Pith. sign in

REVIEW 5 major objections 4 minor 4 cited by

Adversarial camera perturbations can make VLA robots violate physical safety constraints in most tested trials.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-05 10:55 UTC pith:JKYQVI2L

load-bearing objection Useful ISO-grounded safety benchmark and attack pipeline for VLA robots, but the headline ASR numbers are unverifiable until the safety thresholds and aggregation rule are reported. the 5 major comments →

arxiv 2509.03383 v1 pith:JKYQVI2L submitted 2025-09-03 cs.AI cs.RO

ANNIE: Be Careful of Your Robots

Yiyang Huang , Zixuan Wang , Zishen Wan , Yapeng Tian , Haobo Xu , Yinhe Han , Yiming Gan This is my paper
classification cs.AI cs.RO
keywords adversarial attacksembodied AI safetyvision-language-action modelsrobot manipulationISO/TS 15066safety violation taxonomyprojected gradient descentbenchmark
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Embodied AI robots increasingly act through vision-language-action (VLA) models, where camera images map directly to motor commands. This paper argues that safety failures in such systems should be judged not by task accuracy but by physical constraints borrowed from human-robot collaboration standards: minimum separation distance from humans when handling dangerous tools, speed limits, and forbidden collisions. To make that argument concrete, the authors build a benchmark of nine tabletop manipulation scenarios with 2,400 video-action sequences, and an attack framework that uses a trained 'attack leader' to turn a high-level unsafe goal into per-frame perturbation targets, then applies projected gradient descent to the input images. On two recent VLA policies, ACT and Baku, the attack pushes the robot into safety violations in more than half of trials across all three severity levels, and replaying attacked trajectories on a physical arm moved a knife toward a human in 4 of 10 trials. The stakes: if true, any deployment that uploads unauthenticated camera frames to a learned policy is a viable attack surface for physical harm.

Core claim

The central claim is that adversarial safety attacks on embodied AI are both definable and practically effective. The paper defines safety as three constraints derived from ISO/TS 15066 — a critical distance separating dangerous tools from humans, velocity limits on the end effector and manipulated objects, and a rule that contact never includes forbidden objects — and classifies violations into critical, dangerous, and risky. It then introduces ANNIE-Attack: an attack leader network that takes the current observation and the chosen violation category, and outputs a direction and scale in action space; adding that delta to the model's clean action gives a frame-level target, and PGD optimize

What carries the argument

Attack leader model: a small network that encodes the current visual observation (two camera views) and the requested attack category into a continuous attack embedding, then predicts a four-dimensional attack direction ({−1,0,1} per action channel) and a scalar attack scale. It is trained on the paper's Tibbers dataset with a cross-entropy direction loss plus a mean-squared scale loss. Its work in the argument is to solve the missing-label problem of video action attacks: instead of choosing arbitrary target actions frame by frame, the leader maps the long-horizon goal 'cause a critical/dangerous/risky violation' into a concrete action delta; that delta is added to the clean action to form

Load-bearing premise

The safety thresholds in the three constraint equations — Tcritical, the two velocity limits, and the forbidden-object set — are never assigned numeric values, so every attack success rate in the paper counts violations against rules the reader cannot independently check.

What would settle it

Fix the thresholds to explicit SI values drawn from ISO/TS 15066 (e.g., a specific stopping distance and speed limit), run the same ANNIE-Attack, and compare per-category attack success rate against clean, unattacked rollouts under identical thresholds; if clean rollouts already violate the chosen thresholds at comparable rates, the reported vulnerability is an artifact of threshold placement, and if attacked ASR collapses to the clean baseline, the claimed transferable vulnerability is not robust.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Any VLA robot that accepts camera frames over an untrusted channel — storage, memory, or network — inherits the attack surface; cloud offloading makes the threat realistic.
  • Safety-aware evaluation should replace task success rate with constraint-based metrics, and the paper's ASR/AC/AD/TSRC tuple gives a concrete starting point.
  • Action normalization matters for robustness: Min-Max normalized policies (Baku) amplify small perturbations, while mean-std normalization (ACT) dampens them, so normalization choice is a defensive lever.
  • Sparse adaptive attacks undermine the assumption that attackers need continuous frame access; ANNIE-ADAP attacks roughly every 3 frames on average yet keeps perfect ASR in the reported scenario.
  • Real-world transfer is possible: attacked trajectories replay on a physical UR3 arm, moving a held knife toward a human in 4 of 10 trials.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the safety rules become an enforceable test harness only if the thresholds in Eqs. 5–7 are fixed as concrete numeric values; an obvious follow-up is an ISO-derived threshold table that external auditors can apply.
  • The attack leader's per-scenario training suggests a scaling path the paper does not explore: a leader trained across many tasks may transfer to zero-shot scenarios, turning this from a benchmark-specific attack into a general policy vulnerability.
  • The reported normalization sensitivity implies a cheap defensive experiment — re-normalizing action outputs (z-score style) before execution and measuring ASR drop — that the paper does not run.
  • If regulators adopt physical-safety success criteria, the attack success rate under bounded perturbations could serve as a certification-style metric for VLA deployments.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes a safety taxonomy for embodied AI systems—critical, dangerous, and risky—grounded in ISO/TS 15066 and ISO 13855, and contributes ANNIE-Bench, a simulation benchmark of nine scenarios with 2,400 video-action sequences, and ANNIE-Attack, a white-box framework that uses an attack leader model to decompose long-horizon goals into frame-level targets before applying PGD. The attack is evaluated on ACT and Baku policies, with reported attack success rates (ASR) claimed to exceed 50% across safety categories, plus sparse and adaptive variants and a physical UR3 replay in which a knife is induced to approach a human in 4 of 10 trials. The paper also defines auxiliary metrics (Action Consistency, Action Deviation, Task Success Rate Change) and argues that current accuracy-based metrics are insufficient for embodied safety.

