Paper deep dive
Physical Adversarial Attacks on AI Surveillance Systems:Detection, Tracking, and Visible--Infrared Evasion
Miguel A. DelaCruz, Patricia Mae Santos, Rafael T. Navarro
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 93%
Last extracted: 4/10/2026, 3:45:19 AM
Summary
This paper provides a comprehensive review of physical adversarial attacks on AI surveillance systems, shifting the focus from isolated image benchmarks to operational surveillance environments. It introduces a four-part taxonomyātask persistence, sensing modality, physical carrier, and operational objectiveāto analyze how attacks impact person detection, multi-object tracking, and visible-infrared sensing. The authors argue that surveillance robustness must be evaluated as a system-level problem that accounts for temporal persistence, cross-modal sensor fusion, and realistic deployment constraints like wearable or controllable carriers.
Entities (5)
Relation Signals (3)
Physical Adversarial Attacks ā targets ā AI Surveillance Systems
confidence 95% Ā· Physical Adversarial Attacks on AI Surveillance Systems
AI Surveillance Systems ā utilizes ā Multi-object tracking
confidence 90% Ā· A surveillance pipeline is rarely just a detector applied to isolated frames. It typically combines detection, tracking, identity association
AI Surveillance Systems ā utilizes ā Visibleāinfrared sensing
confidence 90% Ā· low-light deployments, multiple sensing channels such as visible and thermal cameras
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Physical adversarial attacks are increasingly studied in settings that resemble deployed surveillance systems rather than isolated image benchmarks. In these settings, person detection, multi-object tracking, visible--infrared sensing, and the practical form of the attack carrier all matter at once. This changes how the literature should be read. A perturbation that suppresses a detector in one frame may have limited practical effect if identity is recovered over time; an RGB-only result may say little about night-time systems that rely on visible and thermal inputs together; and a conspicuous patch can imply a different threat model from a wearable or selectively activated carrier. This paper reviews physical attacks from that surveillance-oriented viewpoint. Rather than attempting a complete catalogue of all physical attacks in computer vision, we focus on the technical questions that become central in surveillance: temporal persistence, sensing modality, carrier realism, and system-level objective. We organize prior work through a four-part taxonomy and discuss how recent results on multi-object tracking, dual-modal visible--infrared evasion, and controllable clothing reflect a broader change in the field. We also summarize evaluation practices and unresolved gaps, including distance robustness, camera-pipeline variation, identity-level metrics, and activation-aware testing. The resulting picture is that surveillance robustness cannot be judged reliably from isolated per-frame benchmarks alone; it has to be examined as a system problem unfolding over time, across sensors, and under realistic physical deployment constraints.
Tags
Links
- Source: https://arxiv.org/abs/2604.06865v1
- Canonical: https://arxiv.org/abs/2604.06865v1
Trouble viewing inline? Open PDF directly ā
Full Text
40,340 characters extracted from source content.
Expand or collapse full text
Physical Adversarial Attacks on AI Surveillance Systems: Detection, Tracking, and VisibleāInfrared Evasion Miguel A. Dela Cruz Department of Computer Science University of the Philippines Diliman Quezon City, Philippines Patricia Mae Santos Department of Information Systems and Computer Science Ateneo de Manila University Quezon City, Philippines Rafael T. Navarro College of Computer Studies De La Salle University Manila, Philippines Abstract Physical adversarial attacks are increasingly studied in settings that resemble deployed surveillance systems rather than isolated image benchmarks. In these settings, person detection, multi-object tracking, visibleāinfrared sensing, and the practical form of the attack carrier all matter at once. This changes how the literature should be read. A perturbation that suppresses a detector in one frame may have limited practical effect if identity is recovered over time; an RGB-only result may say little about night-time systems that rely on visible and thermal inputs together; and a conspicuous patch can imply a different threat model from a wearable or selectively activated carrier. This paper reviews physical attacks from that surveillance-oriented viewpoint. Rather than attempting a complete catalogue of all physical attacks in computer vision, we focus on the technical questions that become central in surveillance: temporal persistence, sensing modality, carrier realism, and system-level objective. We organize prior work through a four-part taxonomy and discuss how recent results on multi-object tracking, dual-modal visibleāinfrared evasion, and controllable clothing reflect a broader change in the field. We also summarize evaluation practices and unresolved gaps, including distance robustness, camera-pipeline variation, identity-level metrics, and activation-aware testing. The resulting picture is that surveillance robustness cannot be judged reliably from isolated per-frame benchmarks alone; it has to be examined as a system problem unfolding over time, across sensors, and under realistic physical deployment constraints. 