Pith. sign in

REVIEW 4 major objections 5 minor 38 references

Black-box Adversarial Attacks on CNN-based SLAM Algorithms

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Black-box adversarial perturbations transferred from an ImageNet classifier can force a CNN-based SLAM system to lose tracking on up to 76% of frames, even at moderate attack strength, and can completely destroy pose estimation when depth…

desk verdict Useful first look at transfer attacks on a CNN feature detector inside a full SLAM pipeline, but the missing same-magnitude random-noise control leaves the central adversarial claim unsupported. read the letter →

arxiv 2505.24654 v1 pith:7WCOKCPU submitted 2025-05-30 cs.RO cs.CV

Maria Rafaela Gkeka , Bowen Sun , Evgenia Smirni , Christos D. Antonopoulos , Spyros Lalis , Nikolaos Bellas This is my paper
classification cs.ROcs.CV
keywords adversarialattackblack-boxCNNfeaturedetectorSLAMGCNv2FGSMPGDtransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a black-box adversarial attack, computed against an unrelated ImageNet classifier rather than against the SLAM system itself, can make a CNN-based SLAM pipeline fail. Using the TUM RGB-D benchmark, the authors perturb input RGB frames with FGSM and PGD noise generated via InceptionResNetV2 and feed them to GCN-SLAM, which combines the GCNv2 feature detector with an ORB-SLAM2 back-end. The central result is that moderate perturbations leave as many as 76% of frames untracked in some trajectories, that attacking only object regions or only a subset of frames still degrades accuracy, and that attacking depth images makes single-frame pose estimation fail entirely. The authors argue this holds across different proxy networks and transfers to another CNN-based SLAM system, DXSLAM.

What carries the argument

The mechanism is adversarial transferability: a perturbation is generated by differentiating a proxy classifier's loss with respect to the input image (FGSM in Equation 1, PGD in Equation 2), and that same perturbation is then applied to frames of the SLAM pipeline, whose own CNN-based feature detector (GCNv2) is never queried. The attack succeeds because the feature detector's keypoint heatmaps are reshuffled by the noise, dispersing salient features from object outlines into neighboring positions and increasing false matches between consecutive frames; the ORB-SLAM2 back-end's bundle adjustment, loop closure, and relocalization are not enough to compensate. Section 4.4 identifies the depth channel as particularly fragile because depth values determine 3D point positions used in matching.

What would settle it

Run the same All-frames FGSM attack pipeline on the TUM fr1 360 sequence with epsilon = 0.05, but replace the adversarial perturbation on each frame with i.i.d. uniform noise scaled to the same L-infinity bound; compare the percentage of untracked frames to the reported 76%. If random noise matches or exceeds the adversarial effect, the tracking failure is driven by perturbation magnitude, not by adversarial direction; if random noise does not reproduce the failure, the transferability claim is supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that the vulnerability of CNN-based feature detectors can be exploited without any access to the detector's internals: adversarial perturbations crafted with FGSM or PGD against a standard ImageNet classification network, such as InceptionResNetV2, transfer to the GCNv2 feature detector embedded in a full SLAM pipeline. On the TUM dataset, these transferred perturbations cause the ORB-SLAM2 back-end to lose track of significant portions of the trajectory, with up to 76% untracked frames for the fr1 360 sequence at epsilon = 0.05, and with trajectory error increasing by at least 43% across all datasets at epsilon = 0.1. The authors further claim that applying the same perturbation to the depth channel, rather than RGB, is catastrophic: the system then consistently fails to estimate a single-frame pose, regardless of attack type. A transferability experiment shows that the same perturbations also degrade DXSLAM, a CNN-based SLAM system with a different architecture, indicating that the attack generalizes beyond a single feature detector.

Load-bearing premise

The findings stand or fall on the assumption that the observed tracking failures are caused by adversarial structure in the perturbations rather than by generic noise: the paper does not compare against random or uniform noise of the same magnitude, so if plain noise degrades tracking equally, the result is about robustness to perturbation rather than about adversarial attacks.

