What this article gives you

Ordinary variation in conditions such as occlusion or lighting can cause a person detector to miss. Deliberate changes made to the input to prevent detection can also cause misses, and evaluating against those is AI security work. If you are responsible for deploying or improving a person detector in a surveillance system, a site-safety monitor, or a robot’s perception stack, you have to decide which changes to treat as threats, what to verify and counter first, and how to re-evaluate a countermeasure before adopting it.

Yoshihiro Kanno, Representative Director of U-Rec, Inc., wrote the research paper “Mask Extent and Texture Content: A Controlled Digital-Compositing Study of Person Detectors,” published on Zenodo as a preprint (v1) on September 19, 2026. It takes an attacker’s perspective: it measures person-detector detection rates under conditions that include textures built to suppress detection. It shows how to structure an evaluation so that those decisions rest on evidence.

Three things follow from the study.

  • Grade the ordinary variation and the deliberate changes you expect, and measure them on the same scenes, and you can see, in comparable form, under which conditions each candidate model’s detection rate drops.
  • Check first whether simple texture conditions already lower the detection rate, and you can decide which changes to treat as threats, whether reproducing advanced attacks is needed, and where verification effort should go.
  • Fix the operating points and sample size in advance and report uncertainty, and the evaluation is less likely to over-read small differences and makes the basis of its conclusions explicit.

This article covers the study in brief, four observations with their implications, why an evaluation should assume deliberate changes as well as ordinary input, and how the method applies to an evaluation project.

The study in brief

Prior work on adversarial textures usually changes the texture content, the surrogate model used for the attack, and the applied area at the same time, which makes the results hard to use in a deployment decision. Our study uses digital compositing, replacing part of the person region in each image with a texture, to measure detection rates on the same scenes across combinations of mask extent and texture. Other conditions are kept as common as possible.

  • Scenes: the same 32 development scenes from COCO val2017 (16 of them were also used to generate the optimized textures)
  • Mask extent: the proxy mask is the intersection of a rectangle defined relative to the person bounding box and the person segmentation. Extent is the number of replaced pixels divided by the bounding-box area, at six levels from 0.074 to 0.416
  • Textures: four conditions, namely three controls (synthetic camouflage, Gaussian-smoothed palette-quantized pixel noise, and a solid fill) and textures optimized within the RGB range to lower a surrogate model’s person score, which is the condition built with the intent of preventing detection
  • Detectors: Faster R-CNN, DETR, and YOLO26n
  • Metric: detection rate at a high-score threshold calibrated in advance and fixed per model (0.981 / 0.981 / 0.886). A lower value means the detector missed the person in more cases under that condition. This is not COCO AP.

Optimized textures were run with three seeds at every level; camouflage is a single fixed generation. Clean-image detection rates were 0.906 / 0.906 / 0.781 (Faster R-CNN / DETR / YOLO26n).

Four observations and what they mean for evaluation

1. Detection rates changed substantially with the mask-extent level

With the camouflage texture, Faster R-CNN’s detection rate was 0.906 at extent 0.074, identical to the clean image. The first separation appeared at 0.136, and the rate fell monotonically to 0.250 at 0.416. Because the mask’s shape, position, and covered body parts change along with extent, this is a descriptive change across condition levels, not an effect of area alone.

Implication: define the conditions you expect as graded levels rather than a single point, and measure each level. The level at which detection rates begin to drop then becomes a basis for comparison.

2. Optimized textures did not consistently beat simple camouflage

Detection rates at the largest extent, 0.416:

Model Clean Camouflage (single generation) Optimized (3-seed mean)
Faster R-CNN 0.906 0.250 0.531
DETR 0.906 0.500 0.635
YOLO26n 0.781 0.094 0.188

On all three models, the optimized textures left detection rates higher than camouflage did, so they suppressed detection less. The same ordering held on 32 holdout scenes that were not used by those optimization runs, and a stronger surrogate combining YOLOv8n and Faster R-CNN did not reverse it within the compute budget we tested. On YOLO26n, however, the optimized textures were 1.0 to 5.2 percentage points lower at extents up to 0.358, so the ordering depends on the level and the model. Within this experiment, no general advantage for optimization was established.

