Pith. sign in

REVIEW 5 major objections 5 minor 57 references

This paper claims that a $50 infrared flashlight and a printed film can make traffic-sign classifiers output attacker-chosen classes, with physical success rates up to 100%.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A printed transparent film illuminated by an infrared flashlight can reliably flip traffic sign classifications to attacker-chosen classes in digital and physical tests.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection The film-plus-lamp mechanism is a real step forward for physical IR attacks, but the bright-light robustness claim is contradicted by the paper's own Table III. the 5 major comments →

arxiv 2509.02042 v1 pith:LT6CRQ2T submitted 2025-09-02 cs.CR

Targeted Physical Evasion Attacks in the Near-Infrared Domain

Pascal Zimmer , Simon Lachnit , Alexander Jan Zielinski , Ghassan Karame This is my paper
classification cs.CR
keywords near-infrared adversarial attacktargeted physical attacktraffic sign recognitionblack-box optimizationmanypixel perturbationexpectation over transformationsinfrared cut filtersegmentation-based detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that adversarial infrared perturbations—projected onto a traffic sign by an off-the-shelf flashlight shining through a printed transparent film—can force a vision-based traffic-sign classifier to output a specific wrong class, not just any wrong class. Prior infrared and laser attacks were largely limited to untargeted disruptions; this work claims to be the first laser-free infrared attack that reliably achieves targeted label flips, including stop signs read as speed limits. The authors report physical attack success rates up to 100% across lighting levels, distances, angles, and a vehicle moving up to 30 km/h, with equipment costs under $50 and deployment in tens of seconds. They also propose a segmentation-based detector that catches their own attack with an F1-score up to 99%.

Core claim

The paper's central claim is that near-infrared light can carry a targeted adversarial perturbation cheaply and reliably. The attacker prints a pattern on transparent PET film, places it in front of an infrared lamp, and aligns the projected light with a traffic sign; the sign's surface outside the pattern receives extra infrared light and shifts in color, while the pattern itself stays at the ambient color. The optimization treats the pattern as a set of square 'manypixel' blocks and searches, via black-box random search and expectation over transformations, for the block layout that makes a classifier output the target class across realistic camera positions, distances, and brightness. In

What carries the argument

Manypixel (MP), a square block of neighboring pixels treated as one optimization unit, makes the perturbation manufacturable on film and shrinks the search space. The infrared transformation models the effect of adding infrared light as a channel-specific scaling of the red channel in CIELAB space, with scaling factors fit from lux measurements. Expectation over transformations (EOT) samples over perspective, distance, rotation, brightness, background, alignment, and motion-blur so the printed pattern works physically, not just digitally. Local random search then adds or removes a decaying number of manypixel blocks to minimize the margin loss, requiring no model gradients.

Load-bearing premise

The attack only works if the camera capturing the sign is sensitive to near-infrared light; if it has an infrared cut filter, the projected pattern never enters the image. The paper argues many production automotive cameras omit such filters, and the entire physical-world claim rests on that hardware premise.

What would settle it

Mount the same film-and-lamp setup in front of a sign and record it with a camera known to carry an infrared cut filter (e.g., a standard phone or webcam) under 1000 lux; if the classifier's output remains correct across all distances and angles, the attack's central physical claim fails for filtered cameras. A simpler measurable check is the spectral transmittance of the camera lens and sensor at 808–850 nm: if it is near zero, the perturbation is not recorded.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If correct, targeted physical attacks on traffic-sign recognition no longer require expensive infrared projectors or lasers: a $50 lamp, printed PET film, and tens of seconds of placement suffice.
  • Because the attack transfers across classifiers and camera sensors in the paper's tests, a single printed pattern could be prepared without direct access to the victim vehicle's model.
  • Existing defenses—spatial smoothing, adversarial training, certified patch masking, and laser-speckle detection—do not stop the attack; only the proposed segmentation-based defense reduces physical attack success to about 2% in static tests and 25% from a moving vehicle.
  • Both two-stage recognition pipelines (detector plus classifier) and single-stage detectors can be fooled, including hide attacks that make a sign undetected, extending the potential harm beyond misclassification.
  • The same setup is claimed applicable to other recognition tasks, such as face recognition, because the infrared transformation is not traffic-sign-specific.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Outside the paper, the decisive constraint is hardware: a camera with an infrared cut filter would render the attack ineffective, so the real-world relevance depends on how many deployed systems actually lack such filters and whether cost pressures keep them that way.
  • The segmentation-based defense suggests a concrete arms race: an attacker could optimize perturbation layouts to minimize the number of segmentation masks, or place the infrared output on edges already present, potentially dropping below the detector's threshold.
  • Because headlight glare on signs is legally capped around 22 lux at typical mounting heights, the attack may remain effective at night even with oncoming headlights; this legal-optical interaction is not tested at higher intensities and could be explored.
  • The method's transferability across model architectures implies it could be tested against commercial black-box systems through substitute-model or query-based attacks, though the authors only report open datasets and models.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes a physical, low-cost adversarial attack in the near-infrared domain for traffic sign recognition. The attacker prints a perturbation pattern on a transparent PET film, places it in front of an off-the-shelf infrared flashlight, and projects the pattern onto a target sign. The optimization uses a random-search black-box procedure over block-shaped 'manypixels', an empirically fitted additive IR channel model, and expectation-over-transformation to target both two-stage classifiers and single-stage detectors. Claims include targeted and untargeted attacks, transfer across models and sensors, physical success at up to 30 km/h, and a segmentation-based defense with F1 up to 99%. The paper also contributes an open-source IR traffic sign dataset (GTSRB-IR-100).

