Adversarial Patch Attack for Ship Detection via Localized Augmentation

Bingqian Zhu; Chun Liu; Hailong Wang; Jiayao Wang; Panpan Ding; Tao Xu; Zheng Zheng; Zhigang Han

REVIEW 4 major objections 4 minor 15 references

Adversarial Patch Attack for Ship Detection via Localized Augmentation

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Restricting training-time data augmentation to the ground-truth target regions, instead of transforming whole scenes, raises the attack success rate of printable adversarial patches against YOLOv5 ship detectors and improves their transfera

desk verdict Localized augmentation is a sensible small idea, but the paper's key empirical claim is undercut by a missing control and inconsistent results across model sizes. read the letter →

arxiv 2508.21472 v1 pith:3BYPMF56 submitted 2025-08-29 cs.CV

Chun Liu , Panpan Ding , Zheng Zheng , Hailong Wang , Bingqian Zhu , Tao Xu , Zhigang Han , Jiayao Wang This is my paper

classification cs.CV

keywords adversarialpatchlocaldataaugmentationattacktransferabilityshipdetectionremotesensingblack-boxobjectHRSC2016

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial patches—printable image fragments that can be stuck over a target to fool a detector—are typically made more transferable by training the surrogate detector with heavy data augmentation. This paper argues that for remote-sensing ship imagery, whole-image augmentation is counterproductive: transformations applied to water, ports, and other background pixels create spurious detections that have nothing to do with the patch and destabilize its optimization. The proposed fix applies the same augmentation operations only to the regions inside ground-truth ship boxes, leaving the rest of the scene untouched. On the HRSC2016 dataset, this localized augmentation raises attack success on the mid-size YOLOv5-M from a 42.0% baseline to 54.1% (versus 49.3% for global augmentation), and a patch trained on YOLOv5-M attacks the smaller YOLOv5-N at 49.9% success versus a 34.3% baseline—showing the trick pays off both in attack strength and in black-box transfer.

What carries the argument

The load-bearing mechanism is the localized augmentation module: a mask-based pipeline that computes the union of all ground-truth target regions R from the annotations (Eq. 2), independently transforms each region with a random operation Tj such as darkening, brightening, simulated rain, or blurring (Eq. 3), and re-fuses the altered regions with the original image via the mask M (Eq. 4). This is the only component that differs between the winning and losing ablation arms. The module's job is to present the patch optimizer with training images whose non-target pixels match deployment conditions, so every gradient update reflects the patch's effect on detection rather than artifacts of backgr

What would settle it

Train patches on YOLOv5-M with four augmentation placements: (a) transformations confined to the ground-truth ship boxes, (b) the same operations applied to equal-area boxes randomly placed in the background, (c) whole-image transformations, and (d) no augmentation. The mechanism predicts (b) behaves like (c) or worse and (a) stays clearly ahead. Separately, rerun (a) and (c) with the scene-intensity matching step (Eq. 5) disabled; if the gap collapses, intensity matching—not localization—is doing the work. Both checks are directly runnable in the paper's own HRSC2016 setup.

Watch

Extended reading notes

Core claim

The paper's central claim is that the standard practice of using data transformations to boost adversarial transferability misfires for patch attacks, because global augmentation disturbs background pixels that play no role in the attack and injects noise into the optimization. The authors propose localized augmentation: extract the target regions from the ground-truth boxes (Eq. 2), apply a randomly chosen weather, brightness, or blur transformation to each region independently (Eq. 3), and paste the transformed regions back over the original image using a mask (Eq. 4). This focuses the detection loss on what the patch does to the ship. The method is combined with a scene-intensity matching

Load-bearing premise

The improvement depends on the premise that global augmentation destabilizes patch optimization by disturbing background pixels, so that confining transformations to the ground-truth target boxes removes exactly that disturbance; if background noise is not the real source of instability, the reported advantage over global augmentation disappears.

