Pith. sign in

REVIEW 5 major objections 5 minor 2 cited by

Gaussian Splatting Under Attack: Investigating Adversarial Noise in 3D Objects

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Masked adversarial noise survives 3D Gaussian Splatting reconstruction and cuts CLIP's top-1 accuracy on training-view renders from 95.4% to 12.5%.

desk verdict Plausible demo that masked 2D IFGSM noise can survive 3DGS reconstruction and hurt CLIP on some rendered views, but the missing controls and tiny evaluation keep it a preliminary result, not a demonstrated vulnerability. read the letter →

arxiv 2412.02803 v1 pith:A7YNVY5T submitted 2024-12-03 cs.CV cs.AIeess.IV

Abdurrahman Zeybey , Mehmet Ergezer , Tommy Nguyen This is my paper · ORCID
classification cs.CVcs.AIeess.IV
keywords adversarialattacks3DGaussianSplattingCLIPvision-languagemodelsM-IFGSMmaskedperturbationszero-shotobjectdetectionradiancefieldrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a 2D adversarial attack can survive a full 3D reconstruction pipeline and keep fooling a vision-language classifier. It introduces M-IFGSM, an iterative fast-gradient-sign attack whose updates are multiplied by a segmentation mask so that only the target object is changed; the resulting images are used to train a 3D Gaussian Splatting model. The reported effect is that CLIP's top-1 accuracy on renders from training camera positions drops from 95.4% to 12.5%, and on held-out test camera positions from 91.2% to 35.4%, with confidence shifting from the true class to misclassifications. If that holds, reconstructed 3D scenes can carry human-invisible errors into downstream classification, which matters for robotics, autonomous driving, and surveillance.

What carries the argument

The load-bearing object is the masked update rule $X_{N+1}^{\mathrm{adv}} = \mathrm{Clip}\left(X^{\mathrm{inv}} + M \odot \left(X_N^{\mathrm{adv}} + \epsilon \cdot \mathrm{sign}(\nabla_X J)\right)\right)$, where $M$ is a Segment Anything segmentation mask and $X^{\mathrm{inv}}$ is the untouched background. M-IFGSM iterates this rule until the true-class probability reaches zero, then the attacked images are fed into 3D Gaussian Splatting, whose optimization bakes the localized noise into the Gaussians' appearance parameters; rendering those Gaussians with a tile-based rasterizer produces the views that CLIP then misclassifies.

What would settle it

A direct check is to compare M-IFGSM against random Gaussian noise of the same $\ell_\infty$ magnitude applied to the same masked regions: if the random-noise renders produce a similar drop in CLIP top-1 accuracy, the reported 12.5% and 35.4% figures would be a masking artifact rather than evidence that adversarial gradients transfer through 3DGS.

Watch

Extended reading notes

Core claim

The central claim is that masked 2D adversarial perturbations become part of the 3D representation during Gaussian Splatting optimization and reappear in rasterized renders. Using eight CO3D classes, the authors report that CLIP ViT-B/16's top-1 accuracy falls from 95.4% to 12.5% on training-view renders and from 91.2% to 35.4% on test-view renders, while the model's confidence in the true label is replaced by confidence in wrong labels. The authors describe the added noise as nearly imperceptible to human observers, and they attribute the attack's transfer to the mask focusing all perturbation energy on the object itself.

Load-bearing premise

The paper assumes that noise placed only on the object in a handful of training photographs will survive the 3D reconstruction optimization and still degrade classification when the model is rendered from camera positions that were never part of the attack.

