Pith. sign in

REVIEW 5 major objections 6 minor 91 references

Preventing Adversarial AI Attacks Against Autonomous Situational Awareness: A Maritime Case Study

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Cross-sensor data fusion can neutralise adversarial AI attacks that defeat single-model defences, cutting attack loss by up to 100 percent in maritime trials.

desk verdict A useful proof-of-concept for multi-sensor maritime AI defense, but the 100% spoofing/patch claims outrun the evaluation; the core idea is sound and worth a serious referee. read the letter →

arxiv 2505.21609 v1 pith:7ET3G2C6 submitted 2025-05-27 cs.CR cs.AI

Mathew J. Walter , Aaron Barrett , Kimberly Tam This is my paper
classification cs.CRcs.AI
keywords adversarialAImachinelearningdatafusionmaritimeautonomoussystemssituationalawarenessDFCRsensorspoofingsecuritymetric
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the best way to defend an autonomous vessel's AI against adversarial attacks is not to harden a single model but to make the whole system check one sensor against another. It introduces the Data Fusion Cyber Resilience (DFCR) method, which combines AIS, radar, and optical detections into a single security-aware confidence score, and tests a system built with it at sea and in controlled experiments. Compared with single-input models and standard defences such as JPEG compression, Gaussian noise, and adversarial training, the DFCR system reports up to a 35% reduction in loss under multi-pronged perturbation attacks and up to 100% reduction in loss under adversarial patch and spoofing attacks, without lowering accuracy on genuine detections. If the result holds, it means autonomous situational awareness can be made resilient by architecture, with multiple independent sensors validating each other, rather than by model-level patches alone.

What carries the argument

The load-bearing mechanism is the Data Fusion Cyber Resilience (DFCR) pipeline, a defence-in-depth layer that sits between object detectors and the operator or downstream decision algorithm. It uses three components: multisensor validation, where a contact must appear in the sensors that should see it; contact position validation, where radar and AIS positions are mapped into optical coordinates with a homography matrix and compared against a two-dimensional normal distribution; and metadata validation, where AIS vessel-size information is correlated with radar signature size by a support vector machine. Each component outputs a pass or fail signal $s^{(k)}_m \in \{+1,-1\}$ that shifts the model's raw confidence by a fixed amount $\delta^{(k)}$, clamped to $[0,1]$, and the resulting DFCR confidence score is the security metric the system displays to the operator. The architecture is deliberately model-agnostic, so the same validation logic can be attached to any object detector.

What would settle it

Build a test scenario with a physically realistic decoy: a small buoy or boat fitted with an AIS transmitter claiming to be a large tanker, plus a radar reflector or synthetic radar contact sized to match the tanker. If the DFCR system assigns that fake contact a confidence score as high as it gives genuine verified contacts, the central claim fails; likewise, if a coordinated AIS-and-radar spoof with matching metadata drives DFCR loss above zero on a relevant dataset, the reported 100% spoofing protection does not generalise.

Watch

Extended reading notes

Core claim

The central claim is that cross-sensor validation, organised as defensive components around object-detection models, can neutralise whole families of adversarial AI attacks that defeat single-model defences. The paper shows this through a DFCR system that runs object detectors on AIS, radar, and optical feeds, then applies multisensor validation, position validation through a homography mapping, and metadata validation through a support vector machine to decide whether a detected contact is trustworthy. Each validation adjusts the detection confidence up or down, producing a final DFCR score $C_{\mathrm{final}} = \min(\max(C^{(0)}_m + \sum_{k=1}^3 \delta^{(k)} s^{(k)}_m, 0), 1)$. Under clean conditions the DFCR score matches or improves on baseline confidence (MSE loss 0.12 versus 0.17); under adversarial patch and spoofing attacks the reported loss drops to zero, meaning the system actively lowers its confidence in forged contacts. The authors interpret this as evidence that security can be built into the decision loop as a metric, not only into the model weights.

Load-bearing premise

The system works only if an attacker cannot forge consistent returns across AIS, radar, and optical sensors at the same time, and in particular cannot produce a radar signature whose size and position match a spoofed AIS vessel; the paper states this as the assumption that spoofing radar signals is highly challenging.

Editorial extensions

If this is right

  • AIS, radar, and optical inputs that agree on a contact raise the system's confidence above what any single model gives, improving clean-scenario detection metrics with a reported 30% lower MSE loss.
  • Adversarial patches against the optical detector produce zero DFCR loss because a fabricated optical contact has no corresponding radar or AIS support, while adversarial training only partially reduces loss and degrades normal accuracy.
  • Spoofed AIS or radar contacts fail metadata or multisensor checks, giving 100% loss reduction for single spoofs and strong reductions when multiple spoofed signals are injected.
  • Traditional defences such as JPEG compression can match DFCR on one attack type, the perturbation attacks, but DFCR maintains original image quality and works across attack types, so it can be combined with model-level defences rather than replacing them.
  • The DFCR confidence score gives remote operators a direct quantitative signal of possible adversarial manipulation, supporting safer human-in-the-loop decisions under degree-three maritime autonomy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct consequence the authors do not spell out is that the same DFCR pattern, redundant semantically aligned sensors plus a pass or fail validation score, transfers to other high-risk autonomy domains such as aerial drones or road vehicles wherever at least two independent sensing modalities observe the same object.
  • Because the 100% spoofing result rests on radar spoofing being hard, an attacker's natural next step is to build synthetic radar returns matched to spoofed AIS metadata, which suggests the community should prioritise radar-signature verification research before deploying DFCR-style systems against sophisticated adversaries.
  • The fixed $\delta^{(k)}$ adjustments could be learned rather than hand-set; a testable extension would optimise these weights per environment so the DFCR score becomes a calibrated probability of contact authenticity rather than a heuristic.
  • DFCR's computational overhead, about 2.8 times the baseline inference time in this implementation, implies that resource-constrained edge platforms may need optimised implementations or a subset of validation components, trading some resilience for latency.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper introduces the Data Fusion Cyber Resilience (DFCR) method: a multi-sensor validation layer for AI-driven maritime situational awareness, comprising multisensor, position, and metadata validation components that adjust an object detector's confidence score into a security-aware 'DFCR confidence' metric. The authors evaluate DFCR on real USV-collected AIS, radar, and optical data using YOLOv8 detectors, comparing against baseline models and standard defences (JPEG compression, adversarial training) across four experiments: clean performance, black-box evolutionary perturbation attacks, PGD patch attacks, and AIS/radar spoofing. They report up to 35% loss reduction for perturbation attacks and 100% loss reduction for patch and (single-contact) spoofing attacks, alongside Wilcoxon signed-rank significance testing and real-world sea trial demonstrations.

