AdvCam: From Adversarial Camouflage to Advanced Cameras

• AdvCam is a multifaceted term denoting adversarial camouflage, anti-adversarial attribution maps, and advanced camera architectures in gamma-ray instrumentation.
• The adversarial camouflage variant uses a two-stage pipeline with style-conditioned perturbations to fool DNN classifiers and enable privacy protection and robustness evaluation.
• In CTAO instrumentation, AdvCam refers to a SiPM-based, fully digital camera system with innovative multi-level FPGA trigger logic that lowers energy thresholds and enhances sensitivity.

AdvCam is a context-dependent term in arXiv literature rather than a single unified concept. In computer vision, it denotes Adversarial Camouflage, a physical-world attack that hides adversarial perturbations in natural styles so that a DNN image classifier is driven toward a wrong label (Duan et al., 2020). In explainable autonomous-driving research, the same attack is used to evaluate an Inductive Logic Programming stop-sign detector that relies on high-level symbolic predicates rather than raw pixels (Chaghazardi et al., 2023). A closely related capitalization, AdvCAM, denotes Anti-Adversarially Manipulated CAM, an attribution-map construction that perturbs an image in the opposite direction from an adversarial attack to enlarge object coverage in weakly and semi-supervised semantic segmentation and object localization (Lee et al., 2021, Lee et al., 2022). In astroparticle instrumentation, AdvCam instead names the next-generation advanced camera for the Large-Sized Telescopes of the Cherenkov Telescope Array Observatory, based on SiPMs and a fully digital trigger chain (Heller, 16 Sep 2025, Burmistrov, 1 Oct 2025).

1. Terminological scope and disambiguation

The literature uses visually similar spellings for three unrelated constructs. Context is therefore essential when interpreting claims about “AdvCam” or “AdvCAM.”

Term	Domain	Meaning
AdvCam	Adversarial ML	Adversarial Camouflage
AdvCAM	Weak supervision / explainability	Anti-Adversarially Manipulated CAM
AdvCam	Gamma-ray instrumentation	Advanced camera for CTAO LSTs

The first usage comes from the paper “Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles,” which formulates a style-conditioned physical attack on image classifiers (Duan et al., 2020). The second comes from “Anti-Adversarially Manipulated Attributions for Weakly and Semi-Supervised Semantic Segmentation” and its extension to object localization, where AdvCAM is an attribution-map generation procedure rather than an attack (Lee et al., 2021, Lee et al., 2022). The third usage appears in CTAO instrumentation papers, where AdvCam is an SiPM-based, fully digital camera architecture with new multi-level trigger logic (Heller, 16 Sep 2025, Burmistrov, 1 Oct 2025).

This suggests that acronym disambiguation is necessary before comparing robustness, interpretability, or performance claims across these literatures.

2. AdvCam as adversarial camouflage in computer vision

In the adversarial-attack literature, AdvCam is a two-stage pipeline composed of a digital crafting stage and a physical-world adaptation stage (Duan et al., 2020). Given a clean source image $x$, a style reference $x^s$, and a mask $M$, the method solves an optimization for a camouflaged adversarial example $x'$ such that the example both fools a target classifier $F$ and matches the chosen style inside $M$. The perturbation is confined to the mask through

$x' = M \odot (x + \delta) + (1-M)\odot x.$

The total objective is

$$L_{\text{total}} = L_{\text{style}}(x',x^s,M) + L_{\text{content}}(x',x,M) + L_{\text{smooth}}(x') + \lambda \cdot L_{\text{adv}}(T(x',o),y,y_{\text{adv}}).$$

The style term uses a fixed, pre-trained VGG-19 feature extractor $\mathcal{A}$ and Gram matrices over convolutional activations. No GAN generator is trained; $x'$ is directly optimized by gradient descent on pixels. The content term preserves image content in the perturbed region, and the smoothness term is a total-variation penalty intended to avoid high-frequency artifacts and improve physical robustness. The adversarial loss is evaluated on transformed images $x^s$0 so that the crafted pattern survives real-world nuisance factors such as rotation, scale changes, illumination changes, and random background insertion (Duan et al., 2020).

The physical adaptation stage is integral rather than post hoc. At each optimization step, the method samples a random background and random transform, including rotation of $x^s$1, scale/resizing in $x^s$2, and brightness/contrast jitter of $x^s$3. After optimization, the resulting pattern is printed on paper or sticker, placed on the real object, and re-photographed with a cellphone camera at multiple distances and angles (Duan et al., 2020).

