Does Adversarial Camouflage Really Work on Real Objects? An Empirical Study of Full-Coverage Camouflage on a Real Vehicle

1. Introduction

With the advancement of deep learning in recent years, deep neural networks have been widely applied in computer vision. By learning from large-scale labeled data, object detection models can effectively extract features of target objects from input images and accurately predict their categories and locations. These models serve as the foundational technology for various computer vision tasks, including instance segmentation, object tracking, and image captioning [1]. Compared with tasks that only require determining the existence of specific targets, object detection exhibits higher complexity. This complexity stems from additional requirements: beyond verifying object presence, detection demands precise localization via bounding boxes and accurate classification into categories. Furthermore, object detection must often address complex scenarios involving multiple objects, varying sizes, occlusions, and changes in orientation. Distinct from traditional techniques that rely on handcrafted features such as threshold-based edge detection or contour analysis [2], modern intelligent object detection leverages computer vision theories and cutting-edge artificial intelligence algorithms represented by deep learning, which automatically locate and classify objects in images or videos [3].

However, deep learning-based algorithms are susceptible to targeted adversarial attacks such as adversarial examples. Adding imperceptible tiny perturbations to input examples can cause well-trained models to fail, leading them to output incorrect predictions with high confidence [4]. This vulnerability stems from the intrinsic nature of deep learning models, which often over-rely on certain features of input data while lacking deep understanding of the data’s inherent structure and logic. As research has progressed, researchers have found that such attacks can be implemented not only in the digital domain but also in the physical domain. This poses significant security risks to deep learning models deployed in real-world physical scenarios, including autonomous driving systems[2,5,6] and face recognition systems [7,8,9].

These object detectors are not merely standalone systems. They constitute the perceptual foundation for a new generation of vision-language agents (VL agents), such as autonomous vehicles and embodied robots, which must interpret and interact with the physical world. The security of these agents, therefore, hinges critically on the robustness of their underlying perception models. Early-stage physical adversarial attacks primarily targeted image classification tasks [10] and were predominantly implemented in the form of patches [11,12,13,14,15]. With the rapid advancement of autonomous driving technology, research on adversarial attacks targeting object detection systems in driving scenarios has gained significant momentum. Among the various attack paradigms developed, many adversarial camouflage attack methods have emerged, including CAMOU [16], DAS [17], FCA [18], DTA [19], and ACTIVE [20].

However, some of these attack methods have only been validated in digital simulation environments. Even for those verified on model vehicles, their effectiveness lacks sufficient persuasiveness. Regarding validation efforts conducted on real vehicles, the adversarial perturbations are primarily implemented in the form of stickers [21]or strips[22]. Notably, studies that validate the effectiveness of full-coverage adversarial camouflage textures on real vehicles remain scarce in the publicly available literature. This scarcity can be attributed to the high costs and substantial time and effort requirements of such schemes, as well as the difficulty in ensuring consistency of external factors such as scene conditions, weather, and lighting during validation. Motivated by this research gap and building upon reference [23], we conduct a full-coverage test of an adversarial camouflage texture on a real vehicle. The primary objective of this work is to investigate the effectiveness of full-coverage adversarial camouflage textures in real-world scenarios on a real object, moving beyond model-based validations as shown in Figure 1. The key contributions of our work are summarized as follows:

• To the best of our knowledge, based on a comprehensive review of publicly available literature, this work represents the first attempt to quantitatively validate the effectiveness of full-coverage adversarial camouflage on real-world vehicles in the physical domain. We provide a scheme to transfer adversarial camouflage textures constructed in the digital domain onto a real-world vehicle, even though this vehicle differs from those employed during the training phase.
• We systematically validate the effectiveness of adversarial camouflage on a real vehicle across diverse real-world conditions. We conduct a detailed analysis of experimental results from both digital and physical domains, with primary focus on the adversarial camouflage applied to real vehicles.
• We provide empirical data and actionable insights for designing more robust vision-language perception systems by identifying and analyzing the key factors that undermine physical attack effectiveness, including texture transfer loss, environmental interference, and detector robustness.

