Pith. sign in

REVIEW 3 major objections 5 minor 66 references

3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PGA uses 3D Gaussian Splatting to generate printable vehicle camouflage from a few photos that hides cars from object detectors across viewpoints and weather.

desk verdict Clever 3DGS-based camouflage with a real evaluation confound: the digital comparison pits PGA in its own renderer against baselines in CARLA's, so the headline 'best in all settings' claim needs a cross-renderer check before it is believed. read the letter →

arxiv 2507.01367 v2 pith:2RPRMXUB submitted 2025-07-02 cs.CV

Tianrui Lou , Xiaojun Jia , Siyuan Liang , Jiawei Liang , Ming Zhang , Yanjun Xiao , Xiaochun Cao This is my paper
classification cs.CV
keywords 3DGaussianSplattingphysicaladversarialattackcamouflageobjectdetectionmulti-viewrobustnessvehiclesphericalharmonicsmin-maxoptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes PGA, a physical adversarial attack method that uses 3D Gaussian Splatting (3DGS) to turn a small set of photographs of a vehicle into printable camouflage that makes the vehicle undetectable or misclassified by object detectors. The central claim is that replacing mesh-based rendering with 3DGS removes the need for manual 3D modeling and simulator-built environments, while two new mechanisms—surface-aligned Gaussians and a min-max background perturbation scheme—make the camouflage consistent and robust across viewpoints. If the claim holds, mounting a physical attack on autonomous-driving vehicle detectors becomes far easier: a camera, a reconstruction step, and printed stickers are enough to generate an effective multi-view camouflage. The paper reports the lowest detection AP@0.5 among compared methods in digital CARLA tests and in physical tests on a 1:24 scale car and a 1:1 real vehicle.

What carries the argument

The central object is the set of 3D Gaussians representing the target scene, rendered by the differentiable 3DGS rasterizer, where each Gaussian is a small 3D ellipsoid with a position, covariance, opacity, and spherical-harmonic color. Two constraints do the work: SuGaR's surface-alignment and opacity-reduction regularization, which prevents Gaussians inside the object from occluding surface color when the viewpoint changes, and optimization restricted to the zero-order spherical harmonic coefficient $\langle k\rangle_0$, which forces each Gaussian to keep a single view-independent color. The min-max optimization, with an inner I-FGSM background perturbation against an outer camouflage update, is the mechanism that discards non-robust features.

What would settle it

Take a glossy, textureless vehicle, photograph it from a small set of viewpoints without calibration stickers, reconstruct it with the SuGaR-regularized 3DGS, and generate PGA camouflage; then evaluate detection at azimuth or pitch angles not used in optimization. If the detector still localizes the vehicle reliably across those novel views, the surface-alignment and zero-order spherical-harmonic assumptions are not sufficient for multi-view transfer.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that a physical adversarial camouflage can be optimized directly on a 3D Gaussian Splatting representation instead of a mesh, using only the zero-order spherical harmonic coefficient $\langle k\rangle_0$ of each Gaussian as the optimizable texture parameter. To keep the camouflage stable across viewpoints, the framework regularizes the reconstruction with SuGaR so Gaussians lie on the object surface, avoiding mutual occlusion, and restricts optimization to the constant term of the spherical harmonics, avoiding self-occlusion, so each Gaussian has one consistent color. A min-max objective first adds bounded pixel noise to each viewpoint's background to raise attack difficulty, then updates the coefficients to minimize detection confidence, filtering out non-robust features. In the paper's experiments this yields the best attack performance against Faster R-CNN, YOLO-v5, Mask R-CNN, and Deformable-DETR across distances, pitch angles, and weather, and in the 1:1 physical test it drops AP@0.5 from 88.48 to 25.67.

Load-bearing premise

The framework assumes that the SuGaR-regularized Gaussian reconstruction places Gaussians on the object surface and that optimizing only the zero-order spherical harmonic coefficient yields a view-independent physical texture; if either fails, the cross-view consistency mechanism breaks and the camouflage may not transfer to the physical object.