1 Introduction Adversarial robustness in computer vision was first discussed largely in terms of classifiers and, later, standalone detectors, often under digitally generated perturbations [1, 2]. Physical attacks changed that picture by forcing perturbations to survive printing, viewpoint changes, lighting variation, and camera processing. Once the problem is placed in a surveillance setting, the difference between benchmark-style success and operational impact becomes even clearer. A surveillance pipeline is rarely just a detector applied to isolated frames. It typically combines detection, tracking, identity association, and, in many low-light deployments, multiple sensing channels such as visible and thermal cameras. Under those conditions, the key question is not only whether a target disappears in one image. An attack may instead matter because it survives across time, induces identity confusion, exploits disagreements between sensing channels, or can be deployed as a garment or accessory without making the threat model implausible. Several surveys provide the necessary background. Broad reviews cover adversarial attacks and defenses across tasks and modalities [1, 2]. Later surveys concentrate on the physical world, emphasizing carriers, optimization procedures, and real-world constraints [30, 32, 31]. More recent work has begun to discuss surveillance and optical attacks directly [25, 10]. Together, these papers make clear that surveillance is not just another application area. It is a setting in which time, sensing redundancy, and deployment realism interact. This survey takes that narrower viewpoint. We focus on physical attacks against AI surveillance systems used for person detection, tracking, and low-light monitoring, and we organize the literature around four practical questions: what persists over time, which sensors are involved, what carrier is physically deployed, and what failure is induced at the system level. Recent results on multi-object tracking [21], dual-modal visibleāinfrared attacks [22], and thermally activated clothing [23] are especially informative in this respect because they make surveillance-specific evaluation requirements hard to ignore. Our goal is not to catalogue every physical attack in computer vision. Instead, we use a surveillance-centered taxonomy to read the literature in a way that foregrounds persistent identity disruption, visibleāinfrared evasion, and wearable or controllable carriers. We then examine what those shifts imply for experimental protocols, defensive design, and benchmark construction. The remainder of the paper is organized as follows. Section 2 positions our scope relative to existing surveys. Section 3 introduces the taxonomy used throughout the paper. Section 4 discusses how the surveillance threat model has broadened over time. Section 5 summarizes evaluation practices, defensive implications, and open problems. Section 6 concludes. 2 Related Work and Scope Physical attacks on surveillance systems sit at the intersection of several survey literatures. General adversarial-vision surveys provide the broadest background across tasks and defenses [1, 2]. Surveys dedicated to the physical world narrow the focus to printability, viewpoint robustness, carrier design, and experimental realism [30, 32, 31]. More recent reviews have begun to discuss surveillance applications explicitly [25], while optical physical attacks have been treated as their own sub-area because illumination, projection, reflection, and sensor effects raise different challenges from those of printed patches alone [10]. What remains less developed is a view that treats the surveillance pipeline itself as the main object of study. Broad surveys necessarily compress the differences between one-frame detection, long-horizon tracking, and visibleāinfrared monitoring. Surveys organized mainly by carrier type can likewise obscure the fact that the same physical artifact may have very different consequences depending on whether the target system performs detection, association, or cross-modal fusion. This is where our scope differs. We are interested in physical attacks that matter for persistent monitoring systems: person detection in public scenes, tracking-by-detection pipelines, and visibleāinfrared deployments used in low-light or night-time settings. Recent papers on physical attacks against multi-object tracking, universal dual-modal patches, and thermally activated clothing are part of that story [21, 22, 23], but they are considered here as representative signs of a broader shift rather than as the whole field. Table 1: Positioning this paper relative to existing surveys. āSurveillance specificityā asks whether persistent monitoring pipelines are treated as a primary object of study rather than a side application. Survey or perspective Year Primary scope Surveillance specificity Tracking emphasis VI/IR emphasis Distinctive