2. Related Work

Adversarial examples are data samples that cause deep neural networks to make erroneous predictions with high confidence after applying human-imperceptible perturbations [24]. Based on implementation domain, adversarial attacks can be categorized into digital attacks and physical attacks. Digital attacks apply pixel-level perturbations in digital space and are mainly divided into gradient-based attacks (e.g., FGSM [25], PGD [26], MI-FGSM [27]) and optimization-based attacks (e.g., C&W [28], DeepFool [29]). These attacks can effectively bypass deep learning models, with some adversarial examples exhibiting cross-model transferability.

Physical attacks extend adversarial attacks to real-world scenarios, requiring deployment that addresses environmental noise, natural transformations, and physical space constraints [30]. Methods such as expectation over transformations [31] and robust physical perturbations [32] incorporate physical factors to enhance perturbation robustness. Early physical attacks were primarily implemented as adversarial patches [33], but single-view patches are susceptible to occlusions, viewing angle changes, and illumination variations.

To implement robust multi-view attacks, researchers have constructed adversarial perturbations on 3D models. CAMOU proposes iterative optimization for adversarial textures on 3D vehicles with complex shapes. MeshAdv [34] adopts the neural mesh renderer [35] as a differentiable renderer, using 3D shapes as the core carrier for adversarial perturbations. DAS disperses model attention from target regions to non-target regions via connected graphs, generating adversarial camouflage with semantic correlation to scenario context. FCA extends texture generation from local stickers to full-coverage textures on vehicle bodies. Cai et al. [23] proposed a data augmentation-based method that improves adversarial camouflage robustness. DTA and ACTIVE employ differentiable transformation networks to learn scene attributes from photorealistic renderers, enhancing image authenticity. With advances in 3D reconstruction, TT3D [36] leverages grid-based NeRF for targeted 3D adversarial examples with transferability. AdvNeRF [37] generates 3D adversarial meshes deceiving both visual and LiDAR perception. PGA [38] employs 3D Gaussian splatting for rapid scene reconstruction while addressing multi-view camouflage inconsistency. Our work focuses on evaluating adversarial camouflage textures on real objects to explore practical implications.

3. Digital to Physical Domain Mapping

3.1. Overview

Conducting adversarial camouflage experiments directly on real vehicles involves numerous practical challenges that greatly limit experimental scalability. First, the extremely high cost of full-vehicle wrapping restricts how many experimental iterations can be completed under standard research budgets. Second, complicated operational procedures such as vehicle preparation, texture application, and outdoor data collection lead to significant time consumption. Third, difficulties in controlling environmental variables including lighting, weather, and background clutter reduce the controllability and reproducibility of experiments, which in turn lowers the statistical reliability of the results. Moreover, a critical challenge arises from the mismatch between the 3D vehicle models used during adversarial texture training and the physical vehicle available for real-world testing. In our case, the adversarial camouflage was originally optimized for a specific vehicle model during the digital training phase (as detailed in reference [23]), but the actual test vehicle (Peugeot 307 sedan) differs in geometric structure, surface topology, and UV parameterization. This domain gap necessitates a systematic texture transfer methodology that preserves adversarial effectiveness while adapting to the target vehicle’s physical characteristics.

To address these challenges, we develop a complete digital-to-physical domain mapping framework illustrated in Figure 2. The framework comprises two primary modules: (1) an image processing module for cross-vehicle texture transfer, which handles the geometric adaptation between different vehicle models; (2) a super-resolution reconstruction module that upscales low-resolution texture patterns to high-fidelity, print-ready designs matching real vehicle dimensions. This systematic approach enables the practical deployment of adversarial camouflage on physical objects while minimizing information loss during the domain transfer process.

3.2. Texture Transfer

The texture transfer process addresses the fundamental challenge of adapting adversarial patterns optimized for one vehicle geometry to a physically different target vehicle. This adaptation must preserve both the adversarial information encoded in the texture and the visual continuity required for seamless application. We decompose this problem into three sequential operations performed in order: semantic alignment, regional scaling, and seam optimization.

