Pith. sign in

REVIEW 4 major objections 6 minor 2 cited by

Imperceptible Adversarial Examples in the Physical World

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Straight-through gradient estimation makes imperceptible, L-infinity-bounded adversarial examples work in the physical world, with zero accuracy on printed photos and AP50 down to 4.22 percent in a driving simulator.

desk verdict Well-executed application of known STE/BPDA trick to physical attacks; strong claims rest on an unmeasured sign-accuracy assumption and a small, confounded experiment. read the letter →

arxiv 2411.16622 v1 pith:B2Q43A6J submitted 2024-11-25 cs.CV cs.AI

Weilin Xu , Sebastian Szyller , Cory Cornelius , Luis Murillo Rojas , Marius Arvinte , Alvaro Velasquez , Jason Martin , Nageen Himayat This is my paper · ORCID
classification cs.CVcs.AI
keywords adversarialexamplesphysical-worldattacksstraight-throughestimatorBPDAimperceptibleperturbationsL-infinityboundedobjectdetectionautonomousdrivingperception
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Imperceptible adversarial perturbations, bounded by tiny L-infinity norms, can survive a real printing-and-photographing pipeline and defeat a deployed image classifier; the paper demonstrates this with six printed photos on which a 12-step PGD attack at $\ell_\infty = 4/255$ drives correct predictions to zero. The same idea works for patches: a perturbation of $\ell_\infty = 8/255$ placed on a billboard-like patch in a photorealistic urban driving simulator drops object-detection AP50 from 43.29% to 4.22%. The enabling trick is a straight-through estimator (STE, also known as BPDA): the exact non-differentiable distortion runs in the forward pass, and the identity function replaces its gradient in the backward pass. Because FGSM and PGD only use the sign of the gradient, the paper argues, the magnitude error from this approximation does not hurt the attack. If the results hold, physical-world adversarial examples are as practical as digital ones, and vision systems in security-sensitive settings should be assessed against this threat.

What carries the argument

The central object is the straight-through estimator (STE, also known as BPDA), defined by using the true non-differentiable distortion in the forward pass and the identity in the backward pass. In the global-perturbation setup it is expressed with a stop-gradient operation as $f(d(x+\delta)) = f(x+\delta + \mathrm{sg}[d(x+\delta)-(x+\delta)])$, so the backward pass sees $x+\delta$ with a constant offset. In the patch setup the distortion is written as $g_d(\delta,x,e)=r(x+\delta)+\mathrm{sg}[c(p(x+\delta),e)-r(x+\delta)]$, where $r$ is a differentiable renderer and the non-differentiable camera-plus-print pipeline only supplies the forward value. The mechanism works because the sign of the identity-backward gradient is asserted to match the true sign whenever the distortion preserves a similar image, and sign-based attacks such as FGSM and PGD only need the sign.

What would settle it

Print the same six images again with a different printer or camera, generate STE-augmented PGD perturbations at $\ell_\infty=4/255$, and count correct predictions of the target classifier; any nonzero correct count would falsify the zero-accuracy claim. A more direct test of the mechanism: for random perturbations, compare the sign of the identity-backward gradient with the sign obtained by finite differences through the physical pipeline; if sign agreement falls well below 100% of pixels, the assertion that the sign is always accurate is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that non-differentiability in physical imaging is not a barrier to imperceptible adversarial examples. On the paper's own terms: apply the true distortion $d(\cdot)$ in the forward pass, so the loss is exact, and backpropagate through the identity, so the gradient is approximate but cheap. The stop-gradient identity $f(d(x+\delta)) = f(x+\delta + \mathrm{sg}[d(x+\delta)-(x+\delta)])$ makes this concrete. For the patch threat model, the same construction uses a differentiable renderer $r(x+\delta)$ in place of the non-differentiable renderer, with the residual detached as a constant. With this machinery, PGD bounded by $\ell_\infty=4/255$ achieves zero accuracy on the printout photos, and an unbounded STE-augmented patch reaches 0% AP50 while an $\ell_\infty=8/255$ patch reaches 4.22% AP50 in the simulator.

