arxiv_cv 95% Match Research Paper AI Security Researchers,Computer Vision Engineers,Developers of Autonomous Systems,Cybersecurity Professionals 2 weeks ago

A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical World

ai-safety › robustness

📄 Abstract

Abstract: In recent years, adversarial attacks against deep learning-based object detectors in the physical world have attracted much attention. To defend against these attacks, researchers have proposed various defense methods against adversarial patches, a typical form of physically-realizable attack. However, our experiments showed that simply enlarging the patch size could make these defense methods fail. Motivated by this, we evaluated various defense methods against adversarial clothes which have large coverage over the human body. Adversarial clothes provide a good test case for adversarial defense against patch-based attacks because they not only have large sizes but also look more natural than a large patch on humans. Experiments show that all the defense methods had poor performance against adversarial clothes in both the digital world and the physical world. In addition, we crafted a single set of clothes that broke multiple defense methods on Faster R-CNN. The set achieved an Attack Success Rate (ASR) of 96.06% against the undefended detector and over 64.84% ASRs against nine defended models in the physical world, unveiling the common vulnerability of existing adversarial defense methods against adversarial clothes. Code is available at: https://github.com/weiz0823/adv-clothes-break-multiple-defenses.

Authors (5)

Wei Zhang

Zhanhao Hu

Xiao Li

Xiaopei Zhu

Xiaolin Hu

Submitted

October 20, 2025

arXiv Category

cs.CV

arXiv PDF

Key Contributions

This paper demonstrates that a single set of adversarial clothes can break multiple existing defense methods against adversarial patch attacks in both digital and physical worlds. The research highlights the vulnerability of current defenses to large-coverage, natural-looking adversarial examples, showing that simply increasing patch size can render defenses ineffective, posing a significant threat to the robustness of object detection systems.

Business Value

Highlights critical security vulnerabilities in AI systems, particularly those used in safety-critical applications like autonomous driving and surveillance. Understanding these weaknesses is crucial for developing more secure and reliable AI.

Paper Metadata

Innovation Type

Attack Demonstration / Vulnerability Analysis

Deployment Feasibility

High for demonstrating attacks. Developing robust defenses is the challenge.

Limitations Addressed

Inadequacy of current defense methods against physically realizable adversarial attacks,Vulnerability of object detectors to large-scale adversarial perturbations,Limited robustness of defenses against natural-looking adversarial examples

Performance Gains

Demonstrates failure of multiple defense methods, indicating a significant security gap.

Technical Tags

adversarial attacksphysical world attacksobject detectiondefense methodsadversarial clothespatch attacksrobustnessFaster R-CNNreal-world evasionlarge coverage attacks

Research Topics

Adversarial Machine LearningAI RobustnessComputer Vision SecurityPhysical AttacksDefense Mechanisms

Methods & Architectures

Adversarial Patch GenerationAdversarial Clothing DesignEvaluation against defense methods Faster R-CNN

Applications & Tasks

Computer Vision Security Autonomous Systems Surveillance Evasion of object detectors using physical adversarial examplesFailure of existing defense methods against large-coverage attacksReal-world adversarial robustness Object Detection EvasionAdversarial Attack and Defense Evaluation

Related Fields

Machine Learning SecurityComputer VisionCybersecurityAI Ethics

Keywords

adversarial attacksphysical attacksobject detectionrobustnessdefense methodsadversarial clothespatch attacksFaster R-CNNevasionsecuritycomputer visiondeep learning

Academic Context

#Adversarial Machine Learning#AI Robustness#Computer Vision Security#Physical Attacks#Defense Mechanisms

Technology Stack

Frameworks & Libraries

Faster R-CNN

Commercial Potential

Potential Products

Adversarial robustness testing toolsMore secure object detection models

Target Industries

TechnologyAutomotiveSecurityRobotics

Use Case Examples

Testing the security of autonomous vehicle perception systemsEvaluating the resilience of surveillance systems to physical tampering

Competitive Edge

Exposes a critical flaw in existing adversarial defense strategies, particularly those focused on small patches, and demonstrates a more effective attack vector using clothing.

Market Opportunity

Large market for AI security and robust AI solutions.

Revenue Models

N/A (attack demonstration)

Resource Requirements

Compute Needs

Moderate for generating attacks and running inference on Faster R-CNN.

Data Requirements

Requires datasets for training object detectors (e.g., COCO) and potentially custom datasets for evaluating attacks in specific scenarios.

Deployment Constraints

The effectiveness of physical attacks depends on environmental factors and the specific implementation of the target system.

Scalability

The methodology for creating adversarial clothes can be scaled to different clothing items and attack targets.

Regulatory Considerations

Ethical implications of developing and demonstrating adversarial attacks.

Production Readiness

Maturity Level

Research / Attack Demonstration

Time to Market

N/A (attack demonstration)

Patent Potential

Low for the attack itself, but high potential for patents related to novel defense mechanisms.

View Full Paper Back to Papers