AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches

AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches

The Thirty-ninth Annual Conference on Neural Information Processing Systems

https://openreview.net/forum?id=aPLc1nWWIU

Wenjun Ji, Yuxiang Fu, Luyang Ying, Deng-Ping Fan, Yuyi Wang, Ming-Ming Cheng, Ivor Tsang, Qing Guo

15 December 2025

Ji, W., Fu, Y., Ying, L., Fan, D., Wang, Y., Cheng, M., Tsang, I., & Guo, Q. (n.d.). AngleROCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches. The Thirty-ninth Annual Conference on Neural Information Processing Systems

Cutting-edge works have demonstrated that text-to-image (T2I) diffusion models can generate adversarial patches that mislead state-of-the-art object detectors in the physical world, revealing detectors’ vulnerabilities and risks. However, these methods neglect the T2I patches’ attack effectiveness when observed from different views in the physical world (i.e., angle robustness of the T2I adversarial patches). In this paper, we study the angle robustness of T2I adversarial patches comprehensively, revealing their angle-robust issues, demonstrating that texts affect the angle robustness of generated patches significantly, and task-specific linguistic instructions fail to enhance the angle robustness. Motivated by the studies, we introduce Angle-Robust Concept Learning (AngleRoCL), a simple and flexible approach that learns a generalizable concept (i.e., text embeddings in implementation) representing the capability of generating angle-robust patches. The learned concept can be incorporated into textual prompts and guides T2I models to generate patches with their attack effectiveness inherently resistant to viewpoint variations. Through extensive simulation and physical-world experiments on five SOTA detectors across multiple views, we demonstrate that AngleRoCL significantly enhances the angle robustness of T2I adversarial patches compared to baseline methods. Our patches maintain high attack success rates even under challenging viewing conditions, with over 50% average relative improvement in attack effectiveness across multiple angles. This research advances the understanding of physically angle-robust patches and provides insights into the relationship between textual concepts and physical properties in T2I-generated contents.

Publisher Copyright

This research / project is supported by the National Research Foundation, Singapore - AI Singapore Programme
Grant Reference no. : ISG4-GC-2023-0081B

This research / project is supported by the National Research Foundation, Singapore and Infocomm Media Development Authority - Trust Tech Funding Initiative
Grant Reference no. :

https://oar.a-star.edu.sg/communities-collections/articles/23011

1556-6013

Institute of High Performance Computing