Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agents

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that physical adversarial patches become far more effective when three LLM agents jointly generate, place, and refine them for a given scene, achieving 66 to 92 percent attack success rates across six digital environments…

desk verdict Digital results are solid and the agent framework is a genuine novelty; the physical validation is too thin to support the driving-scenario claims. read the letter →

arxiv 2412.08014 v2 pith:2FDMUV4G submitted 2024-12-11 cs.CV cs.AI

Yun Xing , Nhat Chung , Jie Zhang , Yue Cao , Ivor Tsang , Yang Liu , Lei Ma , Qing Guo This is my paper · ORCID
classification cs.CVcs.AI
keywords physicaladversarialattackpatchLLMagentsobjectdetectionautonomousdrivingtext-to-imagegenerationscenecontextpromptengineering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that physical adversarial patch attacks against object detectors should be treated as a one-shot, context-aware generation problem rather than a standalone patch-optimization problem. It claims that scene context and patch placement largely determine whether a printed patch will fool a detector, and that a pipeline of three collaborating multimodal LLM agents can handle both generation and deployment automatically. The authors report that their framework, MAGIC, reaches average attack success rates of 80.66 to 90.66 percent across six nuImage environments when attacking YOLOv5, RT-DETR, and YOLOv10, far above the diffusion-only baseline, and that printed patches remain effective in real-world scenes. A sympathetic reader would care because this turns adversarial patch creation into a high-level, language-driven process that could be used to stress-test perception systems in autonomous driving.

What carries the argument

The load-bearing mechanism is a three-agent collaborative loop: GAgent converts the attack objective into a deceptive text prompt for Stable Diffusion v2; DAgent uses set-of-mark visual prompting to read the scene and propose a natural placement and scale for the resulting patch; EAgent inspects the deployed image through both the target detector and a naturalness-scoring LLM and, if either threshold fails, rewrites the prompt for the next iteration. The loop embodies the paper's reformulation: one-shot physical patch generation is framed as iterated prompt engineering guided by scene-aware deployment and self-critique.

What would settle it

A live-traffic or dynamic-scene physical test in which a printed MAGIC patch is placed where an approaching vehicle can see it, under changing weather, lighting, and camera noise; if the detector's confidence on the patch falls below the 0.5 success threshold (or the patch is no longer recognized as a stop sign), the physical-world effectiveness claim is contradicted.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that the effectiveness and stealthiness of a diffusion-generated adversarial patch are not intrinsic to the patch: both depend heavily on the environment in which it is deployed and on where and at what scale it is placed. MAGIC operationalizes this by having a generation agent craft a text prompt for a text-to-image model, a deployment agent select a contextually plausible location and scale using set-of-mark prompting, and a self-examination agent score both detector confidence and human-perceived naturalness before deciding whether to iterate. The reported result is that this collaborative loop produces patches that are detected as stop signs with high confidence by YOLOv5, RT-DETR, and YOLOv10 while looking like abstract art to human observers, with digital attack success rates of 66 to 92 percent depending on environment and detector and successful physical attacks in two real scenes.

Load-bearing premise

The physical demonstrations were run in two static scenes and the patches were deliberately kept out of view of moving vehicles, so the central claim assumes that success under these controlled conditions carries over to real driving conditions with moving traffic, varying weather, lighting, and camera noise.

Editorial extensions

If this is right

  • If the central claim holds, printed adversarial patches can be produced for a given scene without any gradient-based optimization, using only a text prompt and an image of the environment.
  • The approach should transfer to other traffic-sign categories and to other detection architectures, because the generation and placement decisions are expressed in natural language rather than tied to a specific model's gradients.
  • The 0.8-threshold results (average 58.66 percent attack success rate) imply that even confidence-gated detection pipelines remain partially vulnerable to context-aware patches.
  • High naturalness scores (0.89 to 0.99 across the six digital environments) mean the patches are likely to go unnoticed by human observers, increasing the practical risk to perception systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: because placement rather than patch texture alone drives success, the same critic-loop design could be repurposed to probe other perception tasks (segmentation, depth, tracking) by swapping the detector for the target model and keeping the naturalness judge.
  • Beyond the paper: a defensive counterpart, running MAGIC in a sandbox to anticipate where a threat actor would place a patch, would be a natural next step, but the paper only lists OCR checks and robustified training as possible mitigations, not a developed defense.
  • Beyond the paper: the framework's dependence on a particular commercial multimodal LLM means the reported numbers may shift if that model is updated; testing across LLM backends would reveal how much of the effectiveness comes from the agent loop rather than the underlying language model.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes MAGIC, a framework that uses three collaborative multimodal LLM agents (GAgent, DAgent, EAgent) to generate physical adversarial patches with text-to-image models and automatically determine their deployment location and scale in a given scene. The authors reformulate physical adversarial attacks as a one-shot patch generation problem and validate the method digitally on six nuImage environments against YOLOv5, RT-DETR, and YOLOv10, reporting attack success rates (ASR) of 66–92% and consistent improvements over NDDA baselines. They also present physical experiments in a few static real-world scenes and claim that MAGIC can effectively generate context-aware patches, deploy them in the real world, and attack widely used object detectors.

