面向目标检测的物理对抗攻击研究进展

doi:10.3778/j.issn.1002-8331.2410-0315

摘要/Abstract

摘要： 深度神经网络强大的特征学习能力为计算机视觉任务提供了强有力的支撑，但已被证明容易受到对抗性样本的干扰从而输出错误的结果。现有的对抗攻击可分为数字攻击和物理攻击，与在数字像素中产生扰动的数字攻击相比，物理对抗性样本在现实世界中产生的误导作用更具有威胁性。目标检测任务作为计算机视觉领域中应用最广泛的任务之一，在自动驾驶、智能监控以及医学图像分析等领域发挥重要作用。针对目标检测任务的物理攻击，阐述了攻击的基本流程。根据不同电磁波波段将目标检测任务分为可见光目标检测和红外目标检测，并详细讨论了这两类任务中不同的物理攻击方法。探讨了当前物理对抗性攻击面临的问题以及未来可能值得研究的方向。

关键词: 深度学习, 物理攻击, 目标检测

Abstract: Deep neural networks demonstrate strong feature learning capabilities that support computer vision tasks but they are vulnerable to adversarial examples, leading to erroneous outputs. Adversarial attacks are classified into digital attacks and physical attacks, with physical adversarial samples posing a greater threat in the real world compared to digital attacks that perturb pixel values. Object detection, one of the most widely used tasks in computer vision, plays a crucial role in applications such as autonomous driving, intelligent surveillance, and medical image analysis. The process of physical attacks on object detection tasks is first outlined. Object detection is then categorized into visible light detection and infrared detection based on different electromagnetic wave bands, with a discussion of various physical attack methods for each task. Finally, challenges faced by current physical adversarial attacks are examined.

Key words: deep learning, physical attack, target detection

陈浞, 刘东青, 唐平华, 黄燕, 张文霞, 贾岩, 程海峰. 面向目标检测的物理对抗攻击研究进展[J]. 计算机工程与应用, 2025, 61(9): 80-101.

CHEN Zhuo, LIU Dongqing, TANG Pinghua, HUANG Yan, ZHANG Wenxia, JIA Yan, CHENG Haifeng. Research Progress on Physical Adversarial Attacks for Target Detection[J]. Computer Engineering and Applications, 2025, 61(9): 80-101.

参考文献

[1] SIMONYAN K, ZISSERMAN A. Very deep convolutional networks for large-scale image recognition[J]. arXiv:1409.1556, 2014.
[2] CARION N, MASSA F, SYNNAEVE G, et al. End-to-end object detection with Transformers[J]. arXiv:2005.12872, 2020.
[3] SIAM M, GAMAL M, ABDEL-RAZEK M, et al. A comparative study of real-time semantic segmentation for autonomous driving[C]//Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), Salt Lake City, UT, USA, 2018.
[4] REN S, HE K, GIRSHICK R, et al. Faster R-CNN: towards real-time object detection with region proposal networks[J]. arXiv:1506.01497, 2015.
[5] HE K, GKIOXARI G, DOLLáR P, et al. Mask R-CNN[J]. arXiv:1703.06870, 2017.
[6] REDMON J, DIVVALA S, GIRSHICK R, et al. You only look once: unified, real-time object detection[J]. arXiv:1506.02640, 2015.
[7] REDMON J, FARHADI A. YOLO9000: better, faster, stronger[C]//Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, 2017: 6517-6525.
[8] REDMON J, FARHADI A. YOLOv3: an incremental improvement[J]. arXiv:1804.02767, 2018.
[9] ADARSH P, RATHI P, KUMAR M. YOLO v3-Tiny: object detection and recognition using one stage improved model[C]//Proceedings of the 2020 6th International Conference on Advanced Computing and Communication Systems (ICACCS), Coimbatore, India, 2020: 687-694.
[10] WANG C Y, BOCHKOVSKIY A, LIAO H Y M. YOLOv7: trainable bag-of-freebies sets new state-of-the-art for real-time object detectors[C]//Proceedings of the 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Vancouver, BC, Canada, 2023: 7464-7475.