value relative to this paper Akhtar and Mian [1] 2018 General adversarial vision survey Low Low Low Foundational but predates the recent wave of surveillance-focused physical attacks. Akhtar et al. [2] 2021 General attack/defense survey Low Low Low Broader than our scope and not centered on physical surveillance pipelines. Wang et al. [30] 2022 Physical attacks in computer vision Medium Low Medium Strong taxonomy of carriers and tasks, but less focused on surveillance operations. Wei et al. [32] 2022 Ten-year review of physical attacks Medium Low Medium Historical breadth; less emphasis on recent surveillance-specific transitions. Wang et al. [31] 2023 Physical adversarial examples in the real world Medium Low Medium Covers the physical-world bridge well, but not the surveillance pipeline in depth. Nguyen et al. [25] 2023 Surveillance-focused physical attacks High Medium Medium Closest in spirit; our paper sharpens the perspective around tracking, VI sensing, and wearability. Fang et al. [10] 2024 Optical physical attacks Medium Low Low Useful for optical carriers, but not targeted at surveillance persistence or dual-modal sensing. This paper 2026 Surveillance-centered review High High High Brings together tracking, visibleāinfrared sensing, and carrier realism within a single surveillance-oriented scope. We also depart from views that separate papers only by carrier or only by target task. In surveillance, these axes interact. A sticker, a T-shirt, an infrared block, and thermally manipulated clothing are different carriers, but their significance depends strongly on whether the target is a one-frame detector, a multi-object tracker, or a dual-modal detector. Likewise, tracking and detection attacks may share infrastructure while leading to different failure modes: missed detections can suppress an alarm, whereas tracker corruption can generate ID switches or long-lived false trajectories [24, 38]. Our scope is deliberately technical rather than policy-led. AI surveillance also raises social and governance questions, but the purpose of this survey is to clarify technical threat models, evaluation gaps, and design principles for physical attacks and defenses. Within that frame, the next section introduces a surveillance-centered taxonomy for organizing the literature more concretely. 3 A Surveillance-Centered Taxonomy Surveillance systems differ from generic vision benchmarks in one critical way: the model is embedded in an operational loop. A detector may trigger recording or alerting; a tracker may accumulate identity evidence over dozens of frames; visible and thermal cameras may be fused before decision making; and the physical carrier of an attack must coexist with clothing, scene geometry, weather, and camera processing. This motivates a taxonomy that emphasizes system behavior rather than only optimization technique. Task persistence Single-frame object detection Person detection under surveillance Single-object tracking Multi-object tracking and identity maintenance Sensing modality RGB visible-light cameras Thermal infrared cameras Visibleāinfrared paired sensing RGB-T and other multi-modal extensions Physical carrier Printed patch or translucent patch Full texture or adversarial garment Infrared blocks, curves, bulbs, stickers Triggered or thermally activated wearables Operational objective Missed detection or target hiding False positives or ghost objects Track hijacking and ID switches Cross-modal evasion and on-demand activation Figure 1: A surveillance-centered taxonomy of physical adversarial attacks. The point is not only to classify papers, but to clarify which operational questions a method actually stresses. We organize the literature around four dimensions shown in Figure 1. 3.1 Task persistence The first dimension is whether the system acts on isolated frames or on temporally extended evidence. Classical object-detection attacks often measure success frame by frame [40, 20, 5]. Surveillance-specific person-detection work moves closer to deployment, especially when wearability and camera variation are modeled explicitly [28, 41, 27, 16, 11, 34, 7]. Tracking attacks go further by making temporal persistence central: the perturbation must not merely suppress a detection once, but corrupt the trajectory or identity state over time [37, 6, 17, 8, 19, 43, 21, 26]. 3.2 Sensing modality The second dimension is sensing modality. RGB attacks remain the dominant baseline, but surveillance systems increasingly use thermal cameras at night or visibleāinfrared paired sensing in low-light environments. This introduces genuinely new constraints because the perturbation must either transfer across modalities or exploit thermal-specific carriers such as heating elements and infrared emitters [45, 46, 36, 33, 47, 13, 14, 48, 49]. Cross-modal visibleāinfrared attacks make this explicit by optimizing for both channels at once rather than treating infrared as an afterthought [35, 22, 23]. 