Editorial extensions

If this is right

  • Moderate black-box perturbations can force a CNN-based SLAM system to lose tracking, so autonomous agents running such SLAM are vulnerable to an attacker who only manipulates camera input.
  • Attacks on the depth channel are a severe threat: a single perturbed depth image can prevent pose estimation entirely, even if the RGB channel is untouched.
  • Object-focused attacks (Spatially-Adaptive) or attacks on a minority of frames can produce trajectory errors comparable to all-frame attacks, meaning an attacker needs little perceptual evidence to cause real harm.
  • Transferability across proxy networks (InceptionResNetV2, MobileNetV2, DenseNet) and across target systems (GCN-SLAM, DXSLAM) suggests the attack may generalize to other CNN-based feature detectors.
  • The ORB-SLAM2 back-end's robustness mechanisms do not neutralize the attack, so defensive measures must be introduced at the feature-detector or input level.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If adversarial transferability is the active mechanism, then feature detectors trained adversarially against classifier-style perturbations may also become robust to this attack; this is a testable extension the paper does not run.
  • The depth-channel result hints at a general principle: any SLAM component that directly maps measurements to 3D coordinates is a higher-leverage target than the RGB front-end, since corrupted depth corrupts the map itself, not just feature matching.
  • The absence of a random-noise control means the attack's specificity is unproven; a natural follow-up is an ablation with scrambled gradients or sign-randomized perturbations of equal magnitude.
  • Because the attack uses only RGB input and an off-the-shelf classifier, it can be deployed physically by projecting or overlaying adversarial texture onto scene objects, provided the Spatially-Adaptive attack retains effectiveness under real-world capture conditions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes black-box adversarial attacks against CNN-based feature detectors integrated in a SLAM pipeline. The authors generate FGSM and PGD perturbations using pretrained ImageNet classifiers (InceptionResNetV2, MobileNetV2, DenseNet) and apply them to RGB frames fed to GCN-SLAM (GCNv2 front-end with ORB-SLAM2 back-end). Using the TUM RGB-D dataset, they report up to 76.6% untracked frames at ε=0.30 and 75.7% at ε=0.05 for fr1_360, along with ATE increases across several sequences. They also evaluate targeted PGD attacks, frame-selection rates, time-adaptive and spatially adaptive variants, and a depth-image attack, and they demonstrate transfer of the attack to DXSLAM. The central claim is that black-box adversarial perturbations cause tracking failure in a CNN-based SLAM system.

Significance. If substantiated, the paper would be a relevant contribution to the security of learned feature detectors in robotics, as it is, to my knowledge, the first to study black-box adversarial attacks on a CNN-based detector inside a full SLAM system. The use of a public dataset and standard attack libraries is commendable, and the breadth of attack variants (all-frames, rate, time-adaptive, spatially adaptive, targeted, depth) is a strength. However, the current evidence does not separate the effect of the adversarial direction from generic perturbation sensitivity: there is no random-noise control. The depth-attack claim is also under-supported, and several secondary claims lack supporting data. With a randomized control, error bars, and additional quantitative reporting, the paper could become a solid empirical contribution.

major comments (4)
  1. [4.2, Tables 1 and 2] The central claim that adversarial structure, rather than the mere presence of large pixel perturbations, drives the observed tracking failure is not tested. The paper never compares the FGSM/PGD attacks against random or uniform noise of the same L∞ magnitude (e.g., ε=0.05, 0.10, 0.30). At ε=0.10, the perturbation can shift each pixel by up to 25.5 intensity levels, a visible distortion that could plausibly disrupt GCNv2 feature repeatability and ORB-SLAM matching regardless of its direction. A random-noise control is therefore essential to support the abstract's causal language ('adversarial perturbations'). Please add such a control and report the same metrics.
  2. [4.4] The depth-attack claim that 'the SLAM system consistently fails to estimate a single-frame pose' is unsupported by any quantitative result: no table, figure, or baseline is given. Because depth values directly define 3D points in RGB-D SLAM, randomly corrupting depth is likely to break pose estimation trivially. To validate the 'catastrophic impact' statement in the abstract, report the ATE and untracked-frame percentages for the depth attack, and include a random-noise control on depth to determine whether the adversarial direction matters.
  3. [4.5] The stated transferability across known networks is not evidenced: the paper claims that MobileNetV2 and DenseNet yield 'strikingly similar' outcomes, but only InceptionResNetV2 results are shown in the main experiments. Since one of the contributions is evaluating the attack with multiple known CNNs, a summary table (or figure) of untracked-frame percentages and ATE for all three networks is required.
  4. [4.2, Tables 1 and 2] All experimental results appear to come from a single run per condition. ORB-SLAM2 contains stochastic components (e.g., RANSAC in initialization and relocalization), so single-run differences, such as fr1_floor baseline 14.0% vs. ε=0.005 14.2% untracked frames in Table 2, may not be statistically meaningful. Please report the mean and standard deviation over at least three runs (or state explicitly that the pipeline is deterministic and justify this).
minor comments (5)
  1. [4.2.1] The claim that 'the attacks performed with ε=0.1 result in an increase of the ATE by at least 43%' is not correct for fr1_floor, where the ATE rises from 0.33 to 0.47, an increase of 42.4%. Please adjust the statement.
  2. [Table 2] The Spatially-Adaptive results for fr1_360 are non-monotonic: untracked frames are 0.0 at ε=0.10, 75.8 at ε=0.15, and back to 0.0 at ε=0.30. This odd pattern is not discussed; please explain or correct.
  3. [1] The claim that this is 'the first work to propose and study adversarial attacks on NN-based feature detectors' is strong given that [37] attacks landmark detection networks; please add a discussion distinguishing the two.
  4. [4.1] The term 'white-box networks' is confusing, since the known networks are used to generate perturbations in a black-box attack; consider using 'proxy networks' instead.
  5. [Figure 3] The caption does not identify which line color corresponds to which condition; please add a legend or spell out the mapping in the caption.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack perturbations are generated with external ImageNet classifiers and public TUM data, and the outcome is measured against ground-truth trajectories, so no claim reduces to its own inputs.