Semantic Alignment. To establish correspondence between the source vehicle model (used during training) and the target vehicle (physical test platform), we perform preprocessing that aligns key semantic regions. This involves identifying and matching functional components (hood, doors, roof, trunk) between the two vehicle geometries and establishing consistent UV coordinate mappings in these regions. The alignment process standardizes both the directional orientation and proportional scaling of corresponding surface patches. For each semantic region, the UV coordinate transformation is expressed as:

$${\mathbf{u}}_t=D·S·{\mathbf{u}}_s+\mathbf{t}$$

(1)

where ${\mathbf{u}}_t$ and ${\mathbf{u}}_s$ represent the UV coordinate vectors in the target and source vehicle models respectively, D is the directional consistency matrix (typically encoding rotation or reflection to align texture orientation), $S=\mathrm{diag}(s_u,s_v)$ is the diagonal scaling matrix with factors $s_u$ and $s_v$ for horizontal and vertical directions, and t is the translation offset vector that accounts for region displacement. This formulation ensures that texture patterns maintain proper orientation and proportional scaling when mapped to the target vehicle’s UV space.

Regional Scaling. Different vehicle components (e.g., doors, roof panels) exhibit varying dimensional ratios between the source and target vehicles. To maintain pattern integrity while adapting to these geometric differences, we partition the texture into semantic regions and apply independent similarity transformations to each region. For each region, we employ a transformation that combines translation, rotation, and uniform scaling:

$$\left[\begin{array}{c}{x}^{\prime }\\ y^{\prime }\end{array}\right]=s·R\left(\theta \right)·\left[\begin{array}{c}x\\ y\end{array}\right]+\left[\begin{array}{c}{t}_x\\ t_y\end{array}\right]$$

(2)

where $R\left(\theta \right)$ is the 2×2 rotation matrix with angle $\theta$, s is the uniform scaling factor, and $(t_x,t_y)$is the translation vector. This region-wise approach prevents global distortions that would otherwise occur from attempting to fit the entire texture with a single transformation.

Seam Optimization. After regional scaling, discontinuities inevitably emerge at the boundaries between differently transformed regions. To ensure visual continuity in the final texture, we employ Poisson image fusion for seamless boundary blending. This technique solves for a smooth intensity field that respects the gradient structure of the source regions while matching boundary conditions from the target image. The optimization is formulated as solving the Poisson equation:

$${\nabla }^{2}I=\nabla ·\mathbf{v}\mathrm{within}\mathrm{region}\Omega$$

(3)

$$I=I_{\mathrm{target}}\mathrm{on}\mathrm{boundary}\partial \Omega$$

(4)

where v represents the gradient field from the source texture regions, and $I_{\mathrm{target}}$ specifies the boundary values from the target vehicle texture. This approach produces imperceptible transitions between regions while preserving the fine-grained adversarial patterns within each region.

3.3. Super-Resolution Reconstruction

The adversarial textures generated during the digital training phase are optimized at resolutions corresponding to the neural renderer’s output dimensions, which are typically designed for efficient gradient computation rather than high-fidelity printing. Furthermore, the texture patterns generated for scale model validation (as in reference [23]) have spatial dimensions approximately 1:24 relative to a full-size vehicle. Directly scaling these low-resolution patterns to real vehicle dimensions would result in severe quality degradation—visible pixelation, loss of fine texture details, and blurred adversarial perturbations—all of which compromise both visual fidelity and attack effectiveness. To address this resolution gap, we adopt SwinIR [39], a state-of-the-art image super-resolution model based on Swin Transformer architecture. SwinIR effectively reconstructs high-frequency details through hierarchical feature learning with shifted window attention mechanisms, making it particularly suitable for preserving the fine-grained adversarial perturbations essential to our attack. The super-resolution pipeline can be formulated as:

$$I_{\mathrm{high}-\mathrm{res}}=\mathrm{SwinIR}\left(\mathrm{Upsample}(I_{\mathrm{transferred}},S_{vh})\right)$$

(5)

where $I_{\mathrm{transferred}}$ is the texture obtained from the transfer process (Section 3.2), $\mathrm{Upsample}(·,S_{v}h)$ performs bicubic upsampling to match the physical scale $S_{v}h$ of the target vehicle (dimensions required for actual wrapping), and SwinIR(·) applies deep learning-based super-resolution for detail reconstruction and artifact suppression. This two-stage approach: first upsampling to target resolution, then applying learned refinement, produces the final high-resolution texture $I_{\mathrm{high}-\mathrm{res}}$ suitable for professional printing at true vehicle scale. This process is critical for maintaining adversarial information integrity when transitioning from digital simulation to physical fabrication.

