{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T06:19:13Z","timestamp":1782368353295,"version":"3.54.5"},"reference-count":43,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T00:00:00Z","timestamp":1761523200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100020771","name":"Young Scientists Fund of the National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["52302506"],"award-info":[{"award-number":["52302506"]}],"id":[{"id":"10.13039\/501100020771","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62171361"],"award-info":[{"award-number":["62171361"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J. Imaging"],"abstract":"<jats:p>This paper proposes a novel adversarial patch-generation method for infrared images, focusing on enhancing the robustness and transferability of infrared adversarial patches. To improve the flexibility and diversity of the generation process, a Bernoulli random dropout strategy is adopted. The loss function integrates multiple components, including target hiding loss, smoothing loss, structural similarity loss, and patch pixel value loss, ensuring that the generated patches maintain low texture complexity and natural visual features. During model training, the Grad-CAM algorithm is employed to identify the critical regions of interest in the target detector, where adversarial patches are applied to maximize the attack effectiveness. Furthermore, affine transformations and random erasing operations are introduced to increase the diversity and adaptability of patches, thereby enhancing their effectiveness across different scenarios. Experimental results demonstrate that the proposed GADP (Generative Adversarial Patch based on Bernoulli Random Dropout and Loss Function Optimization) algorithm achieves a high Attack Success Rate of 75.8% on various target detection models, significantly reducing the average precision (AP). Specifically, the AP of the YOLOv5s model drops from 81.3% to 15.1%. Compared with existing adversarial attack methods such as advYOLO Patch and QR Attack, GADP exhibits superior transferability and attack performance, reducing the Average Precision of multiple detection models to around 40%. The proposed method is not only theoretically innovative but also shows potential practical value, particularly in tasks such as unmanned aerial vehicle (UAV) detection and ground security under low-visibility environments. This study provides new insights into adversarial attack research for infrared target recognition.<\/jats:p>","DOI":"10.3390\/jimaging11110378","type":"journal-article","created":{"date-parts":[[2025,10,29]],"date-time":"2025-10-29T02:23:28Z","timestamp":1761704608000},"page":"378","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Investigation of the Robustness and Transferability of Adversarial Patches in Multi-View Infrared Target Detection"],"prefix":"10.3390","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8483-8684","authenticated-orcid":false,"given":"Qing","family":"Zhou","sequence":"first","affiliation":[{"name":"School of Defence Science and Technology, Xi\u2019an Technological University, Xi\u2019an 710021, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhongchen","family":"Zhou","sequence":"additional","affiliation":[{"name":"Unmanned System Research Institute, Northwestern Polytechnical University, Xi\u2019an 710072, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhaoxiang","family":"Zhang","sequence":"additional","affiliation":[{"name":"Unmanned System Research Institute, Northwestern Polytechnical University, Xi\u2019an 710072, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-7970-9285","authenticated-orcid":false,"given":"Wei","family":"Luo","sequence":"additional","affiliation":[{"name":"Science and Technology Innovation Center, China Ship Development and Design Center, Wuhan 834099, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Feng","family":"Xiao","sequence":"additional","affiliation":[{"name":"School of Defence Science and Technology, Xi\u2019an Technological University, Xi\u2019an 710021, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sijia","family":"Xia","sequence":"additional","affiliation":[{"name":"Science and Technology Innovation Center, China Ship Development and Design Center, Wuhan 834099, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chunjia","family":"Zhu","sequence":"additional","affiliation":[{"name":"Science and Technology Innovation Center, China Ship Development and Design Center, Wuhan 834099, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Long","family":"Wang","sequence":"additional","affiliation":[{"name":"Aviation Engineering School, Air Force Engineering University, Xi\u2019an 710038, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,10,27]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"141861","DOI":"10.1109\/ACCESS.2021.3120870","article-title":"Yolo-firi: Improved yolov5 for infrared image object detection","volume":"9","author":"Li","year":"2021","journal-title":"IEEE Access"},{"key":"ref_2","first-page":"102912","article-title":"Object