3.3 Physical carrier The third dimension is the physical carrier. Printed patches remain the canonical starting point [4, 20], but surveillance-relevant carriers quickly become more diverse: large patches for person detection [28], full-body textures and adversarial garments [41, 16, 47], translucent or naturalistic patches that better fit scene appearance [15, 50], and thermal carriers such as bulbs, blocks, curves, stickers, and heated wearables [45, 33, 13, 14, 49]. Triggered and controllable carriers add another operational layer because the attacker can decide when the perturbation becomes active [44, 23]. 3.4 Operational objective The fourth dimension is the attack objective as it matters to surveillance operators. Some attacks hide a person or object [28, 39]. Others create false positives or manipulate post-processing, which can flood systems with ghost detections or distract operators [29, 43]. Tracking attacks further target identity integrity, producing ID switches or false track continuity [19, 21]. Cross-modal attacks seek simultaneous evasion across visible and thermal channels [35, 22]. Wearable and thermally activated attacks add the ability to look benign most of the time while activating only under chosen circumstances [44, 23]. Table 2: Representative literature through the surveillance-centered taxonomy. We intentionally group by operational question rather than by venue or year. Category Representative works Common carriers Core surveillance question General patch foundations [4, 3, 9, 5, 20, 42, 29] Printed stickers, robust EoT patches, scene-integrated perturbations How can attacks survive viewpoint change, printing, and detector-specific structure? Person detection under surveillance [28, 41, 15, 27, 16, 11, 34, 7, 44] Wearable patches, garments, naturalistic textures, dynamic or triggered patches How can attacks remain effective across distance, camera pipelines, and human-compatible deployment? Tracking and temporal persistence [37, 6, 17, 8, 19, 43, 26, 21] Textures, query-based perturbations, trajectory-level manipulations, printable patches How does attack success accumulate over time through association, memory, and identity maintenance? Thermal and infrared evasion [45, 46, 36, 33, 47, 13, 14, 48, 49] Heated bulbs, infrared clothing, learnable IR patches, blocks, curves, stickers Which carriers can survive thermal imaging constraints and real night-time deployment? Visibleāinfrared cross-modal attacks [18, 35, 22, 23] Unified VI patch, dual-modal clothing, cross-channel physical designs What does it take to evade both visible and thermal channels simultaneously? This taxonomy matters because it changes how we interpret the literature. A method that is impressive as an RGB detection attack may still be weak as a surveillance attack if it fails under tracking, thermal sensing, or realistic wearability constraints. Conversely, a modest-looking attack can be more operationally serious if it induces persistent ID corruption or cross-modal evasion. The next section uses this lens to discuss how the surveillance threat model has broadened over time. 4 Shifts in the Surveillance Threat Model Read chronologically, the literature suggests that physical attacks on surveillance systems have broadened along three connected axes. Early work mostly asked whether a detector could be fooled in the wild. More recent papers ask harder questions: whether the error persists across time, whether it survives when visible and thermal signals are used together, and whether the attack can be carried in a wearable or selectively activated form. Older detector attacks remain important, but they no longer capture the full surveillance threat model on their own. 4.1 From detector evasion to identity-aware persistence Much of the early physical-attack literature in surveillance was detector-centric. Person detectors were attacked with conspicuous but effective patches [28], then with T-shirts, naturalistic textures, and visually plausible garments [41, 16, 27]. Later papers improved realism by examining camera variation, distance, and scene integration [15, 11, 34, 7]. This line of work remains important because person detection is often the first stage of an automated surveillance stack. Tracking research exposed what detector-only evaluation leaves out. Physical and digital attacks against tracking showed that the relevant failure mode is often not one-frame disappearance but long-lived drift, response corruption, or identity mistakes [37, 6, 17, 8]. Multi-object tracking makes the threat richer still because attacks can target data association itself. Tracklet-Switch and F&F Attack already suggest that surveillance risk is tied to identity corruption, not just missed boxes [19, 43], and Pang et al. show that multi-object trackers can be both blinded and distracted by adversarial perturbations [26]. Recent physical attacks on multi-object tracking make this shift explicit [21]. They move the evaluation target from frame-level detection accuracy to identity continuity over time, which is often closer to the failure mode that matters in practice. This perspective also aligns with how modern tracking-by-detection systems are deployed [38, 24]: the key question is not only whether the camera sees a person, but whether the system keeps the right trajectory attached to the right identity. 