[11] JIANG Z, ZHAO L, LI S, et al. Real-time object detection method based on improved YOLOv4-tiny[J]. arXiv:2011.04244, 2020.
[12] LIU W, ANGUELOV D, ERHAN D, et al. SSD: single shot multibox detector[J]. arXiv:1512.02325, 2015.
[13] LIN T Y, GOYAL P, GIRSHICK R, et al. Focal loss for dense object detection[J]. arXiv:1708.02002, 2017.
[14] DUAN K, BAI S, XIE L, et al. CenterNet++ for object detection[J]. arXiv:2204.08394,2022.
[15] TIAN Z, SHEN C, CHEN H, et al. FCOS: a simple and strong anchor-free object detector[J]. arXiv:2006.09214, 2020.
[16] LIU Z, LIN Y, CAO Y, et al. Swin Transformer: hierarchical vision transformer using shifted windows[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada, 2021: 9992-10002.
[17] XU Y, ZHANG Q, ZHANG J, et al. ViTAE: vision transformer advanced by exploring intrinsic inductive bias[J]. arXiv:2106.03348, 2021.
[18] BAO H B, DONG L, PIAO S H, et al. BEiT: BERT pre-training of image transformers[J]. arXiv:2106.08254, 2021.
[19] BADUE C, GUIDOLINI R, CARNEIRO R V, et al. Self-driving cars: a survey[J]. arXiv:1901.04407, 2019.
[20] ARANI E, GOWDA S, MUKHERJEE R, et al. A comprehensive study of real-time object detection networks across multiple domains: a survey[J]. arXiv:2208.10895, 2022.
[21] SZEGEDY C, ZAREMBA W, SUTSKEVER I, et al. Intriguing properties of neural networks[J]. arXiv:1312.6199, 2013.
[22] KURAKIN A, GOODFELLOW I, BENGIO S. Adversarial examples in the physical world[J]. arXiv:1607.02533, 2016.
[23] LU J, SIBAI H, FABRY E. Adversarial examples that fool detectors[J]. arXiv:1712.02494, 2017.
[24] ZHANG Y, FOROOSH H, DAVID P, et al. CAMOU: learning physical vehicle camouflages to adversarially attack detectors in the wild[C]//Proceedings of the International Conference on Learning Representations, 2018.
[25] WANG Z, ZHENG S, SONG M, et al. advPattern: physical-world attacks on deep person re-identification via adversarially Transformable patterns[J]. arXiv:1908.09327, 2019.
[26] WEI H, WANG Z, JIA X, et al. HOTCOLD block: fooling thermal infrared detectors with a novel wearable design[J]. arXiv:2212.05709, 2022.
[27] HU C, SHI W, JIANG T, et al. Adversarial infrared blocks: a multi-view black-box attack to thermal infrared detectors in physical world[J]. arXiv:2304.10712, 2023.
[28] WANG D, LI C, WEN S, et al. Daedalus: breaking non-maximum suppression in object detection via adversarial examples[J]. arXiv:1902.02067, 2019.
[29] ATHALYE A, ENGSTROM L, ILYAS A, et al. Synthesizing robust adversarial examples[J]. arXiv:1707.07397, 2017.
[30] YANG D Y, XIONG J, LI X, et al. Building towards “invisible cloak”: robust physical adversarial attack on YOLO object detector[C]//Proceedings of the 2018 9th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), New York City, NY, USA, 2018: 368-374.
[31] TILIWALIDI K. Adversarial infrared geometry: using geometry to perform adversarial attack against infrared pedestrian detectors[J]. arXiv:2403.03674, 2024.
[32] ZHU X, HU Z, HUANG S, et al. Infrared invisible clothing: hiding from infrared detectors at multiple angles in real world[C]//Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), New Orleans, LA, USA, 2022: 13307-13316.
[33] DUAN Y, CHEN J, ZHOU X, et al. Learning coated adversarial camouflages for object detectors[J]. arXiv:2109.00124, 2021.