Editorial extensions

If this is right

  • Camouflage for a new object can be produced from a handful of photographs, without acquiring or manually aligning a 3D mesh.
  • Because only the constant spherical-harmonic term is optimized, the generated texture is view-independent and can be printed and applied as stickers.
  • The min-max background perturbation makes the camouflage transfer across backgrounds and weather rather than overfitting to a single training scene.
  • The method transfers to black-box detectors, so a camouflage computed against one architecture weakens other one-stage, two-stage, and transformer detectors.
  • The same pipeline extends beyond RGB vehicle detection, for example to infrared object detection, as the paper's supplementary material indicates.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An untested implication is that surface alignment is the load-bearing step: for glossy or textureless objects, the zero-order color constraint alone may not prevent view-dependent artifacts, and a direct test is reconstructing such an object without calibration stickers and evaluating at novel azimuths.
  • A defense-oriented extension is that the min-max background step operates only in 2D image space; detectors that also use depth, temporal consistency, or geometry could resist the camouflage because those cues are untouched.
  • Since only color is optimized, the attack cannot hide 3D shape; combining Gaussian geometry optimization with color optimization is a natural follow-up the paper leaves implicit.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes PGA, a physical adversarial camouflage generation framework built on 3D Gaussian Splatting (3DGS). PGA reconstructs a target object and scene from a few images using 3DGS, then optimizes the zero-order spherical harmonic coefficients of the Gaussians against a detection loss, while applying SuGaR-based surface alignment, per-viewpoint iteration limits, and a min-max background perturbation procedure to improve cross-view robustness. The method is evaluated in CARLA-simulated digital scenes and on 1:24-scale and 1:1-scale physical vehicles, with claims that it outperforms prior camouflage methods such as DAS, FCA, DTA, ACTIVE, TAS, and RAUCA on Faster R-CNN while also transferring to YOLO-v5, Mask R-CNN, and Deformable-DETR.

Significance. If the reported results were obtained under a fair and consistent evaluation protocol, PGA would be a meaningful contribution: it removes the mesh-prior requirement of prior camouflage methods, uses only a handful of images for reconstruction, and introduces techniques (zero-order SH restriction, SuGaR regularization, min-max background optimization) that are well-motivated for improving multi-view consistency. The paper is also transparent about its code release and provides physical experiments on both a small-scale model and a real vehicle, which is a valuable practical step. However, the current evidence does not support the headline claims of uniform superiority and strong transferability, because the digital comparison uses mismatched rendering pipelines and the transferability numbers in Table 1 fail to show consistent gains over baselines.