Significance. If the claims hold, the paper makes a useful contribution by showing that LLM agents can orchestrate scene-aware adversarial patch generation and deployment, a task that previous diffusion-based attacks did not address. The digital experiments are substantial: six environments, three detectors, and ablations that support the role of each agent. The analysis in Section 3 of how scene context and deployment affect patch effectiveness is a valuable empirical addition. However, the physical validation is thin and the naturalness evaluation is potentially circular, so the current evidence supports a proof of concept rather than the stronger driving-scenario claim in the abstract and conclusion. The framework's modular design and the explicit study of deployment factors are strengths that make the central idea worth further development.

major comments (4)
  1. [§4.4 and §5.2] There is an internal inconsistency between the EAgent's acceptance criterion and the reported ASR values. The EAgent is described as iterating until ci = AND(D(Ii) ≥ θ, E(Ii,γ) ≥ δ) is true, meaning every output patch should satisfy D(Ii) ≥ θ. Yet Table 1 reports MAGIC ASR values of 66–92% at a confidence threshold of 0.5, and Table 2 reports 46–74% at 0.8. If θ is the detection confidence threshold, ASR at that threshold should be near 100% for the final patches. Please clarify whether the refinement loop has a maximum iteration that can return non-conforming patches, whether the ASR is computed over intermediate patch proposals, or whether the θ used by the EAgent differs from the evaluation threshold. As written, the quantitative central claim is difficult to interpret.
  2. [§5.3 and Conclusion] The physical experiments are limited to two static scenes in the main paper (a bus stop bay and a road next to a college), and the authors state that the patches were not observed by vehicles on the road. The conclusion nevertheless claims that MAGIC "can effectively generate context-aware patch, deploy the patch in real world and attack widely applied object detectors." The Limitations section (Section 6) explicitly concedes that the environments "primarily serve as proofs of concept under standard conditions," with no varying weather, daylight/nighttime, or noisy camera inputs. The physical evidence therefore supports only a proof-of-concept claim, not the full driving-scenario claim. Please either temper the abstract/conclusion to match the evidence or add physical experiments with a moving camera, varied conditions, and multiple trials to support the stronger claim.
  3. [§4.4 and Supplementary Table 4] The naturalness scores used to validate the "visual naturality" contribution are computed by an LLM (GPT-4o) that belongs to the same family as the EAgent that makes the acceptance decision, and no human perceptual study is reported. Since the EAgent uses this LLM to decide whether a patch is natural, the reported naturalness scores in Supplementary Table 4 are not an independent measure of stealthiness. This circularity weakens the claim that MAGIC produces contextually natural patches. A human evaluation or at least an independent judge model would be needed to support the naturalness claim.
  4. [§5.1 and Table 1] The digital evaluation uses only six environment images (one per camera view from nuImage), and the ASR results are reported as point estimates without error bars, confidence intervals, or significance tests. Given that the consistent ASR improvement over baselines is the main quantitative evidence for the method's effectiveness, the small number of environments and the absence of variance reporting make it hard to assess whether the improvements are statistically reliable. Please report standard deviations over patch samples or multiple runs, or otherwise justify the stability of the reported ASR values.
minor comments (4)
  1. [Table 3] The table header contains a typo: "Bblation" should be "Ablation".
  2. [§5.2] The subsection heading "Deployment Naturality" uses an uncommon term; "Deployment Naturalness" would be consistent with the rest of the paper.
  3. [§4.4 and Supplementary §3] The values of the thresholds θ and δ are not given in the main text, while the supplementary material defines CONF_THRESHOLD as 0.80 in the prompt. The main experiments evaluate ASR at both 0.5 and 0.8. Please clarify which threshold the EAgent uses and how it relates to the evaluation thresholds.
  4. [§4.1 and §4.5] The paper calls the task a "one-shot patch generation problem" but the pipeline is iterative (EAgent refines the prompt across rounds). Please clarify the distinction or adjust the terminology.

Circularity Check

1 steps flagged · score 4.0 of 10

Naturalness scores are self-referential by construction; attack-effectiveness core is externally grounded.

  1. self definitional [Sec. 4.4 (EAgent, ci rule) and Supplementary Sec. 4.1 / Tab. 4]
    "To determine the patch’s naturalness, we prompt an independent LLM E with instruction γ to generate a naturalness score for the patch. Similarly, we set a naturalness threshold δ and check whether the generated patch satisfies E(Ii, γ) ≥ δ. ... Afterwards, we set ci as a binary operator, calculated by ci = AND(D(Ii) ≥ θ, E(Ii, γ) ≥ δ). ... As the naturalness is measured by the LLM E with the instruction γ which gives out a naturalness score for each deployed patch."

    The same LLM scorer with the same instruction γ is used twice: first as the acceptance rule inside MAGIC's EAgent (a patch exits the loop only if E(Ii,γ) ≥ δ), and second as the reported naturalness evaluation in Supplementary Tab. 4. The high average naturalness scores for MAGIC (0.89–0.99) are therefore a guaranteed property of the selection filter, not independent evidence of naturalness. NDDA baselines were not filtered by E, so the comparison shows an optimized objective versus an unoptimized one under the same subjective scorer.

full rationale

The central attack-effectiveness claim is not circular: the digital ASR is measured against external object detectors (YOLOv5, RT-DETR, YOLOv10) and the physical deployments are a genuine out-of-distribution digital-to-physical transfer test. The paper is transparent that EAgent uses the target detector D as feedback, so the digital ASR is in-sample with respect to D; that is standard for adversarial generation and is not a hidden equivalence, especially because not all runs converge and physical results are reported separately. The one clear reduction-by-construction is the naturalness metric: E(I,γ) serves both as the EAgent's stopping criterion and as the paper's naturalness outcome measure, so the reported naturalness superiority of MAGIC over NDDA is an artifact of optimizing exactly the evaluation function. The limitations section further concedes that physical scenes are proofs of concept under standard conditions, but that is a scope limitation rather than a circularity. Overall, the paper's core attack claim stands on independent evidence, while its secondary naturality claim is partially self-referential, giving a moderate score of 4.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The ledger shows that MAGIC depends on several assumptions inherited from prior work (robust feature theory, diffusion prompt engineering) and one significant ad-hoc assumption about GPT-4o's reliability as a scene understander and naturalness judge. The free parameters are the thresholds used in the optimization loop and evaluation. No new physical or theoretical entities are introduced; the agents are software components that orchestrate existing models.