[34] SURYANTO N, KIM Y, KANG H, et al. DTA: physical camouflage attacks using differentiable transformation network[J]. arXiv:2203.09831, 2022.
[35] SURYANTO N, KIM Y, LARASATI H T, et al. ACTIVE: towards highly transferable 3D physical camouflage for universal and robust vehicle evasion[J]. arXiv:2308.07009, 2023.
[36] HU Z, CHU W, ZHU X, et al. Physically realizable natural-looking clothing textures evade person detectors via 3D modeling[J]. arXiv:2307.01778, 2023.
[37] ZOLFI A, KRAVCHIK M, ELOVICI Y, et al. The translucent patch: a physical and universal attack on object detectors[J]. arXiv:2012.12528, 2020.
[38] ZHANG Y C, ZHANG Y, QI J, et al. Adversarial patch attack on multi-scale object detection for UAV remote sensing images[J]. Remote Sensing, 2022, 14(21): 5298.
[39] LIAN J, MEI S, ZHANG S, et al. Benchmarking adversarial patch against aerial detection[J]. IEEE Transactions on Geoscience and Remote Sensing, 2022, 60: 1-16.
[40] XU K, ZHANG G, LIU S, et al. Adversarial T-shirt! evading person detectors in a physical world[J]. arXiv:1910.11099, 2019.
[41] GUESMI A, DING R, HANIF M A, et al. DAP: a dynamic adversarial patch for evading person detectors[J]. arXiv:2305.11618, 2023.
[42] JAN S T K, MESSOU J, LIN Y C, et al. Connecting the digital and physical world: improving the robustness of adversarial attacks[C]//Proceedings of the AAAI Conference on Artificial Intelligence, 2019: 962-969.
[43] MAHENDRAN A, VEDALDI A. Understanding deep image representations by inverting them[C]//Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Boston, MA, USA, 2015: 5188-5196.
[44] JIA W, LU Z, ZHANG H, et al. Fooling the eyes of autonomous vehicles: robust physical adversarial examples against traffic sign recognition systems[J]. arXiv:2201.06192, 2022.
[45] HU Y C T, CHEN J C, KUNG B H, et al. Naturalistic physical adversarial patch for object detectors[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada, 2021: 7828-7837.
[46] HOORY S, SHAPIRA T, SHABTAI A, et al. Dynamic adversarial patch for evading object detection models[J]. arXiv:2010.13070, 2020.
[47] LI Y, ZHANG B, ZHAO G, et al. InvisibiliTee: angle-agnostic cloaking from person-tracking systems with a tee[J]. arXiv:2208.06962, 2022.
[48] WU T, NING X, LI W, et al. Physical adversarial attack on vehicle detector in the carla simulator[J]. arXiv:2007.16118, 2020.
[49] LOVISOTTO G, TURNER H, SLUGANOVIC I, et al. SLAP: improving physical adversarial examples with short-lived adversarial perturbations[J]. arXiv:2007.04137, 2020.
[50] EYKHOLT K, EVTIMOV I, FERNANDES E, et al. Robust physical-world attacks on deep learning models[J]. arXiv:1707.08945, 2017.
[51] EYKHOLT K, EVTIMOV I, FERNANDES E, et al. Physical adversarial examples for object detectors[J]. arXiv:1807.07769, 2018.
[52] CHEN S T, CORNELIUS C, MARTIN J, et al. ShapeShifter: robust physical adversarial attack on Faster R-CNN object detector[J]. arXiv:1804.05810, 2018.
[53] ZHAO Y, ZHU H, LIANG R, et al. Seeing isn’t believing: towards more robust adversarial attack against real world object detectors[C]//Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019: 1989-2004.
[54] XUE M, YUAN C, HE C, et al. NaturalAE: natural and robust physical adversarial examples for object detectors[J]. Journal of Information Security and Applications, 2021, 57: 102694.
[55] WEI X, GUO Y, YU J. Adversarial sticker: a stealthy attack method in the physical world[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023,45(3): 2711-2725.
[56] ZHU W, JI X, CHENG Y, et al. TPatch: a triggered physical adversarial patch[C]//Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), 2023: 661-678.