Significance. If the claimed reductions hold, the DFCR approach is a meaningful step beyond model-level adversarial defences toward system-level resilience, and the proposed DFCR confidence score is a useful security metric for decision support. The paper's strengths include the use of real maritime data and sea trials, evaluation against recognized attack types (perturbation, patch, spoofing), comparison with established defences, explicit Algorithm 1 pseudocode for the confidence update, and statistical testing of the reported differences. The framing of defence-in-depth for AI systems and the emphasis on security metrics beyond raw model confidence address a real gap in the literature. However, as detailed in the major comments, the central quantitative claims are not yet fully supported because the experiments cover only a narrow set of adversary capabilities and the evaluation pipeline omits several specifications needed for reproducibility and for judging sensitivity to free parameters.

major comments (5)
  1. [V-D, Algorithm 1, Abstract] The reported 0.0000 MSE loss for spoofing attacks applies only to internally inconsistent spoofs (e.g., a large-tanker AIS report paired with a small-buoy radar return). Since Algorithm 1 adds a positive delta for each validation component that passes, a coordinated spoof that forges consistent AIS metadata, radar size, and aligned position would not be penalised; the paper itself acknowledges in V-D that 'spoofing radar signals is highly challenging' but provides no experiment with such consistent spoofs. The abstract's claim of 'up to a 100% reduction in loss for successful spoofing attacks' is therefore not demonstrated for adversaries capable of coordinated multi-sensor spoofing, and the claim should either be tested against consistent spoofs or explicitly qualified to internally inconsistent spoofs.
  2. [V-A, Tables I, III, IV, V] The loss metric is defined only verbally as 'the difference between what is true and what has been predicted', and no computational specification is given for how confidence scores are converted to the reported MSE and MAE values. Without knowing the target values (e.g., whether true contacts are assigned target 1 and false contacts target 0, how missed detections and duplicates are handled, and how multiple contacts per scenario are aggregated), the numbers in Tables I, III, IV, and V cannot be reproduced, and the headline percentage reductions cannot be independently verified. Please provide the exact loss formula and the annotation/aggregation procedure.
  3. [III-D, Algorithm 1] The fixed adjustment values delta(k) for the three validation components are defined in Algorithm 1 and the surrounding text, but their numerical values are never reported. Likewise, the position-validation acceptance thresholds and the parameters of the two-dimensional normal distribution, as well as the SVM hyperparameters (C, kernel) and its training data, are not specified. The zero-loss results in Experiments 3 and 4 depend critically on the magnitude of these penalties relative to the initial YOLO confidence scores; without these parameters, the method is not reproducible and the sensitivity of the results to plausible parameter choices is unknown.
  4. [V, Experiments 2-4] All attacks in the evaluation are non-adaptive: the evolutionary algorithm in Experiment 2, the PGD patch generation in Experiment 3, and the spoofing scenarios in Experiment 4 are optimised against the baseline model and do not attempt to satisfy or bypass the DFCR validation components. Since the paper proposes DFCR as a security mechanism against adversarial attackers, the evaluation should include at least one adaptive adversary that is aware of the validation rules (e.g., a patch that also places a consistent radar/AIS contact). The current results support robustness against non-adaptive attacks only, and the wording 'up to 100% reduction in loss for successful adversarial patch attacks and ... successful spoofing attacks' implies a stronger, adaptive-adversary guarantee than is established.
  5. [Table V, Abstract] For spoofing with 3 and 5 spoofed contacts, the DFCR MSE losses are 0.5136 and 0.4441 respectively, which are far higher than the 0.0000 for 1 contact and are only moderately lower than baseline. The abstract and conclusion state '100% reduction in loss for ... spoofing attacks' without noting that this holds only for the single-spoof case, and the reasons for the sharp degradation with more spoofed contacts are not explained. The claims should be qualified to the actual tested conditions, and the non-monotonic trend in Table V should be discussed.
minor comments (6)
  1. [III (System Architecture)] In the final sentence of the section before Section III-A, 'DFRC system' should be 'DFCR system'.
  2. [II (Background)] In the sentence referencing Microsoft's Tay, the quotation placement is incorrect: '...comments on microsoft's tay" experiment," and wider implications' should be cleaned up, and reference [13] appears to have a stray quote.
  3. [Figure 7] The x-axis label 'JPEGBaseline DFCR Noise Conf Conf Conf Conf' lacks separators and is difficult to read; please list the four groups as separate labels (e.g., 'JPEG', 'Baseline', 'DFCR', 'Noise').
  4. [V-C (Patch Attack)] The PGD description gives alpha = 0.05, ten iterations, and epsilon = 0.3, but the relationship between alpha and epsilon in the clipped gradient update is not stated; please clarify how the PGD step size and perturbation bound are combined.
  5. [V-A (Clean Performance)] For the Wilcoxon signed-rank tests, reporting only p-values obscures effect size; adding a matched-pairs rank-biserial correlation or similar effect-size statistic would help assess the practical magnitude of the differences.
  6. [Abstract] The phrase 'multi-pronged perturbation attacks' is ambiguous, as the perturbation experiments in Section V-B use a single attack type; consider rewording to 'multi-objective perturbation attacks' or 'black-box perturbation attacks'.