major comments (3)
  1. [Sec. 5.2, Eq. (4)] The digital evaluation protocol is unfair to the baselines and confounds the central claim. For PGA, the camouflage is optimized and evaluated on images rendered by the same 3DGS rasterizer (the Idet images in Eq. 4), whereas baselines are evaluated by placing their textures on CARLA vehicles and rendering with CARLA's native renderer. This gives PGA an opportunity to exploit 3DGS-specific artifacts (e.g., splatting order, Gaussian transparency) that would not appear in CARLA-native renderings, so the 'best attack performance in all settings' in Tables 1-2 does not establish stronger camouflage. The authors should either re-render the exported PGA texture in CARLA's native renderer or render all methods through a common differentiable renderer, and report the results under that common protocol.
  2. [Sec. 5.2, Table 1] The claim of strong transferability is contradicted by the paper's own numbers. On the transfer detectors (YOLO-v5, Mask R-CNN, Deformable-DETR), PGA often performs substantially worse than several baselines; for example, at 5m distance in sunny weather, PGA achieves AP 39.10 on YOLO-v5 versus 70.16 for DAS, 10.62 on Mask R-CNN versus 43.82 for DTA, and 28.31 on D-DETR versus 46.29 for FCA. The text states that PGA 'achieves the best attack performance in all settings' and possesses 'strong transferability,' which is an overreach. The authors should either temper the transferability claim to the white-box setting or provide an explanation (and ideally additional results) for the inconsistency.
  3. [Sec. 5.3, Tables 4 and 1:1 experiment] The physical experiments do not fully resolve the digital protocol issue and introduce additional confounds. In the 1:24 experiment, PGA is able to reconstruct the exact toy car it later attacks, while baselines use generic meshes; the 1:1 experiment has no baseline comparison. Moreover, the use of calibration stickers in the 1:1 setup may affect detection independently of the camouflage. The authors should clarify whether the digital-claim re-rendering test was performed, and for the physical experiments they should report results for baselines under the same reconstruction/deployment conditions or explicitly state the limitations of the comparison.
minor comments (5)
  1. [Abstract and Sec. 1] The phrase 'provides rapid and precise reconstruction with few images' is repeated verbatim in the abstract and introduction; consider varying the wording and specifying how few images are needed in practice.
  2. [Sec. 4.2.2, Eq. (9)] The min-max formulation is clear, but the optimization order is not fully specified: the gradient for sigma is taken before each camouflage update, yet it is not stated whether the background noise is re-initialized for each viewpoint or accumulated across viewpoints. Please clarify.
  3. [Sec. 5.1, Table 1] There is a formatting error in Table 1: the entry '61,79' for ACTIVE at distance 10m, cloudy, should be '61.79'.
  4. [Sec. 5.2, last paragraph] The statement 'we primarily use partial coverage camouflage in this section, following [54, 55]' is helpful, but the claim that 'full-coverage camouflage, where PGA still outperforms other methods' is deferred to an appendix that is not included in the submitted text. Please either include the appendix or remove the reference to it.
  5. [Throughout] Several typos and awkward phrasings should be corrected: 'ragarded' in Sec. 4.2.2, 'presents' in Sec. 5.2 (should be 'present'), and inconsistent use of 'Dis' in Table 1 headers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PGA's attack is a direct white-box optimization of Gaussian SH coefficients against a detection loss, and its physical-deployment experiments provide independent evidence.

full rationale

The claimed derivation chain is an optimization, not a prediction-from-fit. The attack objective (Eq. 7) minimizes L_det over rendered images Idet from the 3DGS rasterizer, optimizing only zero-order SH coefficients (Eq. 14). Reporting low AP on the same victim detector is the standard, self-contained measure of attack success, not a tautology: the physical 1:24 and 1:1 experiments deploy the extracted texture and re-measure detection outside the optimization renderer, and the 1:24 comparison includes baselines, giving external content to the claim. The SuGaR regularization and the min-max background update are imported from external work or are explicit optimization heuristics, with no parameter fitted to the evaluation metric and then renamed a prediction. Self-citations ([14], [23], [24], [39], [42]) appear only in general related-work clusters and are not load-bearing for any central claim; no uniqueness theorem or ansatz is smuggled via self-citation. The digital evaluation may have a renderer-mismatch fairness concern (PGA optimized on 3DGS renderings versus baselines in CARLA's native renderer), but that is an experimental-protocol issue, not a circularity of derivation, and the physical results partially mitigate it. Accordingly, no circular step meets the evidentiary bar.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the fidelity of 3DGS reconstruction, on heuristic fixes for Gaussian occlusion, and on the validity of simulator and physical evaluations. Several reported hyperparameters are not given values, so the contribution includes substantial unstated tuning knobs.

free parameters (6)
  • epsilon (background perturbation budget)
    In Eq. (9), the min-max optimization constrains background noise by ||sigma||_inf <= epsilon; the value is not reported in the paper.
  • lambda (regularization weight)
    In Eq. (12), lambda weights the NPS, color, and SH-distance losses; the value is not reported.
  • learning rate eta
    Used for SH coefficient updates in Eq. (14); the value is not reported.
  • per-viewpoint iteration limit
    Used to skip over-optimized viewpoints in Sec. 4.2.2; the value is not reported.
  • top-k primary colors
    K-means clustering on background pixels selects the top-k colors for the color regularization term; k is not reported.
  • EoT transformation set
    Randomizations for scale, contrast, brightness, and noise are applied but the distribution parameters are not specified.
assumptions (5)
  • domain assumption 3DGS reconstruction from a few images accurately represents the target object and scene.
    The entire framework depends on the reconstructed Gaussians G matching the physical object; introduced in Sec. 4.1 Reconstruction module.
  • domain assumption SuGaR regularization aligns Gaussians with the object surface and prevents mutual occlusion.
    Section 4.2.1 adopts SuGaR loss terms as the fix for cross-view inconsistency; no evidence is given that the regularization fully achieves this alignment.
  • ad hoc to paper Optimizing only zero-order SH coefficients eliminates self-occlusion color variance.
    Section 4.2.1 proposes this without proof that view-dependent appearance is fully captured by zero-order terms; it is a heuristic modeling choice.
  • ad hoc to paper Background noise generated by I-FGSM within an epsilon budget simulates real background variation.
    Section 4.2.2 introduces the min-max update as a robustness heuristic; there is no theoretical guarantee that this noise distribution covers physical backgrounds.
  • domain assumption CARLA renders are a valid proxy for the physical world.
    Digital experiments reconstruct and evaluate in CARLA; physical experiments partially validate the proxy, but only for one or two vehicles and without full baseline comparison.

