Adversarial Camouflage Textures (ACT)

• ACT are optimized textures applied on 3D surfaces that maintain visual plausibility while causing deep object detectors to fail.
• They leverage differentiable render-in-the-loop techniques and various mapping strategies, such as UV and triplanar, to ensure robust multi-view performance.
• The field spans full-body vehicle camouflage, localized patches, and wearable garments, addressing trade-offs between human visual acceptance and machine detection evasion.

Adversarial Camouflage Textures (ACT) are physical or renderable textures applied to object surfaces so that the object remains visually plausible or camouflaged while deep object detectors fail to detect, localize, or classify it correctly (Sun et al., 2022). In current research, ACT most often denotes full-body vehicle textures optimized on 3D meshes through differentiable rendering under multi-view physical transformations (Wang et al., 2021, Zhou et al., 2024), but the term also covers scene-conditioned texture fields for 3D nondetection in human visual search (Guo et al., 2022), localized printable aircraft patches constrained by perceptual color distance (Wise et al., 2022), and wearable adversarial garments for person detection under UAV surveillance (Yan et al., 18 Jun 2026). The field lies at the intersection of physical adversarial attacks, neural rendering, texture synthesis, and camouflage design, with recurring emphasis on physical realizability, transferability, and sim-to-real fidelity (Suryanto et al., 2023, Liu et al., 7 May 2025).

1. Conceptual foundations and scope

ACT differs from standard pixel-space adversarial examples in both parameterization and deployment. In ACT, perturbations are typically parameterized in texture space rather than image space, then projected onto a 3D object and rendered under many camera poses, distances, and environmental conditions (Sun et al., 2022). This makes the perturbation intrinsically multi-view and tied to the object’s surface geometry rather than to a single image plane. Vehicle-oriented work often treats the adversarial texture as a UV map for the entire vehicle surface, allowing what is optimized in simulation to be printed and physically applied with fixed texel-to-surface correspondence (Zhou et al., 2024, Wang et al., 2021).

The research area includes several distinct attack goals. Some methods pursue detector disappearance or non-detection by suppressing objectness, class confidence, or localization quality (Zhou et al., 2024, Dimitriu et al., 2024). Others explicitly optimize a dual objective: fooling human observers by background matching while simultaneously degrading detector performance (Sun et al., 2022). GANmouflage broadens the notion further by treating camouflage as 3D object nondetection for human visual search, using a scene-conditioned texture field rather than a UV atlas and evaluating success through confusion rate and response time in human studies (Guo et al., 2022).

A common misconception is that ACT is synonymous with adversarial patches. The literature separates localized printable patches from full-surface camouflage. The aircraft work on imperceptible patches constrains a rectangular patch to remain inside the aircraft’s apparent silhouette and occupy only 20–30% of the cropped or augmented image (Wise et al., 2022). By contrast, FCA, RAUCA, ACTIVE, TACO, and related vehicle methods optimize textures that cover the full body or the full paintable body of a 3D vehicle, precisely because local or planar perturbations degrade under viewpoint change, self-occlusion, and long distance (Wang et al., 2021, Dimitriu et al., 2024).

2. Texture parameterization and surface mapping

The dominant ACT parameterizations are UV-map-based full-body textures, world-aligned or repeated patterns, triplanar mappings, texture fields, and sticker-mode subsets. FCA represents camouflage as a full 3D texture over the entire vehicle surface, excluding glass, tires, and lights, and directly optimizes the complete texture image mapped to the whole mesh (Wang et al., 2021). RAUCA likewise defines an adversarial camouflage texture $T_{\text{adv}}$ as a UV texture map for the entire vehicle surface, emphasizing physical realizability, full coverage, and differentiable optimization (Zhou et al., 2024).