Significance. If the claims hold, the paper would be a useful advance in physical adversarial machine learning: it would demonstrate that a sub-$50, laser-free setup can mount targeted IR perturbations that are invisible to humans, with transferable black-box optimization, and with a credible countermeasure. The authors should be credited for performing physical experiments in indoor, outdoor, and moving-vehicle settings, for releasing source code and a dataset, and for comparing against prior black-box and white-box methods. However, the significance depends heavily on two premises: the target camera lacks an IR-cut filter, and the attack remains effective in bright daylight. The first premise is explicitly assumed rather than demonstrated, and the second is contradicted by the paper's own digital ablations. The defense evaluation also appears to select its threshold on the test data. These issues do not invalidate the low-light physical results but they materially narrow the advertised claims.

major comments (5)
  1. [Abstract; §V-A Table III; §V-C Table VIII] The abstract claims robustness 'across bright lighting conditions', and §IV-D calls the digital model a 'tight worst-case emulation'. But Table III shows a sharp, consistent collapse with illuminance: for GTSRB Scenario 1, ASR falls from 96.10% at 10 lux to 41.05% at 4000 lux and 4.67% at 5000 lux; Scenario 3 falls to 1.25% at 5000 lux; LISA Scenario 2 falls from 100% at 2000 lux to 56.80% at 5000 lux. The physical campaign in §V-C is run at ~1000 lux (Table VIII) and the headlight test in Figure 13 is at only ~22 lux at 9 m. Since daytime traffic scenes routinely exceed 4000–5000 lux, the paper's own model predicts failure in bright daylight. High-illuminance physical validation, or a substantive softening of the 'bright lighting' claim, is required.
  2. [§IV-A Eq. (8); §IV-D Table II; Appendix B] The validation of the IR model appears circular. The scaling factors ρ_c are fitted from the authors' own 100-image IR dataset (Eqs. 7–8), and the same dataset is then used in Table II to compare 'real-world' versus 'simulated' infrared perturbations. This does not establish a tight worst-case emulation for unseen sensors, lighting conditions, or signs. A held-out validation set, ideally with a different camera and independent lux values, is needed before the digital high-lux results can be treated as predictive of physical behavior. The current setup also cannot separate model error from attack optimization artifacts.
  3. [§III-A] The threat model assumes the target camera lacks an infrared cut filter and that the system is purely vision-based. This assumption is load-bearing: if the target camera has an IR-cut filter, the projected perturbation is not recorded at all. The paper cites vendor statements and patents, but does not provide direct measurement of deployed automotive cameras, teardown evidence, or spectral-response data for the specific sensors it claims are affected. The phrase 'like recent Tesla models' needs concrete support. I would request either direct spectral-response measurements of representative production camera modules or a clear restriction of the claimed applicability to cameras verified to lack IR filtering.
  4. [§VII-B; Table X; Figures 15–16] The defense threshold ν appears to be selected on the same data used for evaluation. The text says the threshold was 'interpolated ... experimentally based on the benign and perturbed traffic signs captured in our static experiments ... and from a moving vehicle', and the dataset description lists the very same static and moving captures as the evaluation set. Selecting ν on the test distribution biases the reported ASR (25.3%) and F1 (99%) optimistically. A separate calibration split, cross-validation, or a pre-specified threshold is needed before the defense numbers can be taken at face value.
  5. [§V-C, 'Driving vehicle'; Table VIII] The moving-vehicle ASR is computed over all cropped frames, but the paper does not define the cropping procedure, whether the sign must first be detected, or how frames with no sign/too-small sign are handled. Without a clean-frame baseline, the per-frame ASR may be inflated by frames in which the sign is out of view or too small to classify. Reporting trajectory-level success, per-perturbation ASR, and a benign moving-vehicle classification rate would make the 30 km/h claim more robust.
minor comments (5)
  1. [Fig. 6 and 7] The cell format (ASR over query count) is easy to misread; a legend or header explaining 'ASR / Q' inside each cell would improve clarity. There are also no confidence intervals or per-seed variability, despite the small sample of 25 images per class.
  2. [§IV-A, Fig. 3] The fitted ρ_c curves are shown without error bars or goodness-of-fit values. Given that Eq. (7) is the basis for all digital evaluations, reporting fit residuals and prediction intervals would strengthen the model.
  3. [§II / References] Reference [28] appears mislinked: the URL points to an ITU recommendation (H.273), while the cited title is a patent about image-sensor methods. Please verify the reference metadata.
  4. [§V-C] Physical experiments use ten perturbations per scenario. This is small for claiming 'up to 100%' robustness; standard errors or bootstrap confidence intervals would be useful.
  5. [Table III caption] The caption says 'five attack scenarios' but the table mixes two-stage (Scenarios 1–4) and single-stage (Scenario 5) columns with different model families. A short note in the caption explaining that the 'Lux' rows and 'Patches (k)' rows are separate ablations would reduce confusion.