how reviews work

0 comments
Cite this review

Pith. "Pith review of 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation." pith.science (2026). https://pith.science/paper/2RPRMXUB

@misc{pith2026250701367,
  author       = {Pith},
  title        = {Pith review of: 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2RPRMXUB}},
  note         = {Machine review of arXiv:2507.01367}
}
read the original abstract

Physical adversarial attack methods expose the vulnerabilities of deep neural networks and pose a significant threat to safety-critical scenarios such as autonomous driving. Camouflage-based physical attack is a more promising approach compared to the patch-based attack, offering stronger adversarial effectiveness in complex physical environments. However, most prior work relies on mesh priors of the target object and virtual environments constructed by simulators, which are time-consuming to obtain and inevitably differ from the real world. Moreover, due to the limitations of the backgrounds in training images, previous methods often fail to produce multi-view robust adversarial camouflage and tend to fall into sub-optimal solutions. Due to these reasons, prior work lacks adversarial effectiveness and robustness across diverse viewpoints and physical environments. We propose a physical attack framework based on 3D Gaussian Splatting (3DGS), named PGA, which provides rapid and precise reconstruction with few images, along with photo-realistic rendering capabilities. Our framework further enhances cross-view robustness and adversarial effectiveness by preventing mutual and self-occlusion among Gaussians and employing a min-max optimization approach that adjusts the imaging background of each viewpoint, helping the algorithm filter out non-robust adversarial features. Extensive experiments validate the effectiveness and superiority of PGA. Our code is available at:https://github.com/TRLou/PGA.

Figures

Figures reproduced from arXiv: 2507.01367 by the authors.

Figure 1
Figure 1. Visualization of multi-view robust adversarial camou [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of mutual occlusion and self-occlusion issues [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Demonstration of the framework of PGA. First, the reconstruction module captures multi-view images to build a 3DGS scene. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualization comparison of multi-view detection results in the digital world. Green-bordered images indicate correct detection [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Visualization results from physical experiments on a 1:1 [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

66 extracted references · 45 canonical work pages

  1. [1]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Inter- national conference on machine learning , pages 284–293. PMLR, 2018. 2, 5

    work page 2018

  2. [2]

    Adversarial patch

    Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017. 1

    arXiv 2017

  3. [3]

    You can’t see me: Physical removal attacks on {lidar-based} au- tonomous vehicles driving frameworks

    Yulong Cao, S Hrushikesh Bhupathiraju, Pirouz Naghavi, Takeshi Sugawara, Z Morley Mao, and Sara Rampazzi. You can’t see me: Physical removal attacks on {lidar-based} au- tonomous vehicles driving frameworks. In32nd USENIX Se- curity Symposium (USENIX Security 23), pages 2993–3010,

    work page

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 1

    2017

  5. [5]

    An analysis of adversarial attacks and defenses on autonomous driving models

    Yao Deng, Xi Zheng, Tianyi Zhang, Chen Chen, Guannan Lou, and Miryung Kim. An analysis of adversarial attacks and defenses on autonomous driving models. In 2020 IEEE international conference on pervasive computing and com- munications (PerCom), pages 1–10. IEEE, 2020. 1

    work page 2020

  6. [6]