Circularity Check

2 steps flagged · score 7.0 of 10

Patch and spoofing loss reductions are restatements of the DFCR confidence-update rule; only the perturbation result is independently empirical.

  1. self definitional [Section III-D, Algorithm 1 and Section V-C, Experiment 3 (Table IV)]
    "Update confidence: Cm ← Cm + δ(k) × s(k)m ... Clamp confidence: Cm ← min (max (Cm, 0) , 1) ... This experiment focuses on attacking only the optical detection model with adversarial patches ... Much of the DFCR system’s defence likely relies on the absence of corresponding AIS or radar inputs to validate contacts identified by the optical model."

    The adversarial patch attack is applied only to the optical model, so by design the optical contact has no corresponding AIS or radar contact. Under Algorithm 1, the multisensor validation component then returns s = -1 by construction, fixed penalties are subtracted, and the confidence is clamped to zero. The reported MSE loss of 0.0000 for DFCR is therefore the confidence-update equation applied to a deliberately single-sensor contact, not an empirically demonstrated defence. The headline '100% reduction in loss for successful adversarial patch attacks' is a restatement of the penalty rule, since any unvalidated contact is forced to zero confidence.

  2. self definitional [Section V-D, Experiment 4 (Table V) and Algorithm 1]
    "When attacked by a single spoofed contact, the MSE of the DFCR system’s confidence (0.00) is significantly better than the baseline model confidence (0.51). This is likely due to missing but expected corresponding contacts that can validate the spoofed contact. ... A key assumption underlying this system is that spoofing radar signals is highly challenging."

    The spoofing experiment injects AIS or radar contacts that have no consistent counterpart in the other sensor channels or have mismatched metadata, so the validation components fail by construction. Algorithm 1 then subtracts fixed δ penalties and clamps the final confidence to zero, making the Table V MSE of 0.0000 a direct consequence of the scoring rule rather than a measured property of the system. The '100% reduction in loss for successful spoofing attacks' also depends on the stated but untested assumption that an adversary cannot forge a radar contact consistent with a spoofed AIS message; if an attacker could create cross-sensor-consistent contacts, the validation components would pass and the DFCR score would not penalise the spoof.

full rationale

The DFCR confidence score is defined by Algorithm 1 as the base model confidence plus fixed additive penalties for failed multisensor, position, and metadata validation components. In Experiments 3 and 4, the attacks are constructed so that the injected contacts necessarily fail these checks: the patch is optical-only, and the spoofed AIS or radar signals lack consistent corresponding contacts or matching metadata. The reported 0.0000 MSE losses are therefore the algorithm's clamping behaviour applied to inputs that fail by design, making the claimed 100% patch and spoofing loss reductions circular with the confidence-update definition. The perturbation attack experiment (Experiment 2) is a genuine empirical comparison and its 35% reduction is not circular, but the abstract's central headline includes the by-construction zero losses. Because the central claim is partially forced by the definition of the metric and an untested adversary-capability assumption, a score of 7 is appropriate.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claims depend on several domain assumptions (radar spoofing difficulty, cross-sensor correspondence), an implicit non-adaptive threat model, and hand-chosen confidence adjustment values. These are not derived from first principles or validated by independent benchmarks.

free parameters (3)
  • Delta (adjustment amounts) for validation components = not specified; example 0.3
    The DFCR confidence is updated as C_m^(k) = C_m^(k-1) + delta(k)*s_m^(k). The magnitude of delta determines how strongly failed validations are penalized; the paper gives an illustrative value of 0.3 but not the experimental values. The reported loss reductions depend on these user-chosen constants. (Section III-D, Algorithm 1).
  • Position validation distribution parameters (2D normal variance and acceptance thresholds) = not specified
    Contact position validation uses a two-dimensional normal distribution centered on each contact; the covariance and the threshold for 'significantly or unusually misaligned' are not provided. This affects whether a real contact is penalized. (Section III-C.1).
  • SVM hyperparameters (C, kernel, training data) = not specified
    Metadata validation uses an SVM with objective min 1/2||w||^2 + C sum max(0,1-y_i(w.x_i-b)); the regularization parameter C, kernel choice, and training set are not described. The classifier's accuracy directly affects the DFCR score. (Section III-C.2).
assumptions (5)
  • domain assumption Radar spoofing is highly challenging; spoofed AIS contacts without matching radar returns can be treated as adversarial.
    Stated in Section V-D: 'A key assumption underlying this system is that spoofing radar signals is highly challenging.' The spoofing defense's 100% loss reduction depends on this premise.
  • domain assumption All legitimate contacts within sensor range produce corresponding detections across AIS, radar, and optical.
    The validation components penalize contacts that lack cross-sensor correspondences. The authors acknowledge in Section V-C that contacts without radar verification were disregarded, which would cause false negatives if this assumption fails.
  • ad hoc to paper The adversary is non-adaptive and does not optimize against the DFCR validation components.
    In Section V-B, the evolutionary attack maximizes only the AIS and radar model confidences, and in Section V-C the PGD patch attacks only the optical model. No attack is designed to pass position or metadata validation. This is an implicit threat-model assumption.
  • ad hoc to paper The additive fixed-confidence adjustment rule is a valid security metric.
    Algorithm 1 defines the DFCR score as base confidence plus fixed plus-or-minus delta per validation. The paper does not justify this functional form or show it correlates with true attack success.
  • standard math Standard mathematics of homography projection, SVM classification, and 2D normal distributions.
    Used in Section III-C for coordinate mapping, metadata classification, and position confidence; accepted as background.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Preventing Adversarial AI Attacks Against Autonomous Situational Awareness: A Maritime Case Study." pith.science (2026). https://pith.science/paper/7ET3G2C6

