Differentiable Render Camouflage Checkpoints
This repository releases audited universal camouflage-generator checkpoints, safe tensor-only exports, frozen configurations, per-seed evaluation records, and integrity manifests. The releases document development and transfer failures; they are not evidence for a broadly effective physical camouflage attack.
Released models
Latent-grid UV-space candidate
stage2_universal_latent32x64_v1 is a geometry-conditioned universal generator
with a 32 x 64 stochastic latent grid, an eight-channel latent representation,
mask/UV/object-position/object-normal conditioning, a spatial decoder producing a
256 x 256 feature field, and a 2048 x 2048 UV texture output. Training used
four vehicles, two-view mean EOT, a hard maximum over detector boxes, six epochs,
and 1,728 optimizer steps.
The selected full checkpoint has SHA-256
c9bfa671a06924aa51e2e7ea6036f54b3d761da61ea93b776effa545ef0b6631.
It contains model state, optimizer state, RNG state, the frozen runtime config, and
artifact hashes. The tensor-only model.safetensors export is preferred when
resume state is unnecessary. Never load an unverified pickle-based .pt file
from an untrusted source.
Canonical-surface candidate
stage2_universal_canonical_surface_v1 replaces the active UV-space geometry
convolutions with a canonical object-space tri-plane field sampled from normalized
object positions. It retains the 32 x 64 stochastic latent grid, four training
vehicles, two-view mean EOT, hard maximum over detector boxes, six epochs, and
1,728 optimizer steps of the matched reference protocol.
All six epoch exports are available under
stage2_universal_canonical_surface_v1/epochs/. Each epoch contains a
tensor-only model.safetensors, frozen config.json, export metadata, and an
integrity manifest; no pickle training checkpoint is published. The selected
epoch-6 safe export has SHA-256
4d2a90f476341432084b11f69693df1b017c799dd432e7c210cf3b60bb77c82f.
Results and decision
Lower attacked AP50:95 and higher clean-conditioned ASR indicate a stronger
attack. Values after +/- are sample standard deviations over latent seeds 42--46.
Latent-grid transfer result
| Vehicle role | Clean AP50:95 | Attacked AP50:95 | Clean-conditioned ASR | Interpretation |
|---|---|---|---|---|
| Toyota validation | 0.303291 | 0.232563 +/- 0.007383 | 0.234234 | Selected epoch 6 |
| Lincoln development holdout | 0.228031 | 0.206965 +/- 0.003146 | 0.105085 +/- 0.019510 | Development evidence only |
| Nissan outcome-sealed confirmation | 0.353245 | 0.345791 +/- 0.000788 | 0.014035 +/- 0.004805 | Frozen source gate failed |
The Nissan gate required an absolute AP50:95 reduction of at least 0.015 and
mean ASR of at least 0.075. The observed reduction was 0.007454, and mean ASR
was 0.014035; both effect conditions failed. AP50, recall, and mean confidence
increased under the attacked render. Per the preregistered stopping rule, no
held-out detector, naturalness, or physical expansion was run for this checkpoint.
Canonical-surface development result
All six checkpoints were evaluated on the 144-view Toyota development-validation
split. The frozen selector chose epoch 6 at attacked AP50:95
0.298996 +/- 0.001600, attacked AP50 0.790225 +/- 0.002958, and
clean-conditioned ASR 0.027027 +/- 0.000000. Clean Toyota AP50:95 was
0.303237.
The prior latent-grid reference had attacked AP50:95 0.232563; the canonical
candidate was therefore 0.066433 worse for the attack and exceeded the frozen
non-inferiority threshold of 0.235563 by 0.063433. The Toyota gate failed, so
Lincoln evaluation was not authorized. Nissan was absent from configuration,
training, selection, and evaluation. This falsifies only the tested tri-plane
configuration under the recorded detector, data, optimizer, and six-epoch budget;
it does not falsify all object-space representations.
Intended use
- Reproduce the frozen development and confirmation analysis.
- Reproduce the canonical-surface negative development result and stopping decision.
- Study validation-to-confirmation collapse across vehicle geometry.
- Initialize a new redesign that is selected only on development vehicles.
- Benchmark artifact provenance, checkpoint replay, and negative-result reporting.
Nissan outcomes must not inform future architecture, objective, checkpoint, view, or seed selection. This model is not validated for deployment, physical attacks, autonomous-driving safety claims, detector transfer, or natural-looking wraps.
Dependencies not bundled
This repository does not redistribute YOLO, Z-Image, or other third-party model weights. The released universal checkpoint does not contain a Z-Image foundation model. Exact external artifact hashes and expected paths are recorded in the checkpoint metadata and provenance files.
Reproducibility
The latent-grid run source commit is
5f01bf5f1b4c84e81c4d8bdb862b9f661a848faf; the canonical-surface run source
commit is 34eb09336cb5ae2b8257ef11f69899c82f043d39. The canonical experiment used
dataset revision 0664d82e27ee87f7519aba8f704f4ad40537e81e (tag
raw-v1-20260803). Verify downloaded files against their SHA256SUMS, and retain
the frozen manifests, scene statistics, latent seeds, and detector-weight hash.
The private codebase is managed separately and is not included in this model
repository.
License
Project-authored model weights, configurations, and release metadata are available under the MIT License. Dataset and CARLA-derived materials retain the attribution requirements described in the linked dataset repository.