    Carla: An open urban driv- ing simulator

    Alexey Dosovitskiy, German Ros, Felipe Codevilla, Anto- nio Lopez, and Vladlen Koltun. Carla: An open urban driv- ing simulator. In Conference on robot learning, pages 1–16. PMLR, 2017. 2, 6

    work page 2017

  7. [7]

    Adversarial camouflage: Hiding physical-world attacks with natural styles

    Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A Kai Qin, and Yun Yang. Adversarial camouflage: Hiding physical-world attacks with natural styles. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1000–1008, 2020. 2

    work page 2020

  8. [8]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 1625–1634, 2018. 1, 2

    work page 2018

Show all 66 references
  1. [9]

    Advances in deep concealed scene understanding

    Deng-Ping Fan, Ge-Peng Ji, Peng Xu, Ming-Ming Cheng, Christos Sakaridis, and Luc Van Gool. Advances in deep concealed scene understanding. Visual Intelligence, 1(1):16,

  2. [10]

    Meta-attack: Class-agnostic and model-agnostic physical adversarial attack

    Weiwei Feng, Baoyuan Wu, Tianzhu Zhang, Yong Zhang, and Yongdong Zhang. Meta-attack: Class-agnostic and model-agnostic physical adversarial attack. In Proceedings of the IEEE/CVF international conference on computer vi- sion, pages 7787–7796, 2021. 2

    2021

  3. [11]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1

    2014 arXiv

  4. [12]

    A survey on transferability of adversar- ial examples across deep neural networks

    Jindong Gu, Xiaojun Jia, Pau de Jorge, Wenqain Yu, Xin- wei Liu, Avery Ma, Yuan Xun, Anjun Hu, Ashkan Khakzar, Zhijiang Li, et al. A survey on transferability of adversar- ial examples across deep neural networks. arXiv preprint arXiv:2310.17626, 2023. 1

    arXiv

  5. [13]

    Sugar: Surface- aligned gaussian splatting for efficient 3d mesh reconstruc- tion and high-quality mesh rendering

    Antoine Gu ´edon and Vincent Lepetit. Sugar: Surface- aligned gaussian splatting for efficient 3d mesh reconstruc- tion and high-quality mesh rendering. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5354–5363, 2024. 4

    2024

  6. [14]

    Generating transferable 3d adversarial point cloud via random perturbation factoriza- tion

    Bangyan He, Jian Liu, Yiming Li, Siyuan Liang, Jingzhi Li, Xiaojun Jia, and Xiaochun Cao. Generating transferable 3d adversarial point cloud via random perturbation factoriza- tion. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 764–772, 2023. 1

    2023

  7. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 1

    2016

  8. [16]

    Mask r-cnn

    Kaiming He, Georgia Gkioxari, Piotr Doll ´ar, and Ross Gir- shick. Mask r-cnn. In Proceedings of the IEEE international conference on computer vision, pages 2961–2969, 2017. 7

    2017

  9. [17]

    Nat- uralistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun- Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. Nat- uralistic physical adversarial patch for object detectors. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7848–7857, 2021. 1

    2021

  10. [18]

    Adversarial texture for fooling person detectors in the physical world

    Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling person detectors in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13307–13316, 2022. 2

    2022

  11. [19]

    Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling

    Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition , pages 16975–16984,

  12. [20]

    Universal physical camouflage attacks on object detectors

    Lifeng Huang, Chengying Gao, Yuyin Zhou, Cihang Xie, Alan L Yuille, Changqing Zou, and Ning Liu. Universal physical camouflage attacks on object detectors. In Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 720–729, 2020. 2

    2020

  13. [21]

    Towards transferable targeted 3d adversarial attack in the physical world

    Yao Huang, Yinpeng Dong, Shouwei Ruan, Xiao Yang, Hang Su, and Xingxing Wei. Towards transferable targeted 3d adversarial attack in the physical world. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24512–24522, 2024. 3

    2024

  14. [22]