full rationale

The paper's derivation chain is not circular. Adversarial perturbations are computed with FGSM or PGD on the loss of an external pretrained classifier (InceptionResNetV2, MobileNetV2, or DenseNet) using public TUM RGB-D images. These perturbations are then applied to the input of GCN-SLAM, an open-source system combining the GCNv2 feature detector with the ORB-SLAM2 back-end, and the outcome is the average ATE and the percentage of untracked frames against ground-truth poses. None of these target quantities are used to construct the perturbations, and no fitted parameter is later relabeled as a prediction. The transferability of classifier-generated perturbations to GCNv2 is an empirical premise of the black-box attack, not a definitional equivalence: the attack does not optimize against GCNv2 or against the SLAM loss. The absence of a same-magnitude random- or uniform-noise control is a genuine experimental-control weakness that threatens the attribution of the effect to adversarial structure, but it is a correctness risk, not a circularity. Similarly, the Section 4.4 depth-attack claim that the system 'consistently fails to estimate a single-frame pose' is asserted without a table or baseline, which is missing evidence rather than a reduction of the result to its inputs. The citations used are external systems, datasets, and attack methods; the paper does not rely on its own prior results to define the measured quantity. Therefore, the analysis is self-contained with respect to circularity, and the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

The paper introduces no fitted parameters or invented entities. The attack uses a public dataset and pretrained models; epsilon values are swept attack strengths, not fitted to data. The main hidden assumptions are the transferability of adversarial examples and the causal attribution of tracking failure to the feature detector.

assumptions (2)
  • domain assumption Adversarial perturbations computed against a proxy ImageNet classifier transfer to the GCNv2 feature detector and degrade SLAM tracking.
    Section 3.1 assumes this transferability when choosing InceptionResNetV2 as the known CNN. No theoretical justification or control experiment with random noise is provided.
  • domain assumption Tracking failure measured by the ORB-SLAM2 backend is attributable to the feature-detector perturbation, not to interactions with other SLAM components.
    ORB-SLAM2 includes bundle adjustment, loop closure, and relocalization; the paper does not isolate the causal chain from perturbed features to tracking failure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Black-box Adversarial Attacks on CNN-based SLAM Algorithms." pith.science (2026). https://pith.science/paper/7WCOKCPU

@misc{pith2026250524654,
  author       = {Pith},
  title        = {Pith review of: Black-box Adversarial Attacks on CNN-based SLAM Algorithms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7WCOKCPU}},
  note         = {Machine review of arXiv:2505.24654}
}
read the original abstract

Continuous advancements in deep learning have led to significant progress in feature detection, resulting in enhanced accuracy in tasks like Simultaneous Localization and Mapping (SLAM). Nevertheless, the vulnerability of deep neural networks to adversarial attacks remains a challenge for their reliable deployment in applications, such as navigation of autonomous agents. Even though CNN-based SLAM algorithms are a growing area of research there is a notable absence of a comprehensive presentation and examination of adversarial attacks targeting CNN-based feature detectors, as part of a SLAM system. Our work introduces black-box adversarial perturbations applied to the RGB images fed into the GCN-SLAM algorithm. Our findings on the TUM dataset [30] reveal that even attacks of moderate scale can lead to tracking failure in as many as 76% of the frames. Moreover, our experiments highlight the catastrophic impact of attacking depth instead of RGB input images on the SLAM system.

