AdvSerial is proposed, a dynamic 2D--3D joint optimization framework for generating continuous high-angle physical adversarial patches against pedestrian detectors in infrastructure-based scenarios and the results reveal persistent, temporally consistent failure modes under high-angle surveillance, and motivate the design of motion-aware and 3D-aware defenses for security-critical infrastructure deployments.
Abstract
AI-based visual perception systems are increasingly deployed in infrastructure surveillance, including roadside monitoring units, highway cameras, and smart-city pedestrian management systems. The security vulnerability of these systems to physical adversarial attacks poses a direct threat to the reliable operation of transportation infrastructure. We propose AdvSerial, a dynamic 2D--3D joint optimization framework for generating continuous high-angle physical adversarial patches against pedestrian detectors in infrastructure-based scenarios. We UV-map a boundary-aware quilted texture onto 3D garments, combine 2D digital attacks with 3D sparse- and continuous-frame rendering, and explicitly suppress person-specific semantic features while enforcing temporal continuity. A Feature Smooth Quilting strategy reduces visible patch boundaries and bounds cross-seam feature discontinuities. A serial-frame loss encourages long uninterrupted sequences of detection failures. In physical world experiments, AdvSerial achieves a 74.8% attack success rate on YOLO-v5 and degrades mean detection confidence from 84.30% to 39.38%. Experiments spanning eight detectors with different architectures demonstrate strong transferability. Notably, it achieves an $89.71%$ attack success rate on YOLO-v2 and resists both patch-detection defenses (NapGuard) and 3D-temporal perception (Sparse4D-v3). The results reveal persistent, temporally consistent failure modes under high-angle surveillance, and motivate the design of motion-aware and 3D-aware defenses for security-critical infrastructure deployments.
InsCAT is proposed, an instance-level contrastive adversarial training framework that prevents detectors from using adversarial texture as an independent decision cue, and consistent gains across separately trained detectors demonstrate applicability across architectures with direct inference.
Yuanhao Huang, Yi-Long Ren, Jinlei Wang et al.· arXiv.org· 0 citations
Visual language models (VLMs) have demonstrated outstanding performance in high-value domains such as autonomous driving, unmanned system navigation, and intelligent question-answering; however, the security of their cross-modal alignment mechanisms has not yet been fully verified. Existing visual adversarial patch attacks typically rely on continuous, dense pixel perturbations, which are easily detected and blocked by anomaly detection systems in practical engineering applications. This paper proposes a novel sparse adversarial patch attack algorithm (Sparse Patch Attack, SPA), which successfully misleads the text generation results of VLMs by generating highly dispersed discrete pixel perturbations in non-salient regions of the image. To achieve this, we introduce a differentiable L0-norm approximation and a cross-attention masking mechanism to minimize the number of modified pixels. Furthermore, addressing the characteristics of large-scale model open-ended text generation, we construct a multi-dimensional robustness evaluation framework covering semantic deviation, target achievement rate, and visual concealment. Preliminary experiments on mainstream visual-language models (such as LLaVA and BLIP-2) demonstrate that the SPA algorithm can achieve high success rates in targeted cross-modal attacks with an extremely low pixel modification rate (<1%). This study reveals a novel security vulnerability in visual-language models within complex real-world environments and provides a quantitative evaluation benchmark for future defense mechanisms in multimodal models.
T.-Y. Chen, X.-Y. Hu, J.-F. Wang et al.· Advanced Electromagnetics· 0 citations
AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.