    Adv-watermark: A novel watermark perturbation for adversarial examples

    Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Xiaoguang Han. Adv-watermark: A novel watermark perturbation for adversarial examples. In Proceedings of the 28th ACM inter- national conference on multimedia, pages 1579–1587, 2020. 1

    2020

  15. [23]

    Semantic-aligned adversarial evolution triangle for high-transferability vision- language attack

    Xiaojun Jia, Sensen Gao, Qing Guo, Ke Ma, Yihao Huang, Simeng Qin, Yang Liu, and Xiaochun Cao. Semantic-aligned adversarial evolution triangle for high-transferability vision- language attack. arXiv preprint arXiv:2411.02669, 2024

    2024 arXiv

  16. [24]

    Adversarial attacks against closed-source mllms via fea- ture optimal alignment

    Xiaojun Jia, Sensen Gao, Simeng Qin, Tianyu Pang, Chao Du, Yihao Huang, Xinfeng Li, Yiming Li, Bo Li, and Yang Liu. Adversarial attacks against closed-source mllms via fea- ture optimal alignment. arXiv preprint arXiv:2505.21494 ,

    arXiv

  17. [25]

    Neu- ral 3d mesh renderer

    Hiroharu Kato, Yoshitaka Ushiku, and Tatsuya Harada. Neu- ral 3d mesh renderer. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018. 2

    2018

  18. [26]

    3d gaussian splatting for real-time radiance field rendering

    Bernhard Kerbl, Georgios Kopanas, Thomas Leimk ¨uhler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering. ACM Trans. Graph., 42(4):139–1,

  19. [27]

    Segment any- thing

    Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer White- head, Alexander C Berg, Wan-Yen Lo, et al. Segment any- thing. In Proceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 4015–4026, 2023. 4

    2023

  20. [28]

    Environmen- tal matching attack against unmanned aerial vehicles object detection

    Dehong Kong, Siyuan Liang, and Wenqi Ren. Environmen- tal matching attack against unmanned aerial vehicles object detection. arXiv preprint arXiv:2405.07595, 2024. 1

    2024 arXiv

  21. [29]

    Patch is enough: naturalistic ad- versarial patch against vision-language pre-training models

    Dehong Kong, Siyuan Liang, Xiaopeng Zhu, Yuansheng Zhong, and Wenqi Ren. Patch is enough: naturalistic ad- versarial patch against vision-language pre-training models. Visual Intelligence, 2(1):1–10, 2024. 1

    2024

  22. [30]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In Artificial in- telligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018. 5

    2018

  23. [31]

    Adv3d: gener- ating 3d adversarial examples in driving scenarios with nerf

    Leheng Li, Qing Lian, and Ying-Cong Chen. Adv3d: gener- ating 3d adversarial examples in driving scenarios with nerf. arXiv preprint arXiv:2309.01351, 2023. 3

    2023 arXiv

  24. [32]

    Benchmarking adversarial patch against aerial detec- tion

    Jiawei Lian, Shaohui Mei, Shun Zhang, and Mingyang Ma. Benchmarking adversarial patch against aerial detec- tion. IEEE Transactions on Geoscience and Remote Sensing, 60:1–16, 2022. 1

    2022

  25. [33]

    Efficient adversarial attacks for visual object tracking

    Siyuan Liang, Xingxing Wei, Siyuan Yao, and Xiaochun Cao. Efficient adversarial attacks for visual object tracking. In Computer Vision–ECCV 2020: 16th European Confer- ence, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVI 16, 2020. 1

    2020

  26. [34]

    Gener- ate more imperceptible adversarial examples for object de- tection

    Siyuan Liang, Xingxing Wei, and Xiaochun Cao. Gener- ate more imperceptible adversarial examples for object de- tection. In ICML 2021 Workshop on Adversarial Machine Learning, 2021

    2021

  27. [35]

    A large-scale multiple- objective method for black-box attack against object detec- tion

    Siyuan Liang, Longkang Li, Yanbo Fan, Xiaojun Jia, Jingzhi Li, Baoyuan Wu, and Xiaochun Cao. A large-scale multiple- objective method for black-box attack against object detec- tion. In European Conference on Computer Vision, 2022

    2022

  28. [36]