Load-bearing premise

The load-bearing premise is that the identity backward pass preserves the sign of the true gradient through the physical distortion; if clipping, halftoning, color shifts, perspective misalignment, or game-engine lighting ever make that sign wrong, the digitally optimized perturbation is not what the camera sees, and the zero-accuracy results would not transfer.

Editorial extensions

If this is right

  • Physical adversarial examples no longer require large, visibly strange perturbations: with STE, $\ell_\infty = 4/255$ perturbations force zero accuracy on printed photos, so an attacker does not need to sacrifice imperceptibility.
  • Patch-based attacks on object detection become practical: an $\ell_\infty = 8/255$ patch drops AP50 from 43.29% to 4.22% in a photorealistic driving simulator, and an unbounded patch reaches 0%.
  • Because the attack is fast (a single FGSM step at $\ell_\infty=16/255$ suffices, and a few PGD iterations at $16/255$ cross the zero-accuracy threshold), physical attacks are cheap to generate once the pipeline is built.
  • The method extends to 3D camouflage: the paper's differentiable-rendering construction works with mesh renderers, so imperceptible textures on 3D objects are a direct corollary.
  • Defenses that flag abnormal textures will not catch these examples, since the perturbations remain small and visually benign.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable prediction follows from the sign-accuracy mechanism: the attack's effectiveness should degrade as physical distortion becomes more nonlinear or misaligned, so printers with stronger color shifts or cameras with larger perspective error should require larger $\epsilon$ to reach zero accuracy.
  • The zero-accuracy result rests on six images and one printer-camera pair; if the threat model is as general as the paper suggests, the same STE recipe should transfer to other classifier architectures and capture devices, a claim the experiments do not yet cover.
  • Combining STE with expectation-over-transformation noise, which the paper mentions as future work, should yield physical perturbations robust to viewpoint and lighting variation; the mechanism's design allows this without changing the forward-pass trick.
  • The same stop-gradient construction could be reused as a diagnostic for defenses: a defense that deliberately breaks the sign correspondence between the digital perturbation and the physical loss would neutralize the attack, pointing to a cheap defensive direction.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes using a straight-through estimator (STE, also called BPDA) to generate ℓ∞-bounded adversarial examples that survive non-differentiable physical distortions. In the global perturbation threat model, the method applies the true non-differentiable distortion in the forward pass and an identity backward pass, then uses FGSM or PGD on the resulting surrogate gradient. Experiments with printed ImageNet images report zero classification accuracy for PGD at ℓ∞ = 4/255 and for FGSM at ℓ∞ = 16/255. In the patch threat model, STE is combined with a differentiable perspective renderer in the CARLA simulator; the paper reports AP50 dropping from 43.29% to 4.22% for an ℓ∞ = 8/255 patch and to 0% for an unbounded patch. The authors claim these are the first imperceptible, physically realizable adversarial examples with small ℓ∞ bounds that force near-zero accuracy.

Significance. If the empirical claims hold, this is a significant result: it would show that small ℓ∞-bounded perturbations, imperceptible to humans, can survive print-and-camera pipelines and simulator-based rendering, contradicting the common assumption that physical distortions act as a defense. The mathematical formulation is clean and the stop-gradient identities in Eq. (3) and Eq. (5) are exact. The use of an external pre-trained ResNet-50 and a public CARLA detection model, rather than a model trained by the authors, is a strength, as is the internal consistency of the reported trends: larger budgets monotonically reduce accuracy in nearly all rows. However, the central claims rest on an unmeasured sign-fidelity assumption for the identity backward pass, on six images with no repeated trials, and on CARLA scenes that were recreated rather than taken from the official GARD dataset. The significance is therefore conditional on additional measurement and control experiments.

