Pith. sign in

REVIEW 5 major objections 7 minor 23 references

Infrared lights flashing on a moving object can make optical flow estimation networks output blank or chaotic flow, hiding the object from trackers in real time.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 11:29 UTC pith:UMFZO6XB

load-bearing objection The physical infrared attack setup is genuinely novel, but the printed L_Vis fitness is self-contradictory and the real-time claim is unmeasured; needs a careful rewrite before it can be trusted. the 5 major comments →

arxiv 2607.26651 v1 pith:UMFZO6XB submitted 2026-07-29 cs.CV cs.AI

Physically Real-time Infrared Attack against Optical Flow Estimation Networks

Shen You , Wei Jiang , Jiarui Liu , Yijian Ye , Qiuzhen Lin , Xiangtao Li , Ka-Chun Wong This is my paper
classification cs.CV cs.AI
keywords adversarial attackoptical flow estimationphysical-world attackinfrared lightgenetic algorithmreal-time attackRAFTPWC-Net
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that a physical-world adversarial attack can be mounted against optical flow estimation networks (OFENs) by attaching infrared lights to a moving object and switching their intensities between consecutive frames. The key claim is that this destroys the network's ability to estimate the object's motion, forcing it to output blank or chaotic flow, so downstream tracking fails. To achieve real-time operation, the authors first use a genetic algorithm in a physical training loop to collect adversarial intensity patterns, then train a minimal fully connected network to produce those patterns at frame rate. They report success against both RAFT and PWC-Net under varied ambient lighting, object speeds, and camera distances, and identify flash loss — the temporal intensity difference — as the most important component.

Core claim

The central discovery on the paper's own terms is that breaking the brightness constancy assumption — which optical flow estimation relies on — is sufficient to compromise modern deep OFENs in the physical world, and that a non-gradient evolutionary search can find effective infrared intensity patterns even though the physical light-conversion process is non-differentiable. The attack directly manipulates the physical scene rather than the input image, sidestepping the domain gap that weakens digital-to-physical adversarial examples. The paper's experiments show the attack works on two architectures and remains effective across a broad range of conditions.

What carries the argument

The pivotal mechanism is the temporal flashing of n infrared lights attached to the object, encoded as a perturbation vector P in [0,1]^n and rendered into the physical scene by a non-derivative conversion function C(·). Because C(·) defeats gradient-based optimization, the training phase uses a genetic algorithm with three fitness terms — invisibility (blanking the flow), imperceptibility (chaotic flow), and flash loss (inter-frame brightness difference) — and the attacking phase uses a trained single fully-connected layer (the AGN) to map the previous perturbation to the next in real time. The flash loss is the component that breaks brightness constancy.

Load-bearing premise

The load-bearing premise is that the genetic algorithm's fitness function correctly encodes the goal of blanking the optical flow; the paper's formula for the invisibility term appears to reward large flow instead, so everything depends on that being a typo.

