AdvSerial: Physical adversarial attacks on infrastructure-mounted pedestrian detectors via semantic feature suppression

AI-based visual perception systems are increasingly deployed in infrastructure surveillance, including roadside monitoring units, highway cameras, and smart-city pedestrian management systems. The security vulnerability of these systems to physical adversarial attacks poses a direct threat to the reliable operation of transportation infrastructure. We propose AdvSerial, a dynamic 2D–3D joint optimization framework for generating continuous high-angle physical adversarial patches against pedestrian detectors in infrastructure-based scenarios. We UV-map a boundary-aware quilted texture onto 3D garments, combine 2D digital attacks with 3D sparse- and continuous-frame rendering, and explicitly suppress person-specific semantic features while enforcing temporal continuity. A Feature Smooth Quilting strategy reduces visible patch boundaries and cross-seam feature discontinuities. A serial-frame loss encourages long uninterrupted sequences of detection failures. In physical-world experiments, AdvSerial achieves a attack success rate on YOLOv5n and degrades mean detection confidence from to . Experiments spanning eight detectors with different architectures demonstrate strong transferability. Notably, it achieves an attack success rate on YOLOv2, evades the patch-detection defense NAPGuard, and transfers to the 3D-temporal perception model Sparse4D-v3. The results reveal persistent, temporally consistent failure modes under high-angle surveillance, and motivate the design of motion-aware and 3D-aware defenses for security-critical infrastructure deployments.