    Parallel rectangle flip attack: A query-based black-box attack against object detection

    Siyuan Liang, Baoyuan Wu, Yanbo Fan, Xingxing Wei, and Xiaochun Cao. Parallel rectangle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970, 2022

    2022 arXiv

  29. [37]

    Ob- ject detectors in the open environment: Challenges, solu- tions, and outlook

    Siyuan Liang, Wei Wang, Ruoyu Chen, Aishan Liu, Boxi Wu, Ee-Chien Chang, Xiaochun Cao, and Dacheng Tao. Ob- ject detectors in the open environment: Challenges, solu- tions, and outlook. arXiv preprint arXiv:2403.16271, 2024. 1

    2024 arXiv

  30. [38]

    {X-Adv}: Physical adversarial object attacks against x-ray prohibited item detection

    Aishan Liu, Jun Guo, Jiakai Wang, Siyuan Liang, Renshuai Tao, Wenbo Zhou, Cong Liu, Xianglong Liu, and Dacheng Tao. {X-Adv}: Physical adversarial object attacks against x-ray prohibited item detection. In 32nd USENIX Security Symposium (USENIX Security 23), 2023. 1

    2023

  31. [39]

    Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds

    Tianrui Lou, Xiaojun Jia, Jindong Gu, Li Liu, Siyuan Liang, Bangyan He, and Xiaochun Cao. Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, ...

    2024

  32. [40]

    Nerf: Representing scenes as neural radiance fields for view syn- thesis

    Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view syn- thesis. Communications of the ACM , 65(1):99–106, 2021. 3

    2021

  33. [41]

    Universal adversarial perturba- tions

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturba- tions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1765–1773, 2017. 4

    2017

  34. [42]

    Adversarial instance attacks for interactions between human and object

    Liang Muxue, Chuan Wang, Siyuan Liang, Aishan Liu, Zeming Liu, Liang Yang, and Xiaochun Cao. Adversarial instance attacks for interactions between human and object. 1

  35. [43]

    Physical adversarial attacks for surveil- lance: A survey

    Kien Nguyen, Tharindu Fernando, Clinton Fookes, and Sridha Sridharan. Physical adversarial attacks for surveil- lance: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2023. 1

    2023

  36. [44]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in neural information process- ing systems, 28, 2015. 7

    2015

  37. [45]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and commu- nications security, pages 1528–1540, 2016. 2, 5

    2016

  38. [46]

    Seitz, and Richard Szeliski

    Noah Snavely, Steven M. Seitz, and Richard Szeliski. Photo tourism. ACM Transactions on Graphics , page 835–846,

  39. [47]

    Physical adversarial examples for object detectors

    Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernan- des, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In 12th USENIX workshop on offensive technolo- gies (WOOT 18), 2018. 2

    2018

  40. [48]

    Differential evolution based dual adversarial camouflage: Fooling human eyes and object detectors

    Jialiang Sun, Wen Yao, Tingsong Jiang, Donghua Wang, and Xiaoqian Chen. Differential evolution based dual adversarial camouflage: Fooling human eyes and object detectors. Neu- ral Networks, 163:256–271, 2023. 2

    2023

  41. [49]

    Dta: Physical camouflage attacks using differentiable transforma- tion network

    Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Ha- rashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. Dta: Physical camouflage attacks using differentiable transforma- tion network. In Proceedings of the IEEE/CVF Conference on Computer ...

    2022

  42. [50]

    Active: Towards highly transferable 3d physical camouflage for universal and robust vehicle evasion

    Naufal Suryanto, Yongsu Kim, Harashta Tatimma Larasati, Hyoeun Kang, Thi-Thu-Huong Le, Yoonyoung Hong, Hun- min Yang, Se-Yoon Oh, and Howon Kim. Active: Towards highly transferable 3d physical camouflage for universal and robust vehicle evasion. In Proceedings of the IEEE/CVF ...

    2023

  43. [51]

    Fooling automated surveillance cameras: adversarial patches to at- tack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedem´e. Fooling automated surveillance cameras: adversarial patches to at- tack person detection. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition work- shops, pages 0–0, 2019. 2

    2019

  44. [52]

    Attention is all you need

    A Vaswani. Attention is all you need. Advances in Neural Information Processing Systems, 2017. 1

    2017

  45. [53]

    Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack

    Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In Proceedings of the AAAI conference on artificial intelligence , p...