Editorial extensions

If this is right

Existing patch-attack pipelines can adopt the improvement with one masking step—read the dataset's box annotations and restrict augmentation to those boxes—without changing the model or the loss.
The gain over global augmentation is largest on the mid-size detectors (YOLOv5-M: 54.1% vs 49.3% attack success), so the method should matter most for the model sizes actually deployed in operational maritime surveillance.
Transferability improves sharply for the YOLOv5-M-trained patch (34.3% to 49.9% attack success against YOLOv5-N), meaning a patch crafted once against a public detector can compromise smaller detectors the attacker never had access to.
The patch remains physically realizable—non-printability and total-variation losses are kept in the objective—so the measured gains should carry over to printed patches in the physical world, which the authors list as their next step.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial note: the paper never isolates its central mechanism. Section IV-F's ablation does not state whether the scene-intensity matching module (Eq. 5) is active in all three arms, so part of the gap between local and global augmentation could come from intensity matching rather than localization; toggling Eq. 5 in both settings would settle it.
Editorial note: one reported number appears to be a typo—the text says the YOLOv5-M-trained patch gains 5.4 points on YOLOv5-N, but Table III shows 49.9% versus a 34.3% baseline, a 15.6-point gain; the qualitative conclusion is unchanged. The paper also reuses the symbol Ltv for two different losses (Eq. 7 total variation, Eq. 8 detection loss).
The recipe is not ship-specific: any detector with box annotations could take localized augmentation, and the natural extensions are transformer-based or two-stage detectors and other object classes, where background-interference effects may differ.
Because each target box receives an independent random transformation, the per-object operation pool is a free diversity knob; enlarging it or applying multiple operations per box could widen the local-versus-global gap further, a cheap testable extension.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version: the paper proposes restricting data augmentation to annotation-defined target regions when optimizing adversarial patches for ship detectors. That's a reasonable, clearly motivated tweak to the standard global-augmentation recipe, and it does produce a real jump in ASR on YOLOv5-M (42 to 54) and in transferability to YOLOv5-N (34 to 50). You'll want to look at Table II carefully before believing the abstract's blanket claim, though.

What's new: applying augmentation only inside ground-truth boxes—as opposed to whole-image augmentation—is a legitimate extension of the transferability-boosting augmentations from refs 12-14, and I don't know of prior work doing exactly that. The method itself is simple and well explained: build a mask from the bounding boxes, apply random brightness/blur/rain transforms there, keep the patch optimization loop standard. The YOLOv5-M white-box result and the cross-model transfer to YOLOv5-N are the strongest evidence, and the paper honestly notes that the small YOLOv5-N model doesn't benefit.

The soft spots are mostly about experimental control and precision. The ablation in IV-F never states whether the environmental adaptation module (Eq. 5, contrast/brightness/noise matching) is active in all three conditions. Since that module is part of the proposed pipeline, the local augmentation condition could be benefiting from scene-intensity matching rather than from localization. That needs to be stated explicitly and ideally tested with a 2x2 ablation (augmentation: none/global/local, with and without environment matching). Without that, the central mechanism claim rests on an uncontrolled comparison.

Second, the claim that local augmentation 'consistently outperforms' is not true on the paper's own numbers: YOLOv5-N ASR is 58.0 vs 58.8 baseline, and transferability from YOLOv5-N drops to 31.3 vs 32.9. The abstract overstates the case. Third, there are no error bars or multiple seeds; the differences in some cells are 1-2 points, which could easily be noise. No code either. The transferability study is also limited to the YOLOv5 family.

None of this is a load-bearing fatal flaw. The idea is sensible, the writing is mostly clear (though the notation in Sec. III-C is sloppy, with Ltv used for both total variation and detection loss), and the paper doesn't engage in circular reasoning—white-box ASR measurement is standard. But the paper needs revision before it's a solid contribution: clarify the ablation, add seeds/error bars, and qualify the claims to match the data.

I'd send it to peer review with a request for those experiments. A reader working on physical patch attacks for remote sensing would want to see it, but the current version is more of a useful note than a definitive result. I wouldn't cite it in the next twelve months as-is.

Referee Report

4 major / 4 minor

Summary. The paper proposes a localized data augmentation method for generating adversarial patches against YOLOv5-based ship detectors in remote sensing imagery. Instead of augmenting the entire training image, the method extracts ground-truth target regions and applies random transformations (brightness, weather, blur) only within those regions, with the goal of reducing background interference so that the patch optimization focuses on the target. The framework also includes a scene intensity matching module and affine patch transformations, and optimizes a combined loss of detection loss, total variation, and non-printability. Experiments on HRSC2016 with three YOLOv5 variants (M, S, N) report attack success rate and transferability gains. The central claim is that localized augmentation improves attack success rate and transferability relative to global augmentation and no augmentation.

