Distillation-Enhanced Physical Adversarial Attacks

ChaoQun Li; Huanqian Yan; Wei Liu; Yonglin Wu; Zhuodong Liu

REVIEW 4 major objections 4 minor 1 cited by

Distillation-Enhanced Physical Adversarial Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Knowledge distillation lets color-constrained adversarial patches attack object detectors over 20 percent more effectively without becoming more visible.

desk verdict A sensible, genuinely new application of knowledge distillation to physical adversarial patches; the '>20%' headline is not consistently supported by the paper's own numbers. read the letter →

arxiv 2501.02232 v1 pith:UKAN6YIC submitted 2025-01-04 cs.CV

Wei Liu , Yonglin Wu , Chaoqun Li , Zhuodong Liu , Huanqian Yan This is my paper · ORCID

classification cs.CV

keywords physicaladversarialattackpatchknowledgedistillationstealthycolorspaceobjectdetectionGumbel-softmaxsuccessratecamouflage

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Physical adversarial patches are patterns placed on real objects to fool detectors, but patches that work well tend to look out of place. This paper claims the trade-off can be broken by knowledge distillation: first generating a strong patch with no color restriction, then using it as a 'teacher' to guide a 'student' patch that is restricted to colors taken from the environment. The reported result is an improvement of more than 20 percent in attack performance over the best non-distillation color-constrained method, with no loss of visual stealth. If true, this makes physical attacks considerably more practical while keeping the detector-defeating strength of unconstrained patches.

What carries the argument

Three components carry the argument. A stealthy color space is built by k-means clustering the LAB-space colors of one environment image into a small set of base colors; the patch is forced to use only those colors. Differentiable optimization is achieved with the Gumbel-softmax reparameterization trick, which turns the non-differentiable argmax color choice into a soft approximation. The adversarial knowledge distillation module then computes an attention mask from the difference between teacher and student detection-confidence maps and minimizes the masked feature difference between the unconstrained teacher patch and the stealthy student patch.

What would settle it

Take the same patch and place it in the same scene at a different time of day or under different weather so the environment's dominant colors shift, and measure both a human conspicuity score and detector attack success rate; if the patch becomes noticeably visible or the attack success drops toward the non-distillation baseline, the fixed stealthy color set is the point of failure.

Watch

Extended reading notes

Core claim

The paper's central claim is that color-constrained adversarial patches lose effectiveness not because the constrained colors are incapable of deception, but because standard optimization in the constrained space does not exploit them well. The proposed method optimizes an unconstrained patch and an environment-color-constrained patch jointly, and distills intermediate detector features from the unconstrained 'teacher' into the constrained 'student' using an adaptive mask that focuses on regions where the two patches' detection confidence maps differ. On the INRIA pedestrian dataset, this closes most of the gap between the constrained and unconstrained patches, cutting mAP50 by over 20 percent compared with the non-distillation baseline while keeping the patch's appearance limited to environment-derived colors. The authors state this is the first use of knowledge distillation for generating adversarial patches.

Load-bearing premise

The load-bearing premise is that the set of colors extracted by clustering one environment image stays representative of the environment when the patch is physically deployed; if lighting or scenery changes enough, the patch either becomes visible or loses attack strength.

Editorial extensions

If this is right

Color-constrained patches can reach attack effectiveness close to unrestricted patches, so stealth no longer has to cost attack power.
Knowledge distillation becomes a general strengthening step for adversarial patch generation in constrained color spaces.
Detector evaluation should include distillation-enhanced attacks, since they could defeat defenses tuned for non-distillation patches.
Black-box transfer also improves: the distilled patch outperforms three color-constrained baselines by about 7 percent average mAP drop across unseen detectors.
Practical deployments such as surveillance or autonomous driving face a more realistic and more dangerous adversarial patch threat model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

One natural extension the paper leaves implicit: the teacher could be replaced by an ensemble of unconstrained patches for different viewing conditions, potentially improving physical robustness under varied lighting.
The fixed color set is derived from a single environment image; testing with color sets sampled across times of day or seasons would show whether the stealth guarantee holds in deployment.
The distillation idea could be applied to other constrained generation settings, such as printable inks, limited patch shapes, or texture-only camouflage, where the unconstrained solution provides the teaching signal.
A testable prediction follows from the ablation: if the mask M were removed, the gain from distillation should shrink; measuring mAP drop with a random mask would isolate how much of the 20 percent comes from adaptive region selection.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the idea is real. Using a color-unconstrained patch as a teacher to guide a stealthy, color-constrained student patch is a natural move that I don't think anyone has done before, and the adaptive confidence-based mask is a reasonable detail. The paper reads well and the method section is clear enough to reimplement.