free parameters (3)
  • confidence threshold theta = 0.5 (and 0.8 in high-threshold experiments)
    Used in EAgent to decide attack success and also as evaluation threshold in ASR, creating a shared hyperparameter between optimization and reporting; the value is chosen by the authors.
  • naturalness threshold delta = not reported
    Used by EAgent to accept or reject a patch based on the LLM-assessed naturalness score; the specific value is not given in the paper.
  • SoM slider parameter = 1.8
    Set-of-Mark prompting hyperparameter adjusted from default; affects the granularity of visual grounding for DAgent.
assumptions (4)
  • domain assumption DNNs rely on non-robust features that humans do not perceive (Ilyas et al.)
    The attack mechanism is built on the premise that removing robust features from a stop sign prompt will fool detectors while remaining natural to humans; this is adopted from NDDA (Sato et al.) and cited as [31,32].
  • domain assumption Prompt engineering with Stable Diffusion v2 can produce patches that are simultaneously deceptive to object detectors and recognizable as abstract art to humans
    The GAgent's entire operation is contingent on this capability of the T2I model, as established by NDDA, and MAGIC extends it to scene-specific prompts.
  • ad hoc to paper GPT-4o can reliably understand scene context, reason about spatial relationships from SoM prompts, and judge naturalness similarly to human observers
    The DAgent, EAgent, and the naturalness evaluator all rely on this LLM's perceptual and commonsense abilities; no human baseline is provided for the naturalness scores.
  • domain assumption The six nuImage environments and the two physical scenes are representative of driving scenarios
    The paper generalizes from a small set of scene images to 'widely applied object detection systems' in real-world driving; the representativeness is not justified with a larger dataset.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agents." pith.science (2026). https://pith.science/paper/2FDMUV4G

@misc{pith2026241208014,
  author       = {Pith},
  title        = {Pith review of: MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2FDMUV4G}},
  note         = {Machine review of arXiv:2412.08014}
}
read the original abstract

Physical adversarial attacks in driving scenarios can expose critical vulnerabilities in visual perception models. However, developing such attacks remains challenging due to diverse real-world environments and the requirement for maintaining visual naturality. Building upon this challenge, we reformulate physical adversarial attacks as a one-shot patch generation problem. Our approach generates adversarial patches through a deep generative model that considers the specific scene context, enabling direct physical deployment in matching environments. The primary challenge lies in simultaneously achieving two objectives: generating adversarial patches that effectively mislead object detection systems while determining contextually appropriate deployment within the scene. We propose MAGIC (Mastering Physical Adversarial Generation In Context), a novel framework powered by multi-modal LLM agents to address these challenges. MAGIC automatically understands scene context and generates adversarial patch through the synergistic interaction of language and vision capabilities. In particular, MAGIC orchestrates three specialized LLM agents: The adv-patch generation agent (GAgent) masters the creation of deceptive patches through strategic prompt engineering for text-to-image models. The adv-patch deployment agent (DAgent) ensures contextual coherence by determining optimal deployment strategies based on scene understanding. The self-examination agent (EAgent) completes this trilogy by providing critical oversight and iterative refinement of both processes. We validate our method on both digital and physical levels, i.e., nuImage and manually captured real-world scenes, where both statistical and visual results prove that our MAGIC is powerful and effective for attacking widely applied object detection systems, i.e., YOLO and DETR series.

Figures

Figures reproduced from arXiv: 2412.08014 by the authors.

Figure 1
Figure 1. Intuitive idea of our proposed MAGIC framework. Given the user prompt indicates the attack subject and objective and an image of a real-world scene, our method aims to generate an attack-effective adversarial patch and automatically deploy it into the physical scene with naturalness. We propose to realize the goals through multi-modal agent planning and leverage multiple LLM-based agents to achieve collaborative gen… view at source ↗
Figure 2
Figure 2. Detection error ratios (i.e., ϵ I i and ϵ I i ) across two image sets (i.e. {I k i }k = 1K and {I k i }k = 1K) for 15 prompt types (i = 1, . . . , 15). The y-axis labels indicate removed features: Shape (S), Color (C), Text (T), and Pattern (P). Patch generated by (a) Stable Diffusion and (b) Midjourney. by integrating image [18, 59, 69], video [41, 50] and au￾dio [27]. Notably, [69] incorporated LLM reasoning for f… view at source ↗
Figure 4
Figure 4. (a) - (b): can￾didate patch locations and scales. (c) - (f): the detec￾tion confidence across all locations and scales for ef￾fective pairs in [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Overall pipeline of the proposed MAGIC framework. Please zoom in for better visualization. presented in Sec. 4.3. Subsequently, we insert the patch Pi into E at pi with scale si getting the adversarial image Ii . However, we do not know whether the adversarial image is…
Figure 6
Figure 6. Figure 6: Illustration of the patch deployment results for NDDA baselines and our MAGIC framework in different environments. Patches are pointed out with red arrows. Please zoom in for better visualization. stealthiness rather than boost the attack effectiveness. Deployment Natu…
Figure 7
Figure 7. Figure 7: Illustration of the physical attack cases generated by the proposed MAGIC and the corresponding object detection results. to a college with some pedestrians on the sidewalk. In order to verify the flexibility of our MAGIC, we select the bus stop scene and generate two …
Figure 1
Figure 1. Figure 1: Digital-to-physical transfer visualization results of NDDA and MAGIC. capability of performing robust to real-world influences. Robustness of Viewing Angle & Distance To demon￾strate the robustness of our MAGIC to viewing angle and distance, we set three levels of patc…
Figure 2
Figure 2. Figure 2: Viewing distance and angle results for MAGIC patches. distinct environment attacking, the physical cases shown in [PITH_FULL_IMAGE:figures/full_fig_p015_2.png]
Figure 3
Figure 3. Figure 3: Illustration of the physical attacking cases and the corresponding object detector evaluation results, where our MAGIC can generate several different effective patches for given specific environment. The gray region enclosed the patch and the deployment suggestion gene…
Figure 4
Figure 4. Figure 4: Illustration of the physical attacking cases and the corresponding object detector evaluation results. Scene ❶: A real-world road with heavy traffics. Scene ❷: A parking area with car in and out. The gray region enclosed the patch and the deployment suggestion generate…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments

    cs.CV 2024-11 conditional novelty 6.0 of 10

    A pipeline that plans, places, and renders scene-coherent typographic adversarial text fools vision-language models more often than prior center or margin text attacks, but its success metric and naturalness evaluatio...

Reference graph

Works this paper leans on

103 extracted references · 71 canonical work pages · cited by 1 Pith paper

  1. [1]

    Adversarial patch

    Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. In Proceedings of the Advances in Neural Information Processing Systems Work- shop, 2017. 2

    2017

  2. [2]

    Lang, Sourabh V ora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Gi- ancarlo Baldan, and Oscar Beijbom

    Holger Caesar, Varun Bankiti, Alex H. Lang, Sourabh V ora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Gi- ancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. In 2020 IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, 2020. 2

    2020

  3. [3]

    Scenetap: Scene-coherent ty- pographic adversarial planner against vision-language models in real-world environments

    Yue Cao, Yun Xing, Jie Zhang, Di Lin, Tianwei Zhang, Ivor Tsang, Yang Liu, and Qing Guo. Scenetap: Scene-coherent ty- pographic adversarial planner against vision-language models in real-world environments. arXiv preprint arXiv:2412.00114,

    arXiv

  4. [4]

    Robust feature-level adversaries are inter- pretability tools

    Stephen Casper, Max Nadeau, Dylan Hadfield-Menell, and Gabriel Kreiman. Robust feature-level adversaries are inter- pretability tools. Advances in Neural Information Processing Systems, 35:33093–33106, 2022. 2

    2022

  5. [5]

    End-to-end autonomous driving: Challenges and frontiers

    Li Chen, Penghao Wu, Kashyap Chitta, Bernhard Jaeger, Andreas Geiger, and Hongyang Li. End-to-end autonomous driving: Challenges and frontiers. IEEE Transactions on Pattern Analysis and Machine Intelligence , 46(12):10164– 10183, 2024. 2

    2024

  6. [6]

    Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector

    Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 52–68. Springer, 2018. 2

    2018

  7. [7]

    Physical attack on monocular depth estimation with optimal adversarial patches

    Zhiyuan Cheng, James Liang, Hongjun Choi, Guanhong Tao, Zhiwen Cao, Dongfang Liu, and Xiangyu Zhang. Physical attack on monocular depth estimation with optimal adversarial patches. In ECCV, pages 514–532. Springer, 2022. 2

    2022

  8. [8]

    Towards trans- ferable attacks against vision-llms in autonomous driving with typography

    Nhat Chung, Sensen Gao, Tuan-Anh Vu, Jie Zhang, Aishan Liu, Yun Lin, Jin Song Dong, and Qing Guo. Towards trans- ferable attacks against vision-llms in autonomous driving with typography. arXiv preprint arXiv:2405.14169, 2024. 2

    arXiv 2024

Show all 103 references
  1. [9]

    Talk2car: Taking control of your self-driving car

    Thierry Deruyttere, Simon Vandenhende, Dusan Grujicic, Luc Van Gool, and Marie Francine Moens. Talk2car: Taking control of your self-driving car. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Pro- cessing and the 9th International Joint Confere...

    2019

  2. [10]

    Towards universal physical attacks on single object tracking

    Li Ding, Yongwei Wang, Kaiwen Yuan, Minyang Jiang, Ping Wang, Hua Huang, and Z Jane Wang. Towards universal physical attacks on single object tracking. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 1236– 1245, 2021. 2

    2021

  3. [11]

    Tnt attacks! universal naturalis- tic adversarial patches against deep neural network systems

    Bao Gia Doan, Minhui Xue, Shiqing Ma, Ehsan Abbasnejad, and Damith C Ranasinghe. Tnt attacks! universal naturalis- tic adversarial patches against deep neural network systems. IEEE Transactions on Information Forensics and Security , 17:3816–3830, 2022. 2

    2022

  4. [12]

    Physical adversarial attacks on an aerial imagery object detector

    Andrew Du, Bo Chen, Tat-Jun Chin, Yee Wei Law, Michele Sasdelli, Ramesh Rajasegaran, and Dillon Campbell. Physical adversarial attacks on an aerial imagery object detector. In Proceedings of the IEEE/CVF Winter Conference on Applica- tions of Computer Vision, pages 1796–1806, 2022. 2

    2022

  5. [13]

    Tenen- baum, and Igor Mordatch

    Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenen- baum, and Igor Mordatch. Improving factuality and reasoning in language models through multiagent debate. In Forty-first International Conference on Machine Learning, 2024. 2

    2024

  6. [14]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In CVPR, pages 1625– 1634, 2018. 2

    2018

  7. [15]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, pages 1625–

    2018

  8. [16]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In 2018 IEEE Confer- ence on Computer Vision and Pattern Recognition , pages ...