Circularity Check

2 steps flagged

Core physical attack is independent and empirically grounded; two secondary results—the IR emulation 'validation' and the defense threshold—are in-sample and partly circular.

specific steps
  1. fitted input called prediction [Section IV-A (Eqs. 7-8) and Section IV-D / Table II]
    "To estimate the scaling parameter ρc for various ambient lighting intensities, we rely on empirical measurements. ... ρc = IRc − VISc / VISr ... We used these data points to fit channel-specific functions, as shown in Figure 3 to perform the transformation digitally. ... Our results, however, confirm that our infrared transformation provides a tight worst-case emulation of the real-world."

    The digital IR transform is parameterized by ρc, and ρc is computed from the same kind of ambient/ambient+IR image pairs that constitute the authors' own infrared traffic sign dataset used as the real-world reference in Table II. The digital ASR and the real-world ASR are therefore not independent measurements of the same phenomenon: the emulator is fit to the data against which it is validated, so the 'tight worst-case emulation' conclusion is an in-sample consistency check rather than a prediction.

  2. fitted input called prediction [Section VII-B, 'Determining ν', and Tables IX/X, Figures 15-16]
    "We interpolated the threshold ν on the number of detected shapes, i.e., |R|, experimentally based on the benign and perturbed traffic signs captured in our static experiments (diverse lighting conditions, distances), and from a moving vehicle. ... For the optimal threshold ν = 22, we obtain a CA = 100% and an ASR as low as 2.05% at an equal-error rate (EER) of ∼ 2% and an F1-score of 99%."

    The defense's only tunable parameter ν is selected by interpolating on exactly the same benign/adversarial images that are later used to draw the ROC curve and compute the reported EER/F1 in the same section. The 'F1-score of up to 99%' is the in-sample optimum of ν on the evaluation set, so the headline detection result is forced by the selection procedure rather than by an independent hold-out evaluation.

full rationale

The paper's main contribution—targeted infrared perturbations with physical ASR up to 100%—does not reduce to its own inputs: the optimization is a derivative-free random search over MP positions against a black-box classifier, and the physical success rates are measured directly on two CMOS cameras at various distances, angles, and vehicle speeds. There are no load-bearing self-citations, no imported uniqueness theorem, and no renamed known result. The circularity is confined to two secondary validations: (1) the IR emulator is calibrated with ρc from empirical image pairs and then 'confirmed' against the same measurement campaign, and (2) the segmentation defense selects ν on the evaluation set and reports the resulting F1. Both are in-sample and partly circular, but they do not by construction force the physical attack results, which remain the central independent claim. Overall score 4 reflects partial, secondary circularity without a circular central derivation.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 0 invented entities

The attack's central physical claim rests on a small set of empirical fits (infrared scaling, k, l, EOT ranges) and on the domain assumption that target cameras are near-infrared sensitive. The defense adds a threshold selected on the evaluation data. No invented physical entities such as new particles, forces, or mediators are introduced.

