AdvSerial: Physical Adversarial Attacks on Infrastructure-mounted Pedestrian Detectors via Semantic Feature Suppression

2026-07-19

AI Summary

This work addresses the vulnerability of infrastructure-deployed pedestrian detection systems to physical adversarial attacks, which jeopardize the reliability of traffic perception. The authors propose AdvSerial, a novel framework featuring a dynamic 2D–3D joint optimization mechanism that integrates UV mapping, semantic feature suppression, and temporal continuity constraints to generate high-angle, temporally coherent physical adversarial patches. To enhance stealth, Feature Smooth Quilting reduces patch boundary visibility, while a serial frame loss is designed to induce prolonged missed detections. In real-world evaluations, the method achieves a 74.8% attack success rate against YOLOv5, reducing average detection confidence from 84.30% to 39.38%. It demonstrates strong transferability across eight detectors—reaching up to 89.71% success on YOLOv2—and effectively evades state-of-the-art defenses such as NapGuard and Sparse4D-v3.

Abstract

AI-based visual perception systems are increasingly deployed in infrastructure surveillance, including roadside monitoring units, highway cameras, and smart-city pedestrian management systems. The security vulnerability of these systems to physical adversarial attacks poses a direct threat to the reliable operation of transportation infrastructure. We propose AdvSerial, a dynamic 2D--3D joint optimization framework for generating continuous high-angle physical adversarial patches against pedestrian detectors in infrastructure-based scenarios. We UV-map a boundary-aware quilted texture onto 3D garments, combine 2D digital attacks with 3D sparse- and continuous-frame rendering, and explicitly suppress person-specific semantic features while enforcing temporal continuity. A Feature Smooth Quilting strategy reduces visible patch boundaries and bounds cross-seam feature discontinuities. A serial-frame loss encourages long uninterrupted sequences of detection failures. In physical world experiments, AdvSerial achieves a 74.8% attack success rate on YOLO-v5 and degrades mean detection confidence from 84.30% to 39.38%. Experiments spanning eight detectors with different architectures demonstrate strong transferability. Notably, it achieves an $89.71%$ attack success rate on YOLO-v2 and resists both patch-detection defenses (NapGuard) and 3D-temporal perception (Sparse4D-v3). The results reveal persistent, temporally consistent failure modes under high-angle surveillance, and motivate the design of motion-aware and 3D-aware defenses for security-critical infrastructure deployments.

Problem

• physical adversarial attacks
• pedestrian detectors
• infrastructure surveillance
• semantic feature suppression
• temporal continuity

Innovation

• physical adversarial attack
• 2D-3D joint optimization
• semantic feature suppression
• temporal continuity
• Feature Smooth Quilting