Significance. If the central claim is substantiated, the method would be a simple, low-cost improvement for printable adversarial patch attacks in a practical domain (ship detection in remote sensing). The paper uses a standard public dataset, compares against random noise patches, and covers three model scales, which are useful elements. However, the main empirical comparison is confounded by the environmental adaptation module, the reported improvements are not consistent across models, and no statistical evidence (error bars, multiple runs, significance tests) is provided. The paper does not include code or detailed hyperparameter settings, limiting reproducibility. The white-box same-model evaluation is not itself circular; ASR is measured on held-out test data, which is standard practice.

major comments (4)

[§IV-F and §III-B, Eq. (5)] The ablation that supports the central claim (Sec. IV-F, Table II) does not control for the environmental adaptation module. Eq. (5) performs scene contrast/brightness/noise matching, and Sec. III-B also describes affine patch transformations, both as part of the proposed pipeline. Sec. IV-F does not state whether these components are active in the baseline, global-augmentation, and local-augmentation arms. If Eq. (5) is enabled only for the local-augmentation condition, the reported gains (e.g., YOLOv5-M ASR 42.0%→54.1%) could be caused by intensity matching rather than by localizing the augmentation. Since the paper's mechanism claim is precisely that localization is what helps, this missing control is load-bearing. Please provide a factorial ablation (augmentation type × environment module on/off) or at minimum an explicit statement of the configuration used in each arm.
[§IV-F, Table II] The abstract and Sec. IV-F state that the localized method 'consistently outperforms' the baseline and 'effectively increases' attack success rate, but Table II contradicts this uniformity. For YOLOv5-N, local augmentation achieves ASR 58.0% versus 58.8% for the baseline, i.e., a decrease, and recall is essentially unchanged (35.7% vs 35.6%). For YOLOv5-S, the ASR gain is only 1.1 percentage point (49.3% vs 48.2%). Only YOLOv5-M shows a substantial improvement (54.1% vs 42.0%). No error bars or repeated runs are reported, so the small differences may be within run-to-run noise. The claim should be restricted to the models for which it holds, or additional evidence (multiple seeds, confidence intervals) should be provided.
[§IV-G, Table III] The transferability claim is based on selected favorable comparisons. In Table III, when YOLOv5-N is the source model, local augmentation lowers transfer ASR to YOLOv5-M (31.3% vs baseline 32.9%) and to YOLOv5-N itself (58.0% vs baseline 58.8%); the gain to YOLOv5-S is 1.3 points. When YOLOv5-M is the source, the improvement to YOLOv5-N (49.9% vs 34.3%) is much larger than the improvement to YOLOv5-S (38.3% vs 33.5%). The text acknowledges that trends are 'less evident' for the small model, but the abstract's unqualified statement that the method 'enhances transferability' is overbroad. Moreover, without error bars or multiple seeds, differences of 1–5 percentage points cannot be interpreted as statistically meaningful.
[§IV-D, §III-B] Several hyperparameters essential for reproducing the proposed pipeline are unspecified. In particular, the values or ranges of scene_c, scene_b, and scene_n in Eq. (5), the probability distribution over local augmentation operations in Eq. (3), and whether the affine patch transformations (scaling, rotation) are random per iteration or fixed are not reported. These details are needed both for reproducibility and for interpreting the ablation, because they determine the effective augmentation strength in each condition.

minor comments (4)

[§III-C, Eqs. (7)–(9)] There is a notation collision: Eq. (7) defines a total variation loss L_TV, Eq. (8) reuses L_tv for the detection loss, and Eq. (9) uses Ltv without clarifying which loss it refers to. Please rename one of them (e.g., L_det for the detection loss).
[§II, Eq. (1)] Eq. (1) presents the patch as applied at a fixed position M, but Sec. IV-D states that patch position is randomized during training. The notation would be clearer if Eq. (1) explicitly allowed a position-dependent or randomly sampled mask.
[§IV-D] The paper states 'The training process spans 200 epochs' but does not report the number of training images per epoch, batch size, or whether the 436 training images are used with any form of online augmentation beyond the proposed method. These details would improve reproducibility.
[General] The phrase 'avoiding any influence on non-target areas' in the abstract is too strong: the mask in Eq. (4) restricts augmentation to target pixels, but the patch itself is placed on the image and can affect the whole scene through the detector's receptive field. Suggest softening to 'avoiding direct augmentation of non-target pixels.'

