DAP: A Dynamic Adversarial Patch for Evading Person Detectors

Core Insight

Physical adversarial patches fail when they are treated as static objects.
DAP shows that robust physical attacks must account for pose changes, fabric deformation, and real-world transformations.

Links

• Paper: CVPR Open Access
• Demo: Link

Motivation

Adversarial patches can fool object detectors, but many existing attacks degrade under real-world conditions.
This is especially true for clothing-based attacks, where printed patches are affected by body pose, fabric wrinkles, lighting, scale, and viewpoint changes.

DAP asks:

Can we generate a printable, naturalistic adversarial patch that remains effective under realistic physical transformations?

DAP explicitly optimizes adversarial patches under transformations that approximate real-world deployment conditions.

Method Overview

DAP is a GAN-free adversarial patch generation framework.
Instead of relying on a restricted GAN latent space, DAP directly optimizes patch pixels while preserving a naturalistic visual appearance.

The method introduces:

• a similarity-guided optimization objective
• transformation-aware patch training
• a Creases Transformation (CT) block to simulate non-rigid fabric deformation
• robustness to scale, rotation, lighting, noise, and clothing wrinkles

Abstract

Patch-based adversarial attacks expose critical vulnerabilities in computer vision systems, especially person detectors used in surveillance, autonomous systems, and edge-based smart cameras. However, many existing physical attacks remain conspicuous or fragile under real-world transformations.

We propose DAP, a Dynamic Adversarial Patch framework for generating printable, naturalistic adversarial patterns that evade person detectors under realistic physical conditions. Unlike GAN-based approaches, which are constrained by limited latent spaces, DAP directly optimizes patch pixels while using a similarity metric to preserve a predefined natural appearance.

To address the physical challenges of clothing-based attacks, DAP introduces a Creases Transformation (CT) block that simulates non-rigid deformations caused by pose changes and fabric wrinkles. This enables the generated patch to remain effective under scale changes, rotation, brightness and contrast variation, random noise, and clothing deformation.

DAP achieves an attack success rate of 82.28% in the digital setting against YOLOv7 on INRIA and 65% in the physical setting against YOLOv3-tiny deployed on edge-based smart cameras.

Key Contributions

• Proposes DAP, a GAN-free framework for generating naturalistic printable adversarial patches.
• Shows that directly optimizing patch pixels provides greater flexibility than GAN latent-space optimization.
• Introduces the Creases Transformation (CT) block to model non-rigid T-shirt deformation caused by pose and fabric wrinkles.
• Optimizes patch robustness under realistic transformations, including scale, rotation, lighting, noise, and clothing deformation.
• Demonstrates strong attack performance in both digital and physical settings.
• Reveals practical vulnerabilities in person detection systems deployed on edge-based smart cameras.

Results

DAP achieves strong digital-world attack performance, reaching 82.28% attack success against YOLOv7.

DAP remains effective in the physical world, achieving 65% attack success against YOLOv3-tiny on edge-based smart cameras.

Why This Matters

DAP shows that adversarial robustness cannot be evaluated only under static digital assumptions.

In real deployments, attacks and defenses must account for:

• moving people
• deformable clothing
• changing camera viewpoints
• lighting variation
• edge-device constraints

This work demonstrates that physically realizable adversarial patches can remain effective when designed with deployment conditions in mind.

Broader Perspective

DAP is part of a broader research direction on deployment-aware adversarial robustness.

It shows that transferability and physical robustness depend on preserving adversarial structure under transformation.
This connects to my broader work on understanding how structural consistency, physical variability, and representation alignment shape the security of real-world AI systems.

Citation

@inproceedings{guesmi2024dap,
  title     = {DAP: A Dynamic Adversarial Patch for Evading Person Detectors},
  author    = {Guesmi, Amira and Ding, Ruitian and Hanif, Muhammad Abdullah and Alouani, Ihsen and Shafique, Muhammad},
  booktitle = {Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year      = {2024}
}