What would settle it

Compute L_Vis for a truly blank flow (O ≈ 0): it is 0, not 1. Then run the GA with the fitness function exactly as written (maximize α·|O|/(HWC) + β·L_Per + L_Flash) and observe whether the optical flow becomes blank or larger. If flow magnitude rises, the claimed blanking effect is not produced by the stated objective.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the claim holds, any downstream system that consumes optical flow (vehicle tracking, obstacle avoidance, behavior analysis) can be deceived without touching the victim model or its input feed.
  • The reported success against both RAFT and PWC-Net suggests the attack is not tied to a single architecture, strengthening its threat model.
  • Because the AGN is a single fully connected layer, the attack is fast enough for embedded deployment at camera frame rates.
  • The ablation identifying flash loss as the most important term points to brightness constancy violation as the core vulnerability being exploited.
  • The method's robustness across lighting, speed, and distance implies the physical conditioning problem that weakens many physical attacks is largely avoided.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The printed invisibility loss L_Vis = |O|/(H×W×C) is maximized when the optical flow magnitude is large, not blank; if this is not a transcription error, the GA would evolve perturbations that amplify flow, contradicting the paper's stated objective. This is our reading of the formula, not a claim the paper makes.
  • The same physical mechanism should generalize to classical optical flow algorithms (e.g., Lucas–Kanade or block matching), since those also assume brightness constancy; a testable extension would be running the GA against such baselines.
  • The two-stage GA-then-network pipeline could be accelerated by training the AGN on synthetic perturbations from a differentiable simulator, removing the need for a physical training track.
  • Because cameras without infrared filters are the assumed target, the method may transfer to surveillance and traffic-camera environments that lack such filters.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper proposes RILA, a physical-world attack against optical flow estimation networks (RAFT and PWC-Net) using infrared lights. An offline genetic algorithm (GA) optimizes light-intensity perturbation vectors in a physical testbed to maximize a fitness composed of three terms: invisibility, imperceptibility, and flash loss. The GA-generated perturbation pairs are then used to train a fully connected Adversarial Generative Network (AGN) that predicts the next perturbation from the previous one, enabling real-time deployment. Experiments in a physical environment with a moving plate report high Average Invisibility (AIV) and Average Imperceptibility (AIP) under varying ambient light, object speed, camera distance, and RAFT iteration count, and an ablation study examines the role of each loss term. The central claim is that the method reliably blinds or corrupts optical flow estimates in real time, making tracked objects effectively invisible to downstream tasks.

Significance. If the technical inconsistencies are resolved, the paper addresses a meaningful and underexplored problem: physical, real-time adversarial attacks on optical flow estimators, which are safety-critical upstream components in autonomous driving and surveillance. The use of infrared light as a stealthy physical perturbation channel is novel, and the physical deployment with GA-generated training data followed by a fast generative network is a sensible pipeline for circumventing the non-differentiability of physical light control. The paper includes physical experiments across several controlled conditions, which is a strength compared to purely digital attacks. However, the contribution is currently undermined by sign errors in the fitness definitions, missing metric formulas, and absent timing measurements, so the validity of the reported attack mechanism and the real-time claim cannot be assessed as written. No code is provided, and key hyperparameters are omitted, further limiting reproducibility.

major comments (5)
  1. [§4.2.2, Eq. (5)] The Invisibility loss is defined as L_Vis = |O_i|/(H×W×C), and the text states that when L_Vis tends to 1, the optical flow is blank. However, blank flow has |O_i|≈0, giving L_Vis≈0. Since the GA maximizes the fitness in Eq. (5), the printed objective selects for large flow magnitude, not blankness. This is not a minor typo: the same quantity appears to underlie the AIV metric in §5.1.3, so reported AIV values near 0.9 would then correspond to large flow magnitudes, contradicting the interpretation of 'invisibility.' Please correct the definition (e.g., L_Vis = 1 - |O_i|/(HWC)) or state clearly what the implemented fitness actually computes, and ensure the metric definitions are consistent with the claimed attack effect.
  2. [§5.2, Table 1] The ablation percentages reported in the text do not match Table 1. For RAFT, the relative AIV decrease when removing L_Vis is (0.900-0.887)/0.900 ≈ 1.4%, not 1.16%; the AIP decrease is (0.979-0.974)/0.979 ≈ 0.5%, not 0.26%. Similar discrepancies appear for N-Per and N-Flash (e.g., N-Flash AIV decrease is ≈3.4%, not 3.22%). The authors should recompute all percentages or correct the table, because the relative contribution of each loss is a central empirical claim.
  3. [§5 (overall, real-time claim)] The title and abstract claim 'real-time' attacks, and §4.1 states the attack must complete within one frame interval (about 30 ms). Yet no timing measurements are reported anywhere in §5. The latency of AGN inference, the hardware controller response, and the infrared light display time are never quantified. Without these numbers, the core real-time contribution of the paper is unsupported.
  4. [§5.3, baselines] The text says RILA is 'compared with Blank methods,' but no such baseline is defined or shown in the figures or tables. More importantly, there is no comparison against simpler physical attack strategies, such as fixed infrared intensities or a strobe pattern. The reported improvements over the original optical flow do not establish that the GA/AGN-optimized perturbations are what cause the attack; the mere presence of infrared light could provide the same effect. Adding such baselines is necessary to attribute the results to the proposed method.
  5. [§4.3, §5.1.1] The AGN is trained on GA-generated perturbation pairs collected on the same physical track used for evaluation, and all reported experiments are conducted on that same testbed. The paper claims robust performance 'across multiple scenarios,' but these scenarios (light levels, speeds, distances) are all within the same physical environment. No evidence is provided that the AGN or even the GA-generated perturbations transfer to different environments, camera placements, or object types. This limitation should be acknowledged explicitly, or cross-environment experiments should be added.
minor comments (7)
  1. [§5.3.1, Figure 7] Subfigure captions (a) and (b) are both labeled 'Without L_Vis'; they should be labeled 'AIV' and 'AIP' under varying ambient light.
  2. [Table 1] The table header 'Dis (cm)' appears to be copied from Table 3 and is not relevant to the ablation study.
  3. [§4.2.2] The definition of L_Per is ambiguous: it says '1 minus the average variance of each sliding window,' but does not specify whether the variance is computed on the optical flow field or on image intensities. Also, the text states that higher L_Per indicates flow is 'more chaos,' but 1 - variance is maximized by uniform (blank) flow, which is the opposite of chaos. Please clarify or correct.
  4. [§4.2 (GA hyperparameters)] The population size, number of generations, crossover probability, mutation rate, and tournament size are not reported. Without these, the GA-based training is not reproducible.
  5. [§4.3] The AGN architecture is described only as 'a fully connected layer.' The input/output dimensions, number of hidden units, activation functions, and training loss for the AGN are not provided. Please include these details.
  6. [Algorithm 1, line 4] The line 'P_i = GA(I_{i-1})' suggests the GA takes only the previous frame as input, but Eq. (2) requires both frames and both perturbations. Please clarify the actual inputs to the GA and whether the current frame is captured before or after the perturbation is applied.
  7. [§1] The claim that 'most cameras are usually not equipped with infrared filters' is stated without support and is questionable for consumer cameras, which commonly include IR-cut filters. Please justify or soften this statement.