4.2 From RGB attacks to visibleāinfrared evasion The second shift comes from sensing modality. RGB cameras remain the default benchmark, but they are not the whole surveillance stack. Night-time monitoring, perimeter security, and low-light traffic scenarios often rely on thermal cameras or visibleāinfrared pairs, which makes purely visual camouflage less informative. Thermal attacks therefore developed their own design language, including bulbs, infrared clothing, learnable patches, and HOTCOLD-style wearable elements [45, 46, 36, 33, 47, 13, 14, 48, 49]. Once visible and infrared channels are considered together, the problem changes again. A method that succeeds in RGB alone may say little about a system that fuses visible and thermal information. Unified visibleāinfrared patches established that cross-modal physical attacks are feasible [35]. More recent dual-modal work pushes toward stronger transfer across detectors and scenes [22]. The broader lesson is that surveillance robustness should be measured against coupled sensing channels rather than against each modality in isolation. This shift also affects what counts as a plausible carrier. In RGB benchmarks, one can often discuss visual inconspicuousness. In dual-modal settings, however, the carrier has to negotiate two appearance spaces with different physics. Visibleāinfrared evasion is therefore less like ordinary texture design and more like coordinated sensor-facing engineering. 4.3 From static patches to wearable and controllable threats The third shift concerns deployment realism. A printed patch on a board or a fixed sticker on an object is an instructive starting point, but many surveillance-relevant attacks must live on clothes, accessories, or thermally manipulated materials. Person-detection papers already moved in this direction through adversarial garments and naturalistic textures [41, 16, 27]. Benchmark work such as REAP and recent camera-aware studies further emphasized that success under one camera or one distance is not enough to support strong claims about real use [12, 34, 11, 7]. Controllability pushes the threat model further. Triggered patches show that an attack need not be permanently active [44]. Thermally activated dual-modal clothing extends the same idea to visibleāinfrared surveillance [23], showing that wearability, cross-modal evasion, and user control can be combined in a single carrier. This matters because the timing of activation changes both the attackerās options and the defenderās assumptions. A system that appears stable during passive observation may still fail once the carrier is deliberately switched into an effective state. 2017ā2018: foundations. Universal patches, EoT-style robust examples, and detector-specific attacks establish the feasibility of physical attacks on modern vision systems [4, 3, 9, 5, 20, 42, 29]. 2019ā2020: surveillance entry points. Person-detection patches and physical tracking textures bring physical attacks into surveillance-like settings [28, 37, 39, 41]. 2021ā2023: infrared and identity-aware attacks. Thermal carriers, naturalistic garments, tracking attacks, and VI unified patches expand the threat model toward sensing diversity and temporal association [45, 46, 36, 33, 6, 17, 8, 19, 43, 35]. 2024ā2026: operational realism. Camera-aware attacks, full-distance evaluation, multi-view infrared attacks, multi-object tracking attacks, stronger dual-modal patches, and thermally activated clothing make persistence, cross-modality, and controllability central evaluation axes [34, 13, 14, 48, 49, 11, 7, 21, 22, 23]. Figure 2: A timeline view of the literature. The field has moved from detector-centric demonstrations toward temporally persistent, cross-modal, and wearable attacks that better match surveillance deployments. Table 3: Selected milestones that broadened the surveillance threat model. The table mixes earlier external work with more recent papers that highlight tracking, dual-modal sensing, and controllable wearables. Representative work Year Primary task Sensing modality Carrier type Why it mattered for surveillance Thys et al. [28] 2019 Person detection RGB Wearable adversarial patch Established physical attacks directly against automated surveillance cameras. Wiyatno and Xu [37] 2019 Visual object tracking RGB video Adversarial texture Showed that temporal objectives in tracking differ from one-frame detector evasion. Wei et al. [35] 2023 Cross-modal detection Visibleāinfrared Unified physical patch Demonstrated joint visibleāinfrared attacks in the physical world. Wei et al. [33] 2023 Thermal pedestrian detection Infrared Wearable HOTCOLD block Highlighted practical thermal carriers for human-centered evasion. PapMOT [21] 2024 Multi-object tracking RGB surveillance video Printable patch Brought physical patch attacks to identity association in multi-object tracking. Cdupatch [22] 2025 Dual-modal detection Visibleāinfrared Universal dual-modal patch Emphasized detector transfer and scene-level universality across two sensing channels. Thermally Activated Dual-Modal Adversarial Clothing [23] 2026 Dual-modal surveillance evasion Visibleāinfrared Wearable, thermally activated clothing Combined wearability and on-demand activation in a dual-modal surveillance setting. Taken together, these developments suggest that surveillance papers are most informative when they report how an attack behaves across time, across sensors, and under realistic carrying conditions. Per-frame RGB success remains a useful baseline, but it is no longer sufficient to characterize operational risk. 5 Evaluation Protocols, Defenses, and Open Problems As the threat model broadens, evaluation has to do more than report per-frame attack success. The literature already points toward this change, but protocols remain uneven. What matters in surveillance is not only whether a detector fails once, but whether failure persists over time, survives across sensing channels, and remains plausible under real deployment constraints. 