Pith. sign in

REVIEW 4 major objections 6 minor 56 references

IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read IAP shows that targeted adversarial patch attacks can be both highly successful and nearly invisible to humans by placing patches via a perceptibility-aware localization score and optimizing them with color-constancy updates.

desk verdict A well-engineered patch attack with impressive objective stealth, but the human-invisibility claim needs a proper user study before I'd trust it. read the letter →

arxiv 2507.06856 v1 pith:CQDHIQ2B submitted 2025-07-09 cs.CV cs.AI

Subrat Kishore Dutta , Xiao Zhang This is my paper · ORCID
classification cs.CVcs.AI
keywords adversarialpatchestargetedattackimperceptibilitypatchlocalizationsensitivitymapGrad-CAMcolorconstancydefenseevasion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that adversarial patches—small, localized image modifications that flip a model's prediction—can be made nearly invisible to human eyes while still succeeding at targeted attacks. Prior attacks usually force a tradeoff: either the patch is loud and detectable, or the attack only works untargeted. IAP breaks that tradeoff by choosing the patch's location with a score that balances model vulnerability with human sensitivity, and by optimizing the patch with a perceptual distance regularizer plus a color-constancy update rule that keeps each pixel's base color unchanged. On ImageNet with ResNet-50, IAP reports 99.5% targeted attack success with local LPIPS 0.12 and SSIM 0.94, and a human study detects its patches only 4.2% of the time versus 94.5% for a strong baseline. It also reports that the stealthy patches bypass six state-of-the-art patch defenses, with 100% success against SAC.

What carries the argument

The load-bearing object is the perturbation priority index $G(x;i,j)$ (Eq. 3), which combines a Grad-CAM class localization map $J_y(x)$ and a human-visual sensitivity map $\mathrm{Sens}(x) = 1/(\sigma_{ij}+\lambda)$, where $\sigma_{ij}$ is the square root of the minimum of horizontal and vertical standard deviations at that pixel (Eq. 6). The index selects where to put the patch: high $J_y$ makes the model easy to fool there, and low $\mathrm{Sens}$ (i.e., high local variance) means humans can tolerate bigger changes. The optimization then uses a sensitivity-weighted perceptual distance $D$ (Eq. 7) as a regularizer in the loss (Eq. 8), and a gradient update (Eq. 9) that averages the gradient over color channels and divides by $\mathrm{Sens}$, which preserves each pixel's base color while letting perturbations accumulate in textured areas.

What would settle it

A human study in which at least 100 non-expert participants view single full-resolution images (no clean/adversarial pairs) at a fixed duration, with patches placed in textured regions chosen by IAP, would settle the invisibility claim if detection rates substantially exceed the 4.2% reported in the paper's paired, ML-expert study.

Watch

Extended reading notes

Core claim

The central discovery is that targeted adversarial patch attacks need not sacrifice imperceptibility: a patch covering 14% of the image can reliably mislead the model while being effectively invisible. The method, IAP, first computes a perturbation priority index $G(x;i,j)$ for every candidate patch location, defined as the sum over the patch window of the ratio between a Grad-CAM class localization map $J_y$ and a sensitivity map $\mathrm{Sens}$ based on local variance (Eq. 3–6). It then optimizes the patch by minimizing a targeted cross-entropy loss balanced against a ground-truth loss and a perceptibility distance $D$ (Eq. 7–8), using an update rule that divides the gradient by the sensitivity map and averages across color channels so the base color of each pixel is preserved (Eq. 9). The result is a patch whose perturbations are concentrated in high-texture regions and whose channel-averaged updates keep it contextually coherent, achieving targeted attack success rates above 98% across four architectures on ImageNet and VGG Face while attaining the lowest LPIPS and highest SSIM among compared attacks.

Load-bearing premise

The assumption that the sensitivity map—based on local variance and channel-averaged updates—fully captures human imperceptibility is the load-bearing premise, and the paper's own Section 7 admits individual pixels can become unnaturally bright or dark, leaving the 28-participant, 10-image user study as the only direct evidence that this does not matter in practice.

