One Patch to Rule Them All: Transforming Static Patches into Dynamic Attacks in the Physical World

2025-06-10

AI Summary

Existing physical adversarial patches (PAPs) support only a single fixed attack target, limiting adaptability in dynamic scenarios—e.g., rapidly changing traffic objects in autonomous driving. This paper proposes SwitchPatch: a static physical patch that enables real-time, imperceptible switching of attack targets via external colored light signals—without retraining, regenerating, or redeploying the patch. Methodologically, it integrates color-projected optical triggering, controllable occlusion modeling, physics-aware simulation, and outdoor unmanned ground vehicle (UGV) validation. It is the first to achieve multi-target, dynamically controllable adversarial attacks with a single static patch, while ensuring conditional stealth: the patch behaves benignly in the absence of activation signals. Evaluated across classification, object detection, and depth estimation tasks, SwitchPatch maintains high attack success rates and strong robustness under varying illumination, viewing angles, and distances.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Security and Privacy: Large-scale security measurements

Abstract

Numerous methods have been proposed to generate physical adversarial patches (PAPs) against real-world machine learning systems. However, each existing PAP typically supports only a single, fixed attack goal, and switching to a different objective requires re-generating and re-deploying a new PAP. This rigidity limits their practicality in dynamic environments like autonomous driving, where traffic conditions and attack goals can change rapidly. For example, if no obstacles are present around the target vehicle, the attack may fail to cause meaningful consequences. To overcome this limitation, we propose SwitchPatch, a novel PAP that is static yet enables dynamic and controllable attack outcomes based on real-time scenarios. Attackers can alter pre-defined conditions, e.g., by projecting different natural-color lights onto SwitchPatch to seamlessly switch between attack goals. Unlike prior work, SwitchPatch does not require re-generation or re-deployment for different objectives, significantly reducing cost and complexity. Furthermore, SwitchPatch remains benign when the enabling conditions are absent, enhancing its stealth. We evaluate SwitchPatch on two key tasks: traffic sign recognition (classification and detection) and depth estimation. First, we conduct theoretical analysis and empirical studies to demonstrate the feasibility of SwitchPatch and explore how many goals it can support using techniques like color light projection and occlusion. Second, we perform simulation-based experiments and ablation studies to verify its effectiveness and transferability. Third, we conduct outdoor tests using a Unmanned Ground Vehicle (UGV) to confirm its robustness in the physical world. Overall, SwitchPatch introduces a flexible and practical adversarial strategy that can be adapted to diverse tasks and real-world conditions.

Problem

• Overcoming single fixed attack goal limitation in adversarial patches
• Enabling dynamic attack outcomes without patch regeneration
• Enhancing stealth and adaptability in real-world scenarios

Innovation

• Dynamic adversarial patch with real-time control
• Light projection enables attack goal switching
• No regeneration needed for different objectives