---
license: mit
datasets:
- bailuyucha/differentiable-render-camouflage-data
tags:
- pytorch
- adversarial-robustness
- differentiable-rendering
- carla
- object-detection
- negative-results
---

# Differentiable Render Camouflage Checkpoints

This repository releases audited universal camouflage-generator checkpoints,
safe tensor-only exports, frozen configurations, per-seed evaluation records,
and integrity manifests. The releases document development and transfer failures;
they are not evidence for a broadly effective physical camouflage attack.

## Released models

### Latent-grid UV-space candidate

`stage2_universal_latent32x64_v1` is a geometry-conditioned universal generator
with a `32 x 64` stochastic latent grid, an eight-channel latent representation,
mask/UV/object-position/object-normal conditioning, a spatial decoder producing a
`256 x 256` feature field, and a `2048 x 2048` UV texture output. Training used
four vehicles, two-view mean EOT, a hard maximum over detector boxes, six epochs,
and 1,728 optimizer steps.

The selected full checkpoint has SHA-256
`c9bfa671a06924aa51e2e7ea6036f54b3d761da61ea93b776effa545ef0b6631`.
It contains model state, optimizer state, RNG state, the frozen runtime config, and
artifact hashes. The tensor-only `model.safetensors` export is preferred when
resume state is unnecessary. Never load an unverified pickle-based `.pt` file
from an untrusted source.

### Canonical-surface candidate

`stage2_universal_canonical_surface_v1` replaces the active UV-space geometry
convolutions with a canonical object-space tri-plane field sampled from normalized
object positions. It retains the `32 x 64` stochastic latent grid, four training
vehicles, two-view mean EOT, hard maximum over detector boxes, six epochs, and
1,728 optimizer steps of the matched reference protocol.

All six epoch exports are available under
`stage2_universal_canonical_surface_v1/epochs/`. Each epoch contains a
tensor-only `model.safetensors`, frozen `config.json`, export metadata, and an
integrity manifest; no pickle training checkpoint is published. The selected
epoch-6 safe export has SHA-256
`4d2a90f476341432084b11f69693df1b017c799dd432e7c210cf3b60bb77c82f`.

## Results and decision

Lower attacked AP50:95 and higher clean-conditioned ASR indicate a stronger
attack. Values after `+/-` are sample standard deviations over latent seeds 42--46.

### Latent-grid transfer result

| Vehicle role | Clean AP50:95 | Attacked AP50:95 | Clean-conditioned ASR | Interpretation |
| --- | ---: | ---: | ---: | --- |
| Toyota validation | 0.303291 | 0.232563 +/- 0.007383 | 0.234234 | Selected epoch 6 |
| Lincoln development holdout | 0.228031 | 0.206965 +/- 0.003146 | 0.105085 +/- 0.019510 | Development evidence only |
| Nissan outcome-sealed confirmation | 0.353245 | 0.345791 +/- 0.000788 | 0.014035 +/- 0.004805 | Frozen source gate failed |

The Nissan gate required an absolute AP50:95 reduction of at least `0.015` and
mean ASR of at least `0.075`. The observed reduction was `0.007454`, and mean ASR
was `0.014035`; both effect conditions failed. AP50, recall, and mean confidence
increased under the attacked render. Per the preregistered stopping rule, no
held-out detector, naturalness, or physical expansion was run for this checkpoint.

### Canonical-surface development result

All six checkpoints were evaluated on the 144-view Toyota development-validation
split. The frozen selector chose epoch 6 at attacked AP50:95
`0.298996 +/- 0.001600`, attacked AP50 `0.790225 +/- 0.002958`, and
clean-conditioned ASR `0.027027 +/- 0.000000`. Clean Toyota AP50:95 was
`0.303237`.

The prior latent-grid reference had attacked AP50:95 `0.232563`; the canonical
candidate was therefore `0.066433` worse for the attack and exceeded the frozen
non-inferiority threshold of `0.235563` by `0.063433`. The Toyota gate failed, so
Lincoln evaluation was not authorized. Nissan was absent from configuration,
training, selection, and evaluation. This falsifies only the tested tri-plane
configuration under the recorded detector, data, optimizer, and six-epoch budget;
it does not falsify all object-space representations.

## Intended use

- Reproduce the frozen development and confirmation analysis.
- Reproduce the canonical-surface negative development result and stopping decision.
- Study validation-to-confirmation collapse across vehicle geometry.
- Initialize a new redesign that is selected only on development vehicles.
- Benchmark artifact provenance, checkpoint replay, and negative-result reporting.

Nissan outcomes must not inform future architecture, objective, checkpoint, view,
or seed selection. This model is not validated for deployment, physical attacks,
autonomous-driving safety claims, detector transfer, or natural-looking wraps.

## Dependencies not bundled

This repository does not redistribute YOLO, Z-Image, or other third-party model
weights. The released universal checkpoint does not contain a Z-Image foundation
model. Exact external artifact hashes and expected paths are recorded in the
checkpoint metadata and provenance files.

## Reproducibility

The latent-grid run source commit is
`5f01bf5f1b4c84e81c4d8bdb862b9f661a848faf`; the canonical-surface run source
commit is `34eb09336cb5ae2b8257ef11f69899c82f043d39`. The canonical experiment used
dataset revision `0664d82e27ee87f7519aba8f704f4ad40537e81e` (tag
`raw-v1-20260803`). Verify downloaded files against their `SHA256SUMS`, and retain
the frozen manifests, scene statistics, latent seeds, and detector-weight hash.
The private codebase is managed separately and is not included in this model
repository.

## License

Project-authored model weights, configurations, and release metadata are available
under the MIT License. Dataset and CARLA-derived materials retain the attribution
requirements described in the linked dataset repository.