@misc{pith2026250521609,
  author       = {Pith},
  title        = {Pith review of: Preventing Adversarial AI Attacks Against Autonomous Situational Awareness: A Maritime Case Study},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7ET3G2C6}},
  note         = {Machine review of arXiv:2505.21609}
}
read the original abstract

Adversarial artificial intelligence (AI) attacks pose a significant threat to autonomous transportation, such as maritime vessels, that rely on AI components. Malicious actors can exploit these systems to deceive and manipulate AI-driven operations. This paper addresses three critical research challenges associated with adversarial AI: the limited scope of traditional defences, inadequate security metrics, and the need to build resilience beyond model-level defences. To address these challenges, we propose building defences utilising multiple inputs and data fusion to create defensive components and an AI security metric as a novel approach toward developing more secure AI systems. We name this approach the Data Fusion Cyber Resilience (DFCR) method, and we evaluate it through real-world demonstrations and comprehensive quantitative analyses, comparing a system built with the DFCR method against single-input models and models utilising existing state-of-the-art defences. The findings show that the DFCR approach significantly enhances resilience against adversarial machine learning attacks in maritime autonomous system operations, achieving up to a 35\% reduction in loss for successful multi-pronged perturbation attacks, up to a 100\% reduction in loss for successful adversarial patch attacks and up to 100\% reduction in loss for successful spoofing attacks when using these more resilient systems. We demonstrate how DFCR and DFCR confidence scores can reduce adversarial AI contact confidence and improve decision-making by the system, even when typical adversarial defences have been compromised. Ultimately, this work contributes to the development of more secure and resilient AI-driven systems against adversarial attacks.

Figures

Figures reproduced from arXiv: 2505.21609 by the authors.

Figure 1
Figure 1. The DFCR system topology shows the defensive components and DFCR confidence output. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Comparison of radar contacts in different coordinate spaces. (a) shows [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. The image shows AIS, radar, and optical spaces. A well-verified [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: The USV Bauza. assess the DFCR system developed for MAS situational aware￾ness. During these attacks, the confidence values of different systems and models, including the DFCR confidence score, will be compared to measure the effectiveness of the defences. A. Marine Da…
Figure 5
Figure 5. Figure 5: Elevated y−values (raw confidence values) correspond to superior detection capabilities, as all detections are genuine. TABLE I COMPARISON OF METRICS BETWEEN DFCR CONFIDENCE AND BASELINE MODEL CONFIDENCE. (LOWER VALUES ARE BETTER) UNDER NORMAL CONDITIONS. Metric DFCR C…
Figure 6
Figure 6. Figure 6: An evolutionary algorithm (EA) evolving adversarial patches for [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: A box plot illustrating the preliminary confidence scores of systems [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

91 extracted references · 65 canonical work pages

  1. [1]

    Towards utilising autonomous ships: A viable advance in industry 4.0,

    H. R. Askari and M. N. Hossain, “Towards utilising autonomous ships: A viable advance in industry 4.0,” Journal of International Maritime Safety, Environmental Affairs, and Shipping , vol. 6, no. 1, pp. 39–49, 2022

    2022

  2. [2]

    Situation awareness in remote control centres for unmanned ships,

    T. Porathe, J. Prison, and Y . Man, “Situation awareness in remote control centres for unmanned ships,” in Proceedings of Human Factors in Ship Design & Operation, 26-27 February 2014, London, UK , 2014, p. 93

    2014

  3. [3]

    Worlds first autonomous ship to launch in 2018,

    D. Morris, “Worlds first autonomous ship to launch in 2018,” 2017. [Online]. Available: http://fortune.com/2017/07/22/ first-autonomous-ship-yara-birkeland/

    2018

  4. [4]

    Costs and benefits of au- tonomous shipping—a literature review,

    E. Ziajka-Pozna ´nska and J. Montewka, “Costs and benefits of au- tonomous shipping—a literature review,” Applied Sciences , vol. 11, no. 10, p. 4553, 2021

    2021

  5. [5]

    Autonomous ships: a review, innovative applications and future maritime business models,

    Z. H. Munim, “Autonomous ships: a review, innovative applications and future maritime business models,” in Supply Chain Forum: An International Journal, vol. 20. Taylor & Francis, 2019, pp. 266–279

    2019

  6. [6]

    Analyzing the eco- nomic benefit of unmanned autonomous ships: An exploratory cost- comparison between an autonomous and a conventional bulk carrier,

    L. Kretschmann, H.-C. Burmeister, and C. Jahn, “Analyzing the eco- nomic benefit of unmanned autonomous ships: An exploratory cost- comparison between an autonomous and a conventional bulk carrier,” Research in transportation business & management , vol. 25, pp. 76–86, 2017

    2017

  7. [7]

    The ocean-going autonomous ship—challenges and threats,

    A. Felski and K. Zwolak, “The ocean-going autonomous ship—challenges and threats,” Journal of Marine Science and Engineering, vol. 8, no. 1, p. 41, 2020

    2020

  8. [8]

    Creating value through autonomous shipping: an ecosystem perspective,

    A. Tsvetkova and M. Hellstr ¨om, “Creating value through autonomous shipping: an ecosystem perspective,” Maritime Economics & Logistics , pp. 1–23, 2022

    2022

Show all 91 references
  1. [9]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  2. [10]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  3. [11]

    Thinking about the security of AI systems,

    NCSC, “Thinking about the security of AI systems,”

  4. [12]

    Introducing our new machine learning security principles,

    N. NCSC, “Introducing our new machine learning security principles,” Aug 2022. [Online]. Available: https://www.ncsc.gov.uk/blog-post/ introducing-our-new-machine-learning-security-principles

    2022

  5. [13]