free parameters (5)
  • IR scaling factors rho_c(lux) = red/green/blue fitted curves over 100 to 6000 lux
    Equation (7) models the infrared channel as VIS_c + VIS_r * rho_c; rho_c is estimated from paired measurements in Section IV-A and is used for all digital attack simulations.
  • Manypixel count k = 192 for main digital results; 16 to 768 tested
    Selected by ablation in Section V-A; k = 192 with l = 2 is reported as striking the best ASR/query tradeoff.
  • Manypixel side length l = 2 pixels digital; 14 pixels physical
    Ablated in Figure 9 for digital experiments; l = 14 is chosen for physical experiments to make patterns visible to the camera.
  • EOT transformation ranges = +/-35 deg perspective, +/-6 deg rotation, +/-20% brightness, +/-5 px shift
    Hand-chosen justified ranges in Section IV-E; they are not derived from first principles and directly influence the optimized perturbation.
  • Defense threshold nu = 22 static, 9 moving
    Section VII.B interpolates nu on the same benign and adversarial images later used for F1 and ROC computation; no held-out selection procedure is reported.
axioms (6)
  • domain assumption Target camera has no infrared spectral filter
    Section III-A; if false, the infrared perturbation does not reach the classifier.
  • domain assumption Camera exposure and white balance adjustments change only the CIELAB L channel
    Section IV-A Normalize(); used to define the simulated infrared transform and is not validated across all cameras.
  • ad hoc to paper Infrared effect is additive and proportional to the red channel: IR_c = VIS_c + VIS_r * rho_c
    Equation (7); fitted to the authors' own dataset rather than derived from sensor physics.
  • domain assumption Manypixels can be approximated as squares whose side length divides image dimensions
    Section IV-A; required for the optimization and for printing the film pattern.
  • domain assumption ECE-R112 limits headlight illumination on traffic signs to about 22 lux at 9 meters
    Section V-C and Figure 13; used to argue that oncoming headlights do not wash out the infrared perturbation.
  • domain assumption The number of Segment Anything masks distinguishes benign from attacked signs
    Section VII.B; the proposed defense relies entirely on this distributional gap.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Targeted Physical Evasion Attacks in the Near-Infrared Domain." pith.science (2026). https://pith.science/paper/LT6CRQ2T

@misc{pith2026250902042,
  author       = {Pith},
  title        = {Pith review of: Targeted Physical Evasion Attacks in the Near-Infrared Domain},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LT6CRQ2T}},
  note         = {Machine review of arXiv:2509.02042}
}
Share X Bluesky LinkedIn Reddit HN
abstract

A number of attacks rely on infrared light sources or heat-absorbing material to imperceptibly fool systems into misinterpreting visual input in various image recognition applications. However, almost all existing approaches can only mount untargeted attacks and require heavy optimizations due to the use-case-specific constraints, such as location and shape. In this paper, we propose a novel, stealthy, and cost-effective attack to generate both targeted and untargeted adversarial infrared perturbations. By projecting perturbations from a transparent film onto the target object with an off-the-shelf infrared flashlight, our approach is the first to reliably mount laser-free targeted attacks in the infrared domain. Extensive experiments on traffic signs in the digital and physical domains show that our approach is robust and yields higher attack success rates in various attack scenarios across bright lighting conditions, distances, and angles compared to prior work. Equally important, our attack is highly cost-effective, requiring less than US\$50 and a few tens of seconds for deployment. Finally, we propose a novel segmentation-based detection that thwarts our attack with an F1-score of up to 99%.

Figures

Figures reproduced from arXiv: 2509.02042 by Alexander Jan Zielinski, Ghassan Karame, Pascal Zimmer, Simon Lachnit.

Figure 1
Figure 1. Figure 1: Overview of our system (icons from [1]). [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Definition of pixel positions (32 × 32) and a concrete perturbation for l = 7 and an image of w = h = 224. drawing of the MP along the contour of the mask, we define a transformation from the reduced coordinate space used for the MP back to the pixel coordinate space of the original input image. In the particular case of a square, this is achieved by adding the positions of all l 2 pixels within a single M… view at source ↗
Figure 4
Figure 4. Figure 4: Comparison of a real-world infrared light source (right), a simulated [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Selected iterations from our approach. Crossed hatches indicate the [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Optimization results for a two-stage architecture on the GTSRB [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 8
Figure 8. Figure 8: Overview of the targeted class flips in our scenarios with European [PITH_FULL_IMAGE:figures/full_fig_p008_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Perturbation width l vs. amount of perturbed pixels on GTSRB for Scenario 1 with the average in the last column. Each cell contains the ASR and query count. ∈ {10, 1000, 2000, 3000, 4000, 5000} and k = 192 (for the reasoning why, see next paragraph). In the case of GTSRB, we mostly observe ASR of more than 90% for lux values below 2000, except for the most challenging Scenario 3, where we reach an ASR arou… view at source ↗
Figure 10
Figure 10. Figure 10: Experimental environments with 1000 lux (avg.) on the sign surface. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png] view at source ↗
Figure 12
Figure 12. Figure 12: Infrared perturbation captured with two different camera sensors. [PITH_FULL_IMAGE:figures/full_fig_p012_12.png] view at source ↗
Figure 14
Figure 14. Figure 14: Output of our segmentation patched defense for a stop traffic sign. [PITH_FULL_IMAGE:figures/full_fig_p014_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Distribution of the segmentation masks for the benign (blue) and [PITH_FULL_IMAGE:figures/full_fig_p015_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: ROC curves for images taken in static and moving settings. [PITH_FULL_IMAGE:figures/full_fig_p015_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: Examples of different infrared absorbing films on a speed limit 20 [PITH_FULL_IMAGE:figures/full_fig_p017_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: Experimental setup used for capturing the [PITH_FULL_IMAGE:figures/full_fig_p017_18.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