Editorial extensions

If this is right

  • Training-view renders of an adversarially reconstructed 3DGS model classify the true object only 12.5% of the time, against 95.4% for a clean model.
  • Novel test-view renders still drop from 91.2% to 35.4% top-1 accuracy, so the effect is not limited to memorized viewpoints.
  • Because the perturbation is confined to the object silhouette and reported as nearly imperceptible, human inspection alone is not a reliable defense.
  • The same masked-attack pipeline is described as model-agnostic, so other differentiable classifiers besides CLIP are exposed to the same transfer.
  • The couch failure case shows that when segmentation misses an object instance, the clean instance can keep the prediction correct, making mask coverage a direct control variable for attack success.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable next step the paper does not run is to backpropagate through the 3DGS rasterizer and perturb the Gaussian parameters directly, which would likely close the train/test gap the authors observe for unseen camera positions.
  • The large per-class spread in the paper's rendered-view table (suitcase test renders stay at 0% top-1 while couch and hydrant stay near 83%) suggests that multi-view fusion or render-time smoothing could average the attack out, a defensive direction the paper does not explore.
  • Because M-IFGSM only needs a differentiable classifier and a segmentation mask, the same 2D-to-3D transfer should generalize to other vision-language and detection models, with the attack's real-world harm depending on whether an adversary can get manipulated images into the reconstruction pipeline.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes M-IFGSM (Masked Iterative Fast Gradient Sign Method), an adversarial attack that applies masked perturbations to 2D images of objects, then uses those adversarially perturbed images to reconstruct 3D Gaussian Splatting (3DGS) models. The authors evaluate the attack on CLIP ViT-B/16 zero-shot classification using eight object classes from CO3D, reporting that top-1 accuracy on rendered views drops from 95.4% to 12.5% for training-view renders and from 91.2% to 35.4% for test-view renders. The central claim is that 2D masked adversarial noise survives 3DGS reconstruction and degrades CLIP classification on novel views, with the noise being nearly imperceptible to humans.

Significance. If fully supported, the result would be a useful demonstration that 2D adversarial perturbations can survive a 3D reconstruction pipeline and affect a vision-language model on held-out views, which is relevant to the security of 3D vision systems. The paper is transparent in reporting per-class results, and the train/test split is clearly defined. However, the evidence currently provided is not sufficient to establish the central claim: there is no control for generic reconstruction artifacts, no statistical characterization of the small per-class test-render samples, no reported perturbation budget, and no transfer test beyond the exact CLIP model used to generate the attack. These are load-bearing gaps because the paper's headline numbers depend on them.

major comments (5)
  1. [§3.2, Table 2] The claimed transfer of adversarial noise to 3DGS renders is not separated from generic reconstruction artifacts. The adversarial 3DGS models are compared only against clean 3DGS models; there is no control trained on images corrupted with equal-magnitude random noise or non-adversarial perturbations. Because M-IFGSM adds RGB perturbations before 3DGS optimization, the reconstruction could suffer from blur, floaters, or color shifts that reduce CLIP accuracy even without any adversarial intent. Adding a same-epsilon random-noise control is necessary to establish that the accuracy drop is caused by the adversarial signal rather than by generic degradation.
  2. [§3.2, Table 2] The reported test-render averages are statistically fragile. Each class contributes only six test renders, the averages are presented without error bars or confidence intervals, and the per-class results vary widely: Couch and Hydrant retain 0.833 top-1 accuracy in adversarial test renders, while Suitcase drops to 0.000. The paper's claim that the attack 'effectively transfers' to novel views therefore needs per-class confidence intervals or a paired statistical test across the eight classes; without this, the 35.4% average is not a reliable estimate.
  3. [§2.2, Eq. (1)-(2)] The perturbation budget is never reported. The manuscript defines an epsilon parameter and an early-stopping threshold tau, but it does not state the value of epsilon used, nor the achieved L-infinity or L2 norms of the perturbations. The abstract's claim that the noise is 'nearly imperceptible' is therefore unsupported by quantitative evidence; there is also no human perceptual study or perceptual similarity metric. The authors should report the actual perturbation magnitudes and provide some perceptual evaluation, even a small human study or a standard metric such as LPIPS.
  4. [§3.1, Table 1] The attack is generated and evaluated with the same CLIP ViT-B/16 model, and the early-stopping criterion requires the true-class probability to reach zero. This means the attack's success on the training images is partially by construction, and the paper does not test whether the adversarially perturbed images or the 3DGS renders transfer to a different classifier. Reporting transfer to a second model (e.g., a different CLIP backbone or a ResNet trained on ImageNet) is important to support the general security claim in the abstract and conclusions.
  5. [§3.2, Table 2 and Figure 4] The paper acknowledges that the couch mask perturbs only one of two couches and that some test views show diminished attack effect, but it does not analyze how these failure cases affect the headline averages. The authors should either exclude or separately discuss such cases, or report results both with and without them, so readers can see how sensitive the average drop is to these known failure modes.
minor comments (5)
  1. [General] There are numerous typographical and formatting issues: 'Conf idence' has an unintended space, 'iiii' appears instead of 'iv' in the list of reconstruction stages, and Figure 4's caption contains 'veiw' instead of 'view'.
  2. [References] The reference list uses inconsistent formatting (e.g., 'Li u. a.' and 'Schonberger und Frahm') and several entries lack full bibliographic information. The CLIP citation appears as a general 'Vision-Language Intelligence' paper rather than the original CLIP paper; the authors should cite Radford et al. (2021) for CLIP.
  3. [§2.2, Eq. (1)-(2)] The notation Clipmin,max is not defined clearly; it should specify that clipping is applied per-pixel to the valid RGB range, and the bounds min and max should be named explicitly.
  4. [§2.2] The statement 'Our pipeline is designed with flexibility in mind' is not supported by experiments on any model other than CLIP; either add such experiments or temper the claim.
  5. [§2.4] The checkpoint name 'sam-vit-h-4b899' may be a typo or nonstandard; the standard SAM checkpoint names are 'sam_vit_h_4b8939' or similar. Please verify.