    Why we should have seen that coming: comments on microsoft’s tay

    M. J. Wolf, K. Miller, and F. S. Grodzinsky, “Why we should have seen that coming: comments on microsoft’s tay” experiment,” and wider implications,” Acm Sigcas Computers and Society , vol. 47, no. 3, pp. 54–64, 2017

    2017

  6. [14]

    Machine learning security in industry: A quantitative survey,

    K. Grosse, L. Bieringer, T. R. Besold, B. Biggio, and K. Krombholz, “Machine learning security in industry: A quantitative survey,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 1749– 1762, 2023

    2023

  7. [15]

    Securing con- nected & autonomous vehicles: Challenges posed by adversarial machine learning and the way forward,

    A. Qayyum, M. Usama, J. Qadir, and A. Al-Fuqaha, “Securing con- nected & autonomous vehicles: Challenges posed by adversarial machine learning and the way forward,” IEEE Communications Surveys & Tutorials, vol. 22, no. 2, pp. 998–1026, 2020

    2020

  8. [16]

    Cybersecurity of autonomous vehicles: A systematic literature review of adversarial attacks and defense models,

    M. Girdhar, J. Hong, and J. Moore, “Cybersecurity of autonomous vehicles: A systematic literature review of adversarial attacks and defense models,” IEEE Open Journal of Vehicular Technology , vol. 4, pp. 417–437, 2023

    2023

  9. [17]

    Artificial intelligence failures in autonomous vehicles: Causes, implications, and prevention,

    H. C. Joshi and S. Kumar, “Artificial intelligence failures in autonomous vehicles: Causes, implications, and prevention,” Computer, vol. 57, no. 11, pp. 18–30, 2024

    2024

  10. [18]

    Quan- tifying the econometric loss of a cyber-physical attack on a seaport,

    K. Tam, B. Chang, R. Hopcraft, K. Moara-Nkwe, and K. Jones, “Quan- tifying the econometric loss of a cyber-physical attack on a seaport,” Frontiers in Computer Science , vol. 4, p. 1057507, 2023

    2023

  11. [19]

    Adversarial AI testcases for maritime autonomous systems,

    M. J. Walter, A. Barrett, D. J. Walker, and K. Tam, “Adversarial AI testcases for maritime autonomous systems,” AI, Computer Science and Robotics Technology, 2023

    2023

  12. [20]

    A red teaming framework for securing AI in maritime autonomous systems,

    M. J. Walter, A. Barrett, and K. Tam, “A red teaming framework for securing AI in maritime autonomous systems,” Applied Artificial Intelligence, vol. 38, no. 1, p. 2395750, 2024

    2024

  13. [21]

    Learning in the presence of malicious errors,

    M. Kearns and M. Li, “Learning in the presence of malicious errors,” in Proceedings of the twentieth annual ACM symposium on Theory of computing, 1988, pp. 267–280

    1988

  14. [22]

    Adversarial classification,

    N. Dalvi, P. Domingos, Mausam, S. Sanghai, and D. Verma, “Adversarial classification,” in Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, 2004, pp. 99–108

    2004

  15. [23]

    Adversarial learning,

    D. Lowd and C. Meek, “Adversarial learning,” in Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining , 2005, pp. 641–647

    2005

  16. [24]

    Evasion attacks against machine learning at test time,

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. ˇSrndi´c, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, Septem...

    2013

  17. [25]

    Adversarial machine learning at scale,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” arXiv preprint arXiv:1611.01236 , 2016

    2016 arXiv

  18. [26]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in 2016 IEEE European symposium on security and privacy (EuroS&P) . IEEE, 2016, pp. 372–387

    2016

  19. [27]

    One pixel attack for fooling deep neural networks,

    J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,” IEEE Transactions on Evolutionary Computation , vol. 23, no. 5, pp. 828–841, 2019

    2019

  20. [28]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 IEEE symposium on security and privacy (SnP) . Ieee, 2017, pp. 39–57

    2017

  21. [29]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  22. [30]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 2574–2582

    2016

  23. [31]

    Can machine learning be secure?

    M. Barreno, B. Nelson, R. Sears, A. D. Joseph, and J. D. Tygar, “Can machine learning be secure?” in Proceedings of the 2006 ACM Symposium on Information, computer and communications security , 2006, pp. 16–25. 15

    2006

  24. [32]

    Support vector machines under adversarial label noise,

    B. Biggio, B. Nelson, and P. Laskov, “Support vector machines under adversarial label noise,” in Asian conference on machine learning . PMLR, 2011, pp. 97–112

    2011

  25. [33]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  26. [34]

    Attack strength vs. detectability dilemma in adversarial machine learning,

    C. Frederickson, M. Moore, G. Dawson, and R. Polikar, “Attack strength vs. detectability dilemma in adversarial machine learning,” in 2018 international joint conference on neural networks (IJCNN) . IEEE, 2018, pp. 1–8

    2018

  27. [35]

    Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers,

    G. Ateniese, L. V . Mancini, A. Spognardi, A. Villani, D. Vitali, and G. Felici, “Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers,” International Jour- nal of Security and Networks , vol. 10, no. 3, pp. 137–150, 2015

    2015

  28. [36]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SnP) . IEEE, 2017, pp. 3–18

    2017

  29. [37]

    Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays,

    N. Homer, S. Szelinger, M. Redman, D. Duggan, W. Tembe, J. Muehling, J. V . Pearson, D. A. Stephan, S. F. Nelson, and D. W. Craig, “Resolving individuals contributing trace amounts of dna to highly complex mixtures using high-density snp genotyping microarrays,”PLoS genetics, ...