detection from UAV thermal infrared images and videos using YOLO models","volume":"112","author":"Jiang","year":"2022","journal-title":"Int. J. Appl. Earth Obs. Geoinf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"61113","DOI":"10.1109\/ACCESS.2024.3395118","article-title":"How deep learning sees the world: A survey on adversarial attacks & defenses","volume":"12","author":"Costa","year":"2024","journal-title":"IEEE Access"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Zhang, Y., Qi, J., Bin, K., Wen, H., Tong, X., and Zhong, P. (2022). Adversarial patch attack on multi-scale object detection for UAV remote sensing images. Remote Sens., 14.","DOI":"10.20944\/preprints202210.0131.v1"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Li, Y., Fan, X., Sun, S., Lu, Y., and Liu, N. (2024). Categorical-Parallel Adversarial Defense for Perception Models on Single-Board Embedded Unmanned Vehicles. Drones, 8.","DOI":"10.3390\/drones8090438"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"591","DOI":"10.9766\/KIMST.2021.24.6.591","article-title":"Adversarial Attacks for Deep Learning-Based Infrared Object Detection","volume":"24","author":"Kim","year":"2021","journal-title":"J. Korea Inst. Mil. Sci. Technol."},{"key":"ref_7","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Liu, J., Levine, A., Lau, C.P., Chellappa, R., and Feizi, S. (2022, January 18\u201324). Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01455"},{"key":"ref_9","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Hu, Z., Huang, S., Zhu, X., Sun, F., Zhang, B., and Hu, X. (2022, January 18\u201324). Adversarial texture for fooling person detectors in the physical world. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01295"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Kurakin, A., Goodfellow, I.J., and Bengio, S. (2018). Adversarial examples in the physical world. Artificial Intelligence Safety and Security, CRC.","DOI":"10.1201\/9781351251389-8"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Tarchoun, B., Alouani, I., Khalifa, A.B., and Mahjoub, M.A. (2021, January 28\u201330). Adversarial attacks in a multi-view setting: An empirical study of the adversarial patches inter-view transferability. Proceedings of the 2021 International Conference on Cyberworlds (CW), Caen, France.","DOI":"10.1109\/CW52790.2021.00057"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Zhu, Z., Chen, H., Wang, X., Zhang, J., Jin, Z., Choo, K.-K.R., Shen, J., and Yuan, D. (2024, January 18\u201320). GE-AdvGAN: Improving the transferability of adversarial samples by gradient editing-based adversarial generative model. Proceedings of the 2024 SIAM International Conference on Data Mining (SDM), Houston, TX, USA.","DOI":"10.1137\/1.9781611978032.81"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Zhu, R., Ma, S., He, L., and Ge, W. (2024). Ffa: Foreground feature approximation digitally against remote sensing object detection. Remote Sens., 16.","DOI":"10.20944\/preprints202407.1195.v1"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201326). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (sp), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"18419","DOI":"10.1109\/TNNLS.2023.3315414","article-title":"Gradient correction for white-box adversarial attacks","volume":"35","author":"Liu","year":"2023","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1016\/j.ins.2022.07.157","article-title":"Di-aa: An interpretable white-box attack for fooling deep neural networks","volume":"610","author":"Wang","year":"2022","journal-title":"Inf. Sci."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Zhang, H., Shao, W., Liu, H., Ma, Y., Luo, P., Qiao, Y., and Zhang, K. (2024). Avibench: Towards evaluating the robustness of large vision-language model on adversarial visual-instructions. arXiv.","DOI":"10.1109\/TIFS.2024.3520306"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"998","DOI":"10.1109\/ACCESS.2021.3138338","article-title":"Back in black: A comparative evaluation of recent state-of-the-art black-box attacks","volume":"10","author":"Mahmood","year":"2021","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Liu, Q., Zhou, S., Deng, W., Wu, Z., and Qiu, S. (2024). Efficient Ensemble Adversarial Attack for a Deep Neural Network (DNN)-Based Unmanned Aerial Vehicle (UAV) Vision System. Drones, 8.","DOI":"10.3390\/drones8100591"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Huang, G., Sun, Y., Liu, Z., Sedra, D., and Weinberger, K.Q. (2016, January 11\u201314). Deep networks with stochastic depth. Proceedings of the Computer Vision\u2013ECCV 2016: 14th European Conference, Amsterdam, The Netherlands. Proceedings, Part IV.","DOI":"10.1007\/978-3-319-46493-0_39"},{"key":"ref_22","unstructured":"Nie, A. (2016). Stochastic Dropout: Activation-Level Dropout to Learn Better Neural Language Models, Stanford University."