What's good: the framework is straightforward, and the choice of distillation target (intermediate features over a masked region of interest) is well motivated. Digital experiments cover four detectors with white-box and black-box setups, which is more than many patch papers do. The white-box mAP drops on YOLOv2 (28.85 to 21.46) and YOLOv3 (61.68 to 45.46) are solid evidence that the distillation signal is doing something. The qualitative physical results in Fig. 3 are suggestive.

Soft spots, in order of importance:

1. The "over 20% improvement" claim is not what Table I shows. Averaging over the four detectors, mAP drops from 53.88 to 43.82, which is 18.7%, not over 20%. Only YOLOv2 and YOLOv3 exceed 20%; YOLOv5 is 19.9% and Faster R-CNN only 8.7%. The abstract and Section IV.D should quote the actual numbers.

2. The controlled ablation (Fig. 4) is the right experiment—same pipeline with and without distillation—but it is a single bar chart with no numeric values, error bars, or seed count. That's the real evidence for attribution, and it is missing.

3. Physical experiments are qualitative. Fig. 3 shows sample frames and an undocumented ASR. Report what was measured in a table.

4. The stealthy color space is derived from k-means on a single environment image. The authors should acknowledge that a patch tuned to one scene's palette may stand out under different lighting. Minor relative to the above.

The math, the losses, and the optimization are not the problem. The citation pattern is fine, and the novelty claim about being first to apply KD to patch generation appears correct.

Bottom line: incremental but useful contribution to adversarial robustness testing. It deserves a serious referee. I would send it out and ask for a revision: fix the overclaim, quantify the ablation, add error bars, and report physical ASR. Instead of desk rejection, this is a conditional accept with reasonable effort.

Referee Report

4 major / 4 minor

Summary. The paper proposes a physical adversarial patch attack that uses knowledge distillation to improve the attack performance of color-constrained (stealthy) patches. The method first clusters an environment image in LAB space to define a small set of allowed colors, then trains an unconstrained adversarial patch as a 'teacher' and a color-constrained patch as a 'student', transferring intermediate-feature knowledge through an adaptive mask. The authors report digital experiments on INRIA with YOLOv2 as white-box and YOLOv3, YOLOv5, and Faster R-CNN as black-box models, plus qualitative physical-world experiments. The central claim is that the distillation module improves attack performance by over 20% over non-distillation methods while preserving stealth, with contributions claimed as the first use of knowledge distillation for adversarial patch generation.

Significance. If the central claim holds, the paper makes a useful empirical contribution: it demonstrates a plausible mechanism for closing the effectiveness gap between color-constrained and unconstrained adversarial patches, using a standard training signal (feature imitation) rather than a new attack principle. The methodology is clearly described, and the use of a teacher patch that is optimized independently and evaluated on a held-out test set is a sound design. However, the quantitative support for the headline 'over 20%' improvement is incomplete and partially contradicted by the paper's own Table I, and the ablation and physical experiments lack the numeric detail needed to verify the magnitude of the effect. The core idea is promising and well-motivated, but the evidence as presented is not yet sufficient for the stated claims.

major comments (4)