    2008

  30. [38]

    Stealing machine learning models via prediction {APIs},

    F. Tram `er, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction {APIs},” in 25th USENIX security symposium (USENIX Security 16) , 2016, pp. 601–618

    2016

  31. [39]

    Survey of vulnerabilities in large language models revealed by adversarial attacks,

    E. Shayegani, M. A. A. Mamun, Y . Fu, P. Zaree, Y . Dong, and N. Abu- Ghazaleh, “Survey of vulnerabilities in large language models revealed by adversarial attacks,” arXiv preprint arXiv:2310.10844 , 2023

    2023 arXiv

  32. [40]

    A survey on large language model (LLM) security and privacy: The good, the bad, and the ugly,

    Y . Yao, J. Duan, K. Xu, Y . Cai, Z. Sun, and Y . Zhang, “A survey on large language model (LLM) security and privacy: The good, the bad, and the ugly,” High-Confidence Computing, p. 100211, 2024

    2024

  33. [41]

    Breaking down the defenses: A comparative survey of attacks on large language models,

    A. G. Chowdhury, M. M. Islam, V . Kumar, F. H. Shezan, V . Jain, and A. Chadha, “Breaking down the defenses: A comparative survey of attacks on large language models,” arXiv preprint arXiv:2403.04786 , 2024

    2024

  34. [42]

    Understanding robustness of transformers for image classification,

    S. Bhojanapalli, A. Chakrabarti, D. Glasner, D. Li, T. Unterthiner, and A. Veit, “Understanding robustness of transformers for image classification,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 10 231–10 241

    2021

  35. [43]

    Reveal of vision transformers robustness against adversarial attacks,

    A. Aldahdooh, W. Hamidouche, and O. Deforges, “Reveal of vision transformers robustness against adversarial attacks,” arXiv preprint arXiv:2106.03734, 2021

    2021 arXiv

  36. [44]

    Patch-fool: Are vision transformers always robust against adversarial perturbations?

    Y . Fu, S. Zhang, S. Wu, C. Wan, and Y . Lin, “Patch-fool: Are vision transformers always robust against adversarial perturbations?” arXiv preprint arXiv:2203.08392, 2022

    2022 arXiv

  37. [45]

    Towards transferable adversarial attacks on vision transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y .-G. Jiang, “Towards transferable adversarial attacks on vision transformers,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 3, 2022, pp. 2668–2676

    2022

  38. [46]

    Towards transferable adversarial attacks on image and video transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, Y .-G. Jiang, and L. S. Davis, “Towards transferable adversarial attacks on image and video transformers,” IEEE Transactions on Image Processing , vol. 32, pp. 6346–6358, 2023

    2023

  39. [47]

    Slow- former: Universal adversarial patch for attack on compute and energy efficiency of inference efficient vision transformers,

    K. Navaneet, S. A. Koohpayegani, E. Sleiman, and H. Pirsiavash, “Slow- former: Universal adversarial patch for attack on compute and energy efficiency of inference efficient vision transformers,” arXiv preprint arXiv:2310.02544, 2023

    arXiv

  40. [48]

    Desparsify: Adversarial attack against token sparsification mechanisms in vision transformers,

    O. Yehezkel, A. Zolfi, A. Baras, Y . Elovici, and A. Shabtai, “Desparsify: Adversarial attack against token sparsification mechanisms in vision transformers,” arXiv preprint arXiv:2402.02554 , 2024

    2024 arXiv

  41. [49]

    Literature review of maritime cyber security: The first decade,

    A. Vineetha Harish, K. Tam, and K. Jones, “Literature review of maritime cyber security: The first decade,” Maritime Technology and Research, 2024

    2024

  42. [50]

    Artificial intelligence for au- tonomous ship: Potential cyber threats and security,

    J.-W. Yoo, Y .-H. Jo, and Y .-K. Cha, “Artificial intelligence for au- tonomous ship: Potential cyber threats and security,” Journal of the Korea Institute of Information Security & Cryptology , vol. 32, no. 2, pp. 447–463, 2022

    2022

  43. [51]

    Vulnerability of clean-label poisoning attack for object detection in maritime autonomous surface ships,

    C. Lee and S. Lee, “Vulnerability of clean-label poisoning attack for object detection in maritime autonomous surface ships,” Journal of Marine Science and Engineering , vol. 11, no. 6, p. 1179, 2023

    2023

  44. [52]

    Adver- sarial waypoint injection attacks on maritime autonomous surface ships (MASS) collision avoidance systems,

    G. Longo, M. Martelli, E. Russo, A. Merlo, and R. Zaccone, “Adver- sarial waypoint injection attacks on maritime autonomous surface ships (MASS) collision avoidance systems,” Journal of Marine Engineering & Technology, pp. 1–12, 2023

    2023

  45. [53]

    Autonomous cyber defense agents for nato: Threat analysis, design, and experimentation,

    A. Velazquez, R. R. F. Lopes, A. B ´ecue, J. F. Loevenich, P. H. Rettore, and K. Wrona, “Autonomous cyber defense agents for nato: Threat analysis, design, and experimentation,” in MILCOM 2023-2023 IEEE Military Communications Conference (MILCOM) . IEEE, 2023, pp. 207–212

    2023

  46. [54]

    Advancing radar cybersecurity: Defending against adversarial attacks in SAR ship recognition using explainable AI and ensemble learning,

    A. H. Oveis, G. Meucci, F. Mancuso, and A. Cantelli-Forti, “Advancing radar cybersecurity: Defending against adversarial attacks in SAR ship recognition using explainable AI and ensemble learning,” in 2024 IEEE 49th Conference on Local Computer Networks (LCN) . IEEE, 2024, pp. 1–7

    2024

  47. [55]

    A practical deceptive jamming method based on vulnerable location awareness adversarial attack for radar HRRP target recognition,

    C. Du, Y . Cong, L. Zhang, D. Guo, and S. Wei, “A practical deceptive jamming method based on vulnerable location awareness adversarial attack for radar HRRP target recognition,” IEEE Transactions on Infor- mation Forensics and Security , vol. 17, pp. 2410–2424, 2022