Quantitatively, the paper reports that on 2 000 ImageNet images (50 classes), untargeted top-1 success increases from ~40% to ~85% as $x^s$4 increases and the perturbed region is 120×120; targeted top-1 reaches ~60–70% under similar settings, and top-5 is ~80–90% (Duan et al., 2020). In an AMT stealth study, 132 PGD-16 examples were rated “natural” 77.3% ±1.5%, 101 AdvPatch examples were rated “natural” 19.0% ±1.7%, and 122 AdvCam examples were rated “natural” 80.7% ±1.5%. In physical-world evaluations, traffic-sign camouflage reached ~85% success over 20 recaptured shots, compared with ~60% for AdvPatch; for T-shirt logo camouflage, PGD failed even at $x^s$5, AdvPatch reached ~30%, and AdvCam reached ~70% (Duan et al., 2020).

The paper also notes two non-attack uses. AdvCam can be used for privacy protection by hiding “face” or “body” regions in innocuous textures, and for robustness evaluation by stress-testing classifiers under large, realistic-looking perturbations that exceed small-$x^s$6 threat models (Duan et al., 2020).

3. AdvCam in explainable and trustworthy traffic-sign detection

In “Explainable and Trustworthy Traffic Sign Detection for Safe Autonomous Driving: An Inductive Logic Programming Approach,” AdvCam is not the primary method but one of the physical attacks used to evaluate robustness of an ILP-based stop-sign detector (Chaghazardi et al., 2023). The attack is described as a physical-world “stain-based” attack that overlays the sign surface $x^s$7 with one or more coloured stains $x^s$8, then solves a constrained optimization to make the network predict a target class $x^s$9. A canonical formulation is

$M$0

subject to the stain being restricted to small patches and a small total budget. In practice, the attacker alternates gradient steps on $M$1 with a projection that enforces the stain’s shape, size, and colour-range constraints (Chaghazardi et al., 2023).

The defensive contribution is an ILP system that uses symbolic predicates over shape, colour, and text/digits rather than raw pixels. The predicate vocabulary includes colour(Sign,Colour), shape(Sign,Shape), has_word(Sign,WordAtom), closely_match(WordAtom,KnownWord), number(Sign,NumberAtom), and digits(NumberAtom,Integer). Facts are generated by OpenCV + OCR on each image. Positive examples are encoded as traffic_sign(p_i,stop_sign)., and negatives as :- traffic_sign(n_j,stop_sign). (Chaghazardi et al., 2023).

Two ILP learners are described. Aleph 5 uses inverse entailment with Prolog mode declarations and needs on the order of 8 positives + 8 negatives to reach 100% accuracy on clean data. Metagol, using the metarules Identify, Inverse, Precon, Postcon, Chain, and Recursion, can learn the final rule with only 1 positive + 1 negative example (Chaghazardi et al., 2023). Both converge to the same hypothesis: $F$9 or equivalently,

$M$2

The reported robustness mechanism is highly specific: because AdvCam adds small stains to the sign border or background, it does not alter the fact that the sign still carries the word “STOP” in OCR-readable form. The ILP rule ignores pixel-level colour and shape perturbations and fires as long as has_word/2 and closely_match/2 continue to succeed. The case studies indicate that OCR still extracts the token “STOP,” possibly with minor OCR errors tolerated by closely_match/2, so the ILP classifier continues to identify the sign correctly (Chaghazardi et al., 2023).

Test set	DNN Accuracy	ILP Accuracy
Clean (Base)	100%	100%
RP₂ subtle graffiti	0%	100%
RP₂ camouflage graffiti	0%	100%
RP₂ camouflage art	6.6%	100%
AdvCam (various stains)	66.6%	100%

The paper states that the DNN is a standard CNN trained on GTSRB (≈ 50 000 images), whereas the ILP-based classifier uses the single Prolog clause above (Chaghazardi et al., 2023). It also emphasizes explainability and efficiency: the final hypothesis is a single two-literal clause, training uses very few examples, and inference is a single Prolog-style clause that runs in milliseconds on embedded hardware. The stated limitation is equally specific: the method depends on reliable extraction of the word “STOP”; if a camouflage attack perfectly masked or distorted the text, such as by heavy occlusion or adversarial typography, the rule would fail (Chaghazardi et al., 2023).

