Infrared Adversarial Car Stickers

TL;DR

This work addresses the security of infrared perception in autonomous driving by constructing physical infrared adversarial stickers that render real cars invisible to detectors. It introduces a 3D mesh shadow (MSA) approach built on a 3D infrared car model, with a 3D control-point smoothing scheme and differentiable rendering to generate manufacturable 2D patterns that are pasted onto car textures via aluminum stickers. The method achieves high attack effectiveness, with up to 91.49%–96.31% ASR against Faster RCNN and strong transferability to unseen detectors such as RetinaNet and Deformable DETR, demonstrated on real cars, model cars, and diverse viewing angles and distances. These results highlight significant safety implications for infrared-based autonomous systems and provide a scalable framework for evaluating physical infrared attacks. Overall, the study advances the understanding of infrared adversarial robustness and offers a practical pipeline for real-world testing of infrared detectors.

Abstract

Infrared physical adversarial examples are of great significance for studying the security of infrared AI systems that are widely used in our lives such as autonomous driving. Previous infrared physical attacks mainly focused on 2D infrared pedestrian detection which may not fully manifest its destructiveness to AI systems. In this work, we propose a physical attack method against infrared detectors based on 3D modeling, which is applied to a real car. The goal is to design a set of infrared adversarial stickers to make cars invisible to infrared detectors at various viewing angles, distances, and scenes. We build a 3D infrared car model with real infrared characteristics and propose an infrared adversarial pattern generation method based on 3D mesh shadow. We propose a 3D control points-based mesh smoothing algorithm and use a set of smoothness loss functions to enhance the smoothness of adversarial meshes and facilitate the sticker implementation. Besides, We designed the aluminum stickers and conducted physical experiments on two real Mercedes-Benz A200L cars. Our adversarial stickers hid the cars from Faster RCNN, an object detector, at various viewing angles, distances, and scenes. The attack success rate (ASR) was 91.49% for real cars. In comparison, the ASRs of random stickers and no sticker were only 6.21% and 0.66%, respectively. In addition, the ASRs of the designed stickers against six unseen object detectors such as YOLOv3 and Deformable DETR were between 73.35%-95.80%, showing good transferability of the attack performance across detectors.

Figures (8)

• Figure 1: Infrared attack effect on real cars. (a) Visible light view of real cars. (b) Infrared view of real cars. C: clean car. R: car with random shape stickers. A: car with adversarial stickers. The numbers above the bounding boxes are object confidence scores (%) with 0.6 threshold. Our adversarial stickers hid the car from Faster RCNN at various viewing angles, distances and scenes. In comparison, the clean car and the car with random shape stickers were detected at the same situation.
• Figure 2: Construction and optimization of real infrared car texture mapping. (a) Car mesh model. (b) Reorganized faces map. (c) Infrared car texture map collected from real world. (d) Rendered infrared car model.
• Figure 3: Schematic diagram of mesh shadow method.
• Figure 4: The overall pipeline of the proposed method.
• Figure 5: Examples of detection results of different detectors for target cars with different textures. The numbers above the red bounding boxes are the object confidence scores, with a threshold of 0.6. The results of other detectors are shown in SM.