3.4. Printability Constraints

Consumer-grade printers operate within limited color gamuts defined by their CMYK ink systems, which cannot reproduce all colors representable in digital RGB space. Adversarial textures optimized purely in the digital domain may contain colors outside this printable range, leading to unintended color shifts during physical fabrication that degrade attack effectiveness. To ensure accurate color reproduction, we incorporate the Non-Printable Score (NPS) metric [33] into our texture validation pipeline. The NPS quantifies how far each pixel’s color deviates from the nearest printable color in the printer’s gamut. For a given texture T with pixel set $p_{\mathrm{texture}}$, the score is computed as:

$$\mathrm{NPS}=\sum _{p_{\mathrm{texture}}\in T}\underset{c_{\mathrm{printable}}\in C}{min}\parallel p_{\mathrm{texture}}-c_{\mathrm{printable}}\parallel$$

(6)

where C represents the set of colors achievable by the target printer, and$\left|\right|·\left|\right|$ denotes the Euclidean distance in color space (typically CIE Lab space for perceptual uniformity). A high NPS indicates substantial deviation from printable colors, signaling high risk of color distortion during fabrication. Conversely, a low NPS confirms that the texture lies predominantly within the printer’s reproducible range.

In our implementation, we evaluate the NPS of the transferred and super-resolved texture before finalizing the print design. This validation step provides quality assurance that the physical manifestation will closely match the digital design, thereby minimizing adversarial information loss during the digital-to-physical transition. When necessary, color adjustments can be made to reduce the NPS while preserving adversarial effectiveness to the extent possible.

4. Experiments

4.1. Experimental Setup

We apply the adversarial camouflage texture to a Peugeot 307 sedan as the test platform. The texture carrier is PVC matte color-change film, selected specifically for its low-reflectivity properties that reduce specular highlights under natural sunlight. Specular reflection would otherwise introduce spurious high-frequency noise that dilutes adversarial patterns, potentially compromising attack effectiveness.

Data Collection. All experiments were conducted under outdoor natural lighting conditions to capture authentic environmental variability. We designed a data collection plan to ensure comprehensive coverage of viewing angles and distances. The vehicle was positioned with its front orientation sequentially aligned to four cardinal directions (north, south, east, west). For each orientation, we captured images from multiple viewpoints: (1)Ground-level circular sampling: Images were captured while circumnavigating the vehicle at two distance levels (close range and far range); (2)Elevated viewpoint: Additional images were captured from a rooftop position at approximately 2 story elevation to simulate overhead surveillance scenarios. Figure 3 shows the shooting settings in a real scene. A total of 394 images were collected from multiple angles, including both clean samples (vehicle without adversarial camouflage) and adversarial samples (vehicle with adversarial camouflage). Examples of the collected images showing the vehicle before and after the application of the full-coverage adversarial camouflage are presented in Figure 4.

Evaluated Detectors. We selected five state-of-the-art object detection models spanning different architectural paradigms: YOLOv5, YOLOv8 and YOLO11(representing single-stage anchor-based detectors at different maturity levels) [40], SSD (multi-scale feature pyramid approach) [41], Faster R-CNN (two-stage region-based method) [42], and RT-DETR (transformer-based detection) [43]. All models were evaluated using publicly available pre-trained weights from the MS COCO dataset [44] without fine-tuning, ensuring that results reflect the models’ general object detection capabilities rather than domain-specific adaptations. This detector selection provides broad coverage of contemporary detection paradigms and facilitates insights into the transferability of our adversarial camouflage across architectural families. The confidence threshold is set to 0.25, and the non-maximum suppression (NMS) threshold is set to 0.5.

4.2. Evaluation Metrics and Main Results

4.2.1. Evaluation Metrics

Due to the temporal gap between capturing clean and adversarial sample sets (approximately one week, accounting for film production and installation), as well as inherent environmental variability (dynamic lighting, camera positioning uncertainties), perfect pixel-by-pixel correspondence between clean and adversarial images is not achievable. Consequently, we adopt aggregate detection performance metrics that characterize overall model behavior across each dataset:

$$P@0.5={\displaystyle \frac{TP}{TP+FP}}$$

(7)

where $TP$ is the count of true positive detections and FP is the count of false positive detections.

$$\mathrm{MR}={\displaystyle \frac{FN}{TP+FN}}$$

(8)

where $FN$ is the count of false negatives (missed detections).