57 extracted references · 54 canonical work pages

  1. [1]

    https://icons8.de/

    Icons by Icons8. https://icons8.de/

    work page

  2. [2]

    https://cleantechnica.com/tesla-sales/

    Tesla sales. https://cleantechnica.com/tesla-sales/

    work page

  3. [3]

    Regulation No 112 of the Economic Commission for Europe of the United Nations (UN/ECE) — Uniform provisions concerning the ap- proval of motor vehicle headlamps emitting an asymmetrical passing- beam or a driving-beam or both and equipped with filament lamps and/or light-emitting diode (LED) modules, August 2014

    work page 2014

  4. [4]

    Colorimetry – part 4: CIE 1976 L*a*b* colour space - ISO/CIE 11664- 4:2019(E). 2019

    work page 1976

  5. [5]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning , volume 80 of Proceedings of Machine Learning Research, pages 284–293. PMLR, 2018-07-10/2018-07-15

    work page 2018

  6. [6]

    Bingle, Joseph Camilleri, Peter J

    Robert L. Bingle, Joseph Camilleri, Peter J. Whitehead, and Kenneth Schofield. Imaging system for vehicle, June 2011

    work page 2011

  7. [7]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robust- ness of neural networks. In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017 , pages 39–57. IEEE Computer Society, 2017

    work page 2017

  8. [8]

    Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A. K. Qin, and Yun Yang. Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 997–1005, Seattle, W A, USA, June 2020. IEEE

    work page 2020

  9. [9]

    The mapillary traffic sign dataset for detection and classification on a global scale

    Christian Ertler, Jerneja Mislej, Tobias Ollmann, Lorenzo Porzi, Gerhard Neuhold, and Yubin Kuang. The mapillary traffic sign dataset for detection and classification on a global scale. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm, editors, Computer Vision – ECCV 2020 , pages 68–84, Cham, 2020. Springer International Publishing

    work page 2020

  10. [10]

    Robust Physical-World Attacks on Deep Learning Visual Classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust Physical-World Attacks on Deep Learning Visual Classification. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1625–1634, Salt Lake City, UT, USA, June 2018. IEEE. 15

    work page 2018

  11. [11]

    Ultralytics YOLOv8

    Glenn Jocher and Ayush Chaurasia and Jing Qiu. Ultralytics YOLOv8. https://github.com/ultralytics/ultralytics, 2023

    work page 2023

  12. [12]

    Goodfellow, Nicolas Papernot, and Patrick D

    Ian J. Goodfellow, Nicolas Papernot, and Patrick D. McDaniel. Cleverhans v0.1: An adversarial machine learning library. CoRR, abs/1610.00768, 2016

    Pith/arXiv arXiv 2016

  13. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann Le- Cun, editors, 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015

    work page 2015

  14. [14]

    VisionGuard: Secure and Robust Visual Perception of Autonomous Vehicles in Practice

    Xingshuo Han, Haozhao Wang, Kangqiao Zhao, Gelei Deng, Yuan Xu, Hangcheng Liu, Han Qiu, and Tianwei Zhang. VisionGuard: Secure and Robust Visual Perception of Autonomous Vehicles in Practice. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages 1864–1878, Salt Lake City UT USA, December 2024. ACM

    work page 2024

  15. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016 , pages 770–778. IEEE Computer Society, 2016

    work page 2016

  16. [16]

    Adver- sarial Laser Spot: Robust and Covert Physical-World Attack to DNNs

    Chengyin Hu, Yilong Wang, Kalibinuer Tiliwalidi, and Wen Li. Adver- sarial Laser Spot: Robust and Covert Physical-World Attack to DNNs. In Proceedings of The 14th Asian Conference on Machine Learning , pages 483–498. PMLR, April 2023

    work page 2023

  17. [17]

    Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision

    Xiaoyu Ji, Yushi Cheng, Yuepeng Zhang, Kai Wang, Chen Yan, Wenyuan Xu, and Kevin Fu. Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision. In 2021 IEEE Sympo- sium on Security and Privacy (SP) , pages 160–175, San Francisco, CA, USA, May 2021. IEEE

    work page 2021

  18. [18]

    Kennedy and R

    J. Kennedy and R. Eberhart. Particle swarm optimization. In Pro- ceedings of ICNN’95 - International Conference on Neural Networks , volume 4, pages 1942–1948 vol.4, 1995

    work page 1942

  19. [19]

    Berg, Wan-Yen Lo, Piotr Doll ´ar, and Ross Girshick

    Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C. Berg, Wan-Yen Lo, Piotr Doll ´ar, and Ross Girshick. Segment Any- thing. In 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 3992–4003, Paris, France, October 2023. IEEE

    work page 2023

  20. [20]

    Signal Injection Attacks against CCD Image Sensors

    Sebastian K ¨ohler, Richard Baker, and Ivan Martinovic. Signal Injection Attacks against CCD Image Sensors. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security , pages 294–308, Nagasaki Japan, May 2022. ACM

    work page 2022

  21. [21]

    Emergent visual sensors for autonomous vehicles

    You Li, Julien Moreau, and Javier Iba ˜nez-Guzm´an. Emergent visual sensors for autonomous vehicles. IEEE Transactions on Intelligent Transportation Systems, 24:4716–4737, 2023

    work page 2023

  22. [22]

    Light can be dangerous: Stealthy and effective physical-world adversarial attack by spot light

    Yufeng Li, Fengyu Yang, Qi Liu, Jiangtao Li, and Chenhong Cao. Light can be dangerous: Stealthy and effective physical-world adversarial attack by spot light. Computers & Security , 132:103345, 2023

    work page 2023

  23. [23]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 10012–10022, 2021

    work page 2021

  24. [24]

    A Convnet for the 2020s

    Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A Convnet for the 2020s. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11976–11986, 2022

    work page 2022

  25. [25]

    SLAP: Improving physical adversarial examples with Short-Lived adversarial perturbations

    Giulio Lovisotto, Henry Turner, Ivo Sluganovic, Martin Strohmeier, and Ivan Martinovic. SLAP: Improving physical adversarial examples with Short-Lived adversarial perturbations. In 30th USENIX Security Sym- posium (USENIX Security 21), pages 1865–1882. USENIX Association, August 2021

    work page 2021

  26. [26]

    Day-Night imaging without Infrared Cutfilter removal based on metal-gradient perovskite single crystal photodetector

    Yao Ma, Leting Shan, Yiran Ying, Liang Shen, Yufeng Fu, Linfeng Fei, Yusheng Lei, Nailin Yue, Wei Zhang, Hong Zhang, Haitao Huang, Kai Yao, and Junhao Chu. Day-Night imaging without Infrared Cutfilter removal based on metal-gradient perovskite single crystal photodetector. Nature Communications, 15(1):7516, August 2024

    work page 2024

  27. [27]

    Berkay Celik, and Ryan Gerdes

    Yanmao Man, Raymond Muller, Ming Li, Z. Berkay Celik, and Ryan Gerdes. That person moves like a car: Misclassification attack detection for autonomous systems using spatiotemporal consistency. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 6929–6946, Anaheim, CA, August 2023. USENIX Association

    work page 2023

  28. [28]

    Image method of image sensor, imag- ing apparatus and electronic device

    Shuijiang Mao and Xianqing Guo. Image method of image sensor, imag- ing apparatus and electronic device. https://www.itu.int/rec/T-REC-H. 273/en, December 2018

    work page 2018

  29. [29]

    Trivedi, and Thomas B

    Andreas Møgelmose, Mohan M. Trivedi, and Thomas B. Moeslund. Vision-based traffic sign detection and analysis for intelligent driver assistance systems: Perspectives and survey. IEEE Transactions on Intelligent Transportation Systems, 13:1484–1497, 2012

    work page 2012

  30. [30]

    Phantom of the ADAS: Securing Advanced Driver- Assistance Systems from Split-Second Phantom Attacks

    Ben Nassi, Yisroel Mirsky, Dudi Nassi, Raz Ben-Netanel, Oleg Drokin, and Yuval Elovici. Phantom of the ADAS: Securing Advanced Driver- Assistance Systems from Split-Second Phantom Attacks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communica- tions Security, pages 293–308, Virtual Event USA, October 2020. ACM

    work page 2020

  31. [31]

