Adversarial Infrared Catmull-Rom Spline: A black-box attack on infrared pedestrian detectors in the physical world

Abstract

The security of deep neural networks (DNNs) is increasingly threatened by adversarial attacks, yet research in the infrared domain remains limited. Existing white-box attacks, such as light bulb panels and QR code garments, lack stealth and real-world applicability. Additionally, black-box attacks using hot and cold patches exhibit poor robustness. To address these challenges, we introduce AdvICRS, a novel black-box attack method that combines Catmull-Rom Spline curves with Evolutionary Strategy (ES) and the Expectation Over Transformation (EOT) framework to optimize adversarial perturbations. This method generates stealthy and efficient adversarial samples, enabling successful physical attacks using cold patches. Experimental results demonstrate that AdvICRS achieves a 94.9% success rate in digital attacks and 95.2% in physical attacks, outperforming current methods. Stealth analysis confirms that perturbations blend seamlessly with their surroundings, enhancing real-world applicability. Robustness tests show an average success rate of 87.2% across various object detectors, highlighting its adaptability. Ablation studies, generalization evaluations, transfer attacks, and adversarial defense tests further validate AdvICRS's superior performance. These findings not only expose vulnerabilities in infrared detection but also advance adversarial attack strategies in the infrared domain, providing a foundation for future research.