5.1 What surveillance-grade evaluation should report Several ingredients recur across the most convincing papers. One is temporal persistence: tracking attacks and surveillance deployments depend on what happens across frames, not just within them [37, 19, 43, 21]. Another is cross-modal consistency: visible and thermal signals are often used together, so an RGB-only result may misstate practical risk in either direction [18, 35, 13, 14, 22, 23]. Physical performance is also highly sensitive to camera and distance variation, as emphasized by REAP, DAP, camera-agnostic attacks, and full-distance evaluation [12, 11, 34, 7]. Finally, carrier realism matters. A large printed patch, a visually plausible garment, and a selectively activated wearable each imply a different deployment story and a different defensive burden [28, 16, 27, 44, 23]. Stage 1 Digital tests Single model Per-frame metrics Stage 2 Lab physical tests Printed or wearable carrier Short-range views Stage 3 Operational variation Distance change Camera and ISP shifts Stage 4 Temporal persistence Tracking and identity metrics Multi-frame success Stage 5 Multimodal risk Visible + thermal On-demand activation Figure 3: A five-stage evaluation ladder for surveillance-relevant physical attacks. Most papers cover the early stages; far fewer cover all five. 5.2 Why defenses remain fragmented Compared with the attack literature, surveillance-specific defenses are still fragmented. Broad surveys and benchmarks already suggest why: a defense that works against one carrier or one sensor often fails to generalize across cameras, distances, or modalities [2, 30, 25, 10]. REAP and camera-agnostic studies argue that robustness claims should not be trusted without camera diversity [12, 34]. Tracking papers suggest that a defense also has to inspect identity continuity and association reliability [19, 43, 21]. Visibleāinfrared attacks point toward modality-aware redundancy rather than RGB-only countermeasures [35, 13, 22, 23]. In practice, this implies layered diagnostics rather than a single universal fix. Per-frame hardening can reduce obvious detector failures, temporal reasoning can flag suspicious switches or trajectory breaks, and cross-modal monitoring can use visibleāthermal disagreement as a cue. Deployment-oriented testing remains necessary as well, because many apparent improvements disappear once camera pipelines, scale, or carrier realism change. The central issue is therefore not choosing one defense category, but understanding how several partial defenses interact inside the full surveillance pipeline. 5.3 Open problems Persistent identity manipulation. Multi-object tracking attacks are still fewer in number than detector attacks, but they are often closer to real surveillance harm because they target identity continuity rather than one-frame visibility [19, 43, 26, 21]. More work is needed on physically realizable attacks that create sustained ID corruption and on defenses that can detect such corruption before it spreads through a track history. Cross-modal physical design. Visibleāinfrared evasion has been demonstrated, but the field still lacks a clear account of which physical attributes transfer across channels and which remain modality-specific [35, 13, 14, 22]. This is still a scientific question about sensing and carrier design, not just an engineering detail. Wearability and activation. Wearable attacks are no longer limited to printed clothing. Triggered patches and thermally activated garments show that the attack surface includes state changes and user control [44, 23]. Benchmarks should therefore model whether a carrier is always active, conditionally active, and easy or difficult to distinguish from ordinary apparel. From attack demonstrations to system audits. Many of the most useful papers in this area do more than maximize one attack metric. They expose missing evaluation axes and operational assumptions. Future surveillance robustness research would benefit from more work that behaves like a system audit, tying together sensing modality, time, identity, and carrier realism rather than optimizing a single detector-oriented objective [25, 21, 22, 23]. 