    Arora, Yuhang Wu, and Hao Yang

    Dinh-Luan Nguyen, Sunpreet S. Arora, Yuhang Wu, and Hao Yang. Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 3548–3556, Seattle, W A, USA, June 2020. IEEE

    work page 2020

  32. [32]

    Adversarial Imaging Pipelines

    Buu Phan, Fahim Mannan, and Felix Heide. Adversarial Imaging Pipelines. In 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16046–16056, Nashville, TN, USA, June 2021. IEEE

    work page 2021

  33. [33]

    The convergence of the random search method in the extremal control of a many parameter system

    LA Rastrigin. The convergence of the random search method in the extremal control of a many parameter system. Automaton & Remote Control, 24:1337–1342, 1963

    work page 1963

  34. [34]

    Girshick, and Jian Sun

    Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. Faster R- CNN: Towards real-time object detection with region proposal networks. In Corinna Cortes, Neil D. Lawrence, Daniel D. Lee, Masashi Sugiyama, and Roman Garnett, editors, Advances in Neural Information Processing Systems 28: Annual Conference on Neural Information Processing Systems 2015, D...

    work page 2015

  35. [35]

    Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception

    Takami Sato, Sri Hrushikesh Varma Bhupathiraju, Michael Clifford, Takeshi Sugawara, Qi Alfred Chen, and Sara Rampazzi. Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception. In Proceedings 2024 Network and Distributed System Security Symposium, San Diego, CA, USA, 2024. Internet Society

    work page 2024

  36. [36]

    Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect

    Athena Sayles, Ashish Hooda, Mohit Gupta, Rahul Chatterjee, and Ear- lence Fernandes. Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect. In 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 14661–14670, Nashville, TN, USA, June 2021. IEEE

    work page 2021

  37. [37]

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K. Reiter. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , pages 1528–1540, Vienna Austria, October 2016. ACM

    work page 2016

  38. [38]

    SoK: On the semantic AI security in autonomous driving

    Junjie Shen, Ningfei Wang, Ziwen Wan, Yunpeng Luo, Takami Sato, Zhisheng Hu, Xinyang Zhang, Shengjian Guo, Zhenyu Zhong, Kang Li, Ziming Zhao, Chunming Qiao, and Qi Alfred Chen. SoK: On the semantic AI security in autonomous driving. CoRR, abs/2203.05314, 2022

    Pith/arXiv arXiv 2022

  39. [39]

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 32:323–332, 2012

    work page 2012

  40. [40]

    Legitimate Adversarial Patches: Evading Human Eyes and Detection Models in the Physical World

    Jia Tan, Nan Ji, Haidong Xie, and Xueshuang Xiang. Legitimate Adversarial Patches: Evading Human Eyes and Detection Models in the Physical World. In Proceedings of the 29th ACM International Conference on Multimedia , pages 5307–5315, Virtual Event China, October 2021. ACM

    work page 2021

  41. [41]

    Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedeme. Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recog- nition Workshops (CVPRW), pages 49–55, Long Beach, CA, USA, June

    work page 2019

  42. [42]

    I Can See the Light: Attacks on Autonomous Vehicles Using Invisible Lights

    Wei Wang, Yao Yao, Xin Liu, Xiang Li, Pei Hao, and Ting Zhu. I Can See the Light: Attacks on Autonomous Vehicles Using Invisible Lights. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 1930–1944, Virtual Event Republic of Korea, November 2021. ACM

    work page 2021

  43. [43]

    HOTCOLD block: Fooling thermal infrared detectors with a novel wearable design

    Hui Wei, Zhixiang Wang, Xuemei Jia, Yinqiang Zheng, Hao Tang, Shin’ichi Satoh, and Zheng Wang. HOTCOLD block: Fooling thermal infrared detectors with a novel wearable design. In Brian Williams, Yiling Chen, and Jennifer Neville, editors, Thirty-Seventh AAAI Confer- ence on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applicati...

    work page 2023

  44. [44]

    Unified adversarial patch for cross-modal attacks in the physical world

    Xingxing Wei, Yao Huang, Yitong Sun, and Jie Yu. Unified adversarial patch for cross-modal attacks in the physical world. In IEEE/CVF In- ternational Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023 , pages 4422–4431. IEEE, 2023

    work page 2023

  45. [45]

