AdvGrid: A multi-view black-box attack on infrared pedestrian detectors in the physical world

Abstract

Physical adversarial attacks in the visible spectrum have been extensively studied, but research on infrared attacks remains limited. Infrared pedestrian detectors are crucial for modern applications yet vulnerable to adversarial attacks, posing significant security risks. Existing methods using physical perturbations like light bulb arrays or hot/cold patches for black-box attacks have shown limitations in practicality and multi-view support. To address these challenges, we introduce Adversarial Infrared Grid (AdvGrid), a novel approach that models perturbations in a grid format and employs a genetic algorithm for black-box optimization. AdvGrid cyclically applies perturbations to various parts of a pedestrian’s clothing, enabling effective multi-view black-box attacks on infrared detectors. Our extensive experiments demonstrate AdvGrid’s superior performance: Effectiveness: Achieves 80.00% attack success rate in digital environments and 91.86% in physical environments. Stealthiness: Maintains high stealthiness, making it difficult for observers to identify the adversarial patterns. Robustness: Exceeds 50% average attack success rate against mainstream detectors, showcasing its robustness across different scenarios. We also conduct ablation studies, transfer attacks, and adversarial defense evaluations, further confirming AdvGrid’s superiority over baseline methods. Our findings highlight AdvGrid as a powerful tool for advancing the understanding and mitigation of adversarial threats in infrared detection systems.