Physics-Based Adversarial Attack on Near-Infrared Human Detector for Nighttime Surveillance Camera Systems

TL;DR

This work reveals fundamental vulnerabilities in NIR-based surveillance AI arising from color and texture loss in the 850 nm range and the nearly co-located placement of LEDs and cameras. It proposes a fully passive attack that designs binary adversarial patterns in a digital space using 3D-aware rendering and then physically realizes them with tapes to manipulate local NIR intensity and fool a YOLO-based human detector, even under black-box constraints. The authors demonstrate both digital and physical attacks with high attack success rates and show the approach remains stealthy in real-world nighttime settings, underscoring significant reliability concerns for nighttime security deployments. The study suggests the need for defenses that address NIR-specific vulnerabilities and co-located illumination configurations to strengthen robustness in near-infrared surveillance systems.

Abstract

Many surveillance cameras switch between daytime and nighttime modes based on illuminance levels. During the day, the camera records ordinary RGB images through an enabled IR-cut filter. At night, the filter is disabled to capture near-infrared (NIR) light emitted from NIR LEDs typically mounted around the lens. While RGB-based AI algorithm vulnerabilities have been widely reported, the vulnerabilities of NIR-based AI have rarely been investigated. In this paper, we identify fundamental vulnerabilities in NIR-based image understanding caused by color and texture loss due to the intrinsic characteristics of clothes' reflectance and cameras' spectral sensitivity in the NIR range. We further show that the nearly co-located configuration of illuminants and cameras in existing surveillance systems facilitates concealing and fully passive attacks in the physical world. Specifically, we demonstrate how retro-reflective and insulation plastic tapes can manipulate the intensity distribution of NIR images. We showcase an attack on the YOLO-based human detector using binary patterns designed in the digital space (via black-box query and searching) and then physically realized using tapes pasted onto clothes. Our attack highlights significant reliability concerns for nighttime surveillance systems, which are intended to enhance security. Codes Available: https://github.com/MyNiuuu/AdvNIR

Figures (13)

• Figure 1: Illustration for color loss in NIR. Up: Camera Spectral Sensitivities of three different color cameras. Down: RGB images (a) and NIR images (b) for the same scene.
• Figure 2: Co-located setup of surveillance camera systems.
• Figure 3: Illustration for texture loss in NIR. (a) RGB images with IR-cut filter, (b) NIR images through $>$ 700nm long-pass filter, (c) NIR images through 850nm band-pass filter with a full width at half magnitude (FWHM) of 40nm, whose spectral response is very close to the spectral distribution of 850nm LEDs. All images are captured with the same trichromatic camera, with its IR-cut filter removed when needed (b,c). We can see that, although the clothes have rich color and texture in the visible range, they tend to disappear, especially in the narrow spectral range covered by 850nm LEDs.
• Figure 4: Analysis on texture loss in NIR. (a) RGB images, (b) 850nm NIR images. (c) 50 Spectral reflectance sampled from each scene. We can see that the spectral reflectances of different scene points tend to coincide around 850nm.
• Figure 5: Examples of color and texture loss in human clothes from public datasets wu2017rgb.