Editorial extensions

If this is right

  • Targeted patch attacks no longer require visibly artificial patches; a 14% patch can be nearly indistinguishable from the host image while forcing the target class with more than 98% success across CNN and Transformer architectures.
  • Saliency-based defenses that search for the patch's attention peak will often fail: Grad-CAM attention does not overlap the patch for about 70% of IAP samples, and post-defense attack success stays above 78% against all six tested defenses.
  • The method extrapolates beyond ImageNet: on VGG Face, targeted attack success stays above 94% with local LPIPS at or below 0.28, indicating that the invisibility is not dataset-specific.
  • Patch shape and physical-world settings are compatible: a circular patch at 11% area reaches 99.2% attack success with LPIPS 0.085, and printed patches achieve 70% average success in physical tests.
  • Because larger patches improve imperceptibility, patch size is no longer a reliable proxy for detectability, so defenses must look for subtler statistical anomalies rather than raw saliency.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the invisibility claim rests on local variance and base-color preservation, a natural next test is whether patches remain invisible when the surrounding region has unusual texture statistics or repeated patterns; the sensitivity map may underestimate human sensitivity to global texture coherence.
  • The same localization-optimization split could be transferred to other explanation maps (e.g., integrated gradients) or to patch shapes tuned by the optimization, potentially improving black-box transferability beyond the reported NES-based variant.
  • The color-constancy update rule suggests a general recipe for any perturbation method: restrict updates to brightness and saturation changes while keeping hue, which may reduce detectability of other attacks like watermarking or attribute editing.
  • The paper's own Section 7 concedes that individual pixels can become unnaturally bright or dark; a frequency-domain analysis of the patch region may reveal high-frequency spikes that a rival defense could exploit even when local LPIPS is low.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes IAP, a targeted adversarial patch attack that jointly optimizes patch placement and perturbation content for imperceptibility. Placement is determined by maximizing a perturbation priority index built from a Grad-CAM class localization map and a local-variance-based sensitivity map; content is optimized with a cross-entropy-based loss augmented by a perceptibility distance term and a color-preserving multiplicative update rule. Experiments on ImageNet and VGG Face across four architectures report high targeted ASR (94--100%) and substantially lower local LPIPS/SSIM distortion than existing baselines, and the attack is reported to evade six patch defenses with post-defense ASR between 78.6% and 100%. A user study with 28 participants reports a 4.2% detection rate for IAP. The code is released.

Significance. If the claims hold, IAP is a notable advance: it demonstrates that targeted adversarial patch attacks can achieve both high success and low perceptual distortion. The method is precisely specified (Eqs. 3--9, Algorithm 1), the code is available, and the empirical comparison covers a wide range of settings (two datasets, four architectures, six defenses). The defense-avoidance results, particularly the 100% ASR against SAC, are striking. The black-box and physical-world extensions broaden the applicability. The main weakness is the evidence for human imperceptibility: the user study is small and underspecified, and the paper's own limitation section concedes a visible-artifact failure mode. Reproducibility is also hampered by missing hyperparameter values.

