Adversarial camouflage has attracted growing research attention owing to its ability to execute multi-view, persistent attacks in real physical environments, outperforming conventional single-view adversarial patches. However, most existing methods are confined to non-targeted attacks, which induce arbitrary incorrect detection results without specifying target categories. This ambiguity weakens attack destructiveness and stealthiness, posing limitations for security evaluation of real-world vision systems. To address this gap, we present TACT, an approach built upon the full-coverage physical camouflage pipeline. By replacing the original category supervision with a predefined target class, TACT redirects the optimization gradient to guide 3D texture toward the target category features. Such a scheme only employs the inherent feature alignment mechanism of off-the-shelf object detectors, without redesigning network modules, defining novel loss functions, or modifying the rendering pipeline. Extensive experiments across digital and physical domains validate its effectiveness: on seven mainstream general-purpose object detectors, TACT-person achieves an average targeted attack success rate of 51.91%, and delivers cross-architecture and cross-version transferability. In physical tests, TACT-bird reduces mAP50-95 by 59.87% on YOLOv8, yet a TCER–TASR gap suggests that the physical pipeline acts as a low-pass filter: coarse-grained target classes transfer robustly while fine-grained ones suffer feature collapse. These results confirm the viability of native supervision redirection and reveal an empirical pattern: coarse-grained target classes transfer more robustly through the physical pipeline than fine-grained ones, suggesting that target class feature granularity consistently influences physical-domain attack effectiveness.
Di et al. (2026) studied this question.