Phy-DRILL: 2.5D Physical Depth Reversal Illusion against Monocular Depth Estimation

Reliable monocular depth estimation (MDE) is crucial for the operational safety of autonomous systems, making it essential to evaluate its robustness in the physical world. Yet existing physical attacks, whether textures optimized on 2D patches or 3D meshes, alter only appearance and treat physical geometry as a fixed constraint. In this work, we reveal that parameterized geometry unlocks adversarial effects that appearance alone cannot reach. We exploit the Depth Reversal Illusion (DepthRI), a perceptual phenomenon in which protruding structures are visually misinterpreted as receding surfaces due to conflicting geometric and texture cues. We show that DepthRI deceives not only human vision but also SOTA MDE models and trace its effect to two factors: the number of vanishing points in the perspective structure, and the texture gradient that activates the illusion. Guided by these findings, we propose Phy-DRILL (Physical Depth Reversal ILLusion), which constructs 2.5D adversarial patches grounded in perspective geometric relationships and further enhances their adversarial effectiveness through targeted surface texture optimization. Our approach causes physically protruding structures to be systematically misperceived as concave regions by SOTA MDE models. Across six MDE models, the experiments show that Phy-DRILL outperforms existing attacks in both digital and physical settings and transfers from a single surrogate model to five black-box models.