major comments (4)
  1. [§5.3] The human perceptibility study is underspecified and its results are implausibly low. The paper reports a 4.2% detection rate for IAP in a four-option forced-choice task, which is far below the 25% chance level, yet it provides no explanation for this below-chance performance (e.g., a response bias toward the 'Both clean' option). The study does not state how the 10 IAP images were selected, which victim model and target class produced them, whether the clean/adversarial order was randomized and counterbalanced, whether viewing was time-limited, or the exact instructions. Additionally, all 28 participants had an ML background and 82% were familiar with adversarial examples, making them a high-vigilance population. Since the invisibility claim is a central contribution, this evidence is insufficient; the study should be redesigned with a larger, more diverse sample, more images, and full methodological detail.
  2. [§7] The conclusion's limitation statement concedes that 'individual pixels can become unnaturally bright or dark relative to their neighbors, reducing imperceptibility.' This is in direct tension with the abstract's blanket claim of 'highly invisible' patches. If such failure cases occur, a 4.2% detection rate from 10 selected study images may not generalize. Please either qualify the invisibility claim to exclude these cases or provide evidence, for example, a human evaluation that includes the worst-case images, about the frequency of this failure mode.
  3. [§5.1 / §4] The values of the key hyperparameters are never reported. The loss weights w1, w2, w3 in Eq. (8), the smoothing constant λ in Eq. (6), the learning rate η and stop threshold s in Algorithm 1, and the stride of the sliding window used in patch localization are all absent from the main text and Appendix A. Without these values, the experiments cannot be reproduced from the paper alone; please provide them in a dedicated table.
  4. [§6.2 / Table 24] The ablation on the regularization coefficient w3 shows only marginal changes in imperceptibility: local LPIPS ranges from 0.111 to 0.108 as w3 varies from 0 to 13, a difference likely within noise. The paper states that 'our proposed regularized loss and update rule contributes significantly' to imperceptibility, but the ablation indicates that the contribution is dominated by the update rule (Table 25, where Adam gives LPIPS 0.662 versus IAP's 0.070). Please either report a statistically meaningful effect of w3 on a larger set of images or revise the claim to reflect the ablation.
minor comments (6)
  1. [§5.4] The defense evaluation includes DiffPAD [10], which is co-authored by the second author. Please disclose this relationship in the experimental section for transparency.
  2. [Algorithm 1, line 6] The line 'Initialize δ0 ← x' is confusing because δ is described as a patch; clarify that the optimization variable is a full-image tensor whose masked region forms the patch.
  3. [Eq. (6)] Please define what 'standard deviation of the pixel across the color channels' means; it appears to be computed from a local neighborhood, but the neighborhood size is not specified.
  4. [Figure 4 caption] The caption reads 'Human perceptability study' but should be 'Human perceptibility study.'
  5. [§5.1 / §5.2] The paper states that optimization stops when the target confidence reaches 0.9, but Section 5.2 reports an average target confidence of 0.84 ± 0.03 on ImageNet. Please clarify how the average can be below the stopping threshold, for example, by including failed attacks in the average.
  6. [Table 23] In the patch-size ablation, the entry for a 6% patch reports local LPIPS of 0.024, which is lower than the values for 8% and 10% patches (0.183 and 0.152). This appears to be a typo or an anomaly that should be checked.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: IAP's success and imperceptibility are evaluated on held-out data with external metrics, and no derivation step reduces to a fitted value or self-citation.

full rationale

The claimed chain is: (i) choose patch location by maximizing G = sum Jy/Sens (Eq. 3), where Jy is Grad-CAM (Eq. 5) and Sens is the reciprocal local standard deviation (Eq. 6); (ii) optimize patch pixels by minimizing a target/ground-truth cross-entropy loss plus a sensitivity-weighted L1 distance D (Eqs. 7-8); (iii) update with channel-averaged gradients scaled by delta/Sens (Eq. 9). These are construction equations, not predictions. The evaluation quantities reported in support of the headline claims are external: ASR is measured directly on the victim model (Eq. 10), LPIPS/SSIM are independent perceptual metrics, and the invisibility claim is checked by a 28-participant human study (Section 5.3). No constant is fitted to the test set and no reported number is algebraically identical to an optimized objective; the sensitivity map is an engineering proxy, not a definition of the reported outcome metrics. The paper's own Section 7 limitation (pixels can become unnaturally bright/dark) further confirms the proxy is approximate rather than circular. The only self-citation is DiffPAD [10], co-authored by the second author, used as one of six evaluated defenses; it is a benchmark, not a load-bearing premise, and the other five defenses are external. This is a transparency note, not circularity.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The attack depends on hand-chosen hyperparameters (w1, w2, w3, lambda, eta, s, patch size), of which w1, w2, eta, and lambda are never reported with values; on borrowed perceptual and susceptibility models (variance-based sensitivity from [6, 29], Grad-CAM from [38]) whose adequacy is assumed; and on the white-box setting. No new physical or conceptual entities are postulated; the perturbation priority index G(x; i,j) (Eq. 3) is a new composite score over existing maps, not an independently postulated entity.

