FactorizePatch: Factorizing the Printer-Camera Pipeline for Robust Physical Adversarial Patches

Adversarial patches optimized in the digital domain often lose effectiveness once printed and recaptured, because printing and camera imaging distort their colors, textures, and high-frequency structures. Prior work improves physical robustness through generic geometric and photometric transformations, printer-aware modeling, camera-aware simulation, or a single monolithic digital-to-physical mapping. Single-stage methods, however, cover only part of the print-capture path, while monolithic mappings obscure where degradation originates and offer little control over difficult imaging conditions. We present FactorizePatch, which factorizes the print-and-capture process into sequential yet independent differentiable stages (print appearance, scene deployment, and camera formation) instead of collapsing it into one such mapping, and places the full pipeline inside targeted universal patch optimization. Printing and imaging therefore remain explicit and independently controllable. To support attack-relevant printer modeling, we build a dedicated print-scan dataset covering adversarial and print-sensitive patterns; on held-out pairs our print proxy reconstructs printed appearance more accurately than prior proxies, reducing MAE by up to $63.5\%$. Within the camera stage, FactorizePatch samples multiple degradation strengths across optics/motion, sensor, ISP, and full-camera branches and adaptively reweights the branches by their current attack losses, directing optimization toward the patch's most vulnerable imaging condition while preserving coverage of compound degradations. Across CLIP and ResNet victims under simulated and real print-and-capture settings, FactorizePatch narrows the digital-to-physical gap to as little as $0.87$% and achieves state-of-the-art targeted physical robustness. Code and data will be publicly available.