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Selvaraju, R.R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. (2017, January 22\u201329). Grad-cam: Visual explanations from deep networks via gradient-based localization. Proceedings of the IEEE International Conference on Computer Vision, Venice, Italy.","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Xiao, C., Li, B., Zhu, J.-Y., He, W., Liu, M., and Song, D. (2018). Generating adversarial examples with adversarial networks. arXiv.","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P. (2016, January 27\u201330). Deepfool: A simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_27","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv."},{"key":"ref_28","first-page":"10081","article-title":"A single gradient step finds adversarial examples on random two-layers neural networks","volume":"34","author":"Bubeck","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. (2018, January 18\u201323). Boosting adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref_30","unstructured":"Sutskever, I., Martens, J., Dahl, G., and Hinton, G. (2013, January 17\u201319). On the importance of initialization and momentum in deep learning. Proceedings of the International Conference on Machine Learning, Atlanta, GA, USA."},{"key":"ref_31","unstructured":"Liu, X., Yang, H., Liu, Z., Song, L., Li, H., and Chen, Y. (2018). Dpatch: An adversarial patch attack on object detectors. arXiv."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., and Yuille, A. (2017, January 22\u201329). Adversarial examples for semantic segmentation and object detection. Proceedings of the IEEE International Conference on Computer Vision, Venice, Italy.","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref_33","unstructured":"Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. (2018, January 10\u201315). Synthesizing robust adversarial examples. Proceedings of the International Conference on Machine Learning, Stockholm, Sweden."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Sharif, M., Bhagavatula, S., Bauer, L., and Reiter, M.K. (2016, January 24\u201328). Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. Proceedings of the 2016 ACM Sigsac Conference on Computer and Communications Security, Vienna, Austria.","DOI":"10.1145\/2976749.2978392"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Thys, S., Van Ranst, W., and Goedem\u00e9, T. (2019, January 16\u201317). Fooling automated surveillance cameras: Adversarial patches to attack person detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops, Long Beach, CA, USA.","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Zhu, X., Hu, Z., Huang, S., Li, J., and Hu, X. (2022, January 18\u201324). Infrared invisible clothing: Hiding from infrared detectors at multiple angles in real world. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01296"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. (2018, January 18\u201323). Robust physical-world attacks on deep learning visual classification. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Jia, E., Xu, Y., Zhang, Z., Zhang, F., Feng, W., Dong, L., Hui, T., and Tao, C. (2023). An adaptive adversarial patch-generating algorithm for defending against the intelligent low, slow, and small target. Remote Sens., 15.","DOI":"10.3390\/rs15051439"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"600","DOI":"10.1109\/TIP.2003.819861","article-title":"Image quality assessment: From error visibility to structural similarity","volume":"13","author":"Wang","year":"2004","journal-title":"IEEE Trans. Image Process."},{"key":"ref_40","unstructured":"Zhong, Z., Zheng, L., Kang, G., Li, S., and Yang, Y. (2026, January 20\u201327). Random erasing data augmentation. Proceedings of the AAAI Conference on Artificial Intelligence, Singapore."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Wang, C.-Y., Bochkovskiy, A., and Liao, H.-Y.M. (2023, January 17\u201324). YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.00721"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Liu, W., Anguelov, D., Erhan, D., Szegedy, C., Reed, S., Fu, C.-Y., and Berg, A.C. (2016, January 11\u201314). Ssd: Single shot multibox detector. Proceedings of the European Conference on Computer Vision, Amsterdam, The Netherlands.","DOI":"10.1007\/978-3-319-46448-0_2"},{"key":"ref_43","first-page":"1137","article-title":"Faster r-cnn: Towards real-time object detection with region proposal networks","volume":"28","author":"Ren","year":"2015","journal-title":"Adv. Neural Inf. Process. Syst."}],"container-title":["Journal of Imaging"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2313-433X\/11\/11\/378\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,29]],"date-time":"2025-10-29T05:12:40Z","timestamp":1761714760000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2313-433X\/11\/11\/378"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,27]]},"references-count":43,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["jimaging11110378"],"URL":"https:\/\/doi.org\/10.3390\/jimaging11110378","relation":{},"ISSN":["2313-433X"],"issn-type":[{"value":"2313-433X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,27]]}}}