    2018

  9. [17]

    Panoptic nuscenes: A large-scale benchmark for li- dar panoptic segmentation and tracking

    Whye Kit Fong, Rohit Mohan, Juana Valeria Hurtado, Lub- ing Zhou, Holger Caesar, Oscar Beijbom, and Abhinav Val- ada. Panoptic nuscenes: A large-scale benchmark for li- dar panoptic segmentation and tracking. arXiv preprint arXiv:2109.03805, 2021. 6

    2021 arXiv

  10. [18]

    Smith, Wei-Chiu Ma, and Ranjay Krishna

    Xingyu Fu, Yushi Hu, Bangzheng Li, Yu Feng, Haoyu Wang, Xudong Lin, Dan Roth, Noah A. Smith, Wei-Chiu Ma, and Ranjay Krishna. BLINK: multimodal large language models can see but not perceive. CoRR, abs/2404.12390, 2024. 3

    2024 arXiv

  11. [19]

    Tsang, and Qing Guo

    Sensen Gao, Xiaojun Jia, Xuhong Ren, Ivor W. Tsang, and Qing Guo. Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory. In Computer Vision - ECCV 2024, pages 442–460,

    2024

  12. [20]

    Contributions of shape, texture, and color in visual recog- nition

    Yunhao Ge, Yao Xiao, Zhi Xu, Xingrui Wang, and Laurent Itti. Contributions of shape, texture, and color in visual recog- nition. In European Conference on Computer Vision, pages 369–386. Springer, 2022. 3

    2022

  13. [21]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In 3rd In- ternational Conference on Learning Representations, 2015. 2

    2015

  14. [22]

    The human visual cortex

    Kalanit Grill-Spector and Rafael Malach. The human visual cortex. Annu. Rev. Neurosci., 27(1):649–677, 2004. 3

    2004

  15. [23]

    Jindong Gu, Hengshuang Zhao, V olker Tresp, and Philip H. S. Torr. Segpgd: An effective and efficient adversarial 9 attack for evaluating and boosting segmentation robustness. In Computer Vision - ECCV, pages 308–325, 2022. 2

    2022

  16. [24]

    Spark: Spatial- aware online incremental attack against visual tracking

    Qing Guo, Xiaofei Xie, Felix Juefei-Xu, Lei Ma, Zhongguo Li, Wanli Xue, Wei Feng, and Yang Liu. Spark: Spatial- aware online incremental attack against visual tracking. In European conference on computer vision , pages 202–219. Springer, 2020. 2

    2020

  17. [25]

    Natural adversarial examples

    Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In IEEE Conference on Computer Vision and Pattern Recognition , pages 15262–15271, 2021. 2

    2021

  18. [26]

    Naturalistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Jun-Cheng Chen, Bo-Han Kung, Kai-Lung Hua, and Daniel Stanley Tan. Naturalistic physical adversarial patch for object detectors. In 2021 IEEE/CVF International Conference on Computer Vision, pages 7828–7837, 2021. 2

    2021

  19. [27]

    Audiogpt: Understanding and generating speech, music, sound, and talking head

    Rongjie Huang, Mingze Li, Dongchao Yang, Jiatong Shi, Xu- ankai Chang, Zhenhui Ye, Yuning Wu, Zhiqing Hong, Jiawei Huang, Jinglin Liu, Yi Ren, Yuexian Zou, Zhou Zhao, and Shinji Watanabe. Audiogpt: Understanding and generating speech, music, sound, and talking head. In Thirty-...

    2024

  20. [28]

    Inner monologue: Embodied reasoning through planning with language models

    Wenlong Huang, Fei Xia, Ted Xiao, Harris Chan, Jacky Liang, Pete Florence, Andy Zeng, Jonathan Tompson, Igor Mor- datch, Yevgen Chebotar, Pierre Sermanet, Tomas Jackson, Noah Brown, Linda Luu, Sergey Levine, Karol Hausman, and Brian Ichter. Inner monologue: Embodied reasoning ...

    2022

  21. [29]

    Ala: Naturalness-aware adversarial lightness attack

    Yihao Huang, Liangru Sun, Qing Guo, Felix Juefei-Xu, Ji- ayi Zhu, Jincao Feng, Yang Liu, and Geguang Pu. Ala: Naturalness-aware adversarial lightness attack. arXiv preprint arXiv:2201.06070, 2022. 2

    2022 arXiv

  22. [30]

    Joshi, Kyle Jeffrey, Rosario Jauregui Ruano, Jasmine Hsu, Keerthana Gopalakr- ishnan, Byron David, Andy Zeng, and Chu yuan Kelly Fu

    Brian Ichter, Anthony Brohan, Yevgen Chebotar, Chelsea Finn, Karol Hausman, Alexander Herzog, Daniel Ho, Ju- lian Ibarz, Alex Irpan, Eric Jang, Ryan Julian, Dmitry Kalashnikov, Sergey Levine, Yao Lu, Carolina Parada, Kan- ishka Rao, Pierre Sermanet, Alexander Toshev, Vincent V...

  23. [31]

    Adversarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan En- gstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Advances in Neu- ral Information Processing Systems 32: Annual Conference on Neural Information Processing Systems,...

