv5's feedback, have you attempted training with multiple detectors jointly or rotating detectors during training? This might reduce potential detector-specific bias and improve generalization. Did you explore this possibility?\n - Recent works like DiffPatch [1] and Diffusion to Confusion (2023) also use diffusion models to generate physically robust adversarial patches. Could you clarify how your method compares in terms of real-world robustness and patch realism.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-05"}