free parameters (6)
  • Loss weights w1, w2 (Eq. 8) = not disclosed
    The targeted and ground-truth cross-entropy weights in LT are hand-chosen and never reported, so the main results depend on undisclosed values.
  • Regularization weight w3 (Eq. 8) = not disclosed; ablated over 0 to 13
    The ablation (Appendix C.1, Table 24) shows minimal impact on ASR and LPIPS across the range, but the value used for the main tables is never stated.
  • Smoothing constant lambda (Eq. 6) = "small value", not disclosed
    Prevents division by zero in the sensitivity map; it affects both the localization score G and the update scaling, and its value is not reported.
  • Step size eta and reinitialization schedule = not disclosed; up to 3 reinitializations
    Algorithm 1 uses eta and restarts on failure, but neither the initial eta nor the restart schedule is specified.
  • Attack stop threshold s = 0.9
    Confidence threshold for early stopping; it shapes the reported average confidence of 0.84 to 0.86 over successful instances.
  • Patch size w x h = 84 x 84 pixels (14% of image)
    Fixed for all main results; the ablation shows ASR drops to 72.2% at 2% coverage, so the headline invisibility and ASR results depend on this large patch.
assumptions (6)
  • domain assumption The attacker has full access to victim model parameters and gradients (Section 3.1, Algorithm 1).
    The method requires exact gradients for Grad-CAM maps and for the loss update; all main claims are scoped to the white-box setting.
  • domain assumption The Grad-CAM class localization map Jy (Eq. 5) identifies image regions where the model is most vulnerable to perturbation.
    This assumption underlies the perturbation priority index G (Eq. 3); the paper cites Grad-CAM [38] but assumes the vulnerability-location link without evidence.
  • domain assumption Human visual sensitivity is adequately modeled by the reciprocal of the minimum of horizontal and vertical local standard deviations (Eq. 6).
    Borrowed from Croce and Hein [6] and Luo et al. [29]; the invisibility claims and the localization score both depend on this proxy.
  • domain assumption Preserving per-pixel base color (channel ratios) while changing brightness and saturation is sufficient for human imperceptibility.
    The channel-averaged update rule (Eq. 9) enforces this; the 28-participant user study is the only validation, and Section 7 concedes pixels can become unnaturally bright or dark.
  • domain assumption The perceptual distance D(x, x-hat) (Eq. 7), a sensitivity-weighted L1 difference, is a valid regularizer for human invisibility.
    The metric is defined by Luo et al. [29] with the same variance-based sensitivity map; the attack is optimized against it rather than against the LPIPS metric used in evaluation.
  • domain assumption Grad-CAM (Eqs. 4-5) is applicable without modification to Swin Transformer models, despite being designed for CNNs.
    The localization step applies Grad-CAM to all four architectures, including Swin Tiny and Swin Base; the paper does not discuss the known limitations of gradient-based attention for transformer architectures.

how reviews work

0 comments
Cite this review

Pith. "Pith review of IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization." pith.science (2026). https://pith.science/paper/CQDHIQ2B

@misc{pith2026250706856,
  author       = {Pith},
  title        = {Pith review of: IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CQDHIQ2B}},
  note         = {Machine review of arXiv:2507.06856}
}
read the original abstract

Despite modifying only a small localized input region, adversarial patches can drastically change the prediction of computer vision models. However, prior methods either cannot perform satisfactorily under targeted attack scenarios or fail to produce contextually coherent adversarial patches, causing them to be easily noticeable by human examiners and insufficiently stealthy against automatic patch defenses. In this paper, we introduce IAP, a novel attack framework that generates highly invisible adversarial patches based on perceptibility-aware localization and perturbation optimization schemes. Specifically, IAP first searches for a proper location to place the patch by leveraging classwise localization and sensitivity maps, balancing the susceptibility of patch location to both victim model prediction and human visual system, then employs a perceptibility-regularized adversarial loss and a gradient update rule that prioritizes color constancy for optimizing invisible perturbations. Comprehensive experiments across various image benchmarks and model architectures demonstrate that IAP consistently achieves competitive attack success rates in targeted settings with significantly improved patch invisibility compared to existing baselines. In addition to being highly imperceptible to humans, IAP is shown to be stealthy enough to render several state-of-the-art patch defenses ineffective.

Figures

Figures reproduced from arXiv: 2507.06856 by the authors.

