Stealthy in Semantics, Antagonistic in Space: Attacking Visible-Infrared Object Detectors via Object-Level Misalignment
Yueqi Zhu, Qi Ming, Qi Ming, Guo Cheng, Yongkang Zhang, Feiran Liu, Juan Fang, Juan Fang, et al.
cs.CV
Quick verdict
CamoShift camouflages a patch and digitally shifts infrared evidence to attack RGB-IR detectors; strong, broad results, but no physical-world validation.
Summary
The paper proposes CamoShift, an adversarial attack framework for visible-infrared (RGB-IR) object detectors that combines visual camouflage with deliberate object-level spatial misalignment. A Semantic Camouflage Module optimizes a visible patch with VGG-based style, content, and color consistency terms plus an RGB-IR adapter that maps the patch into a plausible infrared response. An Object-level Spatial Decoupling Module predicts a scale-aware offset via an FPN generator, digitally removes the infrared target by LaMa inpainting, and re-pastes it at the shifted location, breaking the cross-modal alignment prior that fusion networks assume. A Harmonic Adversarial loss with stop-gradient adaptive weights balances attack strength against stealth. On DroneVehicle, M3FD, LLVIP, and VEDAI against YOLOv8, C2Former, and COMO, CamoShift reaches e.g. 64.23% Strict-ASR with 21.81% post-attack mAP50 on COMO/DroneVehicle versus 54.54/42.53 for CDUPatch, with SSIM 0.9745 (Table 3), and transfers up to 90.61% across models. Main limitations: all manipulations are digital image edits, with no physical-world validation despite the physical-attack framing; no infrared-deletion baseline isolates whether shifting per se, rather than merely erasing IR evidence, breaks fusion; single-run results without variance; defense tests cover one dataset-model pair.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 2
● low 3
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Deliberately shifting infrared object evidence away from its visible position breaks the object-level correspondence that visible-infrared fusion detectors rely on, causing far larger degradation than stronger aligned appearance perturbations.
- A style/content/color-regularized patch plus an RGB-IR adapter (SCM) achieves simultaneous visual camouflage (SSIM 0.9745) and an effective dual-modality attack.
- The HarAdv loss with stop-gradient harmonic weights yields the best attack-stealth trade-off (Strict-ASR 60.2% to 64.2%, SSIM 0.923 to 0.975 in Table 2).
- The attack transfers across detector architectures (up to 90.61% Strict-ASR) and retains 52.1-74.5% success under three common defenses.
Strengths
Genuinely new attack surface with a fairer metric
OSDM appears to be the first attack to explicitly break object-level RGB-IR correspondence instead of perturbing appearance inside aligned boxes; the proposed Strict-ASR (Eq. 17) demands suppression at both original and shifted locations and provably degenerates to conventional ASR for non-shifting baselines, keeping Table 1 metric-consistent.
Large, consistent empirical gains across a broad grid
Table 1 spans 4 public datasets x 3 detectors x 13 baselines; on COMO/DroneVehicle CamoShift reaches 64.23% Strict-ASR with 21.81% post-attack mAP50 vs CDUPatch's 54.54/42.53, and the lead holds in all 12 detector-dataset cells.
Stealth is quantified, not asserted
Transparent transfer protocol and clean ablation attribution
Weaknesses
Attack is purely digital despite physical framing
Missing deletion/occlusion baseline
Asymmetric attack budgets across methods
Thin defense and mechanism analysis
Statistical reporting below current norms
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is a method paper on adversarial attacks for visible-infrared (RGB-IR) object detection. The authors argue (Sec. 1) that existing cross-modal patch attacks (UNIPatch, TOUAP, CDUPatch) have two weaknesses — conspicuous appearance and confinement to spatially aligned regions — and propose CamoShift: a Semantic Camouflage Module (SCM) for stealthy, thermally valid patches; an Object-level Spatial Decoupling Module (OSDM) that digitally shifts infrared target evidence; and a Harmonic Adversarial loss (HarAdv) balancing strength and stealth. Central claims: (i) object-level cross-modal misalignment is a distinct, more destructive attack surface than aligned appearance perturbation; (ii) CamoShift is the first attack targeting both stealth and success in this setting; (iii) state-of-the-art results on 4 datasets x 3 detectors. The reported numbers support (iii); the causal story behind (i) is weakened by a missing control, and (ii) needs a literature check.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is CamoShift and what does it attack?
CamoShift is an adversarial attack framework against visible-infrared object detectors such as C2Former and COMO (and a YOLOv8-based setup). It attaches a camouflaged adversarial patch to a target object and digitally shifts the object's infrared evidence away from its visible location, so the detector's fusion module can no longer pair the two modalities, causing missed detections.
Does CamoShift work in the physical world?
No physical experiments are reported. All results are digital: the infrared shift is performed by LaMa inpainting and pasting in software, and the infrared appearance is produced by a learned RGB-to-IR adapter rather than physical materials. The visible patch is designed to look printable and camouflaged, but printed-patch or hardware validation is not part of the paper.
What is Strict-ASR in this paper?
Strict Attack Success Rate counts an image as successfully attacked only when the detector produces zero detections at both the object's original location and the digitally shifted infrared location. For baseline methods that do not shift anything, this definition reduces to the conventional attack success rate, which keeps the Table 1 comparisons metric-consistent.
How much better is CamoShift than prior attacks?
On COMO with the DroneVehicle dataset it reaches 64.23% Strict-ASR with post-attack mAP50 of 21.81%, versus 54.54%/42.53% for the strongest prior cross-modal patch (CDUPatch), while also achieving higher visual stealth (SSIM 0.9745 vs 0.9464). The lead holds across four datasets and three detectors, with cross-model transfer up to 90.61%.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1-5 (stealth/effectiveness scatter, qualitative attack visualizations) cannot be assessed from extracted text.
- Supplementary material (hyperparameters, runtime, memory, threshold curves, detector training details) was not part of the extracted text; several implementation questions remain open.
- The extracted text lists Yuhan Zhang as a fourth-affiliation author who is absent from the catalog metadata; otherwise extraction appears complete through the references.
- Equation typography in the extraction is partially garbled (e.g., Eq. 7 lost its absolute-value bars), but the method is reconstructible from context.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.