3D Invisible Cloak

TL;DR

This work introduces a 3D invisible cloak that enables a wearer to evade real-world person detectors by printing adversarial patches on clothing and optimizing under 3D transformations (Radian, Wrinkle, Angle, Occlusion). The method integrates a detector-targeted loss with TV and printability penalties and employs a dual R/U transformation framework to produce robust patches that remain effective under varied poses, angles, and occlusions. Key contributions include 3D-aware patch generation, exploration of optimal input images (notably an orange teddy-bear pattern) for maximum attack success, the pursuit of disappeared cloaks that avoid all object labels, and a comprehensive evaluation framework spanning digital and physical domains with static and dynamic tests. Experimental results show high efficacy, with digital attack rate 86.56% and physical-world static/dynamic rates up to 100% and 77%, respectively, highlighting vulnerabilities in leading detectors and underscoring the need for robust defense strategies.

Abstract

In this paper, we propose a novel physical stealth attack against the person detectors in real world. The proposed method generates an adversarial patch, and prints it on real clothes to make a three dimensional (3D) invisible cloak. Anyone wearing the cloak can evade the detection of person detectors and achieve stealth. We consider the impacts of those 3D physical constraints (i.e., radian, wrinkle, occlusion, angle, etc.) on person stealth attacks, and propose 3D transformations to generate 3D invisible cloak. We launch the person stealth attacks in 3D physical space instead of 2D plane by printing the adversarial patches on real clothes under challenging and complex 3D physical scenarios. The conventional and 3D transformations are performed on the patch during its optimization process. Further, we study how to generate the optimal 3D invisible cloak. Specifically, we explore how to choose input images with specific shapes and colors to generate the optimal 3D invisible cloak. Besides, after successfully making the object detector misjudge the person as other objects, we explore how to make a person completely disappeared, i.e., the person will not be detected as any objects. Finally, we present a systematic evaluation framework to methodically evaluate the performance of the proposed attack in digital domain and physical world. Experimental results in various indoor and outdoor physical scenarios show that, the proposed person stealth attack method is robust and effective even under those complex and challenging physical conditions, such as the cloak is wrinkled, obscured, curved, and from different angles. The attack success rate in digital domain (Inria data set) is 86.56%, while the static and dynamic stealth attack performance in physical world is 100% and 77%, respectively, which are significantly better than existing works.

Figures (16)

• Figure 1: Overall procedure of the proposed person stealth attack.
• Figure 2: The proposed evaluation framework for person stealth attacks.
• Figure 3: The original image and its generated Conventional-patch.
• Figure 4: Some stealth attack results on Inria test images using the original teddy bear image and its generated adversarial patch.
• Figure 5: Six adversarial patches with different physical transformations for physical stealth attacks.