Yuting Wu, Dongfang Guo, Xiangzhong Luo et al.· 0 citations
The increasing deployment of autonomous vehicles (AVs) in intelligent transportation systems necessitates perception models that are not only accurate but also robust and computationally efficient. Although Vision Transformers (ViTs) have shown strong performance in visual recognition tasks, their high computational complexity and vulnerability to adversarial perturbations limit their applicability in real-time and safety-critical autonomous driving scenarios. This paper presents a Lightweight Vision Transformer (L-ViT) framework for robust object detection in autonomous vehicles. The proposed approach integrates a lightweight transformer backbone with a deformable attention-based detection head and introduces a detection-aware Adversarial Consistency Regularization (ACR) strategy. Unlike conventional feature-level defenses, the proposed ACR enforces prediction consistency at the object query, classification, and bounding box regression levels, explicitly embedding robustness into the object detection pipeline. The proposed framework is evaluated on three widely used autonomous driving benchmarks, including KITTI, BDD100K, and Cityscapes. Experimental results demonstrate that the proposed L-ViT achieves competitive detection accuracy while maintaining real-time inference performance on edge devices. Under adversarial conditions, the proposed method significantly reduces performance degradation, exhibiting an accuracy drop of approximately 13\% under strong gradient-based attacks, compared to drops exceeding 25% for conventional detectors. These results indicate that the proposed L-ViT framework effectively balances detection accuracy, adversarial robustness, and computational efficiency. By integrating lightweight architectural design with robustness-aware training, this work provides a practical and deployable solution for secure perception in real-world autonomous driving systems.
Şükrü Okul· Gümüşhane Üniversitesi Fen B...· 0 citations
This research investigates the adversarial robustness of lane detection for Autonomous Vehicles (AVs) under challenging driving conditions using Generative Adversarial Networks (GANs). In this work, the term adversarial refers to the adversarial training mechanism of GANs and to robustness under naturally adverse driving conditions, particularly illumination variation, rather than to defence against deliberate pixel-level perturbation attacks such as FGSM or PGD. Lane detection is a crucial component for safe navigation, but it often fails under poor lighting or adverse weather. To solve this, a U-Net model is trained on the Berkeley DeepDrive (BDD100K) dataset as a baseline. Then, Conditional GAN (CGAN) is used with the Cityscapes dataset to learn the mapping between RGB images and lane masks, which improves structural consistency. To handle illumination changes, CycleGAN is used to simulate Day-to-Night and Night-to-Day translations using BDD100K datasets, creating a more diverse training set. Preprocessing involves resizing images to 512×512 to ensure training efficiency on limited GPU hardware. The experiments are conducted using TensorFlow in a GPU-accelerated environment. Results show that the U-Net + CycleGAN model achieves a Precision of 65.41% and an F1-Score of 63.79%, which outperforms previous studies. The CGAN model also shows high performance with 92.55% F1-Score. This research proves that using GANs for data augmentation and domain translation can enhance the adversarial robustness and reliability of lane detection systems in real-world scenarios.
Brian Lee Chong Ming, Thinesh Ganesan· International Conference on...· 0 citations
By leveraging data from video-based perception systems, intelligent transportation systems (ITS) support safety-critical applications that improve road safety. However, adversaries may manipulate video frames to compromise downstream perception modules, causing failures in safety-critical functions and increasing risks to vulnerable road users. This paper presents a novel attack model and an end-to-end framework for near-real-time targeted object removal attack on a video-based safety-critical system. The end-to-end attack pipeline consists of four stages: localizing targets in each frame, retrieving coherent patches from earlier frames, blending them using context-aware alpha compositing, and reconstructing attacked frames. Experiments at an intersection on the South Carolina Connected Vehicle Testbed (SC-CVT) show that reconstructed frames have high global similarity to the originals, with frame-level Peak Signal to Noise Ratio (PSNR) above 40 dB and Structural Similarity Index Measure (SSIM) above 0.996. Using the YOLO-based detector, the attack reduces object detections by up to 97.59% and achieves a frame-level attack success rate of 94.48%. Across the evaluated detectors and frame resolutions, the mean execution time ranges from 0.074 to 0.172 seconds per frame on GPU hardware, indicating near-real-time performance in testing. The forensic evaluation using several pretrained tamper-detection models shows limited ability to distinguish reconstructed from authentic frames. The findings suggest that video-based perception is vulnerable to stealthy object removal attacks that can degrade the performance of safety-critical applications by reducing object detectability. These findings can help develop mitigation strategies against adversarial object removal attacks that threaten safety-critical applications, such as vision-based pedestrian safety systems.
M. Hasan, M. Salek, Nathan Jones et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
