Fooling automated surveillance cameras: adversarial patches to attack\n person detection

2019/04/18 by Simen Thys, Wiebe Van Ranst, Thys, Simen +3 · 4 voices · 27 citations
Computer Science · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Digital Media Forensic Detection #cs.CV

paper · pdf · doi:10.48550/arxiv.1904.08653

openalex publication_date 2019/04/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Adversarial attacks on machine learning models have seen increasing interest\nin the past years. By making only subtle changes to the input of a\nconvolutional neural network, the output of the network can be swayed to output\na completely different result. The first attacks did this by changing pixel\nvalues of an input image slightly to fool a classifier to output the wrong\nclass. Other approaches have tried to learn "patches" that can be applied to an\nobject to fool detectors and classifiers. Some of these approaches have also\nshown that these attacks are feasible in the real-world, i.e. by modifying an\nobject and filming it with a video camera. However, all of these approaches\ntarget classes that contain almost no intra-class variety (e.g. stop signs).\nThe known structure of the object is then used to generate an adversarial patch\non top of it.\n In this paper, we present an approach to generate adversarial patches to\ntargets with lots of intra-class variety, namely persons. The goal is to\ngenerate a patch that is able successfully hide a person from a person\ndetector. An attack that could for instance be used maliciously to circumvent\nsurveillance systems, intruders can sneak around undetected by holding a small\ncardboard plate in front of their body aimed towards the surveillance camera.\n From our results we can see that our system is able significantly lower the\naccuracy of a person detector. Our approach also functions well in real-life\nscenarios where the patch is filmed by a camera. To the best of our knowledge\nwe are the first to attempt this kind of attack on targets with a high level of\nintra-class variety like persons.\n

Cited by

• Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks
• AdvSerial: Physical Adversarial Attacks on Infrastructure-mounted Pedestrian Detectors via Semantic Feature Suppression
• Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems
• Adversarial Patch Attacks on Vision-Based Cargo Occupancy Estimation via Differentiable 3D Simulation
• Robust Physical Adversarial Patches Using Dynamically Optimized Clusters
• Physically Realistic Sequence-Level Adversarial Clothing for Robust Human-Detection Evasion
• Cheating Stereo Matching in Full-scale: Physical Adversarial Attack against Binocular Depth Estimation in Autonomous Driving
• Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systems
• Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Driving
• Learning Fourier shapes to probe the geometric world of deep neural networks
• Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges
• A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical World
• Structured Universal Adversarial Attacks on Object Detection for Video Sequences
• Uncertainty Quantification In Surface Landmines and UXO Classification Using MC Dropout
• Vision Transformers: the threat of realistic adversarial patches
• BiTAA: A Bi-Task Adversarial Attack for Object Detection and Depth Estimation via 3D Gaussian Splatting
• Semantic Representation Attack against Aligned Large Language Models
• SoK: Cybersecurity Assessment of Humanoid Ecosystem
• DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Models
• Targeted Physical Evasion Attacks in the Near-Infrared Domain
• Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving
• Understanding the Risks of Asphalt Art on the Reliability of Surveillance Perception Systems
• Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insights
• Adversarial attacks to image classification systems using evolutionary algorithms
• Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
• Revisiting Physically Realizable Adversarial Object Attack against LiDAR-based Detection: Clarifying Problem Formulation and Experimental Protocols
• 3DGAA: Realistic and Robust 3D Gaussian-based Adversarial Attack for Autonomous Driving

Discussions

• Fooling surveillance cameras: adversarial patches to attack person detection [hn, 148 points, 23 comments]
• Omg this one is just a square you attach at the waist arxiv.org/pdf/1904.08653 [bsky, 3 points, 1 comments]
• Fooling automated surveillance cameras: patches attack person detection (2019) [hn, 3 points, 2 comments]
• Fooling automated surveillance: adversarial patches to attack person detector [hn, 2 points, 0 comments]

Related

• You Cannot Easily Catch Me: A Low-Detectable Adversarial Patch for Object Detectors
• Adversarial Camera Patch: An Effective and Robust Physical-World Attack on Object Detectors
• Dynamic Adversarial Patch for Evading Object Detection Models
• DAP: A Dynamic Adversarial Patch for Evading Person Detectors
• Attacking Object Detector Using A Universal Targeted Label-Switch Patch