Physical Adversarial Attacks on AI Surveillance Systems:Detection, Tracking, and Visible--Infrared Evasion

A new research paper, published on the arXiv preprint server under identifier 2604.06865v1, argues that the field of physical adversarial attacks on artificial intelligence must evolve to consider the complex, integrated nature of modern surveillance systems. The study, which does not specify a single author but represents a significant literature review and conceptual shift, contends that evaluating attacks based on their ability to fool a single image classifier is an outdated benchmark. Instead, researchers must now account for multi-stage AI pipelines that include person detection, continuous multi-object tracking, and fused visible-infrared sensing, all of which are deployed in real-world security environments. This holistic perspective fundamentally changes how the effectiveness and threat of such attacks should be assessed. The core thesis is that a successful adversarial attack in a laboratory setting may fail completely in a practical surveillance scenario. For instance, a visually crafted patch that successfully causes a person detector to fail in a single video frame is of limited use if the system's tracking algorithm can maintain the target's identity across subsequent frames using other cues. The paper emphasizes that 'identity'—the persistent tracking of an individual—is a critical metric often overlooked in simpler tests. An attack must not only cause a momentary detection failure but must also break the tracking thread to be considered truly effective for evasion. Furthermore, the research highlights the growing importance of multi-spectral sensing, particularly the fusion of visible light and infrared (thermal) cameras, which is standard in advanced security and military applications. An adversarial pattern designed to fool a visible-light camera may be completely ineffective against an infrared sensor, or vice versa. Therefore, future attacks must be designed to be robust across multiple sensing modalities simultaneously. The 'practical form of the attack carrier'—meaning the physical object bearing the adversarial pattern, such as a specially designed jacket or hat—must be evaluated for its feasibility, durability, and effectiveness in real-world conditions against these integrated systems. This shift in focus signals a maturation of adversarial machine learning research, moving from theoretical curiosities to addressing tangible threats against deployed AI. It calls for new benchmarks and testing protocols that mirror the architecture of actual surveillance networks. The implications are significant for both security professionals seeking to harden their systems and for researchers probing the fundamental vulnerabilities of machine perception, underscoring that the battle between AI defenders and attackers is increasingly fought in the complex, multi-dimensional space of real-world operation.