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: all central claims are empirical comparisons with measured ASR.

full rationale

This paper makes no mathematical derivation that could be circular. Its central claim is an empirical comparison of attack success rates measured on held-out test images of HRSC2016. The local augmentation method is defined by Eqs. (2)-(4), and the claimed benefit is supported by Tables II and III; these tables report measured ASR values, not quantities computed from the method's own definitions. No parameter is fitted to the reported ASR and then renamed as a prediction. The white-box setting uses the same model for generation and evaluation, but that is the standard threat-model procedure, not a fitted-input problem. The paper contains no uniqueness theorem and no load-bearing self-citation; references are to prior attack/detection literature and the YOLOv5 implementation. The ablation in Section IV-F may be confounded because Section IV-F does not state whether the environmental adaptation module (Eq. 5) is active in all three arms; however, a missing control is an experimental-validity concern, not a circular derivation. The conclusion explicitly acknowledges that no physical-world tests were conducted and that ASR remains relatively low, which is a stated limitation rather than circular reasoning. Thus no circular step can be exhibited with the required quote-and-reduction standard.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The method relies on domain assumptions about dataset annotations, model representativeness, and loss design, plus several hand-set hyperparameters without sensitivity analysis. No new physical or conceptual entities are introduced.

free parameters (7)

alpha, beta, gamma = not reported
Loss weights in Eq. (9) balancing detection loss, total variation, and non-printability; hand-selected, no sensitivity analysis.
patch_size = 64x64
Initial patch size set in Section IV-D.
target_patch_size_ratio = 0.12
Ratio of patch to target bounding box, Section IV-D.
learning_rate = 0.03
Adam learning rate, Section IV-D.
offset_range = [-0.1, 0.1]
Randomized patch translation range, Section IV-D.
scene_c, scene_b, scene_n = unspecified ranges
Contrast, brightness, noise factors in Eq. (5); no values given.
min_object_area_fraction = 0.05%
Objects smaller than 0.05% of image area removed during preprocessing, Section IV-A.

assumptions (5)

domain assumption HRSC2016 annotations accurately delimit ship target regions
Section III-A uses label-derived regions r(y_k) to build masks; if labels are noisy, the local augmentation is misaligned.
domain assumption YOLOv5-N/S/M trained on HRSC2016 are representative ship detectors
Section IV-B treats these three variants as a sufficient benchmark; transferability is only assessed within YOLOv5.
domain assumption Max-confidence detection loss is a sufficient surrogate for degrading detector performance
Eq. (8) minimizes max confidence over all boxes; the paper does not validate that this correlates with recall/ASR.
domain assumption The selected augmentation operations (darkening, brightening, rainfall, blurring) span real environmental variation
Section III-A lists these operations without evidence that they match deployment conditions.
standard math Adam optimization of the composite loss converges to an effective patch
Section III-C assumes gradient-based optimization with the given losses yields useful patches; no convergence analysis.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Patch Attack for Ship Detection via Localized Augmentation." pith.science (2026). https://pith.science/paper/3BYPMF56

@misc{pith2026250821472,
  author       = {Pith},
  title        = {Pith review of: Adversarial Patch Attack for Ship Detection via Localized Augmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3BYPMF56}},
  note         = {Machine review of arXiv:2508.21472}
}

read the original abstract

Current ship detection techniques based on remote sensing imagery primarily rely on the object detection capabilities of deep neural networks (DNNs). However, DNNs are vulnerable to adversarial patch attacks, which can lead to misclassification by the detection model or complete evasion of the targets. Numerous studies have demonstrated that data transformation-based methods can improve the transferability of adversarial examples. However, excessive augmentation of image backgrounds or irrelevant regions may introduce unnecessary interference, resulting in false detections of the object detection model. These errors are not caused by the adversarial patches themselves but rather by the over-augmentation of background and non-target areas. This paper proposes a localized augmentation method that applies augmentation only to the target regions, avoiding any influence on non-target areas. By reducing background interference, this approach enables the loss function to focus more directly on the impact of the adversarial patch on the detection model, thereby improving the attack success rate. Experiments conducted on the HRSC2016 dataset demonstrate that the proposed method effectively increases the success rate of adversarial patch attacks and enhances their transferability.

Figures

Figures reproduced from arXiv: 2508.21472 by the authors.