Significance. If the central claims hold, this is a useful step toward safety-centric evaluation of vision-language-action policies. The ISO-inspired taxonomy is a reasonable organizing principle, and the attack-leader decomposition is a sensible way to make long-horizon adversarial attacks tractable. The paper also ships code and a benchmark, reports an ablation of the attack leader, includes held-out test episodes, and attempts a physical validation; these are concrete strengths. However, the quantitative conclusions are currently load-bearing on unspecified safety thresholds and inconsistent aggregation rules, and the physical experiment is an open-loop replay rather than a closed-loop demonstration. These issues must be fixed before the headline claims can be accepted at face value.

major comments (5)
  1. [Sec. 3.1, Eqs. (5)-(7)] The ASR metric and the attack-leader training labels are defined by the inequalities in Eqs. (5)-(7), yet no numeric value is given for Tcritical, T_ee_dangerous, T_env_dangerous, or the forbidden-object sets in Eq. (7). There is also no mapping from ISO/TS 15066/ISO 13855 to these thresholds, and no statement about whether they were fixed a priori or calibrated after observing policy behavior. Since every headline ASR in Table 2 and the abstract inherits these constants, the quantitative claims are unverifiable as written. Please add explicit threshold values, their derivation from the standards, the episode-level counting rule (e.g., any violating frame vs. majority), and the aggregation rule across scenarios and models.
  2. [Abstract, Sec. 1, Table 2] There is a direct inconsistency in the central quantitative claim. The abstract says ASR 'exceeding 50% across all safety categories'; the introduction reports 52%/67%/50% for critical/dangerous/risky; and the plain averages of Table 2 are roughly 72% critical, 52% dangerous, and 50% risky for the two models combined (Baku alone: 83/60/53; ACT alone: 60/43/47). The paper never states which pooling or weighting produces these numbers, and 50% is not 'exceeding 50%'. With only 20 test sequences per scenario and no confidence intervals, rates like 0.1 and 0.3 are statistically weak. Please report per-scenario counts, exact aggregation, and uncertainty intervals.
  3. [Sec. 6.3] The real-world experiment applies the attack to collected vision-action sequences and replays them on a physical UR3 arm. This is open-loop: it does not run the perturbed images through the ACT policy online, so it shows that the recorded actions are executable, but not that the closed-loop policy would produce those unsafe actions when receiving adversarial frames. The claim of 'real-world impact' in the abstract and Sec. 9 is stronger than this evidence supports. Please either run the attack in a closed-loop experiment or explicitly describe the validation as replay of attacked trajectories.
  4. [Secs. 4.2-4.3, 5.3] The attack-leader labels and the ASR metric are both generated from the same threshold rules (Eqs. 5-7) without any external annotation or standard calibration. The benchmark is therefore internally consistent by construction, but it cannot independently validate the proposed safety definitions or establish that the measured violations correspond to real hazards. Please provide an independent validation step, such as human/expert annotation of violation severity or a documented calibration against ISO 15066 recommended separation distances and speed limits, or state this limitation explicitly.
  5. [Algo. 1, Sec. 5.2-5.3, Sec. 8] Several load-bearing implementation details are missing: the PGD budget epsilon, number of iterations N and step size alpha in Algorithm 1; the architecture/hyperparameters of the attack leader besides lambda=0.5; and the adaptive sparse-attack threshold. Additionally, Sec. 6.1 trains a dedicated attack leader per scenario and Sec. 8 admits that the framework 'struggles to generalize to unseen tasks'. This does not invalidate the results, but it significantly narrows the scope of the 'systematic study' claim. Please add the missing parameters and move the generalization caveat into the abstract/contributions.
minor comments (4)
  1. [Throughout] Typos and language errors should be corrected ('Tybe C', 'that it', 'inference the attack', 'EAI systems-a robot-by'), and the notation in Eq. (1) should be made consistent (phi vs. Phi).
  2. [Fig. 5a, Sec. 4.2] Fig. 5a plots ASR and AD together despite different scales; please use separate axes or normalized values. The AC/AD columns in Table 2 lack units and a caption-level statement of the 'lower is better' convention.
  3. [Sec. 7] The 'first systematic study' claim would be easier to evaluate with a direct comparison table against cited works (e.g., [11], [73], [76]), listing threat model, attack surface, safety metric, and whether physical execution is demonstrated.
  4. [Eq. (8)] The Mahalanobis ratio in Eq. (8) is difficult to parse; the placement of the norm and the exponent should be cleaned up.

Circularity Check

1 steps flagged

Partial circularity: attack leader training labels and the ASR metric are both defined by the same, unspecified safety-constraint thresholds.

specific steps
  1. self definitional [Sec. 4.2 (ASR definition) and Sec. 4.3 / Eq. (9) (Tibbers dataset), with Sec. 5.3 / Eq. (11) (attack leader loss)]
    "In our task, attack success rate refers to the percentage of instances where our safety constraint rules were violated during task completion. ... τ = {(ot, dt)} contains preceding states ot and attack guidelines dt to reach the goal of violating the safety constraints specified by the given attack type. ... The module is trained on the Tibbers datasets ... L = L_dir + λ·L_scale."