6 Conclusion Physical adversarial attacks on surveillance systems are no longer well described by the older picture of a patch fooling a detector in a single RGB image. The literature now spans tracking, visibleāinfrared sensing, wearable carriers, and conditionally activated attacks. Taken together, these threads suggest that the relevant unit of analysis is the surveillance pipeline rather than the isolated model. This leads to a simple conclusion. Stronger attack papers should report persistence over time, behavior across sensing channels, and the realism of the deployed carrier. Stronger defenses should be judged by the same criteria. If future benchmarks move in that direction, they will provide a more faithful picture of what robustness means in real surveillance environments. References Akhtar and Mian [2018] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6:14410ā14430, 2018. Akhtar et al. [2021] Naveed Akhtar, Ajmal Mian, Navid Kardan, and Mubarak Shah. Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access, 9:155161ā155196, 2021. Athalye et al. [2018] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International Conference on Machine Learning, pages 284ā293, 2018. Brown et al. [2017] Tom B. Brown, Dandelion ManĆ©, Aurko Roy, MartĆn Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017. Chen et al. [2018] Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Chau. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. arXiv preprint arXiv:1804.05810, 2018. Chen et al. [2021] Xuesong Chen, Canmiao Fu, Feng Zheng, Yong Zhao, Hongsheng Li, Ping Luo, and Guo-Jun Qi. A unified multi-scenario attacking network for visual object tracking. Proceedings of the AAAI Conference on Artificial Intelligence, 35(2):1097ā1104, 2021. Cheng et al. [2024] Zhi Cheng, Zhanhao Hu, Yuqiu Liu, Jianmin Li, Hang Su, and Xiaolin Hu. Full-distance evasion of pedestrian detectors in the physical world. Advances in Neural Information Processing Systems, 37, 2024. Ding et al. [2021] Li Ding, Yongwei Wang, Kaiwen Yuan, Minyang Jiang, Ping Wang, Hua Huang, and Z. Jane Wang. Towards universal physical attacks on single object tracking. Proceedings of the AAAI Conference on Artificial Intelligence, 35(2):1236ā1245, 2021. Eykholt et al. [2018] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1625ā1634, 2018. Fang et al. [2024] Junbin Fang, You Jiang, Canjian Jiang, Zoe L. Jiang, Chuanyi Liu, and Siu-Ming Yiu. State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems. Expert Systems with Applications, 252:123761, 2024. Guesmi et al. [2024] Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24595ā24604, 2024. Hingun et al. [2023] Nabeel Hingun, Chawin Sitawarin, Jerry Li, and David Wagner. Reap: A large-scale realistic adversarial patch benchmark. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7860ā7871, 2023. Hu et al. [2024a] Chengyin Hu, Weiwen Shi, Tingsong Jiang, Wen Yao, Ling Tian, Xiaoqian Chen, Jingzhi Zhou, and Wen Li. Adversarial infrared blocks: A multi-view black-box attack to thermal infrared detectors in physical world. Neural Networks, 175:106310, 2024a. Hu et al. [2024b] Chengyin Hu, Weiwen Shi, Wen Yao, Tingsong Jiang, Ling Tian, Xiaoqian Chen, and Wen Li. Adversarial infrared curves: An attack on infrared pedestrian detectors in the physical world. Neural Networks, 178:106459, 2024b. Hu et al. [2021] Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Naturalistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7848ā7857, 2021. Hu et al. [2022] Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13307ā13316, 2022. Jia et al. [2021a] Shuai Jia, Yibing Song, Chao Ma, and Xiaokang Yang. Iou attack: Towards temporally coherent black-box adversarial attack for visual object tracking. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6709ā6718, 2021a. Jia et al. [2021b] Xinyu Jia, Chuang Zhu, Minzhen Li, Wenqi Tang, and Wenli Zhou. Llvip: A visible-infrared paired dataset for low-light vision. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3496ā3504, 2021b. Lin et al. [2021] Delv Lin, Qi Chen, Chengyu Zhou, and Kun He. Tracklet-switch adversarial attack against pedestrian multi-object tracking trackers. arXiv preprint arXiv:2111.08954, 2021. Liu et al. [2018] Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299, 2018. Long et al. [2024] Jiahuan Long, Tingsong Jiang, Wen Yao, Shuai Jia, Weijia Zhang, Weien Zhou, Chao Ma, and Xiaoqian Chen. Papmot: Exploring adversarial patch attack against multiple object tracking. In European Conference on Computer Vision, pages 128ā144, 2024. Long et al. [2025] Jiahuan Long, Wen Yao, Tingsong Jiang, Jiacheng Hou, Shuai Jia, Junqi Wu, Xiaoya Zhang, Xiaohu Zheng, and Chao Ma. Cdupatch: Color-driven universal adversarial patch attack for dual-modal visible-infrared detectors. In Proceedings of the 33rd ACM International Conference on Multimedia, pages 1462ā1470, 2025. Long et al. [2026] Jiahuan Long, Tingsong Jiang, Hanqing Liu, Chao Ma, and Wen Yao. Thermally activated dual-modal adversarial clothing against ai surveillance systems. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026. Luo et al. [2021] Wenhan Luo, Junliang Xing, Anton Milan, Xiaoqin Zhang, Wei Liu, and Tae-Kyun Kim. Multiple object tracking: A literature review. Artificial Intelligence, 293:103448, 2021. Nguyen et al. [2023] Kien Nguyen, Tharindu Fernando, Clinton Fookes, and Sridha Sridharan. Physical adversarial attacks for surveillance: A survey. arXiv preprint arXiv:2305.01074, 2023. Pang et al. [2024] Haibo Pang, Rongqi Ma, Jie Su, Cheng-Ming Liu, Yufei Gao, and Qun Jin. Blinding and blurring the multi-object tracker with adversarial perturbations. Neural Networks, 178:106408, 2024. Tan et al. [2021] Jia Tan, Nan Ji, Haidong Xie, and Xueshuang Xiang. Legitimate adversarial patches: Evading human eyes and detection models in the physical world. In Proceedings of the 29th ACM International Conference on Multimedia, pages 5307ā5315, 2021. Thys et al. [2019] Simen Thys, Wiebe Van Ranst, and Toon GoedemĆ©. Fooling automated surveillance cameras: Adversarial patches to attack person detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 49ā55, 2019. Wang et al. [2019] Derui Wang, Chaoran Li, Sheng Wen, Qing-Long Han, Surya Nepal, Xiangyu Zhang, and Yang Xiang. Daedalus: Breaking non-maximum suppression in object detection via adversarial examples. arXiv preprint arXiv:1902.02067, 2019. Wang et al. [2022] Donghua Wang, Wen Yao, Tingsong Jiang, Guijian Tang, and Xiaoqian Chen. A survey on physical adversarial attack in computer vision. arXiv preprint arXiv:2209.14262, 2022. Wang et al. [2023] Jiakai Wang, Xianglong Liu, Jin Hu, Donghua Wang, Siyang Wu, Tingsong Jiang, Yuanfang Guo, Aishan Liu, and Jiantao Zhou. Adversarial examples in the physical world: A survey. arXiv preprint arXiv:2311.01473, 2023. Wei et al. [2022] Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang, Hanxun Yu, Zhubo Li, Shināichi Satoh, Luc Van Gool, and Zheng Wang. Physical adversarial attack meets computer vision: A decade survey. arXiv preprint arXiv:2209.15179, 2022. Wei et al. [2023a] Hui Wei, Zhixiang Wang, Xuemei Jia, Yinqiang Zheng, Hao Tang, Shināichi Satoh, and Zheng Wang. Hotcold block: Fooling thermal infrared detectors with a novel wearable design. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 2907ā2915, 2023a. Wei et al. [2024a] Hui Wei, Zhixiang Wang, Kewei Zhang, Jiaqi Hou, Yuanwei Liu, Hao Tang, and Zheng Wang. Revisiting adversarial patches for designing camera-agnostic attacks against person detection. Advances in Neural Information Processing Systems, 37, 2024a. Wei et al. [2023b] Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. Unified adversarial patch for visible-infrared cross-modal attacks in the physical world. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023b. Wei et al. [2024b] Xingxing Wei, Jie Yu, and Yao Huang. Infrared adversarial patches with learnable shapes and locations in the physical world. International Journal of Computer Vision, 132(6):1928ā1944, 2024b. Wiyatno and Xu [2019] Rey Reza Wiyatno and Anqi Xu. Physical adversarial textures that fool visual object tracking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4824ā4833, 2019. Wojke et al. [2017] Nicolai Wojke, Alex Bewley, and Dietrich Paulus. Simple online and realtime tracking with a deep association metric. In IEEE International Conference on Image Processing, pages 3645ā3649, 2017. Wu et al. [2020] Zuxuan Wu, Ser-Nam Lim, Larry S. Davis, and Tom Goldstein. Making an invisibility cloak: Real world adversarial attacks on object detectors. In European Conference on Computer Vision, pages 1ā17, 2020. Xie et al. [2017] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision, 2017. Xu et al. [2020] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In European Conference on Computer Vision, pages 665ā681, 2020. Zhao et al. [2018] Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen. Seeing isnāt believing: Practical adversarial attack against object detectors. arXiv preprint arXiv:1812.10217, 2018. Zhou et al. [2023] Tao Zhou, Qi Ye, Wenhan Luo, Kaihao Zhang, Zhiguo Shi, and Jiming Chen. F&f attack: Adversarial attack against multiple object trackers by inducing false negatives and false positives. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4573ā4583, 2023. Zhu et al. [2023a] Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. Tpatch: A triggered physical adversarial patch. In 32nd USENIX Security Symposium, pages 3035ā3052, 2023a. Zhu et al. [2021] Xiaopei Zhu, Xiao Li, Jianmin Li, Zheyao Wang, and Xiaolin Hu. Fooling thermal infrared pedestrian detectors in real world using small bulbs. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 3616ā3624, 2021. Zhu et al. [2022] Xiaopei Zhu, Zhanhao Hu, Siyuan Huang, Jianmin Li, and Xiaolin Hu. Infrared invisible clothing: Hiding from infrared detectors at multiple angles in real world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13317ā13326, 2022. Zhu et al. [2023b] Xiaopei Zhu, Zhanhao Hu, Siyuan Huang, Jianmin Li, Xiaolin Hu, and Zheyao Wang. Hiding from infrared detectors in real world with adversarial clothes. Applied Intelligence, 53(23):29537ā29555, 2023b. Zhu et al. [2024a] Xiaopei Zhu, Xiao Li, Jianmin Li, Zheyao Wang, and Xiaolin Hu. Hiding from thermal imaging pedestrian detectors in the physical world. Neurocomputing, 564:126923, 2024a. Zhu et al. [2024b] Xiaopei Zhu, Yuqiu Liu, Zhanhao Hu, Jianmin Li, and Xiaolin Hu. Infrared adversarial car stickers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24284ā24293, 2024b. Zolfi et al. [2021] Alon Zolfi, Moshe Kravchik, Yuval Elovici, and Asaf Shabtai. The translucent patch: A physical and universal attack on object detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15232ā15241, 2021.