[Section IV.B, Table I] The abstract and Section IV.D claim an attack-performance improvement of 'over 20%' from distillation, but Table I does not uniformly support this. Compared with AdvCat, the white-box YOLOv2 column improves by 25.6% (28.85 to 21.46 mAP), YOLOv3 by 26.3% (61.68 to 45.46), YOLOv5 by 19.9% (51.47 to 41.24), and Faster R-CNN by only 8.7% (73.53 to 67.12). The average improvement over AdvCat is approximately 18.7%, and the black-box average is approximately 17.6%. Thus the 'over 20%' statement is not supported for the overall or black-box-average comparisons; the claim should be revised to be column-specific or accompanied by additional supporting experiments.
[Section IV.D, Fig. 4] The ablation study that is the primary attribution of the improvement to the distillation module is presented only as a bar chart (Fig. 4) with no numeric values, no error bars, and no statement of the number of seeds or runs. Given that the headline claim rests on this comparison, the authors should report the exact mAP values (and ideally standard deviations) for the with- and without-distillation conditions, and should specify whether the 'without' condition is the same pipeline with the distillation term removed or the separate AdvCat implementation described in Section IV.B.
[Section IV.C, Fig. 3] The physical-world experiments are qualitative only. The paper defines Attack Success Rate (ASR) in Section IV.A but reports no ASR numbers for the physical experiments; the claim that the method 'more effectively deceives the detector' is supported only by a figure. To substantiate the physical-world improvement, the authors should report ASR (and ideally detection-confidence statistics) for the compared methods across the recorded frames.
[Section IV.A and IV.E] There is an inconsistency in the distillation coefficient β. Section IV.A states that the two-stage model uses β=0.01 and the single-stage model uses β=1, while Section IV.E concludes 'we set the distillation loss coefficient β to 1' based on Fig. 5. If different detectors use different coefficients, this should be stated explicitly and justified; if β=1 is used everywhere, the earlier sentence should be corrected.

minor comments (4)

[Section III.C.2, Eq. (6)] The Gumbel-softmax estimator is referenced to Maddison et al. [28], but [28] is 'A* sampling'; the appropriate citation would be the categorical reparameterization with Gumbel-Softmax by Jang et al. or Maddison et al.'s 'The Concrete Distribution' paper.
[Throughout, e.g., Section III.D] Notation is inconsistent and typo-ridden: 'f eattch' and 'f eatstu' should be rendered as math (e.g., f_t and f_s), and 'maitaining' in the conclusion and 'V oronoi' in Section II.A should be corrected.
[Section II.A] The method named 'AdvCat' in Table I and the text is spelled 'AdvCaT' in Section II.A; please use consistent naming.
[Section IV.B] The sentence 'The average mAP of NatPatch, DAP, and our method on three black-box models are 53.87, 56.82, and 51.27' is unclear: these values do not match the average row of Table I, and 'three black-box models' should be spelled out explicitly as YOLOv3, YOLOv5, and Faster R-CNN.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the distillation gain is measured against external baselines on a held-out test set.

full rationale

The paper's derivation chain is self-contained. The teacher patch is a color-unconstrained adversarial patch optimized independently of the stealthy student patch; Eq. (10) defines the distillation loss as a feature-difference term that transfers teacher features to the student, and Eq. (12) adds it to the adversarial loss. The student is evaluated on the held-out INRIA test set with mAP50, and the claimed improvement is computed relative to AdvCat, an external non-distillation baseline (Table I), not by construction from the training objective. The stealthy color space is obtained by k-means clustering of an environment image (Eqs. (2)-(3)) and is not defined in terms of the attack metric, so no fitted input is renamed as a prediction. The only self-citations ([8], [9]) appear in the related-work survey of color-constrained patches and are not load-bearing for the method or its evaluation. The inconsistency between the 'over 20%' wording and the 18.7% average improvement in Table I is a numerical-reporting issue, not circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method rests on several hand-chosen hyperparameters and domain assumptions. The free parameters include the number of color clusters, Gumbel temperature, distillation weight, mask thresholds, and the unspecified adversarial loss weights in Eq (11). The key domain assumption is that LAB-space color clustering from a single environment image is sufficient for stealth under physical conditions.