Figures

Figures reproduced from arXiv: 2505.24654 by the authors.

Figure 1
Figure 1. Block diagram of our approach to black-box attacks on CNN-based feature detectors and the SLAM pipeline (path with black [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Adding the adversarial perturbation (b) generated by the FGSM attack on the InceptionResNetV2 to the (a) original [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Origin-aligned ground truth, baseline and [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: The increase of average ATE wrt. the baseline for each [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Timelines of execution time and ATE per frame of [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 8
Figure 8. Figure 8: The effect of targeted black-box PGD attack on SLAM [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 7
Figure 7. Figure 7: The features detected by (a) the Original and (b) the [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 30 canonical work pages

  1. [1]

    Adversarial Attacks on Camera-Lidar Models for 3D Car Detection

    Mazen Abdelfattah, Kaiwen Yuan, Z Jane Wang, and Rabab Ward. Adversarial Attacks on Camera-Lidar Models for 3D Car Detection. In 2021 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 2189–2194. IEEE, 2021. 2

    work page 2021

  2. [2]

    Anurag Arnab, Ondrej Miksik, and Philip H. S. Torr. On the Robustness of Semantic Segmentation Models to Adversar- ial Attacks. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR, Salt Lake City, UT, USA, June 18-22, 2018, pages 888–897, 2018. 1

    work page 2018

  3. [3]

    Yolov4: Optimal Speed and Accuracy of Object Detection

    Alexey Bochkovskiy, Chien-Yao Wang, and Hong- Yuan Mark Liao. Yolov4: Optimal Speed and Accuracy of Object Detection. arXiv preprint arXiv:2004.10934, 2020. 2

    arXiv 2004

  4. [4]

    Towards Avaluating the Robustness of Neural Networks

    Nicholas Carlini and David Wagner. Towards Avaluating the Robustness of Neural Networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 1

    work page 2017

  5. [5]

    Adversarial Attacks on Monocular Pose Estima- tion

    Hemang Chawla, Arnav Varma, Elahe Arani, and Bahram Zonooz. Adversarial Attacks on Monocular Pose Estima- tion. In 2022 IEEE/RSJ International Conference on Intelli- gent Robots and Systems (IROS), pages 12500–12505. IEEE,

    work page 2022

  6. [6]

    ASpanFormer: Detector-Free Image Matching with Adaptive Span Transformer

    Hongkai Chen, Zixin Luo, Lei Zhou, Yurun Tian, Mingmin Zhen, Tian Fang, David McKinnon, Yanghai Tsin, and Long Quan. ASpanFormer: Detector-Free Image Matching with Adaptive Span Transformer. In 17th European Conference on Computer Vision (ECCV), Tel Aviv, Israel, October 23-27, 2022, Part XXXII, pages 20–36. 1

    work page 2022

  7. [7]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 4

    2009

  8. [8]

    Superpoint: Self-supervised Interest Point Detection and Description

    Daniel DeTone, Tomasz Malisiewicz, and Andrew Rabi- novich. Superpoint: Self-supervised Interest Point Detection and Description. In Proceedings of the IEEE conference on computer vision and pattern recognition workshops , pages 224–236, 2018. 1

    work page 2018

Show all 38 references
  1. [9]

    Adversarial attacks against medical deep learning systems

    Samuel G Finlayson, Hyung Won Chung, Isaac S Kohane, and Andrew L Beam. Adversarial attacks against medical deep learning systems. arXiv preprint arXiv:1804.05296 ,

    arXiv

  2. [10]

    Black-box Adver- sarial Attacks through Speech Distortion for Speech Emo- tion Recognition

    Jin Gao, Diqun Yan, and Mingyu Dong. Black-box Adver- sarial Attacks through Speech Distortion for Speech Emo- tion Recognition. EURASIP Journal on Audio, Speech, and Music Processing, 2022:1–10, 2022. 2

    2022

  3. [11]

