SwitchPatch: Physical Adversarial Attack Strategy with Switchable Adversarial Objectives

TL;DR

SwitchPatch introduces a static physical adversarial patch that can be dynamically triggered to produce different attack effects, enhancing stealth and adaptability without needing device access or costly equipment.

Contribution

It provides a theoretical and empirical analysis of switchable adversarial patches, a gradient-based framework for their creation, and extensive validation through UGV experiments.

Findings

SwitchPatch supports multiple attack objectives with a single static patch.

The trigger patterns enable low-cost, hardware-independent attack activation.

Experimental results demonstrate high effectiveness, transferability, and robustness.

Abstract

Physical adversarial patch (PAP) attacks attach carefully crafted patches to physical objects to manipulate a deployed model. However, existing PAP attacks suffer from several limitations. First, existing patches remain continuously active, which prevents selective targeting of specific attack objectives and compromises stealth. Second, these approaches require target device access or hardware configuration knowledge, and often rely on costly external equipment. To address these limitations, this paper introduces SwitchPatch, a novel physical adversarial attack strategy that employs a physically static adversarial patch yet can be triggered to produce dynamic and controllable attack effects. Unlike existing approaches, SwitchPatch can transition between states through predefined triggers, enabling adaptation to dynamic environments. Moreover, to improve stealth, we design two trigger patterns: one overlapping with the patch and another spatially separated from it. These triggers can be implemented at low cost without target device access or hardware configuration knowledge. We make three contributions. First, we provide theoretical and empirical analysis to establish the feasibility of SwitchPatch and characterize the number of attack objectives it can support. Second, we develop a gradient-based framework for static yet switchable attacks through diverse trigger patterns. Third, we conduct extensive Unmanned Ground Vehicle (UGV) experiments to validate the effectiveness, transferability, and robustness of SwitchPatch.