Figure 1
Figure 1. The overall pipeline of IAP for conducting targeted [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Visualizations of original images (x) and their adversar￾ial counterparts (xˆ) generated by IAP. The smaller images in the bottom-right corner indicate the optimal location (i ′ , j′ ). fix the patch size as 84 × 84, which covers 14% of the total image. Due to space limits, we provide more detailed attack evaluation results of our method in Appendix B.1, and B.2 [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Human perceptability study. “Correct” means correct [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (11 more)
Figure 3
Figure 3. Figure 3: The visualizations presented illustrate the adversarial [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]
Figure 6
Figure 6. Figure 6: Ablation study on the impact of IAP’s components. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: Illustrative images of physical-world applications of IAP. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 7
Figure 7. Figure 7: Transferability of IAP measured by ASR (%) on Ima [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 9
Figure 9. Figure 9: Visualizations of the original images and their adversarial [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 12
Figure 12. Figure 12: Visualizations of the original images and their adver [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: Visualizations of the original images and their adver [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 16
Figure 16. Figure 16: Visualizations of the original images and their adver [PITH_FULL_IMAGE:figures/full_fig_p015_16.png]
Figure 17
Figure 17. Figure 17: Visualizations of the impact of the patch sizes on attack [PITH_FULL_IMAGE:figures/full_fig_p016_17.png]
Figure 18
Figure 18. Figure 18: Visualizations of adversarial patch generated by update [PITH_FULL_IMAGE:figures/full_fig_p016_18.png]
Figure 19
Figure 19. Figure 19: Visualizations of the impact of the number of update [PITH_FULL_IMAGE:figures/full_fig_p016_19.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 47 canonical work pages

  1. [1]

    Inconspicuous adversarial patches for fooling image-recognition systems on mobile devices

    Tao Bai, Jinqi Luo, and Jun Zhao. Inconspicuous adversarial patches for fooling image-recognition systems on mobile devices. IEEE Internet of Things Journal, 9(12):9515–9524,

    work page

  2. [2]

    Adversarial patch

    Tom B Brown, Dandelion Man´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017. 1, 2, 3, 5, 7, 11

    arXiv 2017

  3. [3]

    Look and think twice: Capturing top-down visual attention with feedback convolutional neural networks

    Chunshui Cao, Xianming Liu, Yi Yang, Yinan Yu, Jiang Wang, Zilei Wang, Yongzhen Huang, Liang Wang, Chang Huang, Wei Xu, et al. Look and think twice: Capturing top-down visual attention with feedback convolutional neural networks. In Proceedings of the IEEE international confer- ence on computer vision, pages 2956–2964, 2015. 3

    work page 2015

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 1

    work page 2017

  5. [5]

    Jujutsu: A two-stage defense against adversarial patch attacks on deep neural networks, 2022

    Zitao Chen, Pritam Dash, and Karthik Pattabiraman. Jujutsu: A two-stage defense against adversarial patch attacks on deep neural networks, 2022. 1, 2, 3, 5, 7, 11

    work page 2022

  6. [6]

    Sparse and imperceiv- able adversarial attacks

    Francesco Croce and Matthias Hein. Sparse and imperceiv- able adversarial attacks. In Proceedings of the IEEE/CVF international conference on computer vision , pages 4724– 4732, 2019. 2, 3, 4, 5

    work page 2019

  7. [7]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780–8794, 2021. 2

    work page 2021

  8. [8]

    Perceptual quality metrics applied to still image compression

    Michael P Eckert and Andrew P Bradley. Perceptual quality metrics applied to still image compression. Signal processing, 70(3):177–200, 1998. 2

    work page 1998

Show all 56 references
  1. [9]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognit...

    2018

  2. [10]

    Diffpad: Denoising diffusion- based adversarial patch decontamination

    Jia Fu, Xiao Zhang, Sepideh Pashami, Fatemeh Rahimian, and Anders Holst. Diffpad: Denoising diffusion- based adversarial patch decontamination. arXiv preprint arXiv:2410.24006, 2024. 1, 3, 5, 7, 11

    2024 arXiv

  3. [11]

    Wichmann, and Wieland Brendel

    Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness, 2022. 8

    2022

  4. [12]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1, 2

    2014 arXiv

  5. [13]

    Unravelling robustness of deep learning based face recognition against adversarial attacks,

    Gaurav Goswami, Nalini Ratha, Akshay Agarwal, Richa Singh, and Mayank Vatsa. Unravelling robustness of deep learning based face recognition against adversarial attacks,

  6. [14]

    On visible adversarial perturbations & digital watermarking

    Jamie Hayes. On visible adversarial perturbations & digital watermarking. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 1597–1604, 2018. 2, 3, 5, 7, 11

    2018

  7. [15]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. 5, 11

    2016

  8. [16]

    Clipscore: A reference-free evaluation metric for image captioning

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2104.08718, 2021. 6, 11

    2021 arXiv

  9. [17]