    The attack leader's supervised targets (direction and scale) are constructed to 'violate the safety constraints' of Eqs. 5-7, and the headline ASR metric counts violations of those exact same 'safety constraint rules.' Thus the training objective and the evaluation metric are both defined by the same thresholds—Tcritical, T_dangerous, and O_forbidden—for which no numeric values are ever given. The reported >50% ASR therefore primarily demonstrates that the attack leader can push states across boundaries defined by the same rules used to generate its own labels; the only independent content is the transfer to a held-out VLA policy, which is non-trivial but does not validate the safety definitions themselves. This is partial, not full, circularity.

full rationale

The paper's central empirical claim—ASR >50%—is not a pure tautology: it requires held-out VLA policies (ACT/Baku) to be fooled by PGD perturbations into actions that cross the safety boundaries, and the attack leader is only one component. The ablations (random direction 0.1, fixed direction 0.3, attack leader 0.5) show that the leader's guidance has independent predictive value, so the result is not forced by the loss alone. However, a definitional loop is present: the attack leader's training labels (Sec. 4.3) are generated to violate Eqs. 5-7, and the ASR metric (Sec. 4.2) counts violations of the same constraints. The thresholds in Eqs. 5-7 are never assigned numeric values, and no mapping from ISO/TS 15066 to these thresholds is provided, so the safety categories and attack labels are based on an unstated rule. Consequently, the evaluation cannot distinguish a genuinely unsafe trajectory from normal motion that happens to cross an arbitrary boundary. The abstract's 'exceeding 50% across all safety categories' also does not clearly match the per-cell ASRs in Table 2 (e.g., 0.1 for several cells), indicating an undeclared aggregation rule. These are validity and reproducibility threats rather than fatal circularity, because the experiments use held-out episodes and a separate policy model. Self-citations (e.g., Corki, Dadu-E, Karma, RoboMM) are not load-bearing for the main derivation, and the real-world replay experiment, while open-loop, is not itself circular. Score 4 reflects partial circularity: the benchmark is internally consistent by construction, but the central claim still has independent empirical content.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

No new physical entities are postulated. The paper introduces a benchmark, a dataset, and an attack-leader model, but these are software artifacts rather than entities requiring independent falsifiable evidence.

free parameters (5)
  • Critical distance threshold Tcritical = not reported
    Defines critical violations in Eq. 5; ASR depends directly on its value but no number is given.
  • Velocity thresholds T_ee_dangerous and T_env_dangerous = not reported
    Defines dangerous violations in Eq. 6; values absent from paper.
  • PGD perturbation budget epsilon and iteration count = not reported
    Algorithm 1 uses epsilon and N; both control attack success and visibility, no values given.
  • Attack leader loss weight lambda = 0.5
    Eq. 11; hand-set to balance direction and scale losses.
  • Sparse attack intervals and adaptive scale threshold = e.g., every 2 or 3 frames; threshold not reported
    Defines ANNIE-2, ANNIE-3, and ANNIE-ADAP; chosen heuristically.
axioms (5)
  • domain assumption ISO/TS 15066 and ISO 13855 safety limits are an appropriate model of safety for embodied VLA robots.
    Used in Secs. 2.1 and 3.1 to ground Eqs. 5-7; the paper does not justify why these industrial collaborative-robot standards transfer to general household EAI tasks.
  • domain assumption ManiSkill simulation dynamics and sensor outputs faithfully represent real physical interaction for the tested scenarios.
    Sec. 4.1 builds the whole benchmark on ManiSkill; the real-world experiment uses a different arm and replayed trajectories, so simulation fidelity is load-bearing.
  • domain assumption The attacker has white-box access to the VLA model during perturbation generation.
    Algorithm 1 runs PGD on VLA gradients; threat model in Sec. 3.2 only describes image tampering, and the black-box transfer result is 0.1 ASR, so white-box access is a key premise.
  • domain assumption The action space of delta position plus gripper is sufficient to capture safety-critical behavior.
    Eq. 10 defines the policy output used for all attack targets and safety evaluation; no force, torque, or joint-level safety checks are modeled.
  • standard math PGD is an effective standard optimization primitive.
    Used in Algorithm 1; standard prior result, not a concern.

pith-pipeline@v1.4.0-alltime-deepseek-medium · 21436 in / 13507 out tokens · 94272 ms · 2026-08-05T10:55:36.930004+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of ANNIE: Be Careful of Your Robots." pith.science (2026). https://pith.science/paper/JKYQVI2L

@misc{pith2026250903383,
  author       = {Pith},
  title        = {Pith review of: ANNIE: Be Careful of Your Robots},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JKYQVI2L}},
  note         = {Machine review of arXiv:2509.03383}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

The integration of vision-language-action (VLA) models into embodied AI (EAI) robots is rapidly advancing their ability to perform complex, long-horizon tasks in humancentric environments. However, EAI systems introduce critical security risks: a compromised VLA model can directly translate adversarial perturbations on sensory input into unsafe physical actions. Traditional safety definitions and methodologies from the machine learning community are no longer sufficient. EAI systems raise new questions, such as what constitutes safety, how to measure it, and how to design effective attack and defense mechanisms in physically grounded, interactive settings. In this work, we present the first systematic study of adversarial safety attacks on embodied AI systems, grounded in ISO standards for human-robot interactions. We (1) formalize a principled taxonomy of safety violations (critical, dangerous, risky) based on physical constraints such as separation distance, velocity, and collision boundaries; (2) introduce ANNIEBench, a benchmark of nine safety-critical scenarios with 2,400 video-action sequences for evaluating embodied safety; and (3) ANNIE-Attack, a task-aware adversarial framework with an attack leader model that decomposes long-horizon goals into frame-level perturbations. Our evaluation across representative EAI models shows attack success rates exceeding 50% across all safety categories. We further demonstrate sparse and adaptive attack strategies and validate the real-world impact through physical robot experiments. These results expose a previously underexplored but highly consequential attack surface in embodied AI systems, highlighting the urgent need for security-driven defenses in the physical AI era. Code is available at https://github.com/RLCLab/Annie.