**Figure 2.** Framework for generating adversarial patches based on local data augmentation [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Performance of YOLOv5-N for detecting ships from [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

15 extracted references · 12 canonical work pages

[1]

Ship detection and classification from optical remote sensing images: A survey

Bo Li, Xiaoyang Xie, Xingxing Wei, and Wenting Tang. Ship detection and classification from optical remote sensing images: A survey. Chinese Journal of Aeronautics , 34:145–163, 2021

work page 2021
[2]

Groupnet: Learning to group corner for object detection in remote sensing imagery

Ni Lei, Chunlei Huo, Xin Zhang, Peng Wang, and Zhixin Zhou. Groupnet: Learning to group corner for object detection in remote sensing imagery. Chinese Journal of Aeronautics , 35:273–284, 2022

work page 2022
[3]

Intriguing properties of neural networks

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013

arXiv 2013
[4]

Das, and Rammohan Mallipeddi

Arka Ghosh, Sankha Subhra Mullick, Shounak Datta, Swagatam Das, Asit Kr. Das, and Rammohan Mallipeddi. A black-box adversarial attack strategy with adjustable sparsity and generalizability for deep image classifiers. Pattern Recognition, 122:108279, 2022

work page 2022
[5]

Adversarial objectness gradient attacks in real-time object detection systems

Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Adversarial objectness gradient attacks in real-time object detection systems. In Proceedings of the 2020 IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) , pages 263–272. IEEE, 2020

work page 2020
[6]

Adversarial examples for semantic segmentation and object detection

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV) , pages 1369–1378, 2017

work page 2017
[7]

Robust Adversarial Perturbation on Deep Proposal-based Models

Yinpeng Li, Ding Tian, Ming-Ching Chang, Xiaoming Bian, and Siwei Lyu. Robust adversarial perturbation on deep proposal-based models. arXiv preprint arXiv:1809.05962 , 2018

work page Pith review arXiv 2018
[8]

Trans- ferable adversarial attacks for image and video object detection

Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Trans- ferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1807.12641, 2018

work page arXiv 2018

Show all 15 references

[9]

Adversarial patch

Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart ´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665 , 2017

2017 arXiv
[10]

Dpatch: An adversarial patch attack on object detectors

Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299, 2018

2018 arXiv
[11]

On physical adversarial patches for object detection

Mark Lee and Zico Kolter. On physical adversarial patches for object detection. arXiv preprint arXiv:1904.11897 , 2019

1904 arXiv
[12]

Boosting adversarial attacks with momentum

Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 9185–9193, 2018

2018
[13]

Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Q

Chuan Guo, Jacob R. Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Q. Weinberger. Simple black-box adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 476–485, 2020

2020
[14]

Hopcroft

Jiadong Lin, Chuanbiao Song, Kaichen He, Lizhen Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adver- sarial attacks. In International Conference on Learning Representations (ICLR), 2020

2020
[15]

ultralytics/yolov5: v6.1 - tensorrt, tensorflow edge tpu and openvino export and inference

Glenn Jocher, Ayush Chaurasia, Adam Stoken, et al. ultralytics/yolov5: v6.1 - tensorrt, tensorflow edge tpu and openvino export and inference. Zenodo, 2022

2022

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Ship detection and classification from optical remote sensing images: A survey

Bo Li, Xiaoyang Xie, Xingxing Wei, and Wenting Tang. Ship detection and classification from optical remote sensing images: A survey. Chinese Journal of Aeronautics , 34:145–163, 2021

work page 2021

[2] [2]

Groupnet: Learning to group corner for object detection in remote sensing imagery

Ni Lei, Chunlei Huo, Xin Zhang, Peng Wang, and Zhixin Zhou. Groupnet: Learning to group corner for object detection in remote sensing imagery. Chinese Journal of Aeronautics , 35:273–284, 2022

work page 2022

[3] [3]

Intriguing properties of neural networks

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013

arXiv 2013

[4] [4]

Das, and Rammohan Mallipeddi

Arka Ghosh, Sankha Subhra Mullick, Shounak Datta, Swagatam Das, Asit Kr. Das, and Rammohan Mallipeddi. A black-box adversarial attack strategy with adjustable sparsity and generalizability for deep image classifiers. Pattern Recognition, 122:108279, 2022

work page 2022

[5] [5]

Adversarial objectness gradient attacks in real-time object detection systems

Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Adversarial objectness gradient attacks in real-time object detection systems. In Proceedings of the 2020 IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) , pages 263–272. IEEE, 2020

work page 2020

[6] [6]

Adversarial examples for semantic segmentation and object detection

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV) , pages 1369–1378, 2017

work page 2017

[7] [7]

Robust Adversarial Perturbation on Deep Proposal-based Models

Yinpeng Li, Ding Tian, Ming-Ching Chang, Xiaoming Bian, and Siwei Lyu. Robust adversarial perturbation on deep proposal-based models. arXiv preprint arXiv:1809.05962 , 2018

work page Pith review arXiv 2018

[8] [8]

Trans- ferable adversarial attacks for image and video object detection

Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Trans- ferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1807.12641, 2018

work page arXiv 2018