Circularity Check

2 steps flagged · score 6.0 of 10

Headline 2D accuracy drop and the train-render 'transfer' result are built into the attack's stopping rule and the 3DGS fitting procedure; only the held-out test renders provide independent evidence.

  1. self definitional [Algorithm 1, line 8 (Section 2.2)]
    "Early stopping if probs[ytrue] = 0and J > τ"

    The attack loop is defined to terminate only after the true-class probability reaches exactly zero. Therefore, for every image that exits the loop, the true label cannot be the top-1 prediction and is usually absent from the top-5 predictions as well. The reported drop to 2.1% top-1 accuracy on adversarial images is thus a logical consequence of the stopping rule, not an independently measured property of M-IFGSM. The paper presents this as 'showcasing the method's effectiveness,' but the 2D misclassification rate is set by the algorithm's own termination condition.

  2. fitted input called prediction [Section 3.2, Table 2]
    "Results indicate that renders from training camera locations successfully transfer the adversarial noise into 3DGS models, decreasing the confidence level to 12%."

    The 'training camera locations' are exactly the 35 views used to fit the 3DGS model, and the 3DGS optimization is performed to reproduce the adversarial training images at those views. Reporting the 12.5% top-1 accuracy on these train renders as evidence of 'transfer to 3D' evaluates the model on its fitted inputs. The independent transfer test is the held-out 6 test renders, where accuracy only falls to 35.4% and some classes (Couch, Hydrant) remain at 83.3%. The train-render number is therefore partly forced by the fitting procedure and by the early-stopped adversarial images, not by novel-view generalization.

full rationale

No self-citations, imported uniqueness theorems, or ansatz-smuggling citations were found; all references are external. The paper's central 3D claim does have independent content: the held-out test renders are genuine novel-view transfer measurements, and the paper honestly notes that transfer is diminished for unseen camera positions and fails for some classes. However, the headline numbers rely substantially on two construction-forced results: (i) the 2D attack success on perturbed images is guaranteed by the early-stopping rule that requires the true-class probability to be zero, and (ii) the train-render 'transfer' result evaluates 3DGS on the same camera views used to fit it to the adversarial images. The absence of a random-noise control and the lack of reported perturbation budgets are experimental confounds rather than circularity, but they reinforce that the independent test-render result is the only non-circular evidence. Overall, the paper is partially circular in its headline claims while retaining a non-trivial novel-view evaluation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper does not introduce new physical or mathematical entities. Its claims rest on the untested assumptions that SAM masks are reliable, that 3DGS rendering preserves perturbations, and that CLIP classification on single-view renders captures the risk to detection systems.