Figures

Figures reproduced from arXiv: 2509.03383 by Haobo Xu, Yapeng Tian, Yiming Gan, Yinhe Han, Yiyang Huang, Zishen Wan, Zixuan Wang.

Figure 1
Figure 1. Figure 1: EAI safety levels include critical, dangerous and risky tasks. Ambiguous zones exist on the boundary of each level. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: ANNIE-Bench integrates nine diverse and complex scenes, including three different safety levels. Each safety level contains three different scenarios. In addition to visual observations, robot proprioceptive data, including joint angles, velocities, torques, and the end￾effector pose, can be retrieved. Tasks are loaded into the scene and placed at the center of the workspace. Including the use of dangerous… view at source ↗
Figure 3
Figure 3. Figure 3: ANNIE-Attack Framework. 5. ANNIE-Attack Framework 5.1. Challenges in Adversarial Attack on EAI Directly adapting adversarial attack strategies from clas￾sification and detection tasks to EAI systems is ineffective for two reasons. First, the execution model differs funda￾mentally. Traditional models, such as a classification model, typically follow a one-to-one input-output structure, where each input is a… view at source ↗
Figure 4
Figure 4. Figure 4: Pre-attack and post-attack action sequence comparison. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison of sparse attack and dense attack on [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Real World Experiment. The knife was first towards [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. From Failures to Supervision: DynamicEnvPlan for Robust Long-Horizon Embodied Planning

    cs.RO 2026-08 conditional novelty 6.0

    Training a VLM planner on recovery traces synthesized from perturbations and privileged corrections lifts dynamic household task success from 33.3% to 76.2%.

  2. Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

    cs.CR 2026-03 unverdicted novelty 6.0

    The survey organizes over 400 papers on embodied AI safety into a multi-level taxonomy and flags overlooked issues such as fragile multimodal fusion and unstable planning under jailbreaks.

  3. Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

    cs.CR 2026-03 accept novelty 6.0

    A multi-level taxonomy of risks, attacks, and defenses across the full embodied AI pipeline, synthesizing 500+ papers and flagging overlooked failure modes.

  4. Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

    cs.CR 2026-07 conditional novelty 5.5

    World-model-based embodied AI creates a predictive security boundary where attacks on data, sensors, imagination, ranking, and feedback can turn into unsafe physical action and false safety certificates.

Reference graph

Works this paper leans on

96 extracted references · 44 canonical work pages · cited by 3 Pith papers · 5 internal anchors

  1. [1]

    Safety of machinery — positioning of safeguards with respect to the approach of the human body, November 2024

    2024

  2. [2]

    Adversarial machine learning in wireless communications using rf data: A review, 12 2020

    Damilola Adesina, Chung-Chu Hsieh, Yalin Sagduyu, and Lijun Qian. Adversarial machine learning in wireless communications using rf data: A review, 12 2020

    2020

  3. [3]

    Safety assurance mechanisms of collab- orative robotic systems in manufacturing

    Zhu Ming Bi, Chaomin Luo, Zhonghua Miao, Bing Zhang, Wen-Jun Zhang, and Lihui Wang. Safety assurance mechanisms of collab- orative robotic systems in manufacturing. Robotics and Computer- Integrated Manufacturing, 67:102022, 2021

    2021

  4. [4]

    π0: A vision-language-action flow model for general robot control, 2024

    Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. π0: A vision-language-action flow model for general robot control, 2024. URL https://arxiv. org/abs/2410.24164 , 2024

    Pith/arXiv arXiv 2024

  5. [5]

    Rt-2: Vision-language-action models transfer web knowledge to robotic control

    Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebo- tar, Xi Chen, Krzysztof Choromanski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, et al. Rt-2: Vision-language-action models transfer web knowledge to robotic control. arXiv preprint arXiv:2307.15818, 2023

    Pith/arXiv arXiv 2023

  6. [6]

    Rt-1: Robotics transformer for real-world control at scale

    Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Joseph Dabis, Chelsea Finn, Keerthana Gopalakrishnan, Karol Haus- man, Alex Herzog, Jasmine Hsu, et al. Rt-1: Robotics transformer for real-world control at scale. arXiv preprint arXiv:2212.06817 , 2022

    Pith/arXiv arXiv 2022

  7. [7]

    Towards evaluating the robust- ness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

    2017

  8. [8]

    Gr-2: A generative video-language-action model with web-scale knowledge for robot manipulation

    Chi-Lam Cheang, Guangzeng Chen, Ya Jing, Tao Kong, Hang Li, Yifeng Li, Yuxiao Liu, Hongtao Wu, Jiafeng Xu, Yichu Yang, et al. Gr-2: A generative video-language-action model with web-scale knowledge for robot manipulation. arXiv preprint arXiv:2410.06158, 2024

    Pith/arXiv arXiv 2024

  9. [9]

    Towards Physically Realizable Adversarial Attacks in Embodied Vision Navigation

    Meng Chen, Jiawei Tu, Chao Qi, Yonghao Dang, Feng Zhou, Wei Wei, and Jianqin Yin. Towards physically-realizable ad- versarial attacks in embodied vision navigation. arXiv preprint arXiv:2409.10071, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  10. [10]

    Diffusion policy attacker: Crafting adversarial attacks for diffusion-based policies, 2024

    Yipu Chen, Haotian Xue, and Yongxin Chen. Diffusion policy attacker: Crafting adversarial attacks for diffusion-based policies, 2024

    2024

  11. [11]

    Manipulation facing threats: Evaluating physical vulnerabil- ities in end-to-end vision language action models