free parameters (5)

number of color clusters m = not specified in text
The stealthy color space is defined by k-means clustering into m colors; m is chosen by hand and affects the tradeoff between stealth and attack expressiveness.
Gumbel-softmax temperature omega = 0.3
Set in Section IV.A optimization details; controls approximation of categorical sampling and thus the degree of color constraint.
distillation coefficient beta = 0.01 (two-stage), 1 (single-stage)
Balances adversarial loss and distillation loss; values differ per detector type.
mask threshold th = 0.25 for class scores, 0.1 for object confidence
Filters detection scores to build feature masks in the distillation module.
adversarial loss weights lambda1, lambda2, lambda3 = not specified
Weights for class, objectness, and IoU terms in Eq (11); unspecified in the paper, making exact reproduction impossible.

assumptions (4)

domain assumption LAB color space is perceptually uniform, so k-means clustering in LAB approximates human perceptual color categories.
Used in Section III.C.1 to justify converting RGB to LAB for color clustering.
standard math The reparameterization trick (Gumbel-softmax) provides a differentiable approximation to categorical sampling that preserves gradients.
Used in Eq (5)-(6) to optimize over the discrete color set.
domain assumption The detection confidence scores from the output layer can be mapped to feature map locations to identify regions of interest.
Used in the adaptive feature mask mechanism in Section III.D.
domain assumption The INRIA pedestrian dataset and the specific detectors (YOLOv2, YOLOv3, YOLOv5, Faster R-CNN) are representative for evaluating physical adversarial patches.
Implicit in the experimental design; the paper generalizes conclusions beyond this setup without discussion.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Distillation-Enhanced Physical Adversarial Attacks." pith.science (2026). https://pith.science/paper/UKAN6YIC

@misc{pith2026250102232,
  author       = {Pith},
  title        = {Pith review of: Distillation-Enhanced Physical Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UKAN6YIC}},
  note         = {Machine review of arXiv:2501.02232}
}

read the original abstract

The study of physical adversarial patches is crucial for identifying vulnerabilities in AI-based recognition systems and developing more robust deep learning models. While recent research has focused on improving patch stealthiness for greater practical applicability, achieving an effective balance between stealth and attack performance remains a significant challenge. To address this issue, we propose a novel physical adversarial attack method that leverages knowledge distillation. Specifically, we first define a stealthy color space tailored to the target environment to ensure smooth blending. Then, we optimize an adversarial patch in an unconstrained color space, which serves as the 'teacher' patch. Finally, we use an adversarial knowledge distillation module to transfer the teacher patch's knowledge to the 'student' patch, guiding the optimization of the stealthy patch. Experimental results show that our approach improves attack performance by 20%, while maintaining stealth, highlighting its practical value.

Figures

Figures reproduced from arXiv: 2501.02232 by the authors.

**Figure 2.** The overview of our proposed method. First, we extract the base colors from the environment to craft an adversarial patch that blends seamlessly with [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Compared with other SOTA methods in physical experiments. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: The YOLOv5 decline curve of detection box confidence under [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection
cs.CV 2026-08 conditional novelty 6.0 of 10

ColorFD hides aircraft from YOLOv3u, YOLOv5u, and Faster R-CNN by optimizing a few solid-color patches with differential evolution and finite-difference guidance.

Reference graph

Works this paper leans on

32 extracted references · 30 canonical work pages · cited by 1 Pith paper

[1]

Mysticmask: Adversarial mask for impersonation attack against face recognition systems,

Chaoxiang He, Yimiao Zeng, Xiaojing Ma, Bin Benjamin Zhu, Zewei Li, Shixin Li, and Hai Jin, “Mysticmask: Adversarial mask for impersonation attack against face recognition systems,” in 2024 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2024, pp. 1–6

work page 2024
[2]

An analysis of adversarial attacks and defenses on autonomous driving models,

Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim, “An analysis of adversarial attacks and defenses on autonomous driving models,” in 2020 IEEE international conference on pervasive computing and communications (PerCom) . IEEE, 2020, pp. 1–10

work page 2020
[3]

Invisible pedestrians: Synthesizing adversarial clothing textures to evade industrial camera-based 3d detection,

Xinlong Ding, Hongwei Yu, Jiansheng Chen, Jinlong Wang, Jintai Du, and Huimin Ma, “Invisible pedestrians: Synthesizing adversarial clothing textures to evade industrial camera-based 3d detection,” in 2024 IEEE International Conference on Multimedia and Expo (ICME) . IEEE, 2024, pp. 1–6

work page 2024
[4]