free parameters (3)
  • epsilon (perturbation magnitude) = not reported
    Controls the maximum per-pixel noise in M-IFGSM; its value is not stated in the paper, but the attack's success and imperceptibility depend on it.
  • number of iterations N = not reported
    Iteration count for the iterative FGSM loop; not specified, affecting the attack strength.
  • early stopping threshold tau = 20.00
    Cross-entropy loss threshold used for early stopping; set to 20.00 in the paper.
assumptions (4)
  • domain assumption SAM provides accurate segmentation masks for all eight object classes
    The attack relies on masks that isolate the object; incorrect masks degrade the attack, as seen in the couch example.
  • domain assumption 3D Gaussian Splatting optimization preserves high-frequency adversarial perturbations in rendered images
    For the attack to transfer to novel views, the perturbation must survive reconstruction; the paper does not analyze this explicitly, and results vary.
  • domain assumption CLIP's zero-shot top-1 accuracy is a meaningful proxy for object detection risk
    The paper evaluates classification on rendered objects, not detection, yet the abstract and introduction frame it as object detection.
  • domain assumption The CO3D dataset and selected eight classes are representative of real-world 3D reconstruction tasks
    Only eight classes from CO3D are used, with no justification for the selection.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Gaussian Splatting Under Attack: Investigating Adversarial Noise in 3D Objects." pith.science (2026). https://pith.science/paper/A7YNVY5T

@misc{pith2026241202803,
  author       = {Pith},
  title        = {Pith review of: Gaussian Splatting Under Attack: Investigating Adversarial Noise in 3D Objects},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A7YNVY5T}},
  note         = {Machine review of arXiv:2412.02803}
}
read the original abstract

3D Gaussian Splatting has advanced radiance field reconstruction, enabling high-quality view synthesis and fast rendering in 3D modeling. While adversarial attacks on object detection models are well-studied for 2D images, their impact on 3D models remains underexplored. This work introduces the Masked Iterative Fast Gradient Sign Method (M-IFGSM), designed to generate adversarial noise targeting the CLIP vision-language model. M-IFGSM specifically alters the object of interest by focusing perturbations on masked regions, degrading the performance of CLIP's zero-shot object detection capability when applied to 3D models. Using eight objects from the Common Objects 3D (CO3D) dataset, we demonstrate that our method effectively reduces the accuracy and confidence of the model, with adversarial noise being nearly imperceptible to human observers. The top-1 accuracy in original model renders drops from 95.4\% to 12.5\% for train images and from 91.2\% to 35.4\% for test images, with confidence levels reflecting this shift from true classification to misclassification, underscoring the risks of adversarial attacks on 3D models in applications such as autonomous driving, robotics, and surveillance. The significance of this research lies in its potential to expose vulnerabilities in modern 3D vision models, including radiance fields, prompting the development of more robust defenses and security measures in critical real-world applications.

Figures

Figures reproduced from arXiv: 2412.02803 by the authors.

Figure 1
Figure 1. Two-stage pipeline for generating adversarial 3D models using the proposed [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Mask generation pipeline Xadv N+1 = Clipmin,max  Xinv + M ⊙ [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Adversarial noise effects on object detection of the hairdryer and hydrant objects. Sample [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Adversarial noise effect on object detection. Sample images of the original image dataset [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. 3D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanism

    cs.CV 2026-07 conditional novelty 6.0 of 10

    An optimized, view-consistent 3D Gaussian shell around a face avatar reliably changes which facial attributes vision-language models report, while preserving identity and appearance.

  2. DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

    cs.CV 2026-02 conditional novelty 6.0 of 10

    Zeroing high-frequency wavelet subbands of training views before 3D Gaussian Splatting suppresses Poison-Splat adversarial artifacts, yielding more robust training and rendering across Mip-NeRF 360, Tanks-and-Temples,...