Implication: in an adversarial-resistance evaluation, before investing in reproducing an optimized attack, check whether simple texture conditions already lower the detection rate. Keeping the simple conditions as a baseline is what makes the difference from any advanced condition readable.

3. Each model’s detection rate dropped under different conditions

With the same camouflage at the same extent, 0.196, the detection rates at each model’s calibrated threshold were 0.844 for Faster R-CNN, 0.781 for DETR, and 0.312 for YOLO26n. YOLO26n started lower on clean images, at 0.781, and had already dropped to 0.500 at extent 0.136.

Implication: a single number does not rank models. Set each model’s operating point from common requirements and a common calibration rule, hold those points fixed during the comparison, and then line the candidates up condition by condition.

4. Sample size and operating point changed the conclusion

On 32 scenes, optimization showed a small advantage over camouflage on YOLO26n at extent 0.196 (2.1 points). In an exploratory expansion to 132 scenes at the same mask setting (measured extent 0.191), that advantage was not confirmed. The expansion reused earlier development and holdout scenes, so it is post-hoc rather than an independent replication, and the other five extent levels were not expanded. Sweeping the decision threshold across the range 0.50 to 0.981 also showed that, at extent 0.191, the ordering of camouflage and optimized textures depended on the model and the operating point.

Implication: a difference seen on a small sample is a weak basis for a decision, and raw score comparisons that do not state and align their threshold conditions are hard to interpret. Scene count, operating points, and replication rules need to be decided before measuring.

Why assume deliberate changes, not only ordinary input

An ordinary robustness evaluation asks how the detection rate changes under the variation you expect. An AI security evaluation adds a second question: how well does the detector hold its detection rate when someone changes the input in order to avoid being detected? Where a person detector protects people or assets, an evaluation that never asks the second question leaves the situation in which someone tries to avoid detection outside its scope.

The design of this study is one example of making that question testable. The optimized textures are a condition built to lower a surrogate model’s person score. Comparing them with the unoptimized control conditions under the same masks, the same scenes, and each model’s operating point lets you observe the difference in detection rate between optimized textures and the controls. In this experiment, that difference was not consistent, and because conditions such as color distribution were not matched, the difference is not the effect of optimization alone. From this, the decisions a deployment owner has to make come down to three.

  • Which changes to treat as threats — include low-cost, simple changes as candidates alongside sophisticated optimization, and set the scope from the system’s operating environment and the capability you assume on the other side
  • What to verify and counter first — within the assumed threat conditions, take the conditions where a drop in detection rate was actually observed as candidates, and set priorities by the size of the drop together with how likely the change is to be attempted and what it would mean for the operation
  • How to decide whether to adopt a countermeasure — after applying it, re-evaluate under the same threat conditions and criteria, add conditions aimed at the changed model where needed, and decide between adoption and further verification by how much the drop has narrowed

From here on, these are evaluation-design proposals derived from the study’s method.

Applying the method to an evaluation project

What the study demonstrates directly is a set of descriptive results under specific digital-compositing conditions. The method behind them, however, applies to evaluating person detectors before deployment or during improvement, and in particular to evaluating their resistance to adversarial input.

Observed in the study How to use it in evaluation Decision supported
Detection rates changed substantially with mask-extent level Grade the ordinary variation and deliberate changes you expect, and measure each level on the same scenes Which operating conditions to accept; whether camera placement or additional sensors are needed as compensating measures
Optimization did not consistently beat camouflage Measure simple conditions as a baseline before reproducing advanced attacks Which changes to treat as threats; how far to take costly countermeasures and verification
Each model dropped under different conditions Set operating points from common requirements and calibration rules, then line up candidate models by condition Model selection; whether to switch models or retrain
Sample size and operating point changed the conclusion Fix operating points, scene count, and replication rules before measuring How much weight the results can bear in a decision

The evidence this produces is detection rates by condition and level with the drop from clean, the gap between baseline and advanced conditions, a condition-by-model comparison table, and an evaluation report that states its operating points and uncertainty.