    Physically Adversarial Infrared Patches with Learnable Shapes and Locations

    Xingxing Wei, Jie Yu, and Yao Huang. Physically Adversarial Infrared Patches with Learnable Shapes and Locations. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12334–12342, Vancouver, BC, Canada, June 2023. IEEE

    work page 2023

  46. [46]

    PatchCleanser: Certifiably robust defense against adversarial patches for any image classifier

    Chong Xiang, Saeed Mahloujifar, and Prateek Mittal. PatchCleanser: Certifiably robust defense against adversarial patches for any image classifier. In Kevin R. B. Butler and Kurt Thomas, editors, 31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022, pages 2065–2082. USENIX Association, 2022

    work page 2022

  47. [47]

    Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. In Proceedings 2018 Network and Distributed System Security Symposium , 2018

    work page 2018

  48. [48]

    PhyScout: Detecting Sensor Spoofing Attacks via Spatio- temporal Consistency

    Yuan Xu, Gelei Deng, Xingshuo Han, Guanlin Li, Han Qiu, and Tianwei Zhang. PhyScout: Detecting Sensor Spoofing Attacks via Spatio- temporal Consistency. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages 1879– 1893, Salt Lake City UT USA, December 2024. ACM

    work page 2024

  49. [49]

    GTSRB-CNN

    Vivek Yadav. GTSRB-CNN. https://github.com/vxy10/p2-TrafficSigns

    work page

  50. [50]

    Rolling colors: Adversarial laser exploits against traffic light recognition

    Chen Yan, Zhijian Xu, Zhanyuan Yin, Xiaoyu Ji, and Wenyuan Xu. Rolling colors: Adversarial laser exploits against traffic light recognition. In Kevin R. B. Butler and Kurt Thomas, editors, 31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022, pages 1957–1974. USENIX Association, 2022

    work page 2022

  51. [51]

    PhySense: Defending Physically Realizable Attacks for Autonomous Systems via Consistency Reasoning

    Zhiyuan Yu, Ao Li, Ruoyao Wen, Yijia Chen, and Ning Zhang. PhySense: Defending Physically Realizable Attacks for Autonomous Systems via Consistency Reasoning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages 3853–3867, Salt Lake City UT USA, December 2024. ACM

    work page 2024

  52. [52]

    CAPatch: Physical adversarial patch against image captioning systems

    Shibo Zhang, Yushi Cheng, Wenjun Zhu, Xiaoyu Ji, and Wenyuan Xu. CAPatch: Physical adversarial patch against image captioning systems. In 32nd USENIX Security Symposium (USENIX Security 23), pages 679– 696, Anaheim, CA, August 2023. USENIX Association

    work page 2023

  53. [53]

    Shadows can be Dangerous: Stealthy and Effective Physical- world Adversarial Attack by Natural Phenomenon

    Yiqi Zhong, Xianming Liu, Deming Zhai, Junjun Jiang, and Xiangyang Ji. Shadows can be Dangerous: Stealthy and Effective Physical- world Adversarial Attack by Natural Phenomenon. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15324–15333, New Orleans, LA, USA, June 2022. IEEE

    work page 2022

  54. [54]

    DeepBillboard: Systematic physical-world testing of autonomous driving systems

    Husheng Zhou, Wei Li, Zelun Kong, Junfeng Guo, Yuqun Zhang, Bei Yu, Lingming Zhang, and Cong Liu. DeepBillboard: Systematic physical-world testing of autonomous driving systems. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering, pages 347–358, Seoul South Korea, June 2020. ACM

    work page 2020

  55. [55]

    Invisible mask: Practical attacks on face recognition with infrared

    Zhe Zhou, Di Tang, Xiaofeng Wang, Weili Han, Xiangyu Liu, and Kehuan Zhang. Invisible mask: Practical attacks on face recognition with infrared. CoRR, abs/1803.04683, 2018

    Pith/arXiv arXiv 2018

  56. [56]

    Infrared Invisible Clothing: Hiding from Infrared Detectors at Multiple Angles in Real World

    Xiaopei Zhu, Zhanhao Hu, Siyuan Huang, Jianmin Li, and Xiaolin Hu. Infrared Invisible Clothing: Hiding from Infrared Detectors at Multiple Angles in Real World. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 13307–13316, New Orleans, LA, USA, June 2022. IEEE

    work page 2022

  57. [57]

    Fooling thermal infrared pedestrian detectors in real world using small bulbs

    Xiaopei Zhu, Xiao Li, Jianmin Li, Zheyao Wang, and Xiaolin Hu. Fooling thermal infrared pedestrian detectors in real world using small bulbs. In Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, Thirty-Third Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, the Eleventh Symposium on Educational Ad- vances in Ar...

    work page 2021

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.