    Hao Cheng, Erjia Xiao, Chengyuan Yu, Zhao Yao, Jiahang Cao, Qiang Zhang, Jiaxu Wang, Mengshu Sun, Kaidi Xu, Jindong Gu, et al. Manipulation facing threats: Evaluating physical vulnerabil- ities in end-to-end vision language action models. arXiv preprint arXiv:2409.13174, 2024

    arXiv 2024

  12. [12]

    Diffusion policy: Visuomotor policy learning via action diffusion

    Cheng Chi, Zhenjia Xu, Siyuan Feng, Eric Cousineau, Yilun Du, Ben- jamin Burchfiel, Russ Tedrake, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion. The International Journal of Robotics Research , page 02783649241273668, 2023

    2023

  13. [13]

    Palm-e: An embodied multimodal lan- guage model

    Danny Driess, Fei Xia, Mehdi SM Sajjadi, Corey Lynch, Aakanksha Chowdhery, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, Wenlong Huang, et al. Palm-e: An embodied multimodal lan- guage model. 2023

    2023

  14. [14]

    Panda: The Collaborative Robot Arm

    Franka Emika. Panda: The Collaborative Robot Arm. Official product page for the Franka Emika Panda robot

  15. [15]

    Safety of machinery - safety-related parts of control systems, 2023

    International Organization for Standardization. Safety of machinery - safety-related parts of control systems, 2023. Part 1: General principles for design

    2023

  16. [16]

    Mobile aloha: Learning bimanual mobile manipulation with low-cost whole-body teleopera- tion

    Zipeng Fu, Tony Z Zhao, and Chelsea Finn. Mobile aloha: Learning bimanual mobile manipulation with low-cost whole-body teleopera- tion. arXiv preprint arXiv:2401.02117 , 2024

    Pith/arXiv arXiv 2024

  17. [17]

    Threedworld: A platform for in- teractive multi-modal physical simulation

    Chuang Gan, Jeremy Schwartz, Seth Alter, Damian Mrowca, Martin Schrimpf, James Traer, Julian De Freitas, Jonas Kubilius, Abhishek Bhandwaldar, Nick Haber, et al. Threedworld: A platform for in- teractive multi-modal physical simulation. In Thirty-fifth Conference on Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2021

    2021

  18. [18]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  19. [19]

    Countering adversarial images using input transforma- tions

    Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transforma- tions. arXiv preprint arXiv:1711.00117 , 2017

    Pith/arXiv arXiv 2017

  20. [20]

    Baku: An efficient transformer for multi-task policy learning

    Siddhant Haldar, Zhuoran Peng, and Lerrel Pinto. Baku: An efficient transformer for multi-task policy learning. In The Thirty-eighth Annual Conference on Neural Information Processing Systems

  21. [21]

    Llm-personalize: Aligning llm planners with human preferences via reinforced self-training for housekeeping robots

    Dongge Han, Trevor McInroe, Adam Jelley, Stefano V Albrecht, Peter Bell, and Amos Storkey. Llm-personalize: Aligning llm planners with human preferences via reinforced self-training for housekeeping robots. arXiv preprint arXiv:2404.14285 , 2024

    Pith/arXiv arXiv 2024

  22. [22]

    Interpreting adversarial examples in deep learning: A review

    Sicong Han, Chenhao Lin, Chao Shen, Qian Wang, and Xiaohong Guan. Interpreting adversarial examples in deep learning: A review. ACM Computing Surveys , 55(14s):1–38, 2023

    2023

  23. [23]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , June 2016

    2016

  24. [24]

    Practical attacks on deep neural networks by memory trojaning

    Xing Hu, Yang Zhao, Lei Deng, Ling Liang, Pengfei Zuo, Jing Ye, Yingyan Lin, and Yuan Xie. Practical attacks on deep neural networks by memory trojaning. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 40(6):1230–1243, 2020

    2020

  25. [25]

    V oxposer: Composable 3d value maps for robotic ma- nipulation with language models

    Wenlong Huang, Chen Wang, Ruohan Zhang, Yunzhu Li, Jiajun Wu, and Li Fei-Fei. V oxposer: Composable 3d value maps for robotic ma- nipulation with language models. arXiv preprint arXiv:2307.05973 , 2023

    Pith/arXiv arXiv 2023

  26. [26]

    Corki: Enabling real-time embodied ai robots via algorithm-architecture co- design

    Yiyang Huang, Yuhui Hao, Bo Yu, Feng Yan, Yuxin Yang, Feng Min, Yinhe Han, Lin Ma, Shaoshan Liu, Qiang Liu, et al. Corki: Enabling real-time embodied ai robots via algorithm-architecture co- design. arXiv preprint arXiv:2407.04292 , 2024

    Pith/arXiv arXiv 2024

  27. [27]

    Physical Intelligence, Kevin Black, Noah Brown, James Darpinian, Karan Dhabalia, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Manuel Y . Galliker, Dibya Ghosh, Lachy Groom, Karol Hausman, Brian Ichter, Szymon Jakubczak, Tim Jones, Liy- iming Ke, Devin LeBlanc, Sergey Levine, Adrian Li-Bell, Mohith Mothukuri, Suraj Nair, Karl Pert...

