Targeted Physical Evasion Attacks in the Near-Infrared Domain

2025-09-02

AI Summary

To address the weak targetability, laser-device dependency, and poor scene adaptability of existing near-infrared (NIR) physical adversarial attacks, this paper proposes a low-cost, highly stealthy targeted physical evasion attack. Specifically, digitally generated adversarial perturbations are projected onto a transparent film using a commercial NIR flashlight and then cast onto the target object. This is the first laser-free targeted NIR physical attack, enabling robust deployment across varying illumination conditions, distances, and viewing angles. Additionally, we design a semantic segmentation–based detection mechanism capable of effectively identifying such attacks. Experimental evaluation on traffic sign recognition demonstrates that our method achieves significantly higher attack success rates than state-of-the-art approaches, with a deployment cost under $50 and an attack latency of only tens of seconds. The proposed framework thus offers strong practicality and scalability for real-world NIR vision systems.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Ad search and search for Web retail
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

A number of attacks rely on infrared light sources or heat-absorbing material to imperceptibly fool systems into misinterpreting visual input in various image recognition applications. However, almost all existing approaches can only mount untargeted attacks and require heavy optimizations due to the use-case-specific constraints, such as location and shape. In this paper, we propose a novel, stealthy, and cost-effective attack to generate both targeted and untargeted adversarial infrared perturbations. By projecting perturbations from a transparent film onto the target object with an off-the-shelf infrared flashlight, our approach is the first to reliably mount laser-free targeted attacks in the infrared domain. Extensive experiments on traffic signs in the digital and physical domains show that our approach is robust and yields higher attack success rates in various attack scenarios across bright lighting conditions, distances, and angles compared to prior work. Equally important, our attack is highly cost-effective, requiring less than US$50 and a few tens of seconds for deployment. Finally, we propose a novel segmentation-based detection that thwarts our attack with an F1-score of up to 99%.

Problem

• Generating targeted adversarial infrared perturbations for evasion attacks
• Mounting laser-free targeted attacks using infrared flashlight projection
• Achieving cost-effective physical evasion in various lighting conditions

Innovation

• Infrared film projection for targeted attacks
• Laser-free perturbation with off-the-shelf flashlight
• Cost-effective deployment under $50 in seconds