Universal physical camouflage attacks on object detectors,

Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu, “Universal physical camouflage attacks on object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2020, pp. 720–729

work page 2020
[5]

Naturalistic physical adver- sarial patch for object detectors,

Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng, “Naturalistic physical adver- sarial patch for object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 7848–7857

work page 2021
[6]

Dap: A dynamic adversarial patch for evading person detectors,

Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique, “Dap: A dynamic adversarial patch for evading person detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2024, pp. 24595–24604

work page 2024
[7]

Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,

Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu, “Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 16975–16984

work page 2023
[8]

Prompt-Guided Environmentally Consistent Adversarial Patch

Chaoqun Li, Huanqian Yan, Lifeng Zhou, Tairan Chen, Zhuodong Liu, and Hang Su, “Prompt-guided environmentally consistent adversarial patch,” arXiv preprint arXiv:2411.10498 , 2024

work page Pith review arXiv 2024

Show all 32 references

[9]

Capgen: An environment-adaptive generator of adversarial patches,

Chaoqun Li, Zhuodong Liu, Huanqian Yan, and Hang Su, “Capgen: An environment-adaptive generator of adversarial patches,” arXiv preprint arXiv:2412.07253, 2024

2024 arXiv
[10]

Fooling automated surveillance cameras: adversarial patches to attack person detection,

Simen Thys, Wiebe Van Ranst, and Toon Goedem ´e, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops , 2019, pp. 0–0

2019
[11]

The v1 hypothesis-creating a bottom-up saliency map for preattentive selection and segregation,

L Zhaoping, “The v1 hypothesis-creating a bottom-up saliency map for preattentive selection and segregation,” Understanding vision: theory, models, and data , pp. 189–314, 2014

2014
[12]

Attention capture by eye of origin singletons even without awareness—a hallmark of a bottom-up saliency map in the primary visual cortex,

Li Zhaoping, “Attention capture by eye of origin singletons even without awareness—a hallmark of a bottom-up saliency map in the primary visual cortex,” Journal of Vision, vol. 8, no. 5, pp. 1–1, 2008

2008
[13]

Physical adversarial examples for object detectors,

Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno, “Physical adversarial examples for object detectors,” in 12th USENIX workshop on offensive technologies (WOOT 18) , 2018

2018
[14]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 acm sigsac conference on computer and communications security , 2016, pp. 1528–1540

2016
[15]

Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,

Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen, “Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors,” in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, ...

2019
[16]

Adversarial t- shirt! evading person detectors in a physical world,

Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin, “Adversarial t- shirt! evading person detectors in a physical world,” in ECCV. Springer, 2020, pp. 665–681

2020
[17]

Inconspicuous adversarial patches for fooling image-recognition systems on mobile devices,

Tao Bai, Jinqi Luo, and Jun Zhao, “Inconspicuous adversarial patches for fooling image-recognition systems on mobile devices,”IEEE Internet of Things Journal , vol. 9, no. 12, pp. 9515–9524, 2021

2021
[18]

Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon,

Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji, “Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2022, pp. 15345–15354

2022
[19]

{SLAP}: Improving physical adversarial examples with {Short-Lived} adversarial perturbations,

Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic, “ {SLAP}: Improving physical adversarial examples with {Short-Lived} adversarial perturbations,” in USENIX Security , 2021, pp. 1865–1882

2021
[20]

Distilling the knowledge in a neural network,

Geoffrey Hinton, Oriol Vinyals, and Jeff Dean, “Distilling the knowledge in a neural network,” arXiv preprint arXiv:1503.02531 , 2015

2015 arXiv
[21]

Learning without forgetting,

Zhizhong Li and Derek Hoiem, “Learning without forgetting,” IEEE transactions on pattern analysis and machine intelligence , vol. 40, no. 12, pp. 2935–2947, 2017

2017
[22]

Mimicking very efficient network for object detection,

Quanquan Li, Shengying Jin, and Junjie Yan, “Mimicking very efficient network for object detection,” in CVPR, 2017, pp. 6356–6364

2017
[23]