    2022

  48. [56]

    Adversarial camouflage for naval vessels,

    L. Aurdal, K. H. Løkken, R. A. Klausen, A. Brattli, and H. C. Palm, “Adversarial camouflage for naval vessels,” in Artificial Intelligence and Machine Learning in Defense Applications , vol. 11169. SPIE, 2019, pp. 163–174

    2019

  49. [57]

    Robustness of adversarial camouflage (ac) for naval vessels,

    K. H. Løkken, A. Brattli, H. C. Palm, L. Aurdal, and R. A. Klausen, “Robustness of adversarial camouflage (ac) for naval vessels,” in Auto- matic Target Recognition XXX , vol. 11394. SPIE, 2020, pp. 184–197

    2020

  50. [58]

    Shipcamou: adversarial camouflage against optical remote sensing image ship detector,

    Y . Pan and H. Wang, “Shipcamou: adversarial camouflage against optical remote sensing image ship detector,” in First Aerospace Frontiers Conference (AFC 2024) , vol. 13218. SPIE, 2024, pp. 933–943

    2024

  51. [59]

    Cyber risk assessment of cyber-enabled autonomous cargo vessel,

    A. Yousaf, A. Amro, P. T. H. Kwa, M. Li, and J. Zhou, “Cyber risk assessment of cyber-enabled autonomous cargo vessel,” International Journal of Critical Infrastructure Protection , vol. 46, p. 100695, 2024

    2024

  52. [60]

    Verifai: Framework for functional verification of AI based systems in the mar- itime domain,

    T. Stach, P. Koch, M. Constapel, M. Portier, and H. Schmid, “Verifai: Framework for functional verification of AI based systems in the mar- itime domain,” TransNav, International Journal on Marine Navigation and Safety od Sea Transportation , vol. 18, no. 3, pp. 585–591, 2024

    2024

  53. [61]

    Formulating cybersecurity requirements for au- tonomous ships using the square methodology,

    J. Yoo and Y . Jo, “Formulating cybersecurity requirements for au- tonomous ships using the square methodology,” Sensors, vol. 23, no. 11, p. 5033, 2023

    2023

  54. [62]

    Artificial intelligence and data fusion at the edge,

    A. Munir, E. Blasch, J. Kwon, J. Kong, and A. Aved, “Artificial intelligence and data fusion at the edge,” IEEE Aerospace and Electronic Systems Magazine, vol. 36, no. 7, pp. 62–78, 2021

    2021

  55. [63]

    An introduction to multisensor data fusion,

    D. L. Hall and J. Llinas, “An introduction to multisensor data fusion,” Proceedings of the IEEE , vol. 85, no. 1, pp. 6–23, 1997

    1997

  56. [64]

    Bayesian data fusion of multiview synthetic aperture sonar imagery for seabed classification,

    D. P. Williams, “Bayesian data fusion of multiview synthetic aperture sonar imagery for seabed classification,” IEEE Transactions on Image Processing, vol. 18, no. 6, pp. 1239–1254, 2009

    2009

  57. [65]

    Bayesian information fusion and multitarget tracking for maritime situational awareness,

    D. Gaglione, G. Soldi, F. Meyer, F. Hlawatsch, P. Braca, A. Farina, and M. Z. Win, “Bayesian information fusion and multitarget tracking for maritime situational awareness,” IET Radar, Sonar & Navigation , vol. 14, no. 12, pp. 1845–1857, 2020

    2020

  58. [66]

    Asynchronous trajectory matching-based multimodal maritime data fusion for vessel traffic surveillance in inland waterways,

    Y . Guo, R. W. Liu, J. Qu, Y . Lu, F. Zhu, and Y . Lv, “Asynchronous trajectory matching-based multimodal maritime data fusion for vessel traffic surveillance in inland waterways,” IEEE Transactions on Intelli- gent Transportation Systems, vol. 24, no. 11, pp. 12 779–12 792, 2023

    2023

  59. [67]

    Space-based global maritime surveillance. part ii: Artificial intelligence and data fusion techniques,

    G. Soldi, D. Gaglione, N. Forti, L. M. Millefiori, P. Braca, S. Carniel, A. Di Simone, A. Iodice, D. Riccio, F. C. Daffin `a et al., “Space-based global maritime surveillance. part ii: Artificial intelligence and data fusion techniques,” IEEE Aerospace and Electronic Systems M...

    2021

  60. [68]

    A network model for detecting marine floating weak targets based on multimodal data fusion of radar echoes,

    G. Duan, Y . Wang, Y . Zhang, S. Wu, and L. Lv, “A network model for detecting marine floating weak targets based on multimodal data fusion of radar echoes,” Sensors, vol. 22, no. 23, p. 9163, 2022

    2022

  61. [69]

    A fuzzy-logic architecture for autonomous multisensor data fusion,

    J. A. Stover, D. L. Hall, and R. E. Gibson, “A fuzzy-logic architecture for autonomous multisensor data fusion,” IEEE Transactions on Industrial Electronics, vol. 43, no. 3, pp. 403–410, 1996

    1996

  62. [70]

    Practical moving target detection in maritime environments using fuzzy multi-sensor data fusion,

    W. Liu, Y . Liu, B. A. Gunawan, and R. Bucknall, “Practical moving target detection in maritime environments using fuzzy multi-sensor data fusion,” International Journal of Fuzzy Systems, vol. 23, no. 6, pp. 1860– 1878, 2021

    2021

  63. [71]

    Multisensor tracking of marine targets: Decentralized fusion of kalman and neural filters,

    A. Stateczny and W. Kazimierski, “Multisensor tracking of marine targets: Decentralized fusion of kalman and neural filters,” International Journal of Electronics and Telecommunications , vol. 57, pp. 65–70, 2011

    2011

  64. [72]