Circularity Check

2 steps flagged

Partial circularity: the AGN is trained on GA-optimized perturbation pairs and evaluated on AIV/AIP metrics that mirror the GA fitness terms; the printed L_Vis definition also contradicts the claimed blank-flow mechanism.

specific steps
  1. fitted input called prediction [Section 4.2.2 (Eq. 5), Section 4.3 / Algorithm 1, Section 5.1.3]
    "Invisibility (L_V is): This term is defined as L_V is = |O_i|/(H×W×C)... measures the invisibility of the perturbation. ... Given these three sub-fitness terms, the overall fitness function is ... F_itness(P_i)=α×L_V is+β×L_P er+L_F lash. ... Two performance metrics are computed to evaluate the performance of RILA: Average Invisibility (AIV) and Average Imperceptibility (AIP)."

    The GA maximizes Eq. 5, whose leading term L_Vis is a mean-flow-magnitude quantity, and the reported success metric AIV is the same 'invisibility' construct. The AGN is trained on the GA-optimized pairs (P_{i-1}, P_i) and then evaluated with AIV/AIP, so the high attack-performance numbers partly restate the optimized objective by construction rather than an independent success measure. The physical deployment on new frames and varied conditions adds independent evidence, so the circularity is partial, not total.

  2. self definitional [Section 4.2.2 (Fitness Design)]
    "When L_V istends to one, it indicates that the optical flow is blank, meaning no moving object will be detected."