Online model distillation for efficient video inference,

Ravi Teja Mullapudi, Steven Chen, Keyi Zhang, Deva Ramanan, and Kayvon Fatahalian, “Online model distillation for efficient video inference,” in CVPR, 2019, pp. 3573–3582

2019
[24]

Distillation as a defense to adversarial perturbations against deep neural networks,

Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Anan- thram Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE symposium on security and privacy (SP) . IEEE, 2016, pp. 582–597

2016
[25]

Extending defensive distilla- tion,

Nicolas Papernot and Patrick McDaniel, “Extending defensive distilla- tion,” arXiv preprint arXiv:1705.05264 , 2017

2017 arXiv
[26]

Ad- versarially robust distillation,

Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein, “Ad- versarially robust distillation,” in Proceedings of the AAAI Conference on Artificial Intelligence , 2020, vol. 34, pp. 3996–4003

2020
[27]

Revisiting adversarial robustness distillation: Robust soft labels make student better,

Bojia Zi, Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang, “Revisiting adversarial robustness distillation: Robust soft labels make student better,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 16443–16452

2021
[28]

A* sampling,

Chris J Maddison, Daniel Tarlow, and Tom Minka, “A* sampling,” Advances in neural information processing systems , vol. 27, 2014

2014
[29]

I-divergence geometry of probability distributions and minimization problems,

Imre Csisz ´ar, “I-divergence geometry of probability distributions and minimization problems,” The annals of probability , pp. 146–158, 1975

1975
[30]

Histograms of oriented gradients for human detection,

Navneet Dalal and Bill Triggs, “Histograms of oriented gradients for human detection,” in 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05) . Ieee, 2005, vol. 1, pp. 886–893

2005
[31]

Synthesizing robust adversarial examples,

Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok, “Synthesizing robust adversarial examples,” in International conference on machine learning . PMLR, 2018, pp. 284–293

2018
[32]

T-sea: Transfer-based self-ensemble attack on object detection,

Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang, “T-sea: Transfer-based self-ensemble attack on object detection,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 20514–20523

2023

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Mysticmask: Adversarial mask for impersonation attack against face recognition systems,

Chaoxiang He, Yimiao Zeng, Xiaojing Ma, Bin Benjamin Zhu, Zewei Li, Shixin Li, and Hai Jin, “Mysticmask: Adversarial mask for impersonation attack against face recognition systems,” in 2024 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 2024, pp. 1–6

work page 2024

[2] [2]

An analysis of adversarial attacks and defenses on autonomous driving models,

Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim, “An analysis of adversarial attacks and defenses on autonomous driving models,” in 2020 IEEE international conference on pervasive computing and communications (PerCom) . IEEE, 2020, pp. 1–10

work page 2020

[3] [3]

Invisible pedestrians: Synthesizing adversarial clothing textures to evade industrial camera-based 3d detection,

Xinlong Ding, Hongwei Yu, Jiansheng Chen, Jinlong Wang, Jintai Du, and Huimin Ma, “Invisible pedestrians: Synthesizing adversarial clothing textures to evade industrial camera-based 3d detection,” in 2024 IEEE International Conference on Multimedia and Expo (ICME) . IEEE, 2024, pp. 1–6

work page 2024

[4] [4]

Universal physical camouflage attacks on object detectors,

Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu, “Universal physical camouflage attacks on object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2020, pp. 720–729

work page 2020

[5] [5]

Naturalistic physical adver- sarial patch for object detectors,

Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng, “Naturalistic physical adver- sarial patch for object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 7848–7857

work page 2021

[6] [6]

Dap: A dynamic adversarial patch for evading person detectors,

Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique, “Dap: A dynamic adversarial patch for evading person detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2024, pp. 24595–24604

work page 2024

[7] [7]

Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,

Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu, “Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 16975–16984

work page 2023

[8] [8]

Prompt-Guided Environmentally Consistent Adversarial Patch

Chaoqun Li, Huanqian Yan, Lifeng Zhou, Tairan Chen, Zhuodong Liu, and Hang Su, “Prompt-guided environmentally consistent adversarial patch,” arXiv preprint arXiv:2411.10498 , 2024

work page Pith review arXiv 2024