Reference graph

Works this paper leans on

17 extracted references · 11 canonical work pages · cited by 2 Pith papers

  1. [1]

    Dosovitskiy u.\,a. 2021 Dosovitskiy , Alexey ; Beyer , Lucas ; Kolesnikov , Alexander ; Weissenborn , Dirk ; Zhai , Xiaohua ; Unterthiner , Thomas ; Dehghani , Mostafa ; Minderer , Matthias ; Heigold , Georg ; Gelly , Sylvain ; Uszkoreit , Jakob ; Houlsby , Neil: An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. 2021

    work page 2021

  2. [2]

    2015 Goodfellow , Ian J

    Goodfellow u.\,a. 2015 Goodfellow , Ian J. ; Shlens , Jonathon ; Szegedy , Christian: Explaining and Harnessing Adversarial Examples. 2015. -- URL https://arxiv.org/abs/1412.6572

    arXiv 2015

  3. [3]

    2023 Kerbl , Bernhard ; Kopanas , Georgios ; Leimk \"u hler , Thomas ; Drettakis , George: 3D Gaussian Splatting for Real-Time Radiance Field Rendering

    Kerbl u.\,a. 2023 Kerbl , Bernhard ; Kopanas , Georgios ; Leimk \"u hler , Thomas ; Drettakis , George: 3D Gaussian Splatting for Real-Time Radiance Field Rendering. In: ACM Transactions on Graphics 42 (2023), July, Nr. 4. -- URL https://repo-sam.inria.fr/fungraph/3d-gaussian-splatting/

    work page 2023

  4. [4]

    2024 Kim , Yeseung ; Kim , Dohyun ; Choi , Jieun ; Park , Jisang ; Oh , Nayoung ; Park , Daehyung: A survey on integration of large language models with intelligent robots

    Kim u.\,a. 2024 Kim , Yeseung ; Kim , Dohyun ; Choi , Jieun ; Park , Jisang ; Oh , Nayoung ; Park , Daehyung: A survey on integration of large language models with intelligent robots. In: Intelligent Service Robotics (2024), August. -- URL http://dx.doi.org/10.1007/s11370-024-00550-5. -- ISSN 1861-2784

    doi:10.1007/s11370-024-00550-5 2024

  5. [5]

    2023 Kirillov , Alexander ; Mintun , Eric ; Ravi , Nikhila ; Mao , Hanzi ; Rolland , Chloe ; Gustafson , Laura ; Xiao , Tete ; Whitehead , Spencer ; Berg , Alexander C

    Kirillov u.\,a. 2023 Kirillov , Alexander ; Mintun , Eric ; Ravi , Nikhila ; Mao , Hanzi ; Rolland , Chloe ; Gustafson , Laura ; Xiao , Tete ; Whitehead , Spencer ; Berg , Alexander C. ; Lo , Wan-Yen ; Dollár , Piotr ; Girshick , Ross: Segment Anything. 2023

    work page 2023

  6. [6]

    2022 Li , Feng ; Zhang , Hao ; Zhang , Yi-Fan ; Liu , Shilong ; Guo , Jian ; Ni , Lionel M

    Li u.\,a. 2022 Li , Feng ; Zhang , Hao ; Zhang , Yi-Fan ; Liu , Shilong ; Guo , Jian ; Ni , Lionel M. ; Zhang , PengChuan ; Zhang , Lei: Vision-Language Intelligence: Tasks, Representation Learning, and Large Models. 2022. -- URL https://arxiv.org/abs/2203.01922

    arXiv 2022

  7. [7]

    2024 Li , Yanjie ; Xie , Bin ; Guo , Songtao ; Yang , Yuanyuan ; Xiao , Bin: A survey of robustness and safety of 2d and 3d deep learning models against adversarial attacks

    Li u.\,a. 2024 Li , Yanjie ; Xie , Bin ; Guo , Songtao ; Yang , Yuanyuan ; Xiao , Bin: A survey of robustness and safety of 2d and 3d deep learning models against adversarial attacks. In: ACM Computing Surveys 56 (2024), Nr. 6, S. 1--37

    work page 2024

  8. [8]

    2018 Madry , Aleksander ; Makelov , Aleksandar ; Schmidt , Ludwig ; Tsipras , Dimitris ; Vladu , Adrian: Towards deep learning models resistant to adversarial attacks

    Madry u.\,a. 2018 Madry , Aleksander ; Makelov , Aleksandar ; Schmidt , Ludwig ; Tsipras , Dimitris ; Vladu , Adrian: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (ICLR), 2018

    work page 2018

Show all 17 references
  1. [9]

    Reizenstein u.\,a. 2021 Reizenstein , Jeremy ; Shapovalov , Roman ; Henzler , Philipp ; Sbordone , Luca ; Labatut , Patrick ; Novotny , David: Common Objects in 3D: Large-Scale Learning and Evaluation of Real-life 3D Category Reconstruction. In: International Conference on Com...