    By the paper's own definition, L_Vis = |O_i|/(H×W×C), so a blank optical flow (|O_i|≈0) gives L_Vis≈0, not 1. Maximizing L_Vis as written increases the mean flow magnitude, i.e., the opposite of 'blank'. The claimed fitness-to-effect link is inverted by the defining equation; if the implementation instead uses 1−L_Vis, the printed equation must be corrected. This is a self-definitional inconsistency in the central attack objective.

full rationale

The paper does not contain a formal derivation that reduces a prediction to its inputs, but it does contain two self-referential elements. First, the AGN is trained as a supervised imitator of the GA's optimized perturbations, and the main evaluation metrics AIV/AIP correspond to the same L_Vis/L_Per terms the GA fitness maximized; thus part of the reported attack performance is the optimized objective being re-measured. The physical testing across new frames, speeds, distances, and lighting provides genuine external evidence, so this is partial rather than fully forced. Second, the printed L_Vis formula contradicts its stated role: L_Vis = |O_i|/(HWC) is maximized by large flow magnitudes, whereas the text says L_Vis→1 means blank flow. This is a serious correctness risk and a self-definitional inconsistency, though it may be a typo for 1−|O_i|/(HWC). I flag it explicitly per the reviewing rule but do not treat it as intentional circularity. There is no load-bearing self-citation or imported uniqueness theorem.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The central claim rests on several untested assumptions about the physical world and on a fitness function with an apparent sign error. The GA hyperparameters and loss weights are not reported, so the training process is not reproducible from the paper.

free parameters (4)
  • γ (initialization bias) = 0.2 or 0.8 (depending on frame parity)
    Used in Eq. 4 to initialize GA perturbations; chosen by hand to alternate brightness between adjacent frames.
  • α and β (loss weights) = not reported
    Weights in Eq. 5 balance invisibility and imperceptibility losses; no values given, likely tuned to make the attack effective.
  • GA hyperparameters (population, generations, crossover, mutation) = not reported
    Essential for reproducing the GA-generated training data; not specified.
  • Sliding window size for L_Per = not specified
    Imperceptibility loss uses average variance over sliding windows; window size undefined.
axioms (4)
  • domain assumption Brightness constancy is a valid assumption for the victim OFENs and attacking it disrupts estimation.
    The attack aims to break the brightness constancy assumption; the paper relies on this being the mechanism of failure.
  • domain assumption The victim camera is sensitive to 840nm infrared light and does not have an effective IR-cut filter.
    The attack requires the IR lights to appear in the captured frames; the paper states 'most cameras... are usually not equipped with infrared filters' (Section 1), but this is not verified for target cameras.
  • domain assumption The physical conversion C(·) from light intensity to image brightness is stable and repeatable across trials.
    The GA optimizes against the physical process; if the response drifts, the learned AGN mapping may fail.
  • ad hoc to paper The fully-connected AGN trained on GA-generated perturbation pairs generalizes to unseen time steps and motion states.
    The real-time attack assumes the AGN output at deployment is as effective as the GA-optimized perturbation; no analysis of distribution shift is provided.

pith-pipeline@v1.3.0-daily-deepseek · 10878 in / 11985 out tokens · 113386 ms · 2026-08-01T11:29:18.225285+00:00 · methodology

0 comments
read the original abstract

With the promising performance of deep neural networks on image-based tasks, different real-world applications such as autonomous driving and motion detection have become increasingly mature and relevant to human lives. In particular, Optical Flow Estimation Networks (OFENs), as upstream models, play a critical role in different domains. Its outputs are heavily assumed and adopted for different downstream tasks, and it is essential to test its robustness to prevent safety accidents. We present an approach for real-time attacks on OFENs in the physical world, leveraging infrared lights for their stealthiness. By generating a large number of Adversarial Examples in advance, our approach computes AEs in real time and dynamically displays them, which allows our method to facilitate precise and targeted attacks without modifying the victim system. Unlike previous digital-to-physical attack techniques, our method directly attacks victim models within the physical world, thereby overcoming the limitations associated with the ineffectiveness of AEs. Experimental results demonstrate the efficacy of our approach in compromising OFENs across diverse lighting conditions, varying object motion velocities, and different object placements, ultimately impairing the network's ability to accurately estimate optical flow.

Figures

Figures reproduced from arXiv: 2607.26651 by Jiarui Liu, Ka-Chun Wong, Qiuzhen Lin, Shen You, Wei Jiang, Xiangtao Li, Yijian Ye.