[57] WANG N, LUO Y, SATO T, et al. Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack[J]. arXiv:2308.11894, 2023.
[58] LIN T, YU L, JIN G, et al. Out-of-bounding-box triggers: a stealthy approach to cheat object detectors[J]. arXiv:2410. 10091, 2024.
[59] LIN T Y, MAIRE M, BELONGIE S, et al. Microsoft COCO: common objects in context[C]//Proceedings of the European Conference on Computer Vision(ECCV 2014), 2014: 740-755.
[60] ZHU Z, LIANG D, ZHANG S, et al. Traffic-sign detection and classification in the wild[C]//Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA, 2016: 2110-2118.
[61] THYS S, VAN RANST W, GOEDEMé T. Fooling automated surveillance cameras: adversarial patches to attack person detection[J]. arXiv:1904.08653, 2019.
[62] HUANG H, CHEN Z, CHEN H, et al. T-SEA: transfer-based self-ensemble attack on object detection[J]. arXiv:2211.09773, 2022.
[63] BAYER J, BECKER S, MüNCH D, et al. Eigenpatche-adversarial patches from principal components[J]. arXiv:2306.10963, 2023.
[64] TAN W, LI Y, ZHAO C, et al. DOEPatch: dynamically optimized ensemble model for adversarial patches generation[J]. arXiv:2312.16907, 2023.
[65] ZHANG H, MA X. Misleading attention and classification: an adversarial attack to fool object detection models in the real world[J]. Computers & Security, 2022, 122: 102876.
[66] GUESMI A, BILASCO I M, SHAFIQUE M, et al. AdvART: adversarial art for camouflaged object detection attacks[J]. arXiv:2303.01734, 2023.
[67] ZHOU Z, ZHAO H, LIU J, et al. MVPatch: more vivid patch for adversarial camouflaged attacks on object detectors in the physical world[J]. arXiv:2312.17431, 2023.
[68] LAPID R, MIZRAHI E, SIPPER M. Patch of invisibility: naturalistic physical black-box adversarial attacks on object detectors[J]. arXiv:2303.04238, 2023.
[69] QIN Y, ZHANG K, PAN H. Adversarial attack for object detectors under complex conditions[J]. Computers & Security, 2023, 134: 103460.
[70] CHEN X, LIU F, JIANG D, et al. Natural adversarial patch generation method based on latent diffusion model[J]. arXiv:2312.16401, 2023.
[71] LEE M, KOLTER Z. On physical adversarial patches for object detection[J]. arXiv:1906.11897, 2019.
[72] DALAL N, TRIGGS B. Histograms of oriented gradients for human detection[C]//Proceedings of the 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05), San Diego, CA, USA, 2005: 886-893.
[73] CHENG J, ZHANG Y, WANG Z, et al. DePatch: towards robust adversarial patch for evading person detectors in the real world[J]. arXiv:2408.06625, 2024.
[74] EVERINGHAM M, VAN GOOL L, WILLIAMS C K I, et al. The pascal visual object classes (VOC) challenge[J]. International Journal of Computer Vision, 2010, 88(2): 303-338.
[75] RUSSAKOVSKY O, DENG J, SU H, et al. ImageNet large scale visual recognition challenge[J]. International Journal of Computer Vision, 2015, 115(3): 211-252.
[76] ANDRILUKA M, PISHCHULIN L, GEHLER P, et al. 2D human pose estimation: new benchmark and state of the art analysis[C]//Proceedings of the 2014 IEEE Conference on Computer Vision and Pattern Recognition, Columbus, OH, USA, 2014: 3686-3693.
[77] DU A, CHEN B, CHIN T J, et al. Physical adversarial attacks on an aerial imagery object detector[C]//Proceedings of the 2022 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), Waikoloa, HI, USA, 2022: 3798-3808.
[78] CUI J, GUO W, HUANG H, et al. Adversarial examples for vehicle detection with projection transformation[J]. IEEE Transactions on Geoscience and Remote Sensing, 2024, 62: 1-18.
