  An adversary can fool deep neural network object detectors by generating
adversarial noises. Most of the existing works focus on learning local visible
noises in an adversarial "patch" fashion. However, the 2D patch attached to a
3D object tends to suffer from an inevitable reduction in attack performance as
the viewpoint changes. To remedy this issue, this work proposes the Coated
Adversarial Camouflage (CAC) to attack the detectors in arbitrary viewpoints.
Unlike the patch trained in the 2D space, our camouflage generated by a
conceptually different training framework consists of 3D rendering and dense
proposals attack. Specifically, we make the camouflage perform 3D spatial
transformations according to the pose changes of the object. Based on the
multi-view rendering results, the top-n proposals of the region proposal
network are fixed, and all the classifications in the fixed dense proposals are
attacked simultaneously to output errors. In addition, we build a virtual 3D
scene to fairly and reproducibly evaluate different attacks. Extensive
experiments demonstrate the superiority of CAC over the existing attacks, and
it shows impressive performance both in the virtual scene and the real world.
This poses a potential threat to the security-critical computer vision systems.