Figure 1
Figure 1. Figure 1: The application infrared attack. bations [5, 15], which can significantly disrupt model out￾puts. This poses a unique challenge in autonomous driving as erroneous predictions can lead to severe consequences for the safety of drivers and passengers, where OFENs’ outputs are critical for downstream decision-making sys￾tems. Despite the extensive research on Adversarial Ex￾amples (AEs) in the physical world [… view at source ↗
Figure 2
Figure 2. Figure 2: (a) Timeline and (b) Sequence Chart of the OFEN attacking process with AEs in the physical world. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: shows how we use GA to generate AEs. Firstly, we initialize a perturbation set, and then for each perturba￾tion, we send it to the hardware controller. The hardware controller will set each infrared light at specific power to get the dirty frame, then the previous frame and the current dirty frame will be sent to OFEN to get the fitness. After we get the fitness of each perturbation, we need to construct t… view at source ↗
Figure 4
Figure 4. Figure 4: The experiment environments. 5.1. Experiment Setup 5.1.1. Physical Test Environment To test RILA, we constructed a physical test environment consisting of five main components: a track, ambient light￾ing, attached infrared lights, camera, and a controller. • Track: The track is used to control the movement of the target object, allowing us to easily stop the object and wait for the GA to compute the AEs. •… view at source ↗
Figure 6
Figure 6. Figure 6: The target object is moving to the left from right. The original optical flow (up) and the attack results with full loss item (down) [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: The invisibility of RILA in different ambient lights. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

23 extracted references · 2 linked inside Pith

  1. [1]

    On the vulnerability of traffic light recognition systems to laser illumination attacks

    Sri Hrushikesh Varma Bhupathiraju, Takeshi Sugawara, Takami Sato, Qi Alfred Chen, Michael Clifford, and Sara Rampazzi. On the vulnerability of traffic light recognition systems to laser illumination attacks. InISOC Symposium on Vehicle Security and Privacy (VehicleSec). ISOC, San Diego, CA, USA. https://doi. org/10, 2024. 2

    2024

  2. [2]

    Adversarial patch.arXiv preprint arXiv:1712.09665, 2017

    Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch.arXiv preprint arXiv:1712.09665, 2017. 2

    Pith/arXiv arXiv 2017

  3. [3]

    Optical flow based visual potential field for autonomous driving

    Linda Capito, Umit Ozguner, and Keith Redmill. Optical flow based visual potential field for autonomous driving. In 2020 IEEE Intelligent Vehicles Symposium (IV), pages 885–

    2020

  4. [4]

    Jes ´us Chamorro-Martinez and Joaqu ´ın Fern ´andez-Valdivia. A new approach to motion pattern recognition and its ap- plication to optical flow estimation.IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), 37(1):39–51, 2006. 1

    2006

  5. [5]

    Sparse and imperceiv- able adversarial attacks

    Francesco Croce and Matthias Hein. Sparse and imperceiv- able adversarial attacks. InProceedings of the IEEE/CVF international conference on computer vision, pages 4724– 4732, 2019. 2

    2019

  6. [6]

    Flownet: Learning optical flow with convolutional networks

    Alexey Dosovitskiy, Philipp Fischer, Eddy Ilg, Philip Hausser, Caner Hazirbas, Vladimir Golkov, Patrick Van Der Smagt, Daniel Cremers, and Thomas Brox. Flownet: Learning optical flow with convolutional networks. InPro- ceedings of the IEEE international conference on computer vision, pages 2758–2766, 2015. 2

    2015

  7. [7]

    Adversarial laser beam: Effective physical-world attack to dnns in a blink

    Ranjie Duan, Xiaofeng Mao, A Kai Qin, Yuefeng Chen, Shaokai Ye, Yuan He, and Yun Yang. Adversarial laser beam: Effective physical-world attack to dnns in a blink. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 16062–16071, 2021. 2

    2021

  8. [8]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. InProceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 1625–1634, 2018. 2

    2018

  9. [9]

    Optical adversarial attack

    Abhiram Gnanasambandam, Alex M Sherman, and Stan- ley H Chan. Optical adversarial attack. InProceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 92–101, 2021. 3

    2021

  10. [10]

    Invisible optical adversarial stripes on traffic sign against autonomous vehicles