    2025

  28. [28]

    Robots and robotic de- vices — collaborative robots

    International Organization for Standardization. Robots and robotic de- vices — collaborative robots. Technical Report ISO/TS 15066:2016, International Organization for Standardization, Geneva, Switzerland, 2016

    2016

  29. [29]

    Safety of machinery: Positioning of safeguards with respect to the approach speeds of parts of the human body

    EN ISO13855. Safety of machinery: Positioning of safeguards with respect to the approach speeds of parts of the human body. International Organization for Standardization. Geneva , 2010

    work page 2010

  30. [30]

    Rlbench: The robot learning benchmark & learning en- vironment

    Stephen James, Zicong Ma, David Rovick Arrojo, and Andrew J Davison. Rlbench: The robot learning benchmark & learning en- vironment. IEEE Robotics and Automation Letters , 5(2):3019–3026, 2020

    work page 2020

  31. [31]

    Mining requirements from closed-loop control models

    Xiaoqing Jin, Alexandre Donz ´e, Jyotirmoy V Deshmukh, and Sanjit A Seshia. Mining requirements from closed-loop control models. In Proceedings of the 16th international conference on Hybrid systems: computation and control , pages 43–52, 2013

    work page 2013

  32. [32]

    Intel realsense stereoscopic depth cameras, 2017

    Leonid Keselman, John Iselin Woodfill, Anders Grunnet-Jepsen, and Achintya Bhowmik. Intel realsense stereoscopic depth cameras, 2017

    work page 2017

  33. [33]

    Openvla: An open-source vision-language- action model

    Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, et al. Openvla: An open-source vision-language- action model. arXiv preprint arXiv:2406.09246 , 2024

    Pith/arXiv arXiv 2024

  34. [34]

    Openvla: An open-source vision- language-action model

    Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan P Foster, Pannag R Sanketi, Quan Vuong, et al. Openvla: An open-source vision- language-action model. In 8th Annual Conference on Robot Learning

    work page

  35. [35]

    Ai2-thor: An interactive 3d environment for visual ai

    Eric Kolve, Roozbeh Mottaghi, Winson Han, Eli VanderBilt, Luca Weihs, Alvaro Herrasti, Matt Deitke, Kiana Ehsani, Daniel Gordon, Yuke Zhu, et al. Ai2-thor: An interactive 3d environment for visual ai. arXiv preprint arXiv:1712.05474 , 2017

    Pith/arXiv arXiv 2017

  36. [36]

    Spec- ification mining and robust design under uncertainty: A stochastic temporal logic approach

    Panagiotis Kyriakis, Jyotirmoy V Deshmukh, and Paul Bogdan. Spec- ification mining and robust design under uncertainty: A stochastic temporal logic approach. ACM Transactions on Embedded Computing Systems (TECS), 18(5s):1–21, 2019

    work page 2019

  37. [37]

    Safe human–robot collaboration for industrial settings: a survey

    Weidong Li, Yudie Hu, Yong Zhou, and Duc Truong Pham. Safe human–robot collaboration for industrial settings: a survey. Journal of Intelligent Manufacturing , 35(5):2235–2261, 2024

    work page 2024

  38. [38]

    Mcu: A task-centric framework for open-ended agent evaluation in minecraft

    Haowei Lin, Zihao Wang, Jianzhu Ma, and Yitao Liang. Mcu: A task-centric framework for open-ended agent evaluation in minecraft. arXiv preprint arXiv:2310.08367 , 2023

    Pith/arXiv arXiv 2023

  39. [39]

    Spatiotemporal attacks for embodied agents

    Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen J Maybank, and Dacheng Tao. Spatiotemporal attacks for embodied agents. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceed- ings, Part XVII 16 , pages 122–138. Springer, 2020

    work page 2020

  40. [40]

    Libero: Benchmarking knowledge transfer for lifelong robot learning

    Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng, Qiang Liu, Yuke Zhu, and Peter Stone. Libero: Benchmarking knowledge transfer for lifelong robot learning. Advances in Neural Information Processing Systems, 36:44776–44791, 2023

    2023

  41. [41]

    Exploring the robustness of decision-level through adversarial attacks on llm-based embodied models

    Shuyuan Liu, Jiawei Chen, Shouwei Ruan, Hang Su, and Zhaoxia Yin. Exploring the robustness of decision-level through adversarial attacks on llm-based embodied models. In Proceedings of the 32nd ACM International Conference on Multimedia , pages 8120–8128, 2024

    work page 2024

  42. [42]

    Delving into transferable adversarial examples and black-box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. CoRR, 2016

    work page 2016

  43. [43]

    Poex: Policy executable embodied ai jailbreak attacks

    Xuancun Lu, Zhengxian Huang, Xinfeng Li, Wenyuan Xu, et al. Poex: Policy executable embodied ai jailbreak attacks. arXiv preprint arXiv:2412.16633, 2024

    Pith/arXiv arXiv 2024

  44. [44]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017

    Pith/arXiv arXiv 2017

  45. [45]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018

    2018

  46. [46]

    Roco: Dialectic multi- robot collaboration with large language models

    Zhao Mandi, Shreeya Jain, and Shuran Song. Roco: Dialectic multi- robot collaboration with large language models. In 2024 IEEE International Conference on Robotics and Automation (ICRA) , pages 286–299. IEEE, 2024

    work page 2024

  47. [47]

    Mahalanobis distance

    Goeffrey J McLachlan. Mahalanobis distance. Resonance, 4(6):20– 26, 1999

    work page 1999

  48. [48]

    Calvin: A benchmark for language-conditioned policy learning for long-horizon robot manipulation tasks

    Oier Mees, Lukas Hermann, Erick Rosete-Beas, and Wolfram Bur- gard. Calvin: A benchmark for language-conditioned policy learning for long-horizon robot manipulation tasks. IEEE Robotics and Au- tomation Letters, 7(3):7327–7334, 2022

    work page 2022

  49. [49]

    Magnet: a two-pronged defense against adversarial examples

    Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pages 135– 147, 2017

    work page 2017

  50. [50]