major comments (4)
  1. The assertion that 'the sign of the approximate gradient is always accurate' is load-bearing for the zero-accuracy claim but is never measured. The argument only requires d(x + δ) to be similar to x + δ; for sign-based PGD, one needs per-coordinate sign agreement between the identity backward pass and the true distortion. The printout pipeline in Section 3.2 applies a perspective transform from handheld photos and a manual crop, so after the homography d(x + δ) is not pixel-wise close to x + δ. A one-pixel misalignment can flip the sign of high-frequency components at ε = 4/255. The paper itself concedes in Section 3.4 that any pixel misalignment breaks the assumption, and Figure A.1 shows white edges from imperfect cropping on the images used for the zero-accuracy claim. Please quantify the sign agreement between the identity backward pass and the true distortion (for example, by finite differences on registered images), and either eliminate cropping artifacts or report results separately for cleanly registered images. Without this, the Physical column of Table 1 may reflect misalignment plus cropping artifacts rather than the bounded perturbation alone.
  2. The detached residual C = c(p(x + δ), e) - r(x + δ) is assumed small because the differentiable renderer places the patch at the same location as the UE4 renderer, but this assumption is never quantified. UE4 applies lighting, weather, materials, and occlusion, while the differentiable renderer is only a perspective transformation. Furthermore, Section 4.2 states that the GARD scenes had to be recreated with the OSCAR toolkit because the released CARLA metadata was incomplete, so the evaluation is not on the official GARD images. Please report the distribution of pixel residuals between the UE4 render and the differentiable renderer across the 20 scenes (for example, mean and maximum absolute difference per patch), and ideally include a comparison with digitally composed patches as in the original GARD setup. If C is not small, the 4.22% AP50 result may be an artifact of renderer mismatch rather than evidence that the bounded perturbation survives the full pipeline.
  3. The headline zero-accuracy result is based on six images with no repeated trials. The 113 printouts described in Section 3.2 correspond to one print per condition, so each row in the Physical column is a single observation per image. The claim that STE 'forces zero accuracy' therefore rests on 6 correct classifications becoming 0, a very small sample. Please report per-image results, provide confidence intervals or repeated print/capture trials, and include a control with random bounded perturbations (or an unprinted digital perturbation) to confirm that the effect is attributable to the optimized perturbation under the stated ε bound rather than to cropping, perspective, or printing artifacts. The visible white edges in Figure A.1 make this control particularly important.
  4. The digital and physical columns of Table 1 are surprising in a way that needs explanation: for PGD + STE at ε = 4, the digital accuracy is 3/6 but the physical accuracy is 0/6, meaning the attack is stronger after the print-and-camera distortion than in the digital domain. If STE is only a backward-pass approximation, one would expect physical effectiveness to be no better than digital effectiveness. The current text addresses the gap between digital PGD and STE-physical PGD, but not the comparison between STE-physical and STE-digital. Please measure the realized perturbation in the captured image after registration (for example, the ℓ∞ difference between the registered photo of the benign printout and the attacked printout) and discuss whether the physical distortion itself contributes to the drop. Without this measurement, it is difficult to attribute the zero-accuracy result to the small ℓ∞-bounded perturbation rather than to unintended artifacts.
minor comments (6)
  1. The notation 'where C is a constant' is misleading because C = d(x + δ) - (x + δ) depends on x and δ; it is a term detached from differentiation, not a constant in the mathematical sense. Please rephrase as 'a term treated as constant by the stop-gradient operation.'
  2. The terms 'global perturbation threat model' and 'patch perturbation threat model' are used without definition until Sections 3 and 4. Please define them at first use, since they are central to the claimed contributions.
  3. The caption refers to an 'empirical threshold of loss' that yields zero accuracy, but does not explain how this threshold was computed. Please describe the procedure used to set the dashed cyan line.
  4. The TIDE error columns (Class, Box, Other, Dup., Bg., Missed) lack a clear explanation of what each count represents and how the columns relate to the TIDE taxonomy. Please add a sentence or footnote explaining these counts.
  5. The row labels in Figures A.1 and A.2 appear to contain a typo: the third data row is labeled 'hot pot' in both figures, but the text describing the setup lists the six images as including 'ladle' and only one 'hot pot'. Please correct the labels.
  6. References [36] and [37] have a dangling comma before 'Accessed' in the bibliographic entries; please clean up the formatting.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the STE/BPDA identities are exact forward-pass constructions and the headline results are evaluated against external pretrained models, physical printouts, and the UE4 renderer.