The benefits we would expect are that decisions about acceptable conditions rest on per-condition measurements rather than assumptions, that verification budget goes to the conditions where a drop was actually observed, that fewer model choices are made without evidence, and that decisions are less exposed to small-sample chance. These are not results the study measured. They are what can reasonably be expected when the method is applied, and the actual effect depends on the target system, its data, and the condition design.

A sample workflow

  1. Condition design — From the system’s operating conditions, define the evaluation axes and levels (expected coverage, illumination, distance) and decide which deliberate changes intended to prevent detection are in scope as threats. Set each model’s operating point from common requirements and a common calibration rule.
  2. Baseline measurement — Measure detection rates on clean inputs and under simple texture and occlusion conditions, and record the conditions where the rate drops from clean and by how much.
  3. Candidate comparison — Compare models and configurations on the same scenes with the chosen operating points held fixed, and tabulate the results by condition, so that the conditions that induce misses are visible for each model.
  4. Prioritization and improvement — Take the conditions where a drop was actually observed as candidates, set priorities by the size of the drop, the likelihood of the change being attempted, and its operational impact, and direct additional data, retraining, compensating measures, and deeper verification accordingly.
  5. Re-evaluation and effect check — After applying a candidate improvement, compare detection rate (misses) and false detections before and after the change under the same threat conditions and criteria, confirm on data not used in the evaluation and under conditions aimed at the changed model where needed, and decide whether to adopt the improvement or run further verification. This is also where to check that a measure that reduces misses has not increased false detections.

This study used detection rate at a fixed threshold as its primary metric. In a real evaluation, the validation criteria would be set from the target system’s requirements and could include miss rate, false-detection rate, and metrics such as AP.

Points to keep in mind

  • Detection rate is measured at fixed thresholds, and the choice of operating point is part of what is being measured.
  • Changing mask extent also changes the mask’s shape, position, and covered body parts, so the comparison does not isolate the causal effect of area alone.
  • Color distributions are not matched across texture conditions, so not all differences can be attributed to texture semantics or optimization.
  • The 32 development scenes include the 16 scenes used during optimization. The 132-scene expansion and the sensitivity analysis restricted to the 116 scenes never offered to the optimizer both reuse earlier scenes and are not independent replications.
  • The main experiments were designed and launched by humans; this is not an autonomous AI discovery.
  • The drops in detection rate observed in this study are results under experimental conditions. They do not show that an attack on a real system would succeed, that a vulnerability was found, or that any countermeasure is effective.

About the public code

We have published the research code, including the evaluator, experiment plans, integrity checks, and analysis tools. It is a code-only repository: it does not contain the paper, measured results, images, model weights, generated textures, or run records. It can serve as a reference implementation and starting point for building an evaluation on your own data and models, but it requires you to prepare and validate the inputs, and it does not reproduce the paper’s numbers on its own.

The software is licensed under the PolyForm Noncommercial License 1.0.0. For commercial use, please contact U-Rec, Inc.

Talk to us

“We want to evaluate, with evidence, how well the person detector we plan to deploy holds its detection rate against inputs deliberately changed to avoid detection.” “We want to identify the conditions that induce misses, under both ordinary variation and deliberate changes.” “We need to compare candidate models against a common standard.” “We want to re-evaluate a candidate improvement under the same conditions and decide whether to adopt it.” These are the problems the method used in this study addresses.

AI security research is at the core of U-Rec’s business, and we bring what we learn into custom AI development, where robustness verification and adversarial-attack resistance evaluation are built in from the PoC stage, and into AI security consulting, where an AI security assessment makes the current state visible and prioritizes risks. To discuss the evaluation design for a person-detection system, use the contact form and select “AI security assessment and consultation.”

Paper and reference materials

As of our check on September 19, 2026, the public code was at commit 5dbd4aa0dd7e. This is the revision at the time the public code was reviewed, not the snapshot of the reported experiments.