ML Security PapersIn-the-Wild Camouflage Attack on Vehicle Detectors through Controllable Image Editing
Xiao Fang 1, Yiming Gong 1, Stanislav Panev 1, Celso de Melo 2, Shuowen Hu 2, Shayok Chakraborty 3, Fernando De la Torre 1
Published on arXiv
2603.19456
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Achieves more than 38% AP50 decrease on vehicle detectors while preserving structural fidelity and human-perceived stealthiness, with transferability to unseen black-box detectors and physical world
CtrlCamo
Novel technique introduced
Deep neural networks (DNNs) have achieved remarkable success in computer vision but remain highly vulnerable to adversarial attacks. Among them, camouflage attacks manipulate an object's visible appearance to deceive detectors while remaining stealthy to humans. In this paper, we propose a new framework that formulates vehicle camouflage attacks as a conditional image-editing problem. Specifically, we explore both image-level and scene-level camouflage generation strategies, and fine-tune a ControlNet to synthesize camouflaged vehicles directly on real images. We design a unified objective that jointly enforces vehicle structural fidelity, style consistency, and adversarial effectiveness. Extensive experiments on the COCO and LINZ datasets show that our method achieves significantly stronger attack effectiveness, leading to more than 38% AP50 decrease, while better preserving vehicle structure and improving human-perceived stealthiness compared to existing approaches. Furthermore, our framework generalizes effectively to unseen black-box detectors and exhibits promising transferability to the physical world. Project page is available at https://humansensinglab.github.io/CtrlCamo
Key Contributions
- Formulates vehicle camouflage attack as conditional image-editing problem using fine-tuned ControlNet
- Unified objective balancing structural fidelity, style consistency, and adversarial effectiveness
- Demonstrates 38%+ AP50 decrease with strong transferability to black-box detectors and physical world
🛡️ Threat Analysis
Creates adversarial perturbations (camouflage patterns) applied to vehicles that cause object detectors to fail at inference time. The attack manipulates visible appearance to evade detection while remaining imperceptible/stealthy to humans. Demonstrates both digital attacks and physical-world transferability.