    Denoising diffu- sion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffu- sion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. 2

    2020

  10. [18]

    Human imperceptible attacks and applications to improve fairness, 2021

    Xinru Hua, Huanzhong Xu, Jose Blanchet, and Viet Nguyen. Human imperceptible attacks and applications to improve fairness, 2021. 8

    2021

  11. [19]

    Black-box adversarial attacks with limited queries and information, 2018

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information, 2018. 8

    2018

  12. [20]

    Diffender: Diffusion-based adversarial defense against patch attacks

    Caixin Kang, Yinpeng Dong, Zhengyi Wang, Shouwei Ruan, Yubo Chen, Hang Su, and Xingxing Wei. Diffender: Diffusion-based adversarial defense against patch attacks. In European Conference on Computer Vision, pages 130–147. Springer, 2024. 1, 3, 5, 7, 11

    2024

  13. [21]

    Lavan: Localized and visible adversarial noise

    Danny Karmon, Daniel Zoran, and Yoav Goldberg. Lavan: Localized and visible adversarial noise. In International Conference on Machine Learning, pages 2507–2515. PMLR,

  14. [22]

    Advhat: Real- world adversarial attack on arcface face id system

    Stepan Komkov and Aleksandr Petiushko. Advhat: Real- world adversarial attack on arcface face id system. In 2020 25th International Conference on Pattern Recognition (ICPR), page 819–826. IEEE, 2021. 2

    2020

  15. [23]

    Super-resolution of sentinel-2 images: Learning a globally applicable deep neu- ral network

    Charis Lanaras, Jos ´e Bioucas-Dias, Silvano Galliani, Em- manuel Baltsavias, and Konrad Schindler. Super-resolution of sentinel-2 images: Learning a globally applicable deep neu- ral network. ISPRS Journal of Photogrammetry and Remote Sensing, 146:305–319, 2018. 6, 11

    2018

  16. [24]

    Generative dynamic patch attack

    Xiang Li and Shihao Ji. Generative dynamic patch attack. arXiv preprint arXiv:2111.04266, 2021. 2, 3, 5, 11

    2021 arXiv

  17. [25]

    Anmin Liu, Weisi Lin, Manoranjan Paul, Chenwei Deng, and Fan Zhang. Just noticeable difference for images with decom- position model for separating edge and textured regions.IEEE Transactions on Circuits and Systems for Video Technology, 20(11):1648–1652, 2010. 2, 3

    2010

  18. [26]

    Perceptual-sensitive gan for generating adversarial patches

    Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In Proceedings of the AAAI conference on artificial intelligence, pages 1028–1035,

  19. [27]

    Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection

    Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chel- lappa, and Soheil Feizi. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognitio...

    2022

  20. [28]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 10012–10022, 2021. 5, 11

    2021

  21. [29]

    Towards imperceptible and robust adversarial example attacks against 9 neural networks

    Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu. Towards imperceptible and robust adversarial example attacks against 9 neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, 2018. 2, 3, 4

    2018

  22. [30]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. 1, 2, 5, 11

    2017 arXiv

  23. [31]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pas- cal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 2574–2582, 2016. 1, 2

    2016

  24. [32]

    Face recognition as a method of authentication in a web-based system

    Ben Wycliff Mugalu, Rodrick Calvin Wamala, Jonathan Seru- gunda, and Andrew Katumba. Face recognition as a method of authentication in a web-based system. arXiv preprint arXiv:2103.15144, 2021. 3

    2021 arXiv

  25. [33]

    Diffusion models for adver- sarial purification, 2022

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adver- sarial purification, 2022. 3

    2022

  26. [34]

    Parkhi, Andrea Vedaldi, and Andrew Zisserman

    Omkar M. Parkhi, Andrea Vedaldi, and Andrew Zisserman. Deep face recognition. In British Machine Vision Conference,

  27. [35]

    Visually imper- ceptible adversarial patch attacks on digital images

    Yaguan Qian, Jiamin Wang, Bin Wang, Shaoning Zeng, Zhao- quan Gu, Shouling Ji, and Wassim Swaileh. Visually imper- ceptible adversarial patch attacks on digital images. arXiv preprint arXiv:2012.00909, 2020. 2, 3

    2012 arXiv

  28. [36]

    Berg, and Li Fei-Fei

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, San- jeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. Imagenet large scale visual recognition challenge,

  29. [37]

    Defense-gan: Protecting classifiers against adversarial attacks using generative models, 2018

    Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models, 2018. 2

    2018

  30. [38]

    Grad- cam: Visual explanations from deep networks via gradient- based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad- cam: Visual explanations from deep networks via gradient- based localization. In Proceedings of the IEEE international conference on computer vision, pages 618–62...

