Budget-aware adversarial patches fool YOLOv5, Faster R-CNN, and YOLOS

A team of researchers (Pedram MohajerAnsari et al.) has developed a budget-aware adaptive adversarial patch attack for black-box object detectors, accepted at ICIP 2026. Traditional adversarial patches often require many queries or large visual footprints. This work addresses three gaps: joint optimization of patch location, texture, and size under tight query budgets; linking success to visual footprint; and separating robustness evaluations from plain-view suppression. The method combines a lightweight Contextual Thompson-Sampling placer with NES-style pixel updates, growing the patch only when progress stalls. A strict plain-image suppression test anchors reporting, while EOT is audited separately. Optional appearance and printability weights expose strength-visibility trade-offs.

Across YOLOv5 (CNN), Faster R-CNN (CNN), and YOLOS (transformer), the attack achieves strong suppression on CNN detectors and substantial suppression on the transformer-based detector, using compact patches. Query-footprint trade-offs are clearly shown compared to fixed-size and heuristic baselines. A print-capture pilot further demonstrates transfer across unseen physical objects and viewpoints, proving practical relevance. The work highlights a growing arms race between adversarial patches and real-world object detection systems, with implications for security in autonomous driving, surveillance, and any vision-based AI.