    Explaining and Harnessing Adversarial Examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Adversarial Examples. arXiv preprint arXiv:1412.6572, 2014. 1, 2, 3

    2014 arXiv

  4. [12]

    Simple black-box Adversar- ial Attacks

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box Adversar- ial Attacks. In International Conference on Machine Learn- ing, pages 2484–2493. PMLR, 2019. 2

    2019

  5. [13]

    A CMA-ES-Based Adversarial Attack Against Black-Box Object Detectors

    Lyu Haoran, Tan Yu-an, Xue Yuan, Wang Yajie, and Xu Jingfeng. A CMA-ES-Based Adversarial Attack Against Black-Box Object Detectors. Chinese Journal of Electron- ics, 30:406–412, 2021. 2

    2021

  6. [14]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. 2

    2017

  7. [15]

    Black-box Adversarial Attacks with Limited Queries and Information

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box Adversarial Attacks with Limited Queries and Information. In International conference on machine learning, pages 2137–2146. PMLR, 2018. 2

    2018

  8. [16]

    Adversarial Attack and De- fense of Yolo Detectors in Autonomous Driving Scenarios

    Jung Im Choi and Qing Tian. Adversarial Attack and De- fense of Yolo Detectors in Autonomous Driving Scenarios. In 2022 IEEE Intelligent Vehicles Symposium (IV) , pages 1011–1017. IEEE, 2022. 2

    2022

  9. [17]

    Black-box Adversarial Attacks on Video Recognition Models

    Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, and Yu-Gang Jiang. Black-box Adversarial Attacks on Video Recognition Models. In Proceedings of the 27th ACM Inter- national Conference on Multimedia , pages 864–872, 2019. 2

    2019

  10. [18]

    Khan, Muzammal Naseer, Munawar Hayat, Syed Waqas Zamir, Fahad Shahbaz Khan, and Mubarak Shah

    Salman H. Khan, Muzammal Naseer, Munawar Hayat, Syed Waqas Zamir, Fahad Shahbaz Khan, and Mubarak Shah. Transformers in Vision: A Survey. ACM Comput. Surv., 54(10s):200:1–200:41, 2022. 1

    2022

  11. [19]

    Patch of Invisibility: Natu- ralistic Black-box Adversarial Attacks on Object Detectors

    Raz Lapid and Moshe Sipper. Patch of Invisibility: Natu- ralistic Black-box Adversarial Attacks on Object Detectors. arXiv preprint arXiv:2303.04238, 2023. 2

    2023

  12. [20]

    DXSLAM: A Robust and Efficient Visual SLAM System with Deep Fea- tures

    Dongjiang Li, Xuesong Shi, Qiwei Long, Shenghui Liu, Wei Yang, Fangshi Wang, Qi Wei, and Fei Qiao. DXSLAM: A Robust and Efficient Visual SLAM System with Deep Fea- tures. In 2020 IEEE/RSJ International conference on intel- ligent robots and systems (IROS) , pages 4958–4965. IEEE,

    2020

  13. [21]

    LightGlue: Local Feature Matching at Light Speed

    Philipp Lindenberger, Paul-Edouard Sarlin, and Marc Polle- feys. LightGlue: Local Feature Matching at Light Speed. CoRR, abs/2306.13643, 2023. 1

    2023 arXiv

  14. [22]

    DPATCH: An Adversarial Patch Attack on Object Detectors

    Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Yiran Chen, and Hai Helen Li. DPATCH: An Adversarial Patch Attack on Object Detectors. arXiv: Computer Vision and Pattern Recognition, 2018. 2

    2018

  15. [23]

    Towards Deep Learn- ing Models resistant to Adversarial Attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learn- ing Models resistant to Adversarial Attacks. arXiv preprint arXiv:1706.06083, 2017. 2, 3

    2017 arXiv

  16. [24]

    ORB-SLAM2: An Open-Source SLAM System for Monocular, Stereo, and RGB-D Cameras

    Raul Mur-Artal and Juan D Tard ´os. ORB-SLAM2: An Open-Source SLAM System for Monocular, Stereo, and RGB-D Cameras. IEEE transactions on robotics , 33(5): 1255–1262, 2017. 1, 3

    2017

  17. [25]

    Physical Passive Patch Adversarial Attacks on Visual Odometry Systems

    Yaniv Nemcovsky, Matan Jacoby, Alex M Bronstein, and Chaim Baskin. Physical Passive Patch Adversarial Attacks on Visual Odometry Systems. In Proceedings of the Asian Conference on Computer Vision, pages 1795–1811, 2022. 2