A key distinction in the literature concerns how a 2D texture is bound to the 3D object. World-align-based methods such as DTA and ACTIVE optimize a 2D square pattern that is repeatedly projected onto the vehicle in a world-aligned manner, whereas UV-map-based methods fix the correspondence between texture pixels and the physical surface (Zhou et al., 2024). A plausible implication is that ACT robustness is partly a mapping problem: if optimization-time projection cannot be reproduced at deployment, physical transfer suffers. This motivates later work such as PAV-Camou, which manually adjusts UV coordinates to minimize distortion before adversarial optimization, arguing that physically consistent 2D–3D mapping is critical for printable vehicle camouflage (Liu et al., 7 May 2025).

ACTIVE addresses universality differently by using triplanar mapping rather than per-mesh UV layouts. A single texture $\eta$ is projected along the $x$, $y$, and $z$ axes and blended according to surface normals, so the same camouflage can be reused across arbitrary vehicle meshes without dependence on a specific UV map (Suryanto et al., 2023). This makes the texture instance-agnostic in a way that fixed UV atlases are not.

Another line replaces explicit atlases with continuous implicit representations. GANmouflage represents texture as a scene-conditioned texture field $t_\theta:\mathbb{R}^3 \to \mathbb{R}^3$, avoiding explicit UV parameterization and seam handling while permitting arbitrary mesh complexity (Guo et al., 2022). This representation is especially useful when the object shape is irregular or when the camouflage must be conditioned directly on multi-view scene imagery.

ACT also appears in localized forms. FPA introduces a sticker mode in which selected mesh faces are baked into a dedicated UV map and optimized as a masked subtexture, enabling partial-coverage deployment as printed stickers (Li et al., 2024). The aircraft patch work remains even more local, restricting the perturbation to a rectangular patch centered within the aircraft bounding box and constraining its perceptual distance to a corresponding image segment via CIEDE2000-based PerC loss (Wise et al., 2022).

3. Render-in-the-loop optimization and loss design

Most ACT systems adopt a differentiable render-in-the-loop formulation. FCA gives a canonical expression: $$\mathbf{T}_{adv}^* = \arg\max_{\mathbf{T}_{adv}} J\big(\mathcal{F}(\Phi(\mathcal{R}(\mathbf{M}, \mathbf{T}_{adv}; \theta_c)); \theta_f), Y\big),$$ where $\mathcal{R}$ renders the textured mesh, $\Phi$ composites it into the scene, and $\mathcal{F}$ is the detector (Wang et al., 2021). The practical consequence is direct backpropagation from detector outputs to texture pixels through the renderer.

Detector-aware ACT methods differ in what they optimize. RAUCA defines an untargeted disappearance or misclassification objective through an IoU-weighted detection score,

$\eta$0

and attack loss

$\eta$1

so gradients focus on predictions that actually overlap the ground-truth car (Zhou et al., 2024). FCA combines IoU, objectness, and class terms for YOLO-v3, while ACTIVE replaces class-specific suppression with a stealth loss that minimizes the maximum class-and-objectness detection score over all valid classes, explicitly pushing the vehicle toward non-existence rather than mere misclassification (Wang et al., 2021, Suryanto et al., 2023).

Regularization is central because unconstrained detector loss tends to produce textures that are physically unstable or visually implausible. FCA uses a total-variation-like smoothness term on the rendered image (Wang et al., 2021). RAUCA uses a similar smoothness loss on the rendered vehicle and sets $\eta$2, $\eta$3 in its total loss $\eta$4 (Zhou et al., 2024). TACO generalizes TV into a Convolutional Smooth Loss over a $\eta$5 neighborhood, explicitly studying the trade-off between detector evasion and plausibility on a full-body truck camouflage (Dimitriu et al., 2024). ACTIVE supplements attack and smoothness with a camouflage loss that pulls each texture pixel toward one of the dominant background colors extracted by k-means, turning a non-printability-style term into an environment-adaptive color prior (Suryanto et al., 2023). FPA likewise combines adversarial, smoothness, non-printability, and concealment losses, the last of which constrains texture colors to a band around average environmental color (Li et al., 2024).

ACT objectives are no longer limited to detector logits. UCA, which targets vision-LLMs for autonomous driving, operates in feature space rather than at the logit layer. It defines a Feature Divergence Loss over selected encoder and projector features and combines it with a smoothness term on the rendered adversarial car image, showing that full-surface camouflage can corrupt multimodal perception, prediction, and planning without relying on fixed class logits (Kong et al., 24 Sep 2025).

