AdvTiles: Physical Adversarial Camouflage Clothing against Person Detectors via Learnable Tiles

2026-08-07

AI Summary

This work addresses the challenge that existing physical adversarial camouflage methods struggle to simultaneously achieve visual naturalness and strong attack effectiveness against person detectors, while lacking flexible optimization of local patterns and their spatial arrangements. To overcome these limitations, we propose AdvTiles, a framework that jointly optimizes adversarial patterns and their layout through learnable tiles. Our approach introduces, for the first time, differentiable 3D Gaussian splatting rendering to enhance robustness across multiple viewpoints, lighting conditions, and backgrounds. A differentiable tile selection mechanism based on the straight-through Gumbel-Softmax estimator enables fine-grained texture control. Experiments demonstrate that AdvTiles achieves an average attack success rate of 86.2% across multiple person detectors, significantly outperforming state-of-the-art methods, and real-world wearable prototypes validate its effectiveness in practical scenarios.

Abstract

Physical adversarial attacks against person detectors have evolved from localized patches to full-body textures. However, achieving both visual naturalness and strong attack effectiveness remains challenging. Existing natural-looking methods typically optimize camouflage textures as a whole, limiting the flexibility to refine local adversarial patterns and their spatial arrangement. To address this issue, we propose AdvTiles, a physical adversarial camouflage framework built from learnable tiles, enabling strong attack performance while preserving a natural camouflage appearance. Specifically, we use a Straight-through (ST) Gumbel-Softmax estimator for differentiable tile selection, enabling joint optimization of tile patterns and spatial layouts. This design provides fine-grained control over adversarial texture generation. To improve robustness in diverse physical conditions, we further optimize the camouflage through differentiable 3D Gaussian Splatting rendering with variations in viewpoints, scales, illuminations and backgrounds. Extensive experiments across multiple detectors demonstrate that AdvTiles achieves an average ASR of 86.2%, outperforming existing state-of-the-art attack methods. We further fabricate the optimized camouflage into wearable adversarial clothing, validating its effectiveness in real-world scenarios across diverse distances, angles and backgrounds.

Problem

• physical adversarial attack
• person detection
• camouflage clothing
• visual naturalness
• adversarial robustness

Innovation

• learnable tiles
• physical adversarial attack
• differentiable rendering
• 3D Gaussian Splatting
• adversarial camouflage