    2022

  18. [26]

    Technical Re- port on the Cleverhans v2

    Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, et al. Technical Re- port on the Cleverhans v2. 1.0 Adversarial Examples Library. arXiv preprint arXiv:1610.00768, 2016. 4

    arXiv

  19. [27]

    Prac- tical Black-box attacks Against Machine Learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Prac- tical Black-box attacks Against Machine Learning. In ACM Asia conference on computer and communications security , pages 506–519, 2017. 2

    2017

  20. [28]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zh- moginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 4510–4520, 2018. 2

    2018

  21. [29]

    SuperGlue: Learning Feature Matching With Graph Neural Networks

    Paul-Edouard Sarlin, Daniel DeTone, Tomasz Malisiewicz, and Andrew Rabinovich. SuperGlue: Learning Feature Matching With Graph Neural Networks. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020 , pages 4937–49...

    2020

  22. [30]

    A Benchmark for the Eval- uation of RGB-D SLAM Systems

    J ¨urgen Sturm, Nikolas Engelhard, Felix Endres, Wolfram Burgard, and Daniel Cremers. A Benchmark for the Eval- uation of RGB-D SLAM Systems. In 2012 IEEE/RSJ inter- national conference on intelligent robots and systems, pages 573–580. IEEE, 2012. 1, 2, 4

    2012

  23. [31]

    Loftr: Detector-free local feature matching with transformers

    Jiaming Sun, Zehong Shen, Yuang Wang, Hujun Bao, and Xiaowei Zhou. Loftr: Detector-free local feature matching with transformers. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , pages 8922–8931, 2021. 1

    2021

  24. [32]

    Christian Szegedy, Sergey Ioffe, Vincent Vanhoucke, and Alexander A. Alemi. Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning. In Thirty- First AAAI Conference on Artificial Intelligence, February 4- 9, 2017, San Francisco, California, USA, page...

    2017

  25. [33]

    GCNv2: Efficient Correspondence Prediction for Real-Time SLAM

    Jiexiong Tang, Ludvig Ericson, John Folkesson, and Patric Jensfelt. GCNv2: Efficient Correspondence Prediction for Real-Time SLAM. IEEE Robotics and Automation Letters , 4(4):3505–3512, 2019. 1, 2

    2019

  26. [34]

    MatchFormer: Interleaving Attention in Transformers for Feature Matching

    Qing Wang, Jiaming Zhang, Kailun Yang, Kunyu Peng, and Rainer Stiefelhagen. MatchFormer: Interleaving Attention in Transformers for Feature Matching. In 16th Asian Confer- ence on Computer Vision (ACCV), Macao, China, December 4-8, 2022, Part III, pages 256–273, 2022. 1

    2022

  27. [35]

    Rodr´ıguez, and Jianhua Wang

    Yixiang Wang, Jiqiang Liu, Xiaolin Chang, Ricardo J. Rodr´ıguez, and Jianhua Wang. DI-AA: An interpretable White-box Attack for Fooling Deep Neural Networks. Inf. Sci., 610:14–32, 2022. 2

    2022

  28. [36]

    Uni- versal 3-Dimensional Perturbations for Black-Box Attacks on Video Recognition Systems

    Shangyu Xie, Han Wang, Yu Kong, and Yuan Hong. Uni- versal 3-Dimensional Perturbations for Black-Box Attacks on Video Recognition Systems. 2022 IEEE Symposium on Security and Privacy (SP), pages 1390–1407, 2021. 2

    2022

  29. [37]

    Miss the point: Targeted adversarial Attack on Multiple Landmark Detection

    Qingsong Yao, Zecheng He, Hu Han, and S Kevin Zhou. Miss the point: Targeted adversarial Attack on Multiple Landmark Detection. In Medical Image Computing and Computer Assisted Intervention–MICCAI 2020: 23rd Inter- national Conference, Lima, Peru, October 4–8, 2020, pages 692–...

    2020

  30. [38]

    Ad- versarial Examples: Attacks and Defenses for Deep Learn- ing

    Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Ad- versarial Examples: Attacks and Defenses for Deep Learn- ing. IEEE Trans. Neural Networks Learn. Syst., 30(9):2805– 2824, 2019. 1

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.