4. Robustness, universality, and environment adaptation

Robust ACT requires optimization over viewpoint, scale, illumination, weather, and often model family. A standard mechanism is expectation over transformation, but recent work replaces simple synthetic augmentations with more structured physical distributions. RAUCA uses a CARLA multi-weather dataset with 16 weather combinations formed by sun altitude and fog density, then optimizes the same texture across many camera poses and weather conditions (Zhou et al., 2024). A later RAUCA formulation introduces End-to-End Neural Renderer Plus, UV-traversal sampling so that every UV pixel receives gradients, and Random Output Augmentation for scaling, translation, brightness, and contrast perturbations (Zhou et al., 2024).

Universality can target objects, tasks, or prompts. ACTIVE optimizes a single camouflage across multiple vehicle types and valid detector classes, and reports transferability to other vehicle classes, segmentation models, and the real world (Suryanto et al., 2023). VFACamou extends ACT from vehicles to clothing and UAV surveillance, combining UV-space optimization with multi-scale dynamic training and a natural-environment adaptation loss. Its ablation reports ASR $\eta$6 with multi-scale dynamic training versus $\eta$7 without, under Faster R-CNN at IoU $\eta$8 and confidence $\eta$9 (Yan et al., 18 Jun 2026). UCA analogously seeks universality across user commands and model architectures in vision-language systems by maximizing feature divergence rather than a detector’s class score (Kong et al., 24 Sep 2025).

A separate difficulty is gradient instability across physical configurations. “Physical Adversarial Camouflage through Gradient Calibration and Regularization” identifies two failure modes: inconsistent sampling point densities across distances and conflicting texture updates from multiple angles. It proposes Nearest Gradient Calibration, which propagates gradients from sampled UV points to unsampled neighbors within radius $x$0, and Loss-Prioritized Gradient Decorrelation, which orders per-view gradients by loss and orthogonalizes them before averaging (Liang et al., 7 Aug 2025). A plausible implication is that ACT robustness depends not only on the outer loss but also on the geometry of gradient aggregation in texture space.

The fidelity of the simulator also matters. R-PGA argues that coarse simulators induce a domain gap and that average-case EoT leaves high-loss “failure peaks” in the physical configuration space. It therefore combines relightable 3D Gaussian Splatting, a hybrid foreground-background rendering pipeline, and Hard Physical Configuration Mining, which is equivalent to stochastic optimization of a log-sum-exp upper bound on worst-case configuration loss (Lou et al., 27 Mar 2026). This moves ACT toward robust min-max optimization over physically meaningful variables rather than average-case scene sampling.

Not all robustness claims are universal. DE_DAC is explicitly scene-specific: it learns one global texture $x$1 and one local texture $x$2 for a particular UE4 environment such as “WinterValley,” “Forest,” or “Desert,” trading generality for stronger human camouflage within that scene distribution (Sun et al., 2022). This suggests a persistent design tension between environment-specific crypsis and cross-domain transfer.

5. Physical realization and empirical evidence

Physical realizability is a defining criterion of ACT. FCA exports the optimized full-coverage vehicle texture, prints it, applies it to a toy car, and evaluates 144 physical photos across 8 directions, 3 distances, and 3 backgrounds (Wang et al., 2021). In simulation, FCA reduces YOLO-v5 [email protected] from $x$3 to $x$4, and in physical tests from $x$5 to $x$6 (Wang et al., 2021). RAUCA similarly prints textures for 1:12 Audi E-Tron models and reports, on YOLOv3 [email protected], an average over all real environments of $x$7 for Normal and $x$8 for RAUCA (Zhou et al., 2024).

Physical ACT has also been evaluated in patch form. The aircraft work on imperceptible patches places the patch inside the aircraft silhouette, optimizes alternating deception and perceptibility updates, and reports final mAP $x$9 with no patch, $y$0 for Robust-DPatch, and $y$1 for the proposed imperceptible patch, while reducing PerC from $y$2 to $y$3 relative to Robust-DPatch (Wise et al., 2022). Here the objective is not full-body coverage but a small, printable, low-salience decal-like ACT within object contours.

