Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper reviews physical adversarial attacks on AI surveillance systems, focusing on the interplay between temporal persistence, sensing modality (visible-infrared), carrier realism, and system-level objectives. It critiques the reliance on isolated per-frame benchmarks, arguing they fail to capture the holistic nature of surveillance systems. The authors propose a four-part taxonomy to organize prior work and highlight unresolved gaps, emphasizing the need for system-level evaluation under realistic physical deployment constraints.
Current benchmarks grossly overestimate the robustness of AI surveillance systems because they ignore the temporal, multi-modal, and physical constraints inherent in real-world deployments.
Physical adversarial attacks are increasingly studied in settings that resemble deployed surveillance systems rather than isolated image benchmarks. In these settings, person detection, multi-object tracking, visible--infrared sensing, and the practical form of the attack carrier all matter at once. This changes how the literature should be read. A perturbation that suppresses a detector in one frame may have limited practical effect if identity is recovered over time; an RGB-only result may say little about night-time systems that rely on visible and thermal inputs together; and a conspicuous patch can imply a different threat model from a wearable or selectively activated carrier. This paper reviews physical attacks from that surveillance-oriented viewpoint. Rather than attempting a complete catalogue of all physical attacks in computer vision, we focus on the technical questions that become central in surveillance: temporal persistence, sensing modality, carrier realism, and system-level objective. We organize prior work through a four-part taxonomy and discuss how recent results on multi-object tracking, dual-modal visible--infrared evasion, and controllable clothing reflect a broader change in the field. We also summarize evaluation practices and unresolved gaps, including distance robustness, camera-pipeline variation, identity-level metrics, and activation-aware testing. The resulting picture is that surveillance robustness cannot be judged reliably from isolated per-frame benchmarks alone; it has to be examined as a system problem unfolding over time, across sensors, and under realistic physical deployment constraints.