4. AdvCAM as anti-adversarially manipulated attribution

In the weak-supervision literature, AdvCAM means Anti-Adversarially Manipulated CAM, not adversarial camouflage (Lee et al., 2021, Lee et al., 2022). The method starts from a trained image classifier and perturbs the input image in the direction that increases the classification score for the target class. This is the reverse of a conventional adversarial attack. With image $M$3, target class $M$4, step size $M$5, and iteration count $M$6, the vanilla update is

$M$7

where $M$8 is the logit for class $M$9 (Lee et al., 2022). The CAM at each step is

$x'$0

and the final AdvCAM is the normalized accumulation

$x'$1

The core motivation is that ordinary CAM and Grad-CAM tend to highlight only the most discriminative patch. By climbing the target logit, weaker but still class-relevant regions become stronger contributors, so the aggregated map covers more of the object (Lee et al., 2022). The papers further introduce a regularized objective to suppress wrong attributions and prevent over-concentration on already highlighted regions:

$x'$2

where the restricting mask $x'$3 is defined by a threshold $x'$4 over the current CAM. The reported settings include $x'$5, $x'$6, $x'$7, and $x'$8 (Lee et al., 2021).

The method is then integrated into weakly and semi-supervised segmentation. In the weakly supervised regime, AdvCAM maps are thresholded into seeds, optionally refined with methods such as PSA or IRN, and used as pseudo-pixel labels to train a segmentation network such as DeepLab-v2 ResNet101 (Lee et al., 2021). In the semi-supervised regime, a pixel-labeled subset trains a base segmentation model, while AdvCAM seeds are generated on weakly labeled data and incorporated with a consistency training scheme such as CCT (Lee et al., 2021).

On PASCAL VOC 2012, the paper reports mIoUs of 68.0 and 76.9 for weakly and semi-supervised semantic segmentation respectively on the test set (Lee et al., 2021). The more detailed extension reports, for weakly supervised segmentation on VOC, 68.1 / 68.0 val/test mIoU for AdvCAM, compared with 63.5 / 64.8 for IRN, and seed and pseudo-mask improvements such as 55.6% → 68.0% with PSA and 55.6% → 69.9% with IRN refinement (Lee et al., 2022). For semi-supervised segmentation with 1,464 full masks + 9,118 image tags, AdvCAM reaches 77.8 / 76.9 val/test (Lee et al., 2022). The extension also reports state-of-the-art weakly supervised object localization on CUB-200-2011 and ImageNet-1K, including improvements from 58.0% to 63.7% localization on CUB for a CAM baseline and from 51.9% to 55.0% on ImageNet-1K (Lee et al., 2022).

The method is explicitly described as post-hoc and requiring no retraining of the classifier (Lee et al., 2022). Its stated limitations are that it requires careful tuning of $x'$9, $F$0, $F$1, and $F$2, can highlight spurious features if the classifier is poor or heavily overfit, and still produces coarse maps at GAP resolution, so post-refinement such as CRF, IRN, or PSA remains useful (Lee et al., 2021).

5. AdvCam as the advanced camera for CTAO Large-Sized Telescopes

In CTAO instrumentation, AdvCam is an advanced camera for the Large-Sized Telescopes, based on silicon photomultipliers and a fully digital readout system (Heller, 16 Sep 2025, Burmistrov, 1 Oct 2025). The broader architecture report describes a camera with 163 “super-flowers,” each containing 49 hexagonal pixels, for a total of 7987 pixels, corresponding to ×4 the pixel granularity of the current PMT camera for the same field of view (Heller, 16 Sep 2025). The trigger-design report describes a readout and trigger chain SiPM focal-plane → analog pre-amplifiers → 14-bit ADCs @1.024 GHz sampling → Front-End Boards → Central Trigger Processor → Data Acquisition → Level 3 software trigger → disk (Burmistrov, 1 Oct 2025), while the design report describes a 1 GS/s FADC ASIC (12-bit) per channel on the FEB (Heller, 16 Sep 2025). Taken together, these reports document an evolving fully digital camera and trigger stack.

At the module level, the trigger logic is organized around flowers and super-flowers. FEBs digitize each channel at 1 GHz and compute digital sums over overlapping patches. In the trigger-design study, a super-flower patch is a digital sum over 7×7 = 49 physical channels, with 1 171 overlapping patches covering the full camera without dead regions. For each patch $F$3 and time slice $F$4,

$F$5

and an L1 trigger bit is asserted if

$F$6

This produces ∼1 GHz of L1 hits out of the FEBs, all time-tagged and sent to the CTP (Burmistrov, 1 Oct 2025).