  24. [32]

    Adversarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019. 3

    2019

  25. [33]

    Adversarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Advances in Neural Information Processing Systems, pages 125–136, 2019. 2

    2019

  26. [34]

    Fast and accurate object detector for autonomous driving based on improved yolov5

    Xiangli Jia, Ying Tong, Hongming Qiao, Man Li, Jiangang Tong, and Baolin Liang. Fast and accurate object detector for autonomous driving based on improved yolov5. Scientific Reports, 13, 2023. 2

    2023

  27. [35]

    Ultralytics yolov5, 2020

    Glenn Jocher. Ultralytics yolov5, 2020. 3, 6

    2020

  28. [36]

    Physgan: Generating physical-world-resilient adversarial examples for autonomous driving

    Zelun Kong, Junfeng Guo, Ang Li, and Cong Liu. Physgan: Generating physical-world-resilient adversarial examples for autonomous driving. In CVPR, pages 14254–14263, 2020. 2

    2020

  29. [37]

    VILA: on pre-training for visual language models

    Ji Lin, Hongxu Yin, Wei Ping, Pavlo Molchanov, Mohammad Shoeybi, and Song Han. VILA: on pre-training for visual language models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024. 2

    2024

  30. [38]

    Perceptual-sensitive gan for generating adversarial patches

    Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In AAAI, pages 1028– 1035, 2019. 2

    2019

  31. [39]

    Bias-based universal ad- versarial patch attack for automatic check-out

    Aishan Liu, Jiakai Wang, Xianglong Liu, Bowen Cao, Chongzhi Zhang, and Hang Yu. Bias-based universal ad- versarial patch attack for automatic check-out. In ECCV, pages 395–410. Springer, 2020. 2

    2020

  32. [40]

    Detrs beat yolos on real-time object detection, 2023

    Wenyu Lv, Shangliang Xu, Yian Zhao, Guanzhong Wang, Jinman Wei, Cheng Cui, Yuning Du, Qingqing Dang, and Yi Liu. Detrs beat yolos on real-time object detection, 2023. 6

    2023

  33. [41]

    Gpt- driver: Learning to drive with GPT

    Jiageng Mao, Yuxi Qian, Hang Zhao, and Yue Wang. Gpt- driver: Learning to drive with GPT. CoRR, abs/2310.01415,

    arXiv

  34. [42]

    3d object detection for autonomous driving: A comprehensive survey

    Jiageng Mao, Shaoshuai Shi, Xiaogang Wang, and Hong- sheng Li. 3d object detection for autonomous driving: A comprehensive survey. International Journal of Computer Vision, 131(8):1909–1963, 2023. 2

    1909

  35. [43]

    Marius Zöllner

    Svetlana Pavlitska, Nico Lambing, and J. Marius Zöllner. Ad- versarial attacks on traffic sign recognition: A survey. CoRR, abs/2307.08278, 2023. 1

    2023 arXiv

  36. [44]

    MP5: A multi-modal open-ended embodied system in minecraft via active perception

    Yiran Qin, Enshen Zhou, Qichang Liu, Zhenfei Yin, Lu Sheng, Ruimao Zhang, Yu Qiao, and Jing Shao. MP5: A multi-modal open-ended embodied system in minecraft via active perception. In IEEE/CVF Conference on Computer Vision and Pattern Recognition+, pages 16307–16316, 2024. 2

    2024

  37. [45]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 3, 5

    2022

  38. [46]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 6

    2022

  39. [47]

    Intriguing properties of diffusion models: An empirical study of the natural attack capability in text- to-image generative models

    Takami Sato, Justin Yue, Nanze Chen, Ningfei Wang, and Qi Alfred Chen. Intriguing properties of diffusion models: An empirical study of the natural attack capability in text- to-image generative models. In IEEE/CVF Conference on 10 Computer Vision and Pattern Recognition (CVPR...

    2024

  40. [48]

    Role play with large language models.Nature, 623(7987):493–498,

    Murray Shanahan, Kyle McDonell, and Laria Reynolds. Role play with large language models.Nature, 623(7987):493–498,

  41. [49]

    Sok: On the semantic AI security in au- tonomous driving

    Junjie Shen, Ningfei Wang, Ziwen Wan, Yunpeng Luo, Takami Sato, Zhisheng Hu, Xinyang Zhang, Shengjian Guo, Zhenyu Zhong, Kang Li, Ziming Zhao, Chunming Qiao, and Qi Alfred Chen. Sok: On the semantic AI security in au- tonomous driving. CoRR, abs/2203.05314, 2022. 2

    2022 arXiv

  42. [50]

    Kim, Bilge Soran, Raghuraman Krishnamoorthi, Mohamed Elhoseiny, and Vikas Chandra

    Xiaoqian Shen, Yunyang Xiong, Changsheng Zhao, Lemeng Wu, Jun Chen, Chenchen Zhu, Zechun Liu, Fanyi Xiao, Bal- akrishnan Varadarajan, Florian Bordes, Zhuang Liu, Hu Xu, Hyunwoo J. Kim, Bilge Soran, Raghuraman Krishnamoorthi, Mohamed Elhoseiny, and Vikas Chandra. Longvu: Spa- t...

    arXiv

  43. [51]

    Dta: Phys- ical camouflage attacks using differentiable transformation network

    Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Ha- rashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. Dta: Phys- ical camouflage attacks using differentiable transformation network. In CVPR, pages 15305–15314, 2022. 2

    2022

  44. [52]

    Legiti- mate adversarial patches: Evading human eyes and detection models in the physical world

    Jia Tan, Nan Ji, Haidong Xie, and Xueshuang Xiang. Legiti- mate adversarial patches: Evading human eyes and detection models in the physical world. In ACMMM, pages 5307–5315,

  45. [53]