full rationale

The derivation chain is self-contained, and the reported results are not predetermined by the method's definitions. Equation (3), f(d(x+δ)) = f(x+δ + sg[d(x+δ) − (x+δ)]), and Equation (5), g_d(δ,x,e) = r(x+δ) + sg[c(p(x+δ),e) − r(x+δ)], are exact forward-pass identities; the backward pass uses the identity function as an approximation to the true distortion gradient, not as a fitted parameter that is later renamed a prediction. The zero-accuracy and AP50 values are measured against external, pretrained models (torchvision ResNet-50 and the Armory Faster R-CNN), against physical printouts, and against CARLA's UE4 renderer, so the evaluation targets are independent of the optimization procedure. The self-citations ([11] ShapeShifter, [13] OSCAR Datagen Toolkit, [41] MART) supply related work and implementation tooling; none is load-bearing evidence that STE works, and no uniqueness theorem or fitted quantity is imported from these citations. The paper's own Section 3.4 caveat that pixel misalignment could break the STE assumption is a correctness and robustness limitation, not circularity: it concedes the sign-accuracy assumption may fail, which is the opposite of defining the result into existence. No step in the paper reduces, by construction or by self-citation, to its own input.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no fitted physical constants and no new entities. The central method relies on the known stop-gradient trick and on two domain assumptions with no direct measurement: the sign-fidelity of the identity backward pass through physical distortions, and spatial alignment between the differentiable renderer and the non-differentiable CARLA renderer. Attack hyperparameters are chosen by hand and condition all headline results.

free parameters (3)
  • Global PGD/FGSM step size and iterations = step size 1/255; 12 PGD iterations or 1 FGSM step
    Chosen by hand from standard digital-attack practice. The claimed zero accuracy at ϵ=4/255 is conditional on this schedule, and no ablation over steps or schedules is reported.
  • Patch attack optimizer schedule = Adam-200-1, Adam-200-2, Adam-500-12.75 (learning rates 1/255, 2/255, 12.75/255)
    Adopted from the Armory example attack, not tuned by the authors. AP50 outcomes vary sharply with these settings, from 43.29% to 0%, so they are free choices that condition the central numbers.
  • ℓ∞ perturbation budgets = 2/255, 4/255, 8/255, 16/255, 255/255
    Standard perturbation budgets chosen to define imperceptible perturbations. The method's success is reported per budget rather than derived, and 255/255 is the unbounded control.
assumptions (4)
  • domain assumption For a non-differentiable distortion that approximately preserves pixel correspondence, the identity backward pass yields a gradient whose sign matches the true gradient.
    Section 3.1 states 'the sign of the approximate gradient is always accurate' when the distortion leads to a similar image. This is the load-bearing heuristic of the method, and no measurement of sign fidelity is provided.
  • domain assumption The differentiable renderer r(·) renders x+δ at the same location as the non-differentiable camera-renderer c(p(x+δ), e), so the stop-gradient residual C is effectively constant with respect to δ.
    Section 4.1, immediately after Eq. (6): 'As long as r(·) renders x + δ at the same location as in c(p(x + δ), e)...'. Lighting and material differences in UE4 can break this assumption.
  • domain assumption The CARLA simulator and the particular printer-camera pair are representative of physical-world deployment conditions.
    The paper generalizes from one laser printer, one iPhone 13 Pro, and CARLA/UE4 to 'the physical world' without cross-device validation.
  • domain assumption Six ImageNet images and 20 recreated CARLA scenes are sufficient to support zero-accuracy and near-zero-AP50 claims.
    Section 3.2 and Section 4.2 use these small samples; no confidence intervals or repeated trials are reported, yet the conclusions are stated globally.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Imperceptible Adversarial Examples in the Physical World." pith.science (2026). https://pith.science/paper/B2Q43A6J

@misc{pith2026241116622,
  author       = {Pith},
  title        = {Pith review of: Imperceptible Adversarial Examples in the Physical World},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B2Q43A6J}},
  note         = {Machine review of arXiv:2411.16622}
}
abstract

