arXiv:2606. 17711v1 Announce Type: cross Abstract: Pixel-wise adversarial patches are computationally heavy and often visually detectable, limiting utility in security-critical systems.
arXiv:2609.18133v1 Announce Type: new Abstract: Visible-infrared object detectors are used for robust perception under challenging illumination and weather conditions. Current physical attacks apply...
ComplicitSplat is a novel black‑box attack that leverages 3D Gaussian Splatting (3DGS) shading to create viewpoint‑specific camouflage, embedding adversarial content into scene objects that is only visible from certain angles. The method does not require access to model architecture or weights and can successfully fool a range of popular object detectors—including single‑stage, multi‑stage, and transformer‑based models—on both real‑world physical objects and synthetic scenes. This demonstrates that downstream models using 3DGS are vulnerable to adversarial manipulation.
arXiv:2606. 00159v1 Announce Type: cross Abstract: Deep neural network (DNN)-based object detectors are widely used for analyzing aerial and satellite imagery in applications such as environmental monitoring and urban analytics.
arXiv:2608.29510v1 Announce Type: cross Abstract: Aerial object detection is increasingly deployed in real-world applications, but models remain vulnerable to physical, universal adversarial patches...
arXiv:2607. 22722v1 Announce Type: cross Abstract: Almost all adversarial attacks add an imperceptible perturbation to fool a model.
arXiv:2608.30839v1 Announce Type: new Abstract: Thermal Infrared detection is widely used in autonomous driving, medical AI, etc., but its security has only attracted attention recently. We propose i...
The paper investigates using diffusion-based generative image editing to improve object detector robustness against domain shifts, specifically camouflaged military vehicle detection. By synthetically adding foliage, netting, and multi‑spectral camouflage to training data with models such as Qwen Image Edit 2509 and Flux.2 Dev, the authors demonstrate significant mAP gains (up to +20.1 for foliage) over detectors trained on uncamouflaged data. LoRA fine‑tuning further boosts performance for the more challenging multi‑spectral camouflage.
The paper evaluates six preprocessing defenses against adversarial attacks on depthwise‑separable CNNs, the dominant architecture in edge vision systems, and finds that these defenses consistently fail to recover clean predictions for such models, whereas a residual architecture shows partial recovery. The study reveals that the same preprocessing steps that break clean predictions leave adversarial predictions largely intact, creating a measurable asymmetry that can be exploited for detection without retraining or architectural changes. It also demonstrates that common image quality metrics do not reliably indicate defense effectiveness, highlighting a methodological gap in current evaluation practices.
arXiv:2606. 02603v1 Announce Type: cross Abstract: Camouflaged object detection has improved substantially, but most standard benchmarks evaluate models only on clean images.
The paper examines how preprocessing defenses, commonly used to protect edge vision systems, perform on depthwise‑separable CNNs versus residual architectures. Six preprocessing methods were tested against adversarial attacks, revealing that depthwise‑separable models consistently fail to recover from perturbations while residual models show partial recovery. Interestingly, the same preprocessing that hinders clean predictions leaves adversarial predictions largely intact, offering a measurable detection signal, and the study also finds that typical image‑quality metrics do not reliably indicate defense success.
arXiv:2609.31558v1 Announce Type: new Abstract: Contrastive Language--Image Pretraining (CLIP) has emerged as a dominant vision backbone due to its strong transferability and zero-shot capabilities....
The paper investigates whether pixels alone can determine an image’s origin—human, AI class, or specific generator—under adversarial edits. It establishes a minimax limit: the best possible robust acceptance gap equals the minimum total‑variation distance between the target distribution and attacked source distributions, independent of verifier design. The study also shows that practical public verifiers can fail before reaching this theoretical ceiling, highlighting the need to evaluate both statistical limits and deployed verifier behavior separately.