RFA-Tex: Range-Flexible Adaptive Physical Adversarial Texture Against Real-World Person Detectors

Abstract

Adversarial attacks have attracted growing research interest as they transition from the digital domain to the real world. Among these, adversarial textures that conceal the human body from various person detectors have drawn significant research attention. Yet existing methods can only launch attacks at close range (within 5 m); once the distance increases to common imaging and surveillance distances (over 15 m), these methods become ineffective. We identify that this limitation stems from the numerous fragile fine-grained structures in the textures, which are prone to deterioration during long-range imaging, leading to the loss of adversarial effectiveness. Modifying these fragile structures requires fine-grained adjustments to the textures, but the existing texture generation frameworks fail to support such adjustments. To address this issue, we propose a Range-Flexible Adaptive Physical Adversarial Texture, named RFA-Tex. We first design a detail-preserving texture generation framework that decouples the environmental adaptability from the adversarial effectiveness and optimizes them separately. We further develop a novel deterioration function to suppress the fragile structures in textures, which significantly improves their adaptability to long-range imaging. Moreover, we conduct a theoretical analysis to illustrate that RFA-Tex better supports fine-grained texture adjustments than prior works. Experimental results in digital and physical domains demonstrate that RFA-Tex significantly extends the adversarial attack range to 25–45 m in various real-world scenarios, while exhibiting strong generalization and robustness.