    Image and ais data fusion technique for maritime computer vision applications,

    E. G ¨ulsoylu, P. Koch, M. Yildiz, M. Constapel, and A. P. Kelm, “Image and ais data fusion technique for maritime computer vision applications,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2024, pp. 859–868

    2024

  65. [73]

    A CNNGRU-MHA method for ship trajectory prediction based on marine fusion data,

    J. Bi, M. Gao, K. Bao, W. Zhang, X. Zhang, and H. Cheng, “A CNNGRU-MHA method for ship trajectory prediction based on marine fusion data,” Ocean Engineering, vol. 310, p. 118701, 2024

    2024

  66. [74]

    Ship wake detection using data fusion in multi-sensor remote sensing applications,

    E. Higgins, D. Sobien, L. Freeman, and J. S. Pitt, “Ship wake detection using data fusion in multi-sensor remote sensing applications,” in AIAA SCITECH 2022 Forum, 2022, p. 0997. 16

    2022

  67. [75]

    Deep-learning approach based on multi-data fusion for damage recognition of marine platforms under complex loads,

    S. Xin, Z. Qi, L. Yang, H. Yi, and J. Ziguang, “Deep-learning approach based on multi-data fusion for damage recognition of marine platforms under complex loads,” Ocean Engineering, vol. 303, p. 116604, 2024

    2024

  68. [76]

    Batman: A brain-like approach for tracking maritime activity and nuance,

    A. Jones, S. Koehler, M. Jerge, M. Graves, B. King, R. Dalrymple, C. Freese, and J. V on Albade, “Batman: A brain-like approach for tracking maritime activity and nuance,” Sensors, vol. 23, no. 5, p. 2424, 2023

    2023

  69. [77]

    Remote and autonomous ships,

    R. Royce, “Remote and autonomous ships,” AAWA Position Paper, 2016

    2016

  70. [78]

    Bon voyage for the autonomous ship mayflower,

    M. Anderson, “Bon voyage for the autonomous ship mayflower,” IEEE Spectrum, vol. 57, no. 1, pp. 36–39, 2019

    2019

  71. [79]

    Design and assessment of a low-cost autonomous control system to mitigate effects of communication dropouts in uncrewed surface vessels,

    A. Barrett, “Design and assessment of a low-cost autonomous control system to mitigate effects of communication dropouts in uncrewed surface vessels,” Unpublished, Sep 2023

    2023

  72. [80]

    Sensors and AI techniques for situational awareness in au- tonomous ships: A review,

    S. Thombre, Z. Zhao, H. Ramm-Schmidt, J. M. V . Garc´ıa, T. Malkam¨aki, S. Nikolskiy, T. Hammarberg, H. Nuortie, M. Z. H. Bhuiyan, S. S ¨arkk¨a et al. , “Sensors and AI techniques for situational awareness in au- tonomous ships: A review,” IEEE transactions on intelligent tran...

    2020

  73. [81]

    A study of the effect of jpg compression on adversarial images,

    G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,” arXiv preprint arXiv:1608.00853, 2016

    2016 arXiv

  74. [82]

    YOLO by Ultralytics,

    G. Jocher, A. Chaurasia, and J. Qiu, “YOLO by Ultralytics,” Jan. 2023. [Online]. Available: https://github.com/ultralytics/ultralytics

    2023

  75. [83]

    End-to-end object detection with transformers,

    N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and S. Zagoruyko, “End-to-end object detection with transformers,” in European conference on computer vision . Springer, 2020, pp. 213– 229

    2020

  76. [84]

    Future of maritime autonomy: cybersecurity, trust and mariner’s situational awareness,

    J. P. Misas, R. Hopcraft, K. Tam, and K. Jones, “Future of maritime autonomy: cybersecurity, trust and mariner’s situational awareness,” Journal of Marine Engineering and Technology, vol. 23, no. 3, pp. 224– 235, 2024

    2024

  77. [85]

    An evolutionary many-objective optimization algorithm using reference-point-based nondominated sorting approach, part I: solving problems with box constraints,

    K. Deb and H. Jain, “An evolutionary many-objective optimization algorithm using reference-point-based nondominated sorting approach, part I: solving problems with box constraints,” IEEE transactions on evolutionary computation, vol. 18, no. 4, pp. 577–601, 2013

    2013

  78. [86]

    Evolutionary art attack for black-box adversarial example generation,

    P. N. Williams, K. Li, and G. Min, “Evolutionary art attack for black-box adversarial example generation,” IEEE Transactions on Evolutionary Computation, 2024

    2024

  79. [87]

    Jpeg-resistant adversarial images,

    R. Shin and D. Song, “Jpeg-resistant adversarial images,” in NIPS 2017 workshop on machine learning and computer security, vol. 1, 2017, p. 8

    2017

  80. [88]

    AIS spoofing: A tutorial for researchers,

    G. C. Kessler and D. M. Zorri, “AIS spoofing: A tutorial for researchers,” in 2024 IEEE 49th Conference on Local Computer Networks (LCN) . IEEE, 2024, pp. 1–7

    2024

  81. [89]

    Cyber-risk assessment for autonomous ships,

    K. Tam and K. Jones, “Cyber-risk assessment for autonomous ships,” in 2018 international conference on cyber security and protection of digital services (cyber security) . IEEE, 2018, pp. 1–8

    2018

  82. [90]

    Slowformer: Adversarial attack on compute and energy consumption of efficient vision transformers,

    K. Navaneet, S. A. Koohpayegani, E. Sleiman, and H. Pirsiavash, “Slowformer: Adversarial attack on compute and energy consumption of efficient vision transformers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 24 786–24 797

    2024

  83. [2023]

    Available: https://www.ncsc.gov.uk/blog-post/ thinking-about-security-ai-systems

    [Online]. Available: https://www.ncsc.gov.uk/blog-post/ thinking-about-security-ai-systems

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.