[79] SUN C, SUN J, ZHANG X, et al. Physical strip attack for object detection in optical remote sensing[J]. IEEE Transactions on Geoscience and Remote Sensing, 2024, 62: 1-11.
[80] KONG D, LIANG S, REN W. Environmental matching attack against unmanned aerial vehicles object detection[J]. arXiv:2405.07595, 2024.
[81] MUNDHENK T N, KONJEVOD G, SAKLA W A, et al. A large contextual dataset for classification, detection and counting of cars with deep learning[C]//Proceedings of the European Conference on Computer Vision(ECCV 2016), 2016: 785-800.
[82] ZHU P, WEN L, DU D, et al. Detection and tracking meet drones challenge[J]. arXiv:2001.06303, 2020.
[83] XIE X, CHENG G, WANG J, et al. Oriented R-CNN for object detection[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision(ICCV), Montreal, QC, Canada, 2021: 3500-3509.
[84] XIA G S, BAI X, DING J, et al. DOTA: a large-scale dataset for object detection in aerial images[C]//Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, 2018: 3974-3983.
[85] CHENG G, ZHOU P, HAN J. Learning rotation-invariant convolutional neural networks for object detection in vhr optical remote sensing images[J]. IEEE Transactions on Geoscience and Remote Sensing, 2016, 54(12): 7405-7415.
[86] HOUBEN S, STALLKAMP J, SALMEN J, et al. Detection of traffic signs in real-world images: the German traffic sign detection benchmark[C]//Proceedings of the 2013 International Joint Conference on Neural Networks (IJCNN), Dallas, TX, USA, 2013: 1-8.
[87] HSIEH M R, LIN Y L, HSU W H. Drone-based object counting by spatially regularized regional proposal network[C]//Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV), Venice, 2017: 4165-4173.
[88] DEN HOLLANDER R, ADHIKARI A, TOLIOS I, et al. Adversarial patch camouflage against aerial detection[C]//Proceedings of the Conference on Artificial Intelligence and Machine Learning in Defense Applications, United Kingdom, 2020: 11.
[89] WISE C, PLESTED J. Developing imperceptible adversarial patches to camouflage military assets from computer vision enabled technologies[J]. arXiv:2202.08892, 2022.
[90] LIAN J, WANG X, SU Y, et al. CBA: contextual background attack against optical aerial detection in the physical world[J]. IEEE Transactions on Geoscience and Remote Sensing, 2023, 61: 1-16.
[91] TANG G, YAO W, JIANG T, et al. Adversarial patch-based false positive creation attacks against aerial imagery object detectors[J]. Neurocomputing, 2024, 579: 127431.
[92] WANG X, MEI S, LIAN J, et al. Fooling aerial detectors by background attack via dual-adversarial-induced error identification[J]. IEEE Transactions on Geoscience and Remote Sensing, 2024, 62: 5618416.
[93] CHEN J, ZHANG Y, LIU C, et al. Digital-to-physical visual consistency optimization for adversarial patch generation in remote sensing scenes[J]. IEEE Transactions on Geoscience and Remote Sensing, 2024, 62: 5623017.
[94] LONG Y, GONG Y, XIAO Z, et al. Accurate object localization in remote sensing images based on convolutional neural networks[J]. IEEE Transactions on Geoscience and Remote Sensing, 2017, 55(5): 2486-2498.
[95] TARCHOUN B, ALAM Q M, ABU-GHAZALEH N, et al. Fool the hydra: adversarial attacks against multi-view object detection systems[J]. arXiv:2312.00173, 2023.
[96] HUANG L, GAO C, ZHOU Y, et al. Universal physical camouflage attacks on object detectors[J]. arXiv:1909.04326, 2019.
[97] WU Z, LIM S N, DAVIS L, et al. Making an invisibility cloak: real world adversarial attacks on object detectors[J]. arXiv:1910.14667, 2019.
[98] HU Z, HUANG S, ZHU X, et al. Adversarial texture for fooling person detectors in the physical world[J]. arXiv:2203.03373, 2022.
