BadPatch: Diffusion-Based Generation of Physical Adversarial Patches

TL;DR

BadPatch introduces a diffusion-based framework for creating customizable, natural-looking physical adversarial patches that balance stealthiness and attack effectiveness, enabling more realistic evasion of person detectors.

Contribution

We propose BadPatch, a novel diffusion-based method for generating naturalistic, customizable adversarial patches with flexible shapes and starting from reference images.

Findings

Achieves attack success comparable to state-of-the-art methods.

Produces patches with natural appearance and high stealthiness.

Creates the AdvT-shirt-1K dataset for future defense research.

Abstract

Physical adversarial patches printed on clothing can enable individuals to evade person detectors, but most existing methods prioritize attack effectiveness over stealthiness, resulting in aesthetically unpleasing patches. While generative adversarial networks and diffusion models can produce more natural-looking patches, they often fail to balance stealthiness with attack effectiveness and lack flexibility for user customization. To address these limitations, we propose BadPatch, a novel diffusion-based framework for generating customizable and naturalistic adversarial patches. Our approach allows users to start from a reference image (rather than random noise) and incorporates masks to create patches of various shapes, not limited to squares. To preserve the original semantics during the diffusion process, we employ Null-text inversion to map random noise samples to a single input image and generate patches through Incomplete Diffusion Optimization (IDO). Our method achieves attack performance comparable to state-of-the-art non-naturalistic patches while maintaining a natural appearance. Using BadPatch, we construct AdvT-shirt-1K, the first physical adversarial T-shirt dataset comprising over a thousand images captured in diverse scenarios. AdvT-shirt-1K can serve as a useful dataset for training or testing future defense methods.