    Embod- iedgpt: Vision-language pre-training via embodied chain of thought

    Yao Mu, Qinglong Zhang, Mengkang Hu, Wenhai Wang, Mingyu Ding, Jun Jin, Bin Wang, Jifeng Dai, Yu Qiao, and Ping Luo. Embod- iedgpt: Vision-language pre-training via embodied chain of thought. Advances in Neural Information Processing Systems , 36:25081– 25094, 2023

    work page 2023

  51. [51]

    Gemini 2 3d camera: Technical specifications, 2023

    Orbbec. Gemini 2 3d camera: Technical specifications, 2023. Ac- cessed: 2025-06-06

    work page 2023

  52. [52]

    Backdoor attack on deep neural networks triggered by fault injection attack on image sensor interface

    Tatsuya Oyama, Shunsuke Okura, Kota Yoshida, and Takeshi Fujino. Backdoor attack on deep neural networks triggered by fault injection attack on image sensor interface. In Proceedings of the 5th Workshop on Attacks and Solutions in Hardware Security , pages 63–72, 2021

    work page 2021

  53. [53]

    Adversarial examples created by fault injection attack on image sensor interface

    Tatsuya OY AMA, Kota YOSHIDA, Shunsuke OKURA, and Takeshi FUJINO. Adversarial examples created by fault injection attack on image sensor interface. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences , E107.A, 09 2023

    work page 2023

  54. [54]

    Red teaming the mind of the machine: A systematic evaluation of prompt injection and jailbreak vulnerabilities in llms

    Chetan Pathade. Red teaming the mind of the machine: A systematic evaluation of prompt injection and jailbreak vulnerabilities in llms. arXiv preprint arXiv:2505.04806 , 2025

    Pith/arXiv arXiv 2025

  55. [55]

    Watch-and- help: A challenge for social perception and human-ai collaboration

    Xavier Puig, Tianmin Shu, Shuang Li, Zilin Wang, Yuan-Hong Liao, Joshua B Tenenbaum, Sanja Fidler, and Antonio Torralba. Watch-and- help: A challenge for social perception and human-ai collaboration. In International Conference on Learning Representations (ICLR) , 2021

    work page 2021

  56. [56]

    Sayplan: Grounding large language models using 3d scene graphs for scalable robot task planning

    Krishan Rana, Jesse Haviland, Sourav Garg, Jad Abou-Chakra, Ian Reid, and Niko Suenderhauf. Sayplan: Grounding large language models using 3d scene graphs for scalable robot task planning. arXiv preprint arXiv:2307.06135, 2023

    Pith/arXiv arXiv 2023

  57. [57]

    Depth camera d435, US

    Intel RealSense. Depth camera d435, US. Accessed: 2024-11-26

    work page 2024

  58. [58]

    Hacking the Waveform: Generalized Wireless Adversarial Deep Learning

    Francesco Restuccia, Salvatore D’oro, Amani Al-Shawabka, Bruno Costa Rendon, Kaushik Roy Chowdhury, Stratis Ioannidis, and Tommaso Melodia. Hacking the waveform: Generalized wireless adversarial deep learning. ArXiv, abs/2005.02270, 2020

    work page internal anchor Pith review Pith/arXiv arXiv 2005

  59. [59]

    dalu robot, CN

    Dalu Robot. dalu robot, CN. Accessed: 2024-11-26

    work page 2024

  60. [60]

    Adaptive grippers - two-finger gripper, CA

    Robotiq. Adaptive grippers - two-finger gripper, CA. Accessed: 2024- 11-26

    work page 2024

  61. [61]

    Perceived safety in physical human– robot interaction—a survey

    Matteo Rubagotti, Inara Tusseyeva, Sara Baltabayeva, Danna Sum- mers, and Anara Sandygulova. Perceived safety in physical human– robot interaction—a survey. Robotics and Autonomous Systems , 151:104047, 2022

    work page 2022

  62. [62]

    Habitat: A platform for embodied ai research

    Manolis Savva, Abhishek Kadian, Oleksandr Maksymets, Yili Zhao, Erik Wijmans, Bhavana Jain, Julian Straub, Jia Liu, Vladlen Koltun, Jitendra Malik, et al. Habitat: A platform for embodied ai research. In Proceedings of the IEEE/CVF international conference on computer vision, pages 9339–9347, 2019

    2019

  63. [63]

    Llm-planner: Few-shot grounded planning for embodied agents with large language models

    Chan Hee Song, Jiaman Wu, Clayton Washington, Brian M Sadler, Wei-Lun Chao, and Yu Su. Llm-planner: Few-shot grounded planning for embodied agents with large language models. In Proceedings of the IEEE/CVF international conference on computer vision , pages 2998–3009, 2023

    work page 2023

  64. [64]

    Maniplvm-r1: Reinforcement learning for reasoning in embodied manipulation with large vision-language models, 2025

    Zirui Song, Guangxian Ouyang, Mingzhe Li, Yuheng Ji, Chenxi Wang, Zixiang Xu, Zeyu Zhang, Xiaoqing Zhang, Qian Jiang, Zhen- hao Chen, Zhongzhi Li, Rui Yan, and Xiuying Chen. Maniplvm-r1: Reinforcement learning for reasoning in embodied manipulation with large vision-language models, 2025

    work page 2025

  65. [65]

    DaDu-E: Rethinking the Role of Large Language Model in Robotic Computing Pipeline

    Wenhao Sun, Sai Hou, Zixuan Wang, Bo Yu, Shaoshan Liu, Xu Yang, Shuai Liang, Yiming Gan, and Yinhe Han. Dadu-e: Rethinking the role of large language model in robotic computing pipeline. arXiv preprint arXiv:2412.01663, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  66. [66]

    Maniskill3: Gpu parallelized robotics simulation and rendering for generalizable embodied ai, 2024

    Stone Tao, Fanbo Xiang, Arth Shukla, Yuzhe Qin, Xander Hinrichsen, Xiaodi Yuan, Chen Bao, Xinsong Lin, Yulin Liu, Tse kai Chan, Yuan Gao, Xuanlin Li, Tongzhou Mu, Nan Xiao, Arnav Gurha, Zhiao Huang, Roberto Calandra, Rui Chen, Shan Luo, and Hao Su. Maniskill3: Gpu parallelized robotics simulation and rendering for generalizable embodied ai, 2024

    work page 2024

  67. [67]

    Octo: An open-source generalist robot policy

    Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Tobias Kreiman, Charles Xu, et al. Octo: An open-source generalist robot policy. arXiv preprint arXiv:2405.12213 , 2024

    Pith/arXiv arXiv 2024

  68. [68]

    Universal robot 03 arm, DK

    Universal Robots. Universal robot 03 arm, DK. Accessed: 2024-11- 09

    work page 2024

  69. [69]

    Survey on human–robot collaboration in industrial settings: Safety, intuitive interfaces and applications

    Valeria Villani, Fabio Pini, Francesco Leali, and Cristian Secchi. Survey on human–robot collaboration in industrial settings: Safety, intuitive interfaces and applications. Mechatronics, 55:248–266, 2018

    work page 2018

  70. [70]

    Reca: Integrated acceleration for real-time and efficient cooperative embodied autonomous agents

    Zishen Wan, Yuhang Du, Mohamed Ibrahim, Jiayi Qian, Jason Jab- bour, Yang Zhao, Tushar Krishna, Arijit Raychowdhury, and Vi- jay Janapa Reddi. Reca: Integrated acceleration for real-time and efficient cooperative embodied autonomous agents. In Proceedings of the 30th ACM International Conference on Architectural Support for Programming Languages and Opera...

    work page 2025

  71. [71]

    Thinking and moving: An efficient computing approach for integrated task and motion planning in coop- erative embodied ai systems

    Zishen Wan, Yuhang Du, Mohamed Ibrahim, Yang Zhao, Tushar Krishna, and Arijit Raychowdhury. Thinking and moving: An efficient computing approach for integrated task and motion planning in coop- erative embodied ai systems. In Proceedings of the 43rd IEEE/ACM International Conference on Computer-Aided Design , pages 1–7, 2024

    work page 2024

  72. [72]

    Generative AI in Embodied Systems: System-Level Analysis of Performance, Efficiency and Scalability

    Zishen Wan, Jiayi Qian, Yuhang Du, Jason Jabbour, Yilun Du, Yang Katie Zhao, Arijit Raychowdhury, Tushar Krishna, and Vi- jay Janapa Reddi. Generative ai in embodied systems: System-level analysis of performance, efficiency and scalability. arXiv preprint arXiv:2504.18945, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  73. [73]

    Exploring the adversarial vulnerabilities of vision- language-action models in robotics

    Taowen Wang, Cheng Han, James Chenhao Liang, Wenhao Yang, Dongfang Liu, Luna Xinyu Zhang, Qifan Wang, Jiebo Luo, and Ruixiang Tang. Exploring the adversarial vulnerabilities of vision- language-action models in robotics. arXiv preprint arXiv:2411.13587, 2024

    Pith/arXiv arXiv 2024

  74. [74]

    Karma: Augmenting embodied ai agents with long-and-short term memory systems

    Zixuan Wang, Bo Yu, Junzhe Zhao, Wenhao Sun, Sai Hou, Shuai Liang, Xing Hu, Yinhe Han, and Yiming Gan. Karma: Augmenting embodied ai agents with long-and-short term memory systems. arXiv preprint arXiv:2409.14908, 2024

    Pith/arXiv arXiv 2024

  75. [75]

    How Secure Are Large Language Models (LLMs) for Navigation in Urban Environments?

    Congcong Wen, Jiazhao Liang, Shuaihang Yuan, Hao Huang, and Yi Fang. How secure are large language models (llms) for navigation in urban environments? arXiv preprint arXiv:2402.09546 , 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  76. [76]

    On the safety concerns of deploying llms/vlms in robotics: Highlighting the risks and vulnerabilities

    Xiyang Wu, Ruiqi Xian, Tianrui Guan, Jing Liang, Souradip Chakraborty, Fuxiao Liu, Brian M Sadler, Dinesh Manocha, and Amrit Bedi. On the safety concerns of deploying llms/vlms in robotics: Highlighting the risks and vulnerabilities. In First Vision and Language for Autonomous Driving and Robotics Workshop , 2024

    work page 2024

  77. [77]

    Embodied task planning with large language models

    Zhenyu Wu, Ziwei Wang, Xiuwei Xu, Jiwen Lu, and Haibin Yan. Embodied task planning with large language models. arXiv preprint arXiv:2307.01848, 2023

    Pith/arXiv arXiv 2023

  78. [78]

    Sapien: A simulated part-based interactive environment

    Fanbo Xiang, Yuzhe Qin, Kaichun Mo, Yikuan Xia, Hao Zhu, Fangchen Liu, Minghua Liu, Hanxiao Jiang, Yifu Yuan, He Wang, et al. Sapien: A simulated part-based interactive environment. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11097–11107, 2020

    work page 2020

  79. [79]

    Adversarial examples improve image recognition

    Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le. Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 819–828, 2020

    work page 2020

  80. [80]

    Mitigating adversarial effects through randomization

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991, 2017

    Pith/arXiv arXiv 2017

Showing first 80 references.