Average Precision (AP) is defined as the area enclosed under the precision-recall (P-R) curve in object detection tasks, and serves as a metric for quantifying the overall detection accuracy of the model at different recall levels. These metrics provide complementary perspectives on attack impact: P@0.5 captures the detector’s tendency to produce spurious or mislocalized detections, while MR directly quantifies evasion success. Higher MR and lower AP on adversarial examples (relative to clean samples) indicate effective adversarial perturbation.

4.2.2. Main Results

Table 1 demonstrates architecture-dependent effectiveness of adversarial camouflage on real vehicles. All detectors show reduced AP₅₀, with declines ranging from 1.00% (SSD) to 5.40% (Faster R-CNN), confirming the adversarial impact. For missing rate, YOLO-series detectors exhibit clear vulnerability: YOLOv5 shows the most severe degradation (MR increasing from 3.87% to 17.00%), while newer versions (YOLOv8, YOLO11) demonstrate progressively improved robustness. This aligns with the adversarial texture being optimized against YOLOv3. RT-DETR shows moderate robustness with only a 2.50 percentage point MR increase, likely due to its transformer-based architecture relying on global features rather than local textures. Notably, SSD and Faster R-CNN show decreased MR despite reduced AP₅₀. This counterintuitive result can be attributed to their high baseline MR, architectural differences in feature dependencies, and the one-week temporal gap between clean and adversarial image captures. These findings highlight that adversarial transferability is highly architecture-dependent, with implications for robust multi-model detection systems.

Figure 5 illustrates representative cases of successful and failed attacks. In successful attack cases, detectors exhibit two distinct failure modes: (1) complete detection failure, where the vehicle remains undetected; or (2) semantic misclassification into other categories such as ’vase’, ’skateboard’, or ’suitcase’. Notably, uncovered vehicle components including windows, wheels, and headlights occasionally serve as residual detection cues, leading to misclassification into related vehicle categories rather than complete evasion. This observation suggests that achieving full-coverage adversarial camouflage on all vehicle surfaces remains challenging while maintaining vehicle functionality.

In failed attack cases, detectors successfully localize the vehicle despite the adversarial texture, though with noticeably reduced confidence scores (e.g., confidence decreasing from 0.90 to 0.74 in Figure 5b). This indicates that adversarial patterns disrupt learned feature representations to some extent, yet the vehicle’s overall geometric silhouette combined with uncovered functional components provide sufficient visual cues for detection. The preserved detection capability in these cases aligns with our finding that certain architectures (particularly RT-DETR and newer YOLO versions) demonstrate greater robustness to texture-based perturbations.

Figure 6 presents precision-recall curves(PR curves) that quantitatively confirm the performance degradation across all tested detectors. The reduced area under the PR curves for adversarial camouflaged vehicles demonstrates consistent attack impact, with YOLOv5 exhibiting the most pronounced degradation.

4.3. Evaluation of Digital-to-Physical Domain Performance

We systematically evaluate adversarial camouflage effectiveness across three experimental settings: digital simulation, scaled physical models, and full-scale real vehicles. Table 2 summarizes the comparative results. Our experiments reveal a progressive degradation of attack efficacy as adversarial camouflage transitions from digital to physical domains. In digital simulation, the camouflage achieves substantial disruption of detector performance, with miss rates increasing from baseline values of approximately 28-30% to 59-63% across YOLO-series detectors. Physical model experiments demonstrate intermediate attack effectiveness, suggesting successful domain transfer despite geometric and material constraints. However, real vehicle deployment exhibits markedly attenuated performance, with YOLOv5 miss rate increasing only from 3.87% to 17.00%, representing a reduction in attack magnitude of approximately 60% compared to digital simulation.

4.4. Evaluation Under Varying Lighting Conditions

To assess the influence of ambient illumination, we collected 200 additional images under diminishing natural light from late afternoon to evening twilight. Representative images are shown in Figure 4.

Table 3 presents evening lighting results. Note that evening metrics use P@0.5, while daytime results in Tab. Table 1 report AP₅₀; despite this difference, performance trends remain comparable. Under evening lighting, detectors show substantial recovery compared to their daytime adversarial performance. Both YOLOv5 and Faster R-CNN exhibit improved precision and significantly reduced miss rates. SSD demonstrates complete recovery with miss rate dropping to 0. These patterns indicate that diminished illumination weakens adversarial camouflage effectiveness. Reduced lighting prevents the camera from capturing fine-grained adversarial texture details, causing detectors to rely more on coarse geometric features such as vehicle silhouettes, wheels, and windows that are more robust to texture perturbations.