The second-level trigger uses a ∼10 ns coincidence window across the full camera and evaluates two local-L2 strategies: CNNs and DBSCAN / TDSCAN (Burmistrov, 1 Oct 2025). The example CNN uses 3 hexagonal convolutional layers: 32, 32, 64 filters, pooling, and a fully connected head of 256 → 64 neurons with sigmoid output; the model size is ∼200 k parameters. For clustering, standard DBSCAN over hit positions $F$7 is approximated by the FPGA-friendly TDSCAN, which replaces the neighborhood test with a fixed 3D convolution on a hexagonal kernel. The example TDSCAN latency is 14.3 ns at 350 MHz clock (Eps_{XY}=1, Eps_t=1), and a 1 GHz-clock version is under development (Burmistrov, 1 Oct 2025). A stereo Topo-Stereo L2 then exchanges local times and shower positions among the four LSTs, yielding ∼40–50 kHz stereo triggers (Burmistrov, 1 Oct 2025).

The performance goals are low-energy triggering and low latency. The trigger-design paper reports lowering the single-telescope gamma-ray energy threshold from ≃ 20 GeV to ≃ 13 GeV, reducing the input stream from ∼1 GHz to ∼1 MHz at Local L2, then to ∼40–50 kHz at stereo L2, with total hardware trigger latency < 1 µs at 1 MHz Local L2 rate (Burmistrov, 1 Oct 2025). It also reports that in the 10–30 GeV range, collection area is improved by a factor ~2, and low-energy sensitivity of the LST subarray improves by factors of 2–3 (Burmistrov, 1 Oct 2025). The camera-design report similarly states that the energy threshold $F$8 is lowered by ≈30%, angular resolution improves by ≈20–30% across 20–200 GeV, energy resolution improves by ∼10% at low energies, and differential sensitivity improves by factor 2–3 below 40 GeV (Heller, 16 Sep 2025).

These results are currently tied to simulation and prototyping. The reports list ongoing work that includes completing 1 GHz TDSCAN hardware, porting CNN Local-L2 models to FPGA with hls4ml and quantization, and commissioning an on-site prototype on a single LST camera (Burmistrov, 1 Oct 2025). The camera-design report likewise describes unresolved engineering tasks in ASIC design, FEB integration, trigger algorithms, and system interfacing, with the first full module due Q1 2026 (Heller, 16 Sep 2025).

6. Comparative significance, limitations, and recurrent points of confusion

Across these literatures, the strongest commonality is nominal rather than methodological. The adversarial-ML AdvCam is an attack optimized with style transfer and physical recapture constraints (Duan et al., 2020); the autonomous-driving paper uses that attack to show that a symbolic stop-sign detector can remain correct under stain-based perturbations (Chaghazardi et al., 2023); AdvCAM in weak supervision is an attribution-map expansion procedure based on anti-adversarial climbing (Lee et al., 2021, Lee et al., 2022); and CTAO AdvCam is a hardware camera and trigger platform (Heller, 16 Sep 2025, Burmistrov, 1 Oct 2025).

A recurring technical theme is the replacement of brittle low-level dependence with more structured signals, but the implementations differ sharply. In the stop-sign study, robustness comes from symbolic predicates such as has_word/2 and closely_match/2, not from adversarial training (Chaghazardi et al., 2023). In weak supervision, expanded localization is achieved by iteratively increasing the target logit while regularizing against non-target classes and over-attributed regions (Lee et al., 2021). In CTAO instrumentation, improved sensitivity follows from finer pixelization, fully digital readout, and multi-level FPGA-based trigger logic rather than from computer-vision attribution or attack mechanisms (Heller, 16 Sep 2025, Burmistrov, 1 Oct 2025).

The limitations are likewise domain-specific. The ILP stop-sign rule fails if the word “STOP” is perfectly masked or distorted, and extending the approach to other sign types requires additional predicates and a larger rule set (Chaghazardi et al., 2023). AdvCAM attribution maps require hyperparameter tuning and still need refinement because the localization remains coarse at the classifier’s feature-map resolution (Lee et al., 2021, Lee et al., 2022). The CTAO AdvCam remains under active development, with several components explicitly described as prototype-stage or under development (Heller, 16 Sep 2025, Burmistrov, 1 Oct 2025).

The term therefore functions best as a family of context-specific labels rather than as a single concept. A plausible implication is that any technical discussion of “AdvCam” should specify the field, the capitalization, and the cited paper before interpreting robustness, explainability, or performance claims.