    2022

  46. [54]

    Dual attention suppression attack: Generate adversarial camouflage in physical world

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8565–8574, 2021...

    2021

  47. [55]

    Gener- ate transferable adversarial physical camouflages via triplet attention suppression

    Jiakai Wang, Xianglong Liu, Zixin Yin, Yuxuan Wang, Jun Guo, Haotong Qin, Qingtao Wu, and Aishan Liu. Gener- ate transferable adversarial physical camouflages via triplet attention suppression. International Journal of Computer Vi- sion, pages 1–17, 2024. 1, 2, 6, 7

    2024

  48. [56]

    Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack

    Ningfei Wang, Yunpeng Luo, Takami Sato, Kaidi Xu, and Qi Alfred Chen. Does physical adversarial example really matter to autonomous driving? towards system-level effect of adversarial object evasion attack. In Proceedings of the IEEE/CVF International Conference on Computer Vi...

    2023

  49. [57]

    Fooling aerial detectors by background attack via dual- adversarial-induced error identification

    Xiaofei Wang, Shaohui Mei, Jiawei Lian, and Yingjie Lu. Fooling aerial detectors by background attack via dual- adversarial-induced error identification. IEEE Transactions on Geoscience and Remote Sensing, 2024. 1

    2024

  50. [58]

    advpattern: Physical- world attacks on deep person re-identification via adversari- ally transformable patterns

    Zhibo Wang, Siyan Zheng, Mengkai Song, Qian Wang, Alireza Rahimpour, and Hairong Qi. advpattern: Physical- world attacks on deep person re-identification via adversari- ally transformable patterns. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pag...

    2019

  51. [59]

    Transferable adversarial attacks for image and video object detection

    Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641, 2018. 1

    2018 arXiv

  52. [60]

    Physical adversarial attack on vehicle detector in the carla simulator

    Tong Wu, Xuefei Ning, Wenshuo Li, Ranran Huang, Huazhong Yang, and Yu Wang. Physical adversarial attack on vehicle detector in the carla simulator. arXiv preprint arXiv:2007.16118, 2020. 2

    2007 arXiv

  53. [61]

    Adversarial t-shirt! evading person detectors in a physical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Meng- shu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Procee...

    2020

  54. [62]

    Camou: Learning physical vehicle camouflages to adversarially attack detectors in the wild

    Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. Camou: Learning physical vehicle camouflages to adversarially attack detectors in the wild. In International Conference on Learning Representations, 2018. 1, 2

    2018

  55. [63]

    Boosting transferability of physical attack against detectors by redistributing separable attention

    Yu Zhang, Zhiqiang Gong, Yichuang Zhang, Kangcheng Bin, Yongqian Li, Jiahao Qi, Hao Wen, and Ping Zhong. Boosting transferability of physical attack against detectors by redistributing separable attention. Pattern Recognition, 138:109435, 2023. 2

    2023

  56. [64]

    Rauca: A novel physical adversarial attack on vehicle detectors via robust and accurate camouflage generation

    Jiawei Zhou, Linye Lyu, Daojing He, and Yu Li. Rauca: A novel physical adversarial attack on vehicle detectors via robust and accurate camouflage generation. arXiv preprint arXiv:2402.15853, 2024. 1, 2, 3, 6, 7, 8

    2024 arXiv

  57. [65]

    Multiview consistent phys- ical adversarial camouflage generation through semantic guidance

    Heran Zhu and Dazhong Rong. Multiview consistent phys- ical adversarial camouflage generation through semantic guidance. In 2024 International Joint Conference on Neu- ral Networks (IJCNN), pages 1–8. IEEE, 2024. 2

    2024

  58. [66]

    Deformable detr: Deformable trans- formers for end-to-end object detection

    Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable detr: Deformable trans- formers for end-to-end object detection. arXiv preprint arXiv:2010.04159, 2020. 7

    2010 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.