    Dongfang Guo, Yuting Wu, Yimin Dai, Pengfei Zhou, Xin Lou, and Rui Tan. Invisible optical adversarial stripes on traffic sign against autonomous vehicles. InProceedings of the 22nd Annual International Conference on Mobile Sys- tems, Applications and Services, pages 534–546, 2024. 2, 3

    2024

  11. [11]

    Combination of edge element and optical flow estimates for 3d-model-based vehicle tracking in traffic image sequences.International Journal of Computer Vision, 35:295–319, 1999

    Michael Haag and Hans-Hellmut Nagel. Combination of edge element and optical flow estimates for 3d-model-based vehicle tracking in traffic image sequences.International Journal of Computer Vision, 35:295–319, 1999. 1

    1999

  12. [12]

    Yu-Chih-Tuan Hu and et al. Kung. Naturalistic physical ad- versarial patch for object detectors. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 7848–7857, 2021. 2

    2021

  13. [13]

    On physical adversarial patches for object detection.arXiv preprint arXiv:1906.11897, 2019

    Mark Lee and Zico Kolter. On physical adversarial patches for object detection.arXiv preprint arXiv:1906.11897, 2019. 2

    Pith/arXiv arXiv 1906

  14. [14]

    Perceptual-sensitive gan for generating adversarial patches

    Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. InProceedings of the AAAI conference on artificial intelligence, pages 1028–1035,

  15. [15]

    Simple black-box adversarial attacks on deep neural networks

    Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box adversarial attacks on deep neural networks. In CVPR Workshops, 2017. 2

    2017

  16. [16]

    Attacking optical flow

    Anurag Ranjan, Joel Janai, Andreas Geiger, and Michael J Black. Attacking optical flow. InProceedings of the IEEE/CVF international conference on computer vision, pages 2404–2413, 2019. 2

    2019

  17. [17]

    Sayanan Sivaraman and Mohan Manubhai Trivedi. Look- ing at vehicles on the road: A survey of vision-based vehi- cle detection, tracking, and behavior analysis.IEEE trans- actions on intelligent transportation systems, 14(4):1773– 1795, 2013. 1

    2013

  18. [18]

    Fast optical flow es- timation and its application to real-time obstacle avoidance

    Kai-Tai Song and Jui-Hsiang Huang. Fast optical flow es- timation and its application to real-time obstacle avoidance. InProceedings 2001 ICRA. IEEE International Conference on Robotics and Automation (Cat. No. 01CH37164), pages 2891–2896. IEEE, 2001. 1

    2001

  19. [19]

    Pwc-net: Cnns for optical flow using pyramid, warping, and cost volume

    Deqing Sun, Xiaodong Yang, Ming-Yu Liu, and Jan Kautz. Pwc-net: Cnns for optical flow using pyramid, warping, and cost volume. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 8934–8943,

  20. [20]

    Raft: Recurrent all-pairs field transforms for optical flow

    Zachary Teed and Jia Deng. Raft: Recurrent all-pairs field transforms for optical flow. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23– 28, 2020, Proceedings, Part II 16, pages 402–419. Springer,

    2020

  21. [21]

    Rfla: A stealthy reflected light adversarial at- tack in the physical world

    Donghua Wang, Wen Yao, Tingsong Jiang, Chao Li, and Xi- aoqian Chen. Rfla: A stealthy reflected light adversarial at- tack in the physical world. InProceedings of the IEEE/CVF international conference on computer vision, pages 4455– 4465, 2023. 2

    2023

  22. [22]

    I can see the light: Attacks on autonomous vehicles using invisible lights

    Wei Wang, Yao Yao, Xin Liu, Xiang Li, Pei Hao, and Ting Zhu. I can see the light: Attacks on autonomous vehicles using invisible lights. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Se- curity, pages 1930–1944, 2021. 2

    2021

  23. [23]

    Robust physical-world attacks on face recognition.Pattern Recognition, 133:109009, 2023

    Xin Zheng, Yanbo Fan, Baoyuan Wu, Yong Zhang, Jue Wang, and Shirui Pan. Robust physical-world attacks on face recognition.Pattern Recognition, 133:109009, 2023. 2

    2023