    Fooling automated surveillance cameras: adversarial patches to attack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedemé. Fooling automated surveillance cameras: adversarial patches to attack person detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 0–0, 2019. 2

    2019

  46. [54]

    Yolov10: Real-time end-to-end object detection

    Ao Wang, Hui Chen, Lihao Liu, Kai Chen, Zijia Lin, Jungong Han, and Guiguang Ding. Yolov10: Real-time end-to-end object detection. arXiv preprint arXiv:2405.14458, 2024. 6

    2024 arXiv

  47. [55]

    V oyager: An open-ended embodied agent with large language models

    Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. V oyager: An open-ended embodied agent with large language models. Trans. Mach. Learn. Res., 2024. 2

    2024

  48. [56]

    Uni- versal adversarial patch attack for automatic checkout using perceptual and attentional bias

    Jiakai Wang, Aishan Liu, Xiao Bai, and Xianglong Liu. Uni- versal adversarial patch attack for automatic checkout using perceptual and attentional bias. IEEE Transactions on Image Processing, 31:598–611, 2021. 2

    2021

  49. [57]

    Dual attention suppression attack: Generate adversarial camouflage in physical world

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In CVPR, pages 8565–8574, 2021. 2

    2021

  50. [58]

    Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack

    Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, and Qi Alfred Chen. Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack. In IEEE/CVF International Conference on Computer Vision, pages 4389–44...

    2023

  51. [59]

    Segllm: Multi-round reasoning segmentation

    XuDong Wang, Shaolun Zhang, Shufan Li, Konstantinos Kallidromitis, Kehan Li, Yusuke Kato, Kazuki Kozuka, and Trevor Darrell. Segllm: Multi-round reasoning segmentation. arXiv:2410.18923, 2024. 3

    2024 arXiv

  52. [60]

    Physical adversarial attack meets computer vision: A decade survey

    Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang, Hanxun Yu, Zhubo Li, Shin’ichi Satoh, Luc Van Gool, and Zheng Wang. Physical adversarial attack meets computer vision: A decade survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(12):9797–9817, 2024. 1

    2024

  53. [61]

    Chi, Quoc V

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, Fei Xia, Ed H. Chi, Quoc V . Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models. In Advances in Neural Information Pro- cessing Systems, 2022. 2

    2022

  54. [62]

    Simultane- ously optimizing perturbations and positions for black-box adversarial patch attacks

    Xingxing Wei, Ying Guo, Jie Yu, and Bo Zhang. Simultane- ously optimizing perturbations and positions for black-box adversarial patch attacks. IEEE Transactions on Pattern Anal- ysis and Machine Intelligence, 2022. 2

    2022

  55. [63]

    Unified adversarial patch for visible-infrared cross-modal attacks in the physical world

    Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. Unified adversarial patch for visible-infrared cross-modal attacks in the physical world. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023. 2

    2023

  56. [64]

    Tsang, and Lei Ma

    Yun Xing, Qing Guo, Xiaofeng Cao, Ivor W. Tsang, and Lei Ma. Metarepair: Learning to repair deep neural networks from repairing experiences. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 1781–1790,

  57. [65]

    Adversarial t-shirt! evading person detectors in a physical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In ECCV, pages 665–681. Springer, 2020. 2

    2020

  58. [66]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability. In Advances in Neural Infor- mation Processing Systems, 2023. 2

    2023

  59. [67]

    invisible cloak

    Darren Yu Yang, Jay Xiong, Xincheng Li, Xu Yan, John Raiti, Yuntao Wang, HuaQiang Wu, and Zhenyu Zhong. Building towards" invisible cloak": Robust physical adversarial attack on yolo object detector. In 2018 9th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communicat...

    2018

  60. [68]

    Set-of-mark prompting unleashes ex- traordinary visual grounding in gpt-4v, 2023

    Jianwei Yang, Hao Zhang, Feng Li, Xueyan Zou, Chunyuan Li, and Jianfeng Gao. Set-of-mark prompting unleashes ex- traordinary visual grounding in gpt-4v, 2023. 4, 5

    2023

  61. [69]

    Mastering text-to-image diffusion: Re- captioning, planning, and generating with multimodal llms

    Ling Yang, Zhaochen Yu, Chenlin Meng, Minkai Xu, Stefano Ermon, and Bin Cui. Mastering text-to-image diffusion: Re- captioning, planning, and generating with multimodal llms. In Forty-first International Conference on Machine Learning,

  62. [70]

    Llava-grounding: Grounded visual chat with large multimodal models

    Hao Zhang, Hongyang Li, Feng Li, Tianhe Ren, Xueyan Zou, Shilong Liu, Shijia Huang, Jianfeng Gao, Leizhang, Chunyuan Li, and Jainwei Yang. Llava-grounding: Grounded visual chat with large multimodal models. InComputer Vision - ECCV, pages 19–35, 2024. 2

    2024

  63. [71]

    {CAPatch}: Physical adversarial patch against image captioning systems

    Shibo Zhang, Yushi Cheng, Wenjun Zhu, Xiaoyu Ji, and Wenyuan Xu. {CAPatch}: Physical adversarial patch against image captioning systems. In 32nd USENIX Security Sympo- sium (USENIX Security 23), pages 679–696, 2023. 2

    2023

  64. [72]

    CAMOU: learning physical vehicle camouflages to adver- sarially attack detectors in the wild

    Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. CAMOU: learning physical vehicle camouflages to adver- sarially attack detectors in the wild. In 7th International Conference on Learning Representations (ICLR), 2019. 2 11

    2019

  65. [73]