Adversarial examples in the digital domain against deep learning-based computer vision models allow for perturbations that are imperceptible to human eyes. However, producing similar adversarial examples in the physical world has been difficult due to the non-differentiable image distortion functions in visual sensing systems. The existing algorithms for generating physically realizable adversarial examples often loosen their definition of adversarial examples by allowing unbounded perturbations, resulting in obvious or even strange visual patterns. In this work, we make adversarial examples imperceptible in the physical world using a straight-through estimator (STE, a.k.a. BPDA). We employ STE to overcome the non-differentiability -- applying exact, non-differentiable distortions in the forward pass of the backpropagation step, and using the identity function in the backward pass. Our differentiable rendering extension to STE also enables imperceptible adversarial patches in the physical world. Using printout photos, and experiments in the CARLA simulator, we show that STE enables fast generation of $\ell_\infty$ bounded adversarial examples despite the non-differentiable distortions. To the best of our knowledge, this is the first work demonstrating imperceptible adversarial examples bounded by small $\ell_\infty$ norms in the physical world that force zero classification accuracy in the global perturbation threat model and cause near-zero ($4.22\%$) AP50 in object detection in the patch perturbation threat model. We urge the community to re-evaluate the threat of adversarial examples in the physical world.

Figures

Figures reproduced from arXiv: 2411.16622 by the authors.

Figure 1
Figure 1. Straight-through estimator (STE, a.k.a. BPDA) combined with PGD reliably produces imperceptible adversarial examples in the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. We use STE (a.k.a. BPDA) to cross the non-differentiable barrier of the imaging pipeline under the global perturbation threat [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. We follow the experiments by Kurakin et al. [ [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The loss curves of untargeted PGD attacks bounded by four [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: STE combined with differentiable rendering overcomes non-differentiability in the patch threat model. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Our method produces imperceptible adversarial examples in CARLA, as the three center columns show. We add the benign [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. ALLUDE: A Unified Evaluation System for Configurable Attacks in Differentiable Environments

    cs.CV 2026-07 conditional novelty 6.0 of 10

    A configurable, cross-platform simulator-based evaluation platform shows that object class and camera trajectory, not weather or detector choice, dominate whether 3D adversarial patch attacks succeed, and that all tes...

  2. UNDREAM: Bridging Differentiable Rendering and Photorealistic Simulation for End-to-end Adversarial Attacks

    cs.CR 2025-10 conditional novelty 6.0 of 10

    UnDREAM enables optimization of adversarial textures on arbitrary 3D objects inside Unreal Engine by bridging the simulator to the differentiable renderer Mitsuba.

Reference graph

Works this paper leans on

42 extracted references · 29 canonical work pages · cited by 2 Pith papers

  1. [1]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International confer- ence on machine learning, pages 274–283. PMLR, 2018. 2, 4

    work page 2018

  2. [2]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Inter- national conference on machine learning , pages 284–293. PMLR, 2018. 1, 3

    work page 2018

  3. [3]

    Digital color halftoning

    Farhan A Baqai, J-H Lee, A Ufuk Agar, and Jan P Allebach. Digital color halftoning. IEEE Signal Processing Magazine, 22(1):87–96, 2005. 3

    work page 2005

  4. [4]

    Estimating or propagating gradients through stochastic neurons for conditional computation

    Yoshua Bengio, Nicholas L ´eonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint arXiv:1308.3432, 2013. 3

    arXiv 2013

  5. [5]

    Tide: A general toolbox for identifying object detection er- rors

    Daniel Bolya, Sean Foley, James Hays, and Judy Hoffman. Tide: A general toolbox for identifying object detection er- rors. In ECCV, 2020. 7

    work page 2020

  6. [6]

    Apricot: A dataset of physical adversarial attacks on object detection

    Anneliese Braunegg, Amartya Chakraborty, Michael Krumdick, Nicole Lape, Sara Leary, Keith Manville, Eliz- abeth Merkhofer, Laura Strickhart, and Matthew Walmer. Apricot: A dataset of physical adversarial attacks on object detection. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXI 16, pages 35–...

    work page 2020

  7. [7]

    Re- configuring the imaging pipeline for computer vision

    Mark Buckler, Suren Jayasuriya, and Adrian Sampson. Re- configuring the imaging pipeline for computer vision. In Proceedings of the IEEE International Conference on Com- puter Vision, pages 975–984, 2017. 2, 3

    work page 2017

  8. [8]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 5

    work page 2017

Show all 42 references
  1. [9]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 ,