    2021

  2. [10]

    Frahm , Jan-Michael: Structure-From-Motion Revisited

    Schonberger und Frahm 2016 Schonberger , Johannes L. ; Frahm , Jan-Michael: Structure-From-Motion Revisited. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016

    2016

  3. [11]

    Song u.\,a. 2024 Song , Ziying ; Liu , Lin ; Jia , Feiyang ; Luo , Yadan ; Jia , Caiyan ; Zhang , Guoxin ; Yang , Lei ; Wang , Li: Robustness-aware 3d object detection in autonomous driving: A review and outlook. In: IEEE Transactions on Intelligent Transportation Systems (2024)

    2024

  4. [12]

    2014 Szegedy , Christian ; Zaremba , Wojciech ; Sutskever , Ilya ; Bruna , Joan ; Erhan , Dumitru ; Goodfellow , Ian ; Fergus , Rob: Intriguing properties of neural networks

    Szegedy u.\,a. 2014 Szegedy , Christian ; Zaremba , Wojciech ; Sutskever , Ilya ; Bruna , Joan ; Erhan , Dumitru ; Goodfellow , Ian ; Fergus , Rob: Intriguing properties of neural networks. 2014. -- URL https://arxiv.org/abs/1312.6199

    2014 arXiv

  5. [13]

    Zeng u.\,a. 2019 Zeng , Xiaohui ; Liu , Chenxi ; Wang , Yu-Siang ; Qiu , Weichao ; Xie , Lingxi ; Tai , Yu-Wing ; Tang , Chi-Keung ; Yuille , Alan L.: Adversarial attacks beyond the image space. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognit...

    2019

  6. [14]

    2019 Zhao , Zhong-Qiu ; Zheng , Peng ; Xu , Shou-tao ; Wu , Xindong: Object detection with deep learning: A review

    Zhao u.\,a. 2019 Zhao , Zhong-Qiu ; Zheng , Peng ; Xu , Shou-tao ; Wu , Xindong: Object detection with deep learning: A review. In: IEEE transactions on neural networks and learning systems 30 (2019), Nr. 11, S. 3212--3232

    2019

  7. [15]

    2024 Zhou , Xingcheng ; Liu , Mingyu ; Yurtsever , Ekim ; Zagar , Bare L

    Zhou u.\,a. 2024 Zhou , Xingcheng ; Liu , Mingyu ; Yurtsever , Ekim ; Zagar , Bare L. ; Zimmer , Walter ; Cao , Hu ; Knoll , Alois C.: Vision Language Models in Autonomous Driving: A Survey and Outlook. 2024. -- URL https://arxiv.org/abs/2310.14414

    2024 arXiv

  8. [16]

    Zhu u.\,a. 2023 Zhu , Zijian ; Zhang , Yichi ; Chen , Hai ; Dong , Yinpeng ; Zhao , Shu ; Ding , Wenbo ; Zhong , Jiachen ; Zheng , Shibao: Understanding the Robustness of 3D Object Detection With Bird's-Eye-View Representations in Autonomous Driving. In: Proceedings of the IEE...

    2023

  9. [17]

    2023 Zou , Andy ; Wang , Zifan ; Carlini , Nicholas ; Nasr , Milad ; Kolter , J

    Zou u.\,a. 2023 Zou , Andy ; Wang , Zifan ; Carlini , Nicholas ; Nasr , Milad ; Kolter , J. Z. ; Fredrikson , Matt: Universal and Transferable Adversarial Attacks on Aligned Language Models. 2023. -- URL https://arxiv.org/abs/2307.15043

    2023 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.