[99] GE Y, ZHANG R, WANG X, et al. DeepFashion2: a versatile benchmark for detection, pose estimation, segmentation and re-identification of clothing images[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Long Beach, CA, USA, 2019: 5332-5340.
[100] WU T, NING X, LI W, et al. Physical adversarial attack on vehicle detector in the carla simulator[J]. arXiv:2007. 16118, 2020.
[101] OH S Y, YANG H. Simulation of physical adversarial attacks on vehicle detection models[C]//Proceedings of the 2023 23rd International Conference on Control, Automation and Systems (ICCAS), Yeosu, Korea, 2023: 1395-1400.
[102] WANG J, LIU A, YIN Z, et al. Dual attention suppression attack: generate adversarial camouflage in physical world[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA, 2021: 8561-8570.
[103] WANG D, JIANG T, SUN J, et al. FCA: learning a 3D full-coverage vehicle camouflage for multi-view physical adversarial attack[C]//Proceedings of the AAAI Conference on Artificial Intelligence, 2022: 2414-2422.
[104] ZHANG Y, GONG Z, ZHANG Y, et al. Boosting transferability of physical attack against detectors by redistributing separable attention[J]. Pattern Recognition, 2023, 138: 109435.
[105] ZHOU J, LYU L, HE D, et al. RAUCA: a novel physical adversarial attack on vehicle detectors via robust and accurate camouflage generation[J]. arXiv:2402.15853, 2024.
[106] LI Y, TAN W, ZHAO C, et al. Flexible physical camouflage generation based on a differential approach[J]. arXiv:2402.13575, 2024.
[107] LYU L, ZHOU J, HE D, et al. CNCA: toward customizable and natural generation of adversarial camouflage for vehicle detectors[J]. arXiv:2409.17963, 2024.
[108] YUAN S, LI H, HAN X, et al. ITPatch: an invisible and triggered physical adversarial patch against traffic sign recognition[J]. arXiv:2409.12394, 2024.
[109] WEN H, CHANG S, ZHOU L. Light projection-based physical-world vanishing attack against car detection[C]//Proceedings of the 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 2023), Rhodes Island, Greece, 2023: 1-5.
[110] SHAPIRA A, BITTON R, AVRAHAM D, et al. Attacking object detector using a universal targeted label-switch patch[J]. arXiv:2211.08859, 2022.
[111] CHAHE A, WANG C, JEYAPRATAP A, et al. Dynamic adversarial attacks on autonomous driving systems[J]. arXiv:2312.06701, 2023.
[112] WEI X, HUANG Y, SUN Y, et al. Unified adversarial patch for visible-infrared cross-modal attacks in the physical world[J]. arXiv:2307.14682, 2023.
[113] HU C, SHI W. Adversarial infrared curves: an attack on infrared pedestrian detectors in the physical world[J]. arXiv:2312.14217, 2023.
[114] TILIWALIDI K, HU C, SHI W. Multi-view black-box physical attacks on infrared pedestrian detectors using adversarial infrared grid[J]. arXiv:2407.01168, 2024.
[115] HU C, SHI W. Two-stage optimized unified adversarial patch for attacking visible-infrared cross-modal detectors in the physical world[J]. arXiv:2312.01789, 2023.
[116] HU Z, YANG X, ZHAO J, et al. Physically structured adversarial patch inspired by natural leaves multiply angles deceives infrared detectors[J]. Journal of King Saud University-Computer and Information Sciences, 2024, 36(6): 102122.
[117] JIA X, ZHU C, LI M, et al. LLVIP: a visible-infrared paired dataset for low-light vision[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision Workshops (ICCVW), Montreal, BC, Canada, 2021: 3489-3497.
[118] WEI X X , YU J, HUANG Y. Physically adversarial infrared patches with learnable shapes and locations[J]. arXiv:2303.13868, 2021.
[119] ZHU X, LI X, LI J, et al. Fooling thermal infrared pedestrian detectors in real world using small bulbs[J]. arXiv:2101.08154, 2021.
[120] ZHU X, LIU Y, HU Z, et al. Infrared adversarial car stickers[J]. arXiv:2405.09924, 2024.