Transferable Physical-World Adversarial Patches Against Pedestrian Detection Models

2026-04-24

AI Summary

Existing physical-world adversarial patches struggle to effectively disrupt multi-stage pedestrian detection pipelines and exhibit insufficient robustness under complex physical conditions. To address these limitations, this work proposes TriPatch, a novel approach that simultaneously targets multiple stages of the detection process while enhancing robustness across diverse physical appearances, thereby significantly improving transferability and attack efficacy. TriPatch innovatively integrates a triplet loss formulation that jointly suppresses detection confidence, amplifies bounding box offsets, and interferes with non-maximum suppression (NMS), complemented by an appearance consistency constraint to improve environmental adaptability. Experimental results demonstrate that TriPatch achieves substantially higher attack success rates across various state-of-the-art pedestrian detectors, outperforming existing physical adversarial attack methods.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents
• Machine Learning: Adversarial Learning & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Agentic search
• Security and Privacy: Large-scale security measurements

Abstract

Physical adversarial patch attacks critically threaten pedestrian detection, causing surveillance and autonomous driving systems to miss pedestrians and creating severe safety risks. Despite their effectiveness in controlled settings, existing physical attacks face two major limitations in practice: they lack systematic disruption of the multi-stage decision pipeline, enabling residual modules to offset perturbations, and they fail to model complex physical variations, leading to poor robustness. To overcome these limitations, we propose a novel pedestrian adversarial patch generation method that combines multi-stage collaborative attacks with robustness enhancement under physical diversity, called TriPatch. Specifically, we design a triplet loss consisting of detection confidence suppression, bounding-box offset amplification, and non-maximum suppression (NMS) disruption, which jointly act across different stages of the detection pipeline. In addition, we introduce an appearance consistency loss to constrain the color distribution of the patch, thereby improving its adaptability under diverse imaging conditions, and incorporate data augmentation to further enhance robustness against complex physical perturbations. Extensive experiments demonstrate that TriPatch achieves a higher attack success rate across multiple detector models compared to existing approaches.

Problem

• adversarial patches
• pedestrian detection
• physical-world attacks
• multi-stage pipeline
• robustness

Innovation

• adversarial patch
• multi-stage attack
• physical-world robustness
• triplet loss
• pedestrian detection