    1902 arXiv

  2. [10]

    Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024

    Nicholas Carlini, Milad Nasr, Christopher A Choquette- Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024. 2

    2024

  3. [11]

    Shapeshifter: Robust physical adversar- ial attack on faster r-cnn object detector

    Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Chau. Shapeshifter: Robust physical adversar- ial attack on faster r-cnn object detector. In Machine Learn- ing and Knowledge Discovery in Databases: European Con- ference, ECML PKDD 2018, Dublin, Ireland, September ...

    2018

  4. [12]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In inter- national conference on machine learning, pages 1310–1320. PMLR, 2019. 2

    2019

  5. [13]

    Oscar datagen toolkit

    Cory Cornelius, Luis Murillo, and Weilin Xu. Oscar datagen toolkit. https://github.com/IntelLabs/OSCAR/ tree/main/lib/oscar-datagen-toolkit , 2023. 7

    2023

  6. [14]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on ma- chine learning, pages 2206–2216. PMLR, 2020. 5

    2020

  7. [15]

    Guaranteeing AI Robustness Against Deception (GARD)

    DARPA. Guaranteeing AI Robustness Against Deception (GARD). https : / / www . darpa . mil / program / guaranteeing - ai - robustness - against - deception. Accessed: 2024-07-10. 7

    2024

  8. [16]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 4

    2009

  9. [17]

    Deep learning-based autonomous driving systems: A survey of attacks and defenses

    Yao Deng, Tiehua Zhang, Guannan Lou, Xi Zheng, Jiong Jin, and Qing-Long Han. Deep learning-based autonomous driving systems: A survey of attacks and defenses. IEEE Transactions on Industrial Informatics , 17(12):7897–7912,

  10. [18]

    Carla: An open urban driv- ing simulator

    Alexey Dosovitskiy, German Ros, Felipe Codevilla, Anto- nio Lopez, and Vladlen Koltun. Carla: An open urban driv- ing simulator. In Conference on robot learning, pages 1–16. PMLR, 2017. 2

    2017

  11. [19]

    Unreal Engine

    Epic Games. Unreal Engine. https : / / www . unrealengine.com. Accessed: 2024-07-10. 2

    2024

  12. [20]

    Black Hat AI Track Submissions: Obser- vations and Feedback

    Nathan Hamiel. Black Hat AI Track Submissions: Obser- vations and Feedback. http://web.archive.org/ web / 20241106221125 / https : / / i . blackhat . com / BH - US - 24 / BH - AI - Track - Submissions - Nathan-Hamiel.pdf. Accessed: 2024-11-06. 1

    2024

  13. [21]

    Connecting the digital and phys- ical world: Improving the robustness of adversarial attacks

    Steve TK Jan, Joseph Messou, Yen-Chen Lin, Jia-Bin Huang, and Gang Wang. Connecting the digital and phys- ical world: Improving the robustness of adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelli- gence, pages 962–969, 2019. 1, 3

    2019

  14. [22]

    Detecting physical adversarial patch attacks with object detectors

    Melanie Jutras, Ethan Liang, Sara Leary, Chris Ward, and Keith Manville. Detecting physical adversarial patch attacks with object detectors. In 2022 IEEE Applied Imagery Pattern Recognition Workshop (AIPR), pages 1–7. IEEE, 2022. 3

    2022

  15. [23]

    9 Differentiable rendering: A survey

    Hiroharu Kato, Deniz Beker, Mihai Morariu, Takahiro Ando, Toru Matsuoka, Wadim Kehl, and Adrien Gaidon. 9 Differentiable rendering: A survey. arXiv preprint arXiv:2006.12057, 2020. 3

    2006 arXiv

  16. [24]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In Artificial in- telligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018. 3, 4, 5

    2018

  17. [25]

    We can always catch you: Detecting adversarial patched objects with or without signature

    Bin Liang, Jiachun Li, and Jianjun Huang. We can always catch you: Detecting adversarial patched objects with or without signature. arXiv preprint arXiv:2106.05261, 2021. 3

    2021

  18. [26]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceeding...