4.5. Drone Aerial Evaluation

Using a DJI Mini 4 Pro drone, we captured 26 overhead images to assess attack performance from aerial perspectives. Representative detection results appear in Figure 7.

From overhead viewpoints, detectors produce striking misclassification patterns. YOLOv5 labels the camouflaged vehicle as ’snowboard’, YOLOv9 identifies it as ’cell phone’, Faster R-CNN detects ’bottle’, while DETR also outputs ’cell phone’. Such unrelated category assignments suggest the camouflage successfully interferes with high-level semantic recognition of vehicles viewed from above. The enhanced vulnerability from overhead angles relates to viewing geometry. Top-down perspectives show mainly the roof surface, which carries full adversarial texture coverage, while hiding ground-level features like wheels and grilles that normally aid identification, detectors then rely primarily on top-surface top-surface texture we specifically optimized for attack. Ground-level views, by contrast, expose unmodified components such as windows, wheels, and bumpers that help maintain detection or at least produce related misclassifications like ’truck’ or ’bus’.

Attack effectiveness clearly depends on viewing angle, with overhead positions proving especially problematic. The fact that single-stage, two-stage, and transformer-based detectors all show consistent misclassification behavior points to a fundamental vulnerability rather than an architecture-specific weakness. This matters particularly for aerial surveillance applications where top-down viewing dominates.

5. Discussion

Experimental results from previous sections indicate that although adversarial camouflage on real vehicles in the physical world exhibits a measurable attack effect, this effect is not pronounced and is substantially weaker than attack effects observed in digital domain simulation experiments and model car experiments in laboratory environments as reported in reference [23]. Analysis suggests that this outcome may result from information loss during processing, environmental noise interference, and the strong robustness of detection weights. This performance degradation reveals fundamental challenges in translating digitally-optimized perturbations to physical deployments, with critical implications for vision-based autonomous systems.

The digital-to-physical translation bottleneck stems from multiple factors. Vehicle model discrepancies necessitate texture transfer operations that degrade adversarial information through stretching, cropping, and seam optimization. Super-resolution reconstruction from 1:24 model scale to full-scale vehicles introduces clarity degradation and geometric distortion. More critically, physical instantiation encounters intrinsic limitations: natural illumination variations, material reflectance properties, printing quantization, and environmental noise substantially alter how adversarial textures appear to camera sensors versus simulated renderings. Moreover, detectors trained on MS COCO, a large-scale dataset containing hundreds of thousands of instances across diverse scenes and viewpoints, may inherently exhibit considerable robustness. This may suggest that large-scale heterogeneous training could naturally confer resistance to physical attacks, as models might develop feature representations favoring geometric and structural cues over texture-based patterns.

These findings directly address safety challenges for VL agents operating in physical environments. Unlike digital prompt injections targeting language interfaces, physical camouflage attacks target the perception module grounding agent behavior in real-world observations. The view-dependent vulnerability patterns we observe, especially the pronounced overhead susceptibility, have direct relevance for autonomous vehicles, aerial drones, and robotic systems requiring reliable multi-view perception.

The substantial sim-to-real gap suggests that while digital-domain attacks remain highly effective, real-world deployment substantially attenuates adversarial impacts through environmental interference and model robustness. For emerging VL agents in safety-critical applications, ensuring robust visual perception against intentional physical manipulation becomes essential.

6. Conclusions

In this work, we advanced full-coverage adversarial camouflage from simulation to physical domain verification of real objects for the first time, tested the actual effectiveness of adversarial camouflage on a real vehicle, and collected and evaluated them in various scenarios. Experiments have shown that adversarial camouflage can also affect the performance of object detection models in the real physical world, but this effect is not as significant as in digital domain experiments due to inconsistencies in vehicle models, natural environmental light changes, and imaging losses. We hope our experimental results and analysis provide scheme references and data support for future research on adversarial camouflage applications in the real physical world and further promote the design of robust perception systems for real-world intelligent systems.