Truck-scale digital ACT has reached near-total suppression in simulation. TACO targets YOLOv8X on an M923 military truck and reports [email protected] $y$4 on unseen test data, with transfer to Faster R-CNN and earlier YOLO versions (Dimitriu et al., 2024). FPA, which integrates PyTorch3D rendering, diffusion-based texture generation, and a concealment constraint, reports physical [email protected] on SSD dropping from $y$5 for RAW to $y$6 for FPA(v5) on a printed 1:24 Audi Q5 model (Li et al., 2024). PAV-Camou likewise emphasizes printable 2D patterns that can be cut and applied to a real or scaled vehicle after UV distortion correction, and reports physical success on a 1:20 Chevrolet Impala scale model under rotating-view evaluation (Liu et al., 7 May 2025).

The empirical record shows that ACT performance is strongest when mapping, rendering, and evaluation are aligned. UV-map-based methods can print the optimized texture directly, whereas per-face or world-aligned methods often require approximate post hoc realization, which introduces additional distortion or misalignment (Liu et al., 7 May 2025, Zhou et al., 2024).

6. Misconceptions, limitations, and open problems

A first misconception is that ACT necessarily hides objects from both humans and machines. The literature is split. GANmouflage explicitly optimizes for human nondetection in real scenes (Guo et al., 2022), DE_DAC is dual-objective and seeks a trade-off between fooling human eyes and object detectors (Sun et al., 2022), and the aircraft patch work constrains perceptual color distance for low salience (Wise et al., 2022). By contrast, many vehicle methods primarily optimize detector failure, with human naturalness entering only through smoothness or camouflage color constraints (Wang et al., 2021, Suryanto et al., 2023).

A second misconception is that stronger rendering always eliminates the sim-to-real gap. Several works state the opposite. RAUCA argues that baseline neural renderers cannot reproduce complex environment features such as shadows, fog, and time-of-day lighting (Zhou et al., 2024). PAV-Camou argues that insufficient photorealism and improper physical realization of camouflage are major reasons why prior methods do not transfer well to real vehicles (Liu et al., 7 May 2025). R-PGA further attributes brittleness to both domain gap and optimization objective gap, asserting that minimizing average loss leaves a rugged physical loss landscape (Lou et al., 27 Mar 2026).

The field also remains highly assumption-heavy. Many methods require accurate 3D meshes and UV layouts, white-box access to at least one detector, and representative scene or weather data (Zhou et al., 2024, Liang et al., 7 Aug 2025). VFACamou notes limited handling of cloth dynamics and dependence on environment-specific color weights (Yan et al., 18 Jun 2026). UCA notes that improved transferability to black-box VLM-AD systems is future work (Kong et al., 24 Sep 2025). “Camouflage Adversarial Attacks on Multiple Agent Systems” generalizes the appearance-manipulation concept beyond detection to multi-agent decision systems, but it also highlights how correlated observations and environment constraints limit the attacker relative to unconstrained state-perception attacks (Lu et al., 2024). This suggests that ACT in embodied settings is not only a perception problem but also a control and policy problem.

Open directions recur across the literature. They include richer renderer models with better BRDFs, reflections, motion blur, and weather (Zhou et al., 2024, Lou et al., 27 Mar 2026); stronger black-box ACT through multiple surrogate detectors or feature-space objectives (Kong et al., 24 Sep 2025); human-aware naturalness constraints and user studies (Yan et al., 18 Jun 2026); and more robust defenses such as multi-weather adversarial training, texture-invariant detectors, and multi-sensor fusion (Zhou et al., 2024, Lou et al., 27 Mar 2026). The accumulated evidence suggests that ACT is best understood not as a single attack primitive but as a family of render-aware, surface-aware, and environment-aware physical adversarial methods whose effectiveness depends on how faithfully texture, geometry, and observation are coupled.