    2017

  31. [39]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and communi- cations security, pages 1528–1540, 2016. 2

    2016

  32. [40]

    A general framework for adversarial ex- amples with objectives

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. A general framework for adversarial ex- amples with objectives. ACM Transactions on Privacy and Security (TOPS), 22(3):1–30, 2019. 1

    2019

  33. [41]

    Very deep convo- lutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convo- lutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 5, 11

    2014 arXiv

  34. [42]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1, 2

    2013 arXiv

  35. [43]

    Jedi: entropy-based localization and removal of adversarial patches

    Bilel Tarchoun, Anouar Ben Khalifa, Mohamed Ali Mahjoub, Nael Abu-Ghazaleh, and Ihsen Alouani. Jedi: entropy-based localization and removal of adversarial patches. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4087–4095, 2023. 1,...

    2023

  36. [44]

    Guided diffusion model for adversarial purification.arXiv preprint arXiv:2205.14969, 2022

    Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification.arXiv preprint arXiv:2205.14969, 2022. 3

    2022 arXiv

  37. [45]

    Generating visually realistic adversarial patch

    Xiaosen Wang and Kunyu Wang. Generating visually realistic adversarial patch. arXiv preprint arXiv:2312.03030, 2023. 1, 2, 3

    2023 arXiv

  38. [46]

    A universal image quality index

    Zhou Wang and Alan C Bovik. A universal image quality index. IEEE signal processing letters, 9(3):81–84, 2002. 6, 11

    2002

  39. [47]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600–612, 2004. 6, 11

    2004

  40. [48]

    Privacy-preserving adversarial facial features

    Zhibo Wang, He Wang, Shuaifan Jin, Wenwen Zhang, Jiahui Hu, Yan Wang, Peng Sun, Wei Yuan, Kaixin Liu, and Kui Ren. Privacy-preserving adversarial facial features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8212–8221, 2023. 3

    2023

  41. [49]

    Patchguard++: Efficient provable attack detection against adversarial patches, 2021

    Chong Xiang and Prateek Mittal. Patchguard++: Efficient provable attack detection against adversarial patches, 2021. 7

    2021

  42. [50]

    Densepure: Understanding diffusion models for adversarial robustness

    Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models for adversarial robustness. In The Eleventh International Conference on Learning Representations, 2023. 3

    2023

  43. [51]

    Patchzero: Defending against adversarial patch at- tacks by detecting and zeroing the patch

    Ke Xu, Yao Xiao, Zhaoheng Zheng, Kaijie Cai, and Ram Nevatia. Patchzero: Defending against adversarial patch at- tacks by detecting and zeroing the patch. In Proceedings of the IEEE/CVF Winter Conference on Applications of Com- puter Vision, pages 4632–4641, 2023. 1, 2

    2023

  44. [52]

    Visualizing and un- derstanding convolutional networks

    Matthew D Zeiler and Rob Fergus. Visualizing and un- derstanding convolutional networks. In Computer Vision– ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part I 13, pages 818–833. Springer, 2014. 3

    2014

  45. [53]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018. 6, 11

    2018

  46. [54]

    The translucent patch: A physical and universal attack on object detectors

    Alon Zolfi, Moshe Kravchik, Yuval Elovici, and Asaf Shabtai. The translucent patch: A physical and universal attack on object detectors. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 15232– 15241, 2021. 2, 3

    2021

  47. [55]

    Toaster” class to include “Baseball

    Alon Zolfi, Shai Avidan, Yuval Elovici, and Asaf Shabtai. Adversarial mask: Real-world universal adversarial attack on face recognition model, 2022. 2 10 A. Detailed Experimental Settings In this section, we give more details on the setup of our experiments. We evaluate the pe...

    2022

  48. [56]

    A. J. Buckley

    The results indicate that transferability is influenced by the architectural similarity between the substitute and target models, as well as their relative model sizes. C.4. Black-box Adaptