Pith. sign in

REVIEW 3 major objections 4 minor 51 references

A beam-search “road trip” of intermediate GPS targets turns tiny image noise into a far more reliable way to hide location from geolocalization models.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-12 03:34 UTC pith:2RB3Z7GC

load-bearing objection Solid empirical attack that turns geographic intermediate targets + beam search into a clear win over PGD and GeoShield at low budgets. the 3 major comments →

arxiv 2607.03277 v1 pith:2RB3Z7GC submitted 2026-07-03 cs.CV

Defending from GeoLocalization through Adversarial Road Trips

Niccol\`o Niccoli , Federico Becattini , Lorenzo Seidenari This is my paper
classification cs.CV
keywords adversarial attackimage geolocalizationprivacybeam searchtransferabilityGeoCLIPRoadTrip Attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Modern retrieval-based geolocalization can pin an image to a country or region, raising privacy and safety risks. This paper shows that the usual gradient attacks (PGD, FGSM, Carlini-Wagner) are surprisingly weak against these models when the allowed noise is tiny. The authors reframe the attack as a short journey: at each step they sample a handful of intermediate GPS points inside a shrinking disk around the attacker-chosen target, run a few projected-gradient steps toward each of them, keep only the K best candidates, and repeat. The resulting “RoadTrip Attack” fools GeoCLIP far more often than the baselines, transfers in black-box fashion to two other state-of-the-art systems, and does so with visibly less perceptual damage. The practical claim is that ordinary users can now add imperceptible noise that reliably steers geolocalization models away from the true place and toward a distant false destination.

Core claim

Sampling intermediate geographic targets whose radius shrinks with remaining Haversine distance, then retaining only the top-K beam of adversarial candidates, yields optimization trajectories that systematically escape the poor local minima that trap ordinary PGD, producing higher target accuracy and lower residual ground-truth accuracy at the same tiny noise budget.

What carries the argument

RoadTrip Attack (Algorithm 1): an adaptive-radius beam search over intermediate GPS targets that interleaves projected-gradient steps with geographic pruning, turning a single targeted attack into a short sequence of easier sub-targets.

Load-bearing premise

The geometric heuristic that intermediate targets drawn uniformly inside a disk of radius half the remaining distance, kept by beam search, will reliably find better paths than direct gradient descent.

What would settle it

On the same GeoCLIP / Im2GPS3k setup with ε = 2/255, replace the adaptive geographic sampling by multi-start or random-restart PGD of equal wall-clock budget and show that target accuracy at 1 km and residual ground-truth accuracy at 2500 km become statistically indistinguishable from RTA.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces RoadTrip Attack (RTA), a targeted adversarial attack on retrieval-based image geolocalization. It frames the problem as constructing a sequence of intermediate geographic targets via beam search: at each step intermediate locations are sampled uniformly inside a disk of radius proportional to the remaining Haversine distance to a distant attacker-chosen target, PGD-style perturbations are optimized toward those locations under an L_inf budget, and only the top-K candidates (by distance to the final target) are retained. White-box experiments on GeoCLIP with Im2GPS3k and YFCC4k, plus black-box transfer to Img2Loc and G3, claim substantially higher target accuracy and lower ground-truth accuracy than FGSM, PGD, CW and the geolocalization-specific GeoShield baseline, especially at ε=2/255, while producing lower LPIPS / higher PSNR artifacts.

Significance. Privacy risks of modern geolocalization models are real and under-studied; only one prior dedicated attack (GeoShield) exists. If the reported gains hold, RTA supplies a practical, low-budget, transferable defense tool that is both more effective and less perceptible than existing alternatives. Strengths include the controlled PGD-variant ablations (Table 3) that isolate the geographic beam-search component, multi-threshold ACC_GT / ACC_Target metrics, black-box transfer across architectural paradigms, and the supplementary nearest-neighbor analysis of internal representations. The work is therefore a solid empirical contribution to adversarial geo-privacy.

major comments (3)
  1. §3.2 and Algorithm 1: intermediate targets are always drawn from a disk centered at the final target x_T (radius η·G(current,x_T)). Consequently the sequence of predicted locations is a successive refinement near x_T rather than a geographic path connecting the source to the target. The “road-trip / distractor journey” framing used in the abstract, introduction and Figure 1 is therefore somewhat misleading; a more precise geometric description would better match the actual procedure without diminishing the empirical results.
  2. §4.4 / Tables 4–5: only ACC_GT is reported for black-box transfer because GeoShield is untargeted. For RTA itself, ACC_Target (or at least the distribution of final predicted locations) should also be given; without it the claim of “highly transferable targeted attacks” rests solely on untargeted success rates and is harder to assess.
  3. §5: the privacy motivation is central, yet no evaluation against even the simplest defenses listed as future work (JPEG compression, feature squeezing, etc.) is provided. A minimal set of such experiments would make the practical claims more robust for a journal audience.
minor comments (4)
  1. Notation in Algorithm 1 is inconsistent (D_R(x_T,i) versus the surrounding prose that places the disk at x_T); unify.
  2. Table 6 and Figure 2: LPIPS/PSNR are reported only versus GeoShield; adding the same numbers for PGD at matched ε would complete the perceptibility comparison already begun in Tables 1–2.
  3. §4.5: wall-clock times are given for a single hardware configuration; a brief note on how the parallelization scales with available GPUs would help reproducibility.
  4. A few typographical slips remain (e.g., “theoptimizationlandscapeforadversarialattacks”, missing spaces after periods in the abstract).

Circularity Check

0 steps flagged

No significant circularity: purely empirical optimization procedure evaluated on held-out data and independent models.

full rationale

The paper introduces RoadTrip Attack as a beam-search + PGD procedure (Alg. 1) that samples intermediate geographic targets inside an adaptive Haversine disk and retains the top-K candidates. Success is measured solely by external metrics (ACC_GT, ACC_Target, LPIPS, PSNR) on Im2GPS3k/YFCC4k against GeoCLIP (white-box) and transfer to Img2Loc/G3 (black-box), with controlled ablations of PGD variants, beam size K and scaling factor η. No equation equates a claimed prediction to a fitted constant; hyperparameters are chosen by ablation and reported; no uniqueness theorem, self-citation chain or definitional identity underpins the central empirical claim that RTA outperforms PGD/FGSM/CW/GeoShield at low ε. The derivation chain is therefore self-contained and non-circular.

Axiom & Free-Parameter Ledger

4 free parameters · 3 axioms · 1 invented entities

The central empirical claim rests on standard adversarial-ML machinery (PGD, l∞ ball, cross-entropy on retrieval similarities) plus a small set of hand-chosen geometric heuristics (adaptive disk radius, beam width) that are not derived from first principles. No new physical entities are postulated; free parameters are ordinary hyper-parameters of the search.

free parameters (4)
  • η (radius scaling factor) = 0.5
    Fixed at 0.5 after ablation; controls the size of the intermediate-target disk and is not derived.
  • beam size K = 4
    Set to 4 for all main experiments; larger beams improve accuracy but increase cost.
  • number of parallel targets J = 5
    Set to 5; controls breadth of geographic sampling per beam member.
  • PGD steps per intermediate target = 5
    Fixed at 5 with step size ε/2; early-stop when 1 km accuracy is reached.
axioms (3)
  • domain assumption Projected gradient descent on cross-entropy between query embedding and a chosen gallery embedding produces a valid adversarial example inside the l∞ ball of radius ε.
    Standard additive threat model used throughout §3.1 and Alg. 1; inherited from Madry et al. and Carlini & Wagner.
  • domain assumption Haversine distance is the appropriate metric for both intermediate-target sampling and success evaluation.
    Used to define disks, adaptive radius, and all ACC@km thresholds; conventional for geolocalization but still an unproved modeling choice for the feature-space geometry.
  • domain assumption A surrogate retrieval model (GeoCLIP) yields transferable adversarial examples against generation-based black-box systems (Img2Loc, G3).
    Core premise of the black-box experiments in §4.4; empirically supported but not theoretically guaranteed.
invented entities (1)
  • RoadTrip Attack (RTA) procedure no independent evidence
    purpose: The concrete beam-search-plus-adaptive-disk algorithm that constitutes the paper’s contribution.
    Defined entirely inside the paper (Alg. 1); no independent external evidence of existence beyond the reported experiments.

pith-pipeline@v1.1.0-grok45 · 20904 in / 2636 out tokens · 23223 ms · 2026-07-12T03:34:55.274612+00:00 · methodology

0 comments
read the original abstract

Retrieval-based image geolocalization has emerged as a powerful technique for determining the location of a query image by matching it against a large, geotagged database. The success of deep learning based approaches has raised concerns regarding privacy and safety. A way to protect users from geolocalization is to design adversarial attacks for such methods. In this paper, we introduce RoadTrip Attack (RTA), a novel and highly effective targeted adversarial attack for geolocalization. RTA conceptualizes the adversarial process as finding an optimal distractor journey to a specific, attacker-chosen location. It employs a beam search algorithm to iteratively construct a sequence of incorrect geographic locations that form a path to the target. At each step, the attack generates subtle perturbations to the query image, guiding the geolocalization model toward the next location in this deceptive path. We show that our method is also strong in black-box settings, obtaining highly transferable attacks with less perceptible image artifacts.

Figures

Figures reproduced from arXiv: 2607.03277 by Federico Becattini, Lorenzo Seidenari, Niccol\`o Niccoli.

Figure 1
Figure 1. Figure 1: RoadTrip Attack. Starting from an image Iq correctly localized at x0 by the victim model M∗ , the attack crafts an adversarial image Iq + δ ∗ . By leveraging a surrogate model M, the algorithm explores a “beam” of black-box adversarial solutions (red dots). These are selected as the optimal subset of iteratively sampled geographic neighbors (gray dots). The final optimal “trip” (highlighted in red) demonst… view at source ↗
Figure 2
Figure 2. Figure 2: Visual comparison of adversarial noise for four budgets ε = 2/255, 4/255, 8/255, 16/255 and two methods (Geoshield and ours). The magnified area highlights the fine-grained perturbation patterns for the attack. Best viewed in color on a screen. 4.6 Ablation studies To better understand the behavior of RTA, we perform a series of ablation studies, focusing on the white-box setting. We report a convergence a… view at source ↗
Figure 3
Figure 3. Figure 3: Ablation study comparing RTA with PGD on IM2GPS3k, comparing average processing time (a) and target distance (b). 1 25 200 750 2500 94 95 96 97 98 99 100 Distance (km) Target Accuracy (%) Beam size 1 Beam size 2 Beam size 4 (a) Impact of beam search size (K). 0.5 0.75 1 1.5 98 98.5 99 98.72 98.56 98.55 98.49 η Value Target Accuracy (%) (b) Sensitivity to scaling factor (η) [PITH_FULL_IMAGE:figures/full_fi… view at source ↗
Figure 4
Figure 4. Figure 4: Experimental analysis of RTA parameters. (a) Larger beams increase target accuracy across dis￾tances. (b) Best average results are obtained with η = 0.5. 5 Conclusions In this work, we introduced the RoadTrip Attack, a novel adversarial method to address the privacy risks of image geolocalization. Our approach formulates the attack as an optimal distractor journey to a set of intermediate locations, using … view at source ↗
Figure 5
Figure 5. Figure 5: Visual comparison of adversarial noise for four budgets ε = 2/255, 4/255, 8/255, 16/255 and two methods (Geoshield and ours). The magnified area highlights the fine-grained perturbation patterns for the attack. Best viewed in color on a screen [PITH_FULL_IMAGE:figures/full_fig_p018_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Example of retrieved images by Img2Loc [51]. ε = 2/255 Query Top-5 Similar Images Ground Truth GeoShield [24] RTA [PITH_FULL_IMAGE:figures/full_fig_p019_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Example of retrieved images by Img2Loc [51]. ε = 4/255 [PITH_FULL_IMAGE:figures/full_fig_p019_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Example of retrieved images by Img2Loc [51]. ε = 8/255 Query Top-5 Similar Images Ground Truth GeoShield [24] RTA [PITH_FULL_IMAGE:figures/full_fig_p020_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Example of retrieved images by Img2Loc [51]. ε = 16/255 [PITH_FULL_IMAGE:figures/full_fig_p020_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Example of retrieved images by G3 [16]. ε = 2/255 Query Top-5 Similar Images Ground Truth GeoShield [24] RTA [PITH_FULL_IMAGE:figures/full_fig_p021_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Example of retrieved images by G3 [16]. ε = 4/255 [PITH_FULL_IMAGE:figures/full_fig_p021_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Example of retrieved images by G3 [16]. ε = 8/255 Query Top-5 Similar Images Ground Truth GeoShield [24] RTA [PITH_FULL_IMAGE:figures/full_fig_p022_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Example of retrieved images by G3 [16]. ε = 16/255 [PITH_FULL_IMAGE:figures/full_fig_p022_13.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

51 extracted references · 2 canonical work pages

  1. [1]

    In: Proc

    Andriushchenko, M., Croce, F., Flammarion, N., Hein, M.: Square attack: a query-efficient black-box adversarial attack via random search. In: Proc. of ECCV. pp. 484–501. Springer (2020)

    2020

  2. [2]

    Astruc, G., Dufour, N., Siglidis, I., Aronssohn, C., Bouia, N., Fu, S., Loiseau, R., Nguyen, V.N., Raude, C., Vincent, E., Xu, L., Zhou, H., Landrieu, L.: OpenStreetView-5M: The many roads to global visual geolocation. Proc. of CVPR (2024)

    2024

  3. [3]

    In: Proc

    Athalye, A., Engstrom, L., Ilyas, A., Kwok, K.: Synthesizing robust adversarial examples. In: Proc. of ICML. pp. 284–293. PMLR (2018)

    2018

  4. [4]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Berton, G., Mereu, R., Trivigno, G., Masone, C., Csurka, G., Sattler, T., Caputo, B.: Deep visual geo-localization benchmark. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 5396–5407 (2022)

    2022

  5. [5]

    In: 2017 ieee symposium on security and privacy (sp)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). pp. 39–57. Ieee (2017)

    2017

  6. [6]

    In: Proc

    Chen, P.Y., Sharma, Y., Zhang, H., Yi, J., Hsieh, C.J.: Ead: elastic-net attacks to deep neural networks via adversarial examples. In: Proc. of AAAI. vol. 32 (2018)

    2018

  7. [7]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Clark, B., Kerrigan, A., Kulkarni, P.P., Cepeda, V.V., Shah, M.: Where we are and what we’re looking at: Query based worldwide image geo-localization using hierarchies and scenes. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 23182–23190 (2023)

    2023

  8. [8]

    In: Proc

    Croce,F.,Hein,M.:Reliableevaluationofadversarialrobustnesswithanensembleofdiverseparameter- free attacks. In: Proc. of ICML. PMLR (2020)

    2020

  9. [9]

    Garg, S., Fischer, T., Milford, M.: Where is your place, visual place recognition? arXiv preprint arXiv:2103.06443 (2021)

    Pith/arXiv arXiv 2021

  10. [10]

    In: Bengio, Y., LeCun, Y

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y., LeCun, Y. (eds.) 3rd Int’l Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings (2015),http://arxiv.org/abs/1412.6572

    Pith/arXiv arXiv 2015

  11. [11]

    In: Proc

    Haas, L., Skreta, M., Alberti, S., Finn, C.: Pigeon: Predicting image geolocations. In: Proc. of CVPR. pp. 12893–12902 (2024)

    2024

  12. [12]

    In: Proc

    Hausler,S., Garg, S., Xu, M., Milford, M., Fischer, T.: Patch-netvlad: Multi-scalefusion of locally-global descriptors for place recognition. In: Proc. of CVPR. pp. 14141–14152 (2021)

    2021

  13. [13]

    In: Proc

    Hays, J., Efros, A.A.: Im2gps: estimating geographic information from a single image. In: Proc. of CVPR. pp. 1–8. IEEE (2008)

    2008

  14. [14]

    In: Choi, J., Friedland, G

    Hays, J., Efros, A.A.: Large-scale image geolocalization. In: Choi, J., Friedland, G. (eds.) Multimodal Location Estimation of Videos and Images, pp. 41–62. Springer (2015).https://doi.org/10.1007/ 978-3-319-09861-6_3,https://doi.org/10.1007/978-3-319-09861-6_3

    work page doi:10.1007/978-3-319-09861-6_3 2015

  15. [15]

    In: Proc

    Izbicki, M., Papalexakis, E.E., Tsotras, V.J.: Exploiting the earth’s spherical geometry to geolocate images. In: Proc. of ECML-PKDD. pp. 3–19. Springer (2019)

    2019

  16. [16]

    Jia, P., Liu, Y., Li, X., Zhao, X., Wang, Y., Du, Y., Han, X., Wei, X., Wang, S., Yin, D.: G3: an effective and adaptive framework for worldwide geolocalization using large multi-modality models. Proc. of NeurIPS37, 53198–53221 (2024)

    2024

  17. [17]

    Jia, P., Park, S., Gao, S., Zhao, X., Li, S.: Georanker: Distance-aware ranking for worldwide image geolocalization. Proc. of NeurIPS38, 17673–17699 (2026)

    2026

  18. [18]

    In: Proc

    Jiang, W., Diao, Y., Wang, H., Sun, J., Wang, M., Hong, R.: Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples. In: Proc. of ACM MM. pp. 8910–8921 (2023)

    2023

  19. [19]

    In: Proc

    Kordopatis-Zilos, G., Galopoulos, P., Papadopoulos, S., Kompatsiaris, I.: Leveraging efficientnet and contrastive learning for accurate global-scale location estimation. In: Proc. of ICMR. pp. 155–163 (2021)

    2021

  20. [20]

    In: Artificial intelligence safety and security, pp

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: Artificial intelligence safety and security, pp. 99–112. Chapman and Hall/CRC (2018)

    2018

  21. [21]

    IEEE MultiMedia24(1), 93–96 (2017) Defending from GeoLocalization through Adversarial Road Trips 15

    Larson, M., Soleymani, M., Gravier, G., Ionescu, B., Jones, G.J.: The benchmarking initiative for multimedia evaluation: Mediaeval 2016. IEEE MultiMedia24(1), 93–96 (2017) Defending from GeoLocalization through Adversarial Road Trips 15

    2016

  22. [22]

    IEEE Transactions on Pattern Analysis and Machine Intelligence47(1), 161–171 (2025).https://doi.org/10.1109/TPAMI.2024.3461686

    Li, C., Jiang, T., Wang, H., Yao, W., Wang, D.: Optimizing latent variables in integrating transfer and query based attack framework. IEEE Transactions on Pattern Analysis and Machine Intelligence47(1), 161–171 (2025).https://doi.org/10.1109/TPAMI.2024.3461686

    work page doi:10.1109/tpami.2024.3461686 2025

  23. [23]

    arXiv preprint arXiv:2305.12683 (2023)

    Liang, C., Wu, X.: Mist: Towards improved adversarial examples for diffusion models. arXiv preprint arXiv:2305.12683 (2023)

    Pith/arXiv arXiv 2023

  24. [24]

    Liu, X., Jia, X., Xun, Y., Qin, S., Cao, X.: Geoshield: Safeguarding geolocation privacy from vision- language models via adversarial perturbations (2025),https://arxiv.org/abs/2508.03209

    arXiv 2025

  25. [25]

    In: 6th Int’l Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: 6th Int’l Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. OpenReview.net (2018),https: //openreview.net/forum?id=rJzIBfZAb

    2018

  26. [26]

    In: Proc

    Meng, D., Chen, H.: Magnet: a two-pronged defense against adversarial examples. In: Proc. of SIGSAC. pp. 135–147 (2017)

    2017

  27. [27]

    In: Proc

    Mistretta, M., Baldrati, A., Agnolucci, L., Bertini, M., Bagdanov, A.D.: Cross the gap: Exposing the intra-modal misalignment in clip via modality inversion. In: Proc. of ICLR (2025)

    2025

  28. [28]

    In: Proc

    Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proc. of CVPR (2016)

    2016

  29. [29]

    In: Proc

    Muller-Budack, E., Pustu-Iren, K., Ewerth, R.: Geolocation estimation of photos using a hierarchical model and scene classification. In: Proc. of ECCV. pp. 563–579 (2018)

    2018

  30. [30]

    In: Proc

    Nguyen, A., Yosinski, J., Clune, J.: Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In: Proc. of CVPR. pp. 427–436 (2015)

    2015

  31. [31]

    In: Chaudhuri, K., Jegelka, S., Song, L., Szepesvari, C., Niu, G., Sabato, S

    Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., Anandkumar, A.: Diffusion models for adversarial purification. In: Chaudhuri, K., Jegelka, S., Song, L., Szepesvari, C., Niu, G., Sabato, S. (eds.) Proc. of ICML. vol. 162, pp. 16805–16827. PMLR (17–23 Jul 2022),https://proceedings.mlr.press/v162/ nie22a.html

    2022

  32. [32]

    Progress in brain research155, 23–36 (2006),https://api.semanticscholar.org/CorpusID:2432623

    Oliva, A., Torralba, A.: Building the gist of a scene: the role of global image features in recognition. Progress in brain research155, 23–36 (2006),https://api.semanticscholar.org/CorpusID:2432623

    2006

  33. [33]

    In: Proc

    Pramanick, S., Nowara, E.M., Gleason, J., Castillo, C.D., Chellappa, R.: Where in the world is this image? transformer-based geo-localization in the wild. In: Proc. of ECCV. pp. 196–215. Springer (2022)

    2022

  34. [34]

    Salman, H., Khaddaj, A., Leclerc, G., Ilyas, A., Madry, A.: Raising the cost of malicious ai-powered image editing (2023),https://arxiv.org/abs/2302.06588

    Pith/arXiv arXiv 2023

  35. [35]

    In: Proc

    Samangouei, P., Kabkab, M., Chellappa, R.: Defense-gan: Protecting classifiers against adversarial attacks using generative models. In: Proc. of ICLR (2018)

    2018

  36. [36]

    In: Proc

    Seo, P.H., Weyand, T., Sim, J., Han, B.: Cplanet: Enhancing image geolocalization by combinatorial partitioning of maps. In: Proc. of ECCV. pp. 536–551 (2018)

    2018

  37. [37]

    In: 32nd USENIX Security Symp

    Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., Zhao, B.Y.: Glaze: Protecting artists from style mimicry by text-to-image models. In: 32nd USENIX Security Symp. (USENIX Security 23). pp. 2187–2204 (2023)

    2023

  38. [38]

    In: Proc

    Song, Y., Kim, T., Nowozin, S., Ermon, S., Kushman, N.: Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In: Proc. of ICLR (2018)

    2018

  39. [39]

    IEEE Transactions on Evolutionary Computation23(5), 828–841 (2019)

    Su, J., Vargas, D.V., Sakurai, K.: One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation23(5), 828–841 (2019)

    2019

  40. [40]

    In: Bengio, Y., LeCun, Y

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y., LeCun, Y. (eds.) 2nd Int’l Conference on Learning Rep- resentations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings (2014), http://arxiv.org/abs/1312.6199

    Pith/arXiv arXiv 2014

  41. [41]

    In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision

    Theiner, J., Müller-Budack, E., Ewerth, R.: Interpretable semantic photo geolocation. In: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. pp. 750–760 (2022)

    2022

  42. [42]

    Communications of the ACM59(2), 64–73 (2016) 16 N

    Thomee, B., Shamma, D.A., Friedland, G., Elizalde, B., Ni, K., Poland, D., Borth, D., Li, L.J.: Yfcc100m: The new data in multimedia research. Communications of the ACM59(2), 64–73 (2016) 16 N. Niccoli et al

    2016

  43. [43]

    Trippodo, M., Becattini, F., Seidenari, L.: Immunizing images from text to image editing via adversarial cross-attention. p. 10535–10543. Proc. of ACM MM, Association for Computing Machinery, New York, NY, USA (2025)

    2025

  44. [44]

    Vivanco Cepeda, V., Nayak, G.K., Shah, M.: Geoclip: Clip-inspired alignment between locations and images for effective worldwide geo-localization. Proc. of NeurIPS36, 8690–8701 (2023)

    2023

  45. [45]

    In: Proc

    Vo, N., Jacobs, N., Hays, J.: Revisiting im2gps in the deep learning era. In: Proc. of CVPR. pp. 2621– 2630 (2017)

    2017

  46. [46]

    Weyand, T., Kostrikov, I., Philbin, J.: PlaNet - Photo Geolocation with Convolutional Neural Networks, p. 37–55. Springer International Publishing (2016).https://doi.org/10.1007/978-3-319-46484-8_3, http://dx.doi.org/10.1007/978-3-319-46484-8_3

    doi:10.1007/978-3-319-46484-8_3 2016

  47. [47]

    arXiv preprint arXiv:1704.01155 (2017)

    Xu, W., Evans, D., Qi, Y.: Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155 (2017)

    Pith/arXiv arXiv 2017

  48. [48]

    In: Proceedings of the IEEE/CVF winter conference on applications of computer vision

    Xu, Y., Shamsolmoali, P., Granger, E., Nicodeme, C., Gardes, L., Yang, J.: Transvlad: Multi-scale attention-based global descriptors for visual geo-localization. In: Proceedings of the IEEE/CVF winter conference on applications of computer vision. pp. 2840–2849 (2023)

    2023

  49. [49]

    In: Proc

    Yi, C., Ren, L., Zhan, D.C., Ye, H.J.: Leveraging cross-modal neighbor representation for improved clip classification. In: Proc. of CVPR. pp. 27402–27411 (2024)

    2024

  50. [50]

    In: Proc

    Zhang, R., Isola, P., Efros, A.A., Shechtman, E., Wang, O.: The unreasonable effectiveness of deep features as a perceptual metric. In: Proc. of CVPR. pp. 586–595 (2018)

    2018

  51. [51]

    In: Proc

    Zhou, Z., Zhang, J., Guan, Z., Hu, M., Lao, N., Mu, L., Li, S., Mai, G.: Img2loc: Revisiting image ge- olocalization using multi-modality foundation models and image-based retrieval-augmented generation. In: Proc. of SIGIR. p. 2749–2754. SIGIR 2024, ACM (Jul 2024).https://doi.org/10.1145/3626772. 3657673,http://dx.doi.org/10.1145/3626772.3657673 Defending...

    doi:10.1145/3626772 2024