Adversarial attacks on thermal infrared imaging expose the risk of related
applications. Estimating the security of these systems is essential for safely
deploying them in the real world. In many cases, realizing the attacks in the
physical space requires elaborate special perturbations. These solutions are
often \emph{impractical} and \emph{attention-grabbing}. To address the need for
a physically practical and stealthy adversarial attack, we introduce
\textsc{HotCold} Block, a novel physical attack for infrared detectors that
hide persons utilizing the wearable Warming Paste and Cooling Paste. By
attaching these readily available temperature-controlled materials to the body,
\textsc{HotCold} Block evades human eyes efficiently. Moreover, unlike existing
methods that build adversarial patches with complex texture and structure
features, \textsc{HotCold} Block utilizes an SSP-oriented adversarial
optimization algorithm that enables attacks with pure color blocks and explores
the influence of size, shape, and position on attack performance. Extensive
experimental results in both digital and physical environments demonstrate the
performance of our proposed \textsc{HotCold} Block. \emph{Code is available:
\textcolor{magenta}{this https URL}}.

本研究通过热敏红外成像技术对抗攻击的实验，提出寻找「热 / 冷区块」的可行性，从而设计出实用的物理攻击方案。

HOTCOLD Block: 利用新颖的可穿戴设计欺骗热红外探测器

HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable  Design

Thermal infrared imaging is widely used in body temperature measurement,
security monitoring, and so on, but its safety research attracted attention
only in recent years. We proposed the infrared adversarial clothing, which
could fool infrared pedestrian detectors at different angles. We simulated the
process from cloth to clothing in the digital world and then designed the
adversarial "QR code" pattern. The core of our method is to design a basic
pattern that can be expanded periodically, and make the pattern after random
cropping and deformation still have an adversarial effect, then we can process
the flat cloth with an adversarial pattern into any 3D clothes. The results
showed that the optimized "QR code" pattern lowered the Average Precision (AP)
of YOLOv3 by 87.7%, while the random "QR code" pattern and blank pattern
lowered the AP of YOLOv3 by 57.9% and 30.1%, respectively, in the digital
world. We then manufactured an adversarial shirt with a new material: aerogel.
Physical-world experiments showed that the adversarial "QR code" pattern
clothing lowered the AP of YOLOv3 by 64.6%, while the random "QR code" pattern
clothing and fully heat-insulated clothing lowered the AP of YOLOv3 by 28.3%
and 22.8%, respectively. We used the model ensemble technique to improve the
attack transferability to unseen models.

本文提出了一种基于红外对抗技术的服装设计方法，设计出一种反可见光的 QR 码图案，制造出一件防检测衣服，在数字世界和物理世界的实验中，分别测试了适用性和迁移性。