Dynamic Emissivity Patches Raise Infrared Detection Evasion Rates

Infrared object detectors are used where visible-light camouflage is insufficient, but physical attacks against them must survive viewing-angle changes, range, thermal backgrounds, and fabrication constraints. Earlier thermal patches are generally static: a pattern tuned for one background can lose its effect when the target moves from foliage to urban structures. Adv-Camou addresses that mismatch with a digitally optimized binary pattern deployed on a reconfigurable emissivity array, then selects a field- or urban-oriented configuration according to the scene.

Core Contribution

The paper's central contribution is the coupling of an adversarial-patch objective to a physical device whose emissivity can be switched at the unit level. Rather than treating printability as a final implementation detail, the optimization includes binarization and simulated physical transformations. The authors frame the goal as feature confusion: lower the detector's target saliency while making the target representation align with background features. This is distinct from merely cooling a target or applying a fixed texture.

The claimed practical advantage is adaptation across backgrounds. The 6×4 reversible electrochromic emissivity array has 24 independently addressable elements, and voltage modulation of ±2.5 V changes emissivity from 0.2 to 0.32. That leaves the device with a small number of selectable patterns rather than continuous per-pixel control, an important constraint on how much scene adaptation the result demonstrates.

Technical Approach

Adv-Camou begins with feature maps from an infrared detector and optimizes a patch under a multi-level loss. The objective combines suppression of target-related features with background alignment, targeting the feature conflicts that arise across detector scales. The paper argues that shallow CNN layers respond to local textures, while deeper layers encode larger structural semantics; a patch therefore needs to interfere across receptive-field scales rather than at one location alone.

The digital pipeline applies physical transformations during optimization to account for conditions such as different observation geometries. A Gumbel-Softmax procedure produces a binary patch, intended to bridge the continuous optimization and the emissivity device's discrete states. The authors then generate scenario-specific field and urban patches, using the same hardware array as the deployment medium.

Figure 1 depicts this digital-to-physical path, from feature-confusion optimization and differentiable binarization through transformation simulation to emissivity-device deployment.

Results and Analysis

The static physical evaluation is the strongest evidence for transfer beyond rendered imagery. Table III reports 94.45% ASR indoors, 82.42% on a field background, and 52.78% on an urban background for the general adversarial camouflage configuration. The large urban decline is consequential: it shows that a patch that works under one thermal context does not automatically generalize to another. The abstract reports a 76.55% average ASR for static patches across multi-view, multi-range, and multi-spectral tests, but the displayed table makes clear that this average hides substantial background dependence.

Dynamic switching improves the matching-background case. Table IV gives 82.35% ASR for Field Adv-Camou on field background versus 68.63% for Urban Adv-Camou, and 56.25% for Urban Adv-Camou on urban background versus 41.67% for Field Adv-Camou. The corresponding 13.72- and 14.58-point gains support the narrower claim that scene-matched configurations outperform mismatched ones. The paper also reports that, in YOLOv5 examples, an urban-tuned patch reduces confidence from 0.42 to 0.13 in cityscapes, while a wilderness-tuned patch reduces it from 0.39 to 0.21 in natural scenes.

Figure 2 compares detector outputs, feature-attention maps, patch sizes, pixel configurations, and resolutions. It supports the authors' mechanism-level argument visually, but the article's numeric case rests more directly on the physical ASR tables. The reported 91.55% maximum ASR is promising, yet it should be read as a matched-scene result rather than evidence of broad detector-independent evasion.

Scope and Caveats

The authors identify two direct limits: experiments focus on single targets rather than group or multi-target scenes, and the design targets long-wave infrared (8–14 μm), not visible or mid-wave infrared imagery. The evaluation also centers on infrared pedestrian detection and reports results using YOLOv5 examples, so its coverage of other detector families, target classes, and operational conditions is limited. The physical evidence supports adaptive switching over the tested field and urban settings; it does not establish that the approach will retain the same ASR against unseen sensors or multi-spectral defenses.