Multi-View Black-Box Physical Attacks on Infrared Pedestrian Detectors Using Adversarial Infrared Grid

TL;DR

The paper addresses the vulnerability of infrared pedestrian detectors to physical adversarial perturbations and the lack of effective multi-view, black-box attacks. It introduces AdvGrid, which embeds a grid of perturbations inside clothing and optimizes it with a genetic algorithm, with robustness boosted by the $EOT$ and $TPS$ frameworks. Empirical results show digital ASR of $80.0\%$ and physical ASR of $91.86\%$, with substantial transferability across detectors and favorable stealth compared with baselines. These findings reveal practical security risks in infrared detection systems and motivate the development of robust defenses and cross-modal protections.

Abstract

While extensive research exists on physical adversarial attacks within the visible spectrum, studies on such techniques in the infrared spectrum are limited. Infrared object detectors are vital in modern technological applications but are susceptible to adversarial attacks, posing significant security threats. Previous studies using physical perturbations like light bulb arrays and aerogels for white-box attacks, or hot and cold patches for black-box attacks, have proven impractical or limited in multi-view support. To address these issues, we propose the Adversarial Infrared Grid (AdvGrid), which models perturbations in a grid format and uses a genetic algorithm for black-box optimization. These perturbations are cyclically applied to various parts of a pedestrian's clothing to facilitate multi-view black-box physical attacks on infrared pedestrian detectors. Extensive experiments validate AdvGrid's effectiveness, stealthiness, and robustness. The method achieves attack success rates of 80.00\% in digital environments and 91.86\% in physical environments, outperforming baseline methods. Additionally, the average attack success rate exceeds 50\% against mainstream detectors, demonstrating AdvGrid's robustness. Our analyses include ablation studies, transfer attacks, and adversarial defenses, confirming the method's superiority.

Figures (8)

• Figure 1: Existing infrared physical adversarial attack methods vs. proposed method.
• Figure 2: AdvGrid's adversarial attack framework. The AdvGrid attack encompasses a multifaceted process primarily conducted within the digital domain, involving stages such as simulation, optimization, and robustness enhancement. Subsequently, in the physical domain, the attack strategy involves fabricating infrared suits augmented with cold patches to serve as disruptive elements. These suits are then utilized to execute the attack, leveraging the physical manifestation of perturbations to undermine targeted systems.
• Figure 3: Infrared grid simulation modeling diagram
• Figure 4: Experimental devices. (a) Tripod, cold patch, and infrared camera. (b) Visible spectrum image of the outer surface of the clothing. (c) Visible spectrum image of the inner surface of the clothing. (d) Infrared image of the clothing. (e) Infrared image of a pedestrian. (f) Visible spectrum image of a pedestrian.
• Figure 5: Digital samples generated by AdvGrid.