    You only look at screens: Multimodal chain-of-action agents

    Zhuosheng Zhang and Aston Zhang. You only look at screens: Multimodal chain-of-action agents. In Findings of the As- sociation for Computational Linguistics, pages 3132–3149. Association for Computational Linguistics, 2024. 2

    2024

  66. [74]

    Jingyuan Zhao, Wenyi Zhao, Bo Deng, Zhenghong Wang, Feng Zhang, Wenxiang Zheng, Wanke Cao, Jinrui Nan, Yubo Lian, and Andrew F. Burke. Autonomous driving system: A comprehensive survey. Expert Syst. Appl., 242, 2024. 2

    2024

  67. [75]

    Shadows can be dangerous: Stealthy and effec- tive physical-world adversarial attack by natural phenomenon

    Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be dangerous: Stealthy and effec- tive physical-world adversarial attack by natural phenomenon. In CVPR, pages 15345–15354, 2022. 2 12 MAGIC: Mastering Physical Adversarial Generation in Context...

    2022

  68. [77]

    All the experiments are conducted via a server with AMD EPYC 9554 64-core Processor and an NVIDIA L40 GPU, running Ubuntu 22.04

    Experimental Environment We employ ChatGPT (gpt-4o-2024-08-06) as the LLM back- end for all the agents in our design. All the experiments are conducted via a server with AMD EPYC 9554 64-core Processor and an NVIDIA L40 GPU, running Ubuntu 22.04

    2024

  69. [78]

    Implementation Details We give out the technical details for implementing the pro- posed MAGIC framework. Specifically, there are two main aspects: ❶ the setting adopted for text-to-image (T2I) model, ❷ the parameters for object detectors and ❸ the set-of-mark prompting hyper-...

  70. [79]

    The Pre-defined Goals & Rules As the supplements for InstructionXD and XD, below we first show the details of the definition of attack and deployment goal, and the rules of how to realize attack is detailed in the next page due to the large size of the text. Definition of Atta...

  71. [80]

    can successfully attack the object detector by itself only, and 2) can successfully attack the object detector after it is deployed into an environment. The word ’attack’ here means that 1) the object detector recognizes the visual patch as an instance of category ’xxx’ with h...

  72. [81]

    the process begins with the input text prompt with category ’xxx’ as the grammatical subject

  73. [82]

    then the text-to-image model generates a visual patch with the input text prompt, where the goal is to create an image that composed of all the objects and features described in the text prompt

  74. [83]

    a real-world image which represents the real-world environment is given

  75. [84]

    first list all the regions, poles and beams in the given environment image that can be utilized to either paint or hang the visual patch b

    then a visual patch deployment module conduct the deployment process, a. first list all the regions, poles and beams in the given environment image that can be utilized to either paint or hang the visual patch b. select one region, pole or beam from the list that can keep the ...

  76. [85]

    finally, the object detector conduct evaluation for both the visual patch itself and the environment image with the patch deployed

  77. [86]

    • CONF_THRESHOLD: 0.80

    the detection results give out the confidence of recognizing the visual patch as specific category. • CONF_THRESHOLD: 0.80

  78. [87]

    Statistical Results of Naturalness In section Sec

    More Experimental Results 4.1. Statistical Results of Naturalness In section Sec. 5.2, we visually compare the naturalness of our MAGIC patches. As the naturalness is measured by the LLM E with the instruction γ which gives out a naturalness score for each deployed patch. Here...

  79. [88]

    Translation: The object can be moved or positioned differently in the frame

  80. [89]

    Rotation: The object can be rotated at various angles

  81. [90]

    Scale: The object can appear larger or smaller

  82. [91]

    Illumination: Lighting conditions can change, affecting the object’s appearance

  83. [92]

    Occlusion: Part of the object might be obstructed or hidden

  84. [93]

    Take the robust features of a stop sign as example, they contains:

    Noise: Data might be corrupted by external disturbances. Take the robust features of a stop sign as example, they contains:

  85. [94]

    Octagonal Shape: Stop signs are standardized as octagons

  86. [95]

    Red Color: The background is red, which is a typical color for stop signs to signify the need to stop

  87. [96]

    White Text: The word "STOP" is in white, which contrasts well against the red background, making it easily readable

  88. [97]

    Universal Recognition: The combination of these features is commonly used worldwide to indicate a stop sign

  89. [98]

    High Contrast: The red and white color scheme provides high contrast for easy visibility

  90. [99]

    A stop sign

    Simplicity: Minimalist design for quick recognition and action. Here are some examples of altering the description of robust features while keep using the original category name in a text prompt: The original text prompt: "A stop sign." Example 1: "A yellow triangle stop sign....

  91. [100]

    robustified

    Ethical Consideration Our work highlights the ethical responsibility associated with adversarial research. Without proper safeguards, such tech- niques could be misused to exploit critical systems, under- scoring the need for responsible disclosure and research col- laboration...

  92. [101]

    Limitations The scope of our work is focused on designing physical ad- versarial attack in traffic scenarios via LLM agents. ❶ Nev- ertheless, the current environments primarily serve as proofs of concept under standard conditions, rather than encom- passing a broader range of...

  93. [102]

    robustified

    Broader Impact Understanding vulnerabilities in traffic systems can help improve the safety and resilience of autonomous vehicles. In fact, by rigorously testing adversarial robustness across diverse real-world conditions, we can identify potential risks and develop countermea...

  94. [103]

    Future Work Our future work aims to explore larger-scale attacks to evalu- ate adversarial vulnerabilities across broader traffic systems, including segmentation and depth estimation tasks critical for autonomous navigation. Furthermore, integrating ad- vanced blending techniq...

  95. [1634]

    Computer Vision Foundation / IEEE Computer Society,

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.