    2014

  19. [27]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. 1, 2

    2017 arXiv

  20. [28]

    Hardware-in- the-loop end-to-end optimization of camera image process- ing pipelines

    Ali Mosleh, Avinash Sharma, Emmanuel Onzon, Fahim Mannan, Nicolas Robidoux, and Felix Heide. Hardware-in- the-loop end-to-end optimization of camera image process- ing pipelines. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 7529–...

    2020

  21. [29]

    Pytorch: An im- perative style, high-performance deep learning library

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An im- perative style, high-performance deep learning library. Ad- vances in neural information processing systems ...

    2019

  22. [30]

    Accelerating 3d deep learning with pytorch3d

    Nikhila Ravi, Jeremy Reizenstein, David Novotny, Tay- lor Gordon, Wan-Yen Lo, Justin Johnson, and Georgia Gkioxari. Accelerating 3d deep learning with pytorch3d. arXiv preprint arXiv:2007.08501, 2020. 8

    2007 arXiv

  23. [31]

    A survey on deep learning-based real-time crowd anomaly detection for secure distributed video surveillance

    Khosro Rezaee, Sara Mohammad Rezakhani, Mohammad R Khosravi, and Mohammad Kazem Moghimi. A survey on deep learning-based real-time crowd anomaly detection for secure distributed video surveillance. Personal and Ubiqui- tous Computing, 28(1):135–151, 2024. 1

    2024

  24. [32]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and commu- nications security, pages 1528–1540, 2016. 3

    2016

  25. [33]

    armory, 2023

    David Slater and Lucas Cadalzo. armory, 2023. 7

    2023

  26. [34]

    Dta: Physical camouflage attacks using differentiable transforma- tion network

    Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Ha- rashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. Dta: Physical camouflage attacks using differentiable transforma- tion network. In Proceedings of the IEEE/CVF Conference on Computer ...

    2022

  27. [35]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1

    2013 arXiv

  28. [36]

    Adversarial Patch Attack against CARLA Object Detection

    ARMORY Team. Adversarial Patch Attack against CARLA Object Detection. https : / / github . com / twosixlabs / armory / blob / v0 . 19 . 2 / scenario _ configs / eval7 / carla _ overhead _ object _ detection / carla _ obj _ det _ adversarialpatch _ targeted _ undefended . json,...

    2024

  29. [37]

    CARLA Object Detection Model Weights for GARD Eval7

    ARMORY Team. CARLA Object Detection Model Weights for GARD Eval7. https://armory-public-data. s3 . amazonaws . com / model - weights / carla _ rgb_weights_eval7and8.pt , . Accessed: 2024-02-

    2024

  30. [38]

    Detection of ArUco Markers

    OpenCV Team. Detection of ArUco Markers. https: //docs.opencv.org/4.x/d5/dae/tutorial_ aruco_detection.html, . Accessed: 2024-11-11. 4

    2024

  31. [39]

    PyTorch Perspective Transforma- tion API

    PyTorch Team. PyTorch Perspective Transforma- tion API. https : / / pytorch . org / vision / main / generated / torchvision . transforms . functional . perspective . html, . Accessed: 2024-02-02. 7

    2024

  32. [40]

    Making an invisibility cloak: Real world adversar- ial attacks on object detectors

    Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Gold- stein. Making an invisibility cloak: Real world adversar- ial attacks on object detectors. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23– 28, 2020, Proceedings, Part IV 16 , pages 1–17. Springer,

    2020

  33. [41]

    Modular ad- versarial robustness toolkit

    Weilin Xu, Cory Cornelius, and Luis Murillo. Modular ad- versarial robustness toolkit. https://github.com/ IntelLabs/MART, 2023. 7

    2023

  34. [42]

    piggy bank

    Jiawei Zhou, Linye Lyu, Daojing He, and Yu Li. Rauca: A novel physical adversarial attack on vehicle detectors via robust and accurate camouflage generation. arXiv preprint arXiv:2402.15853, 2024. 3 10 A. Appendix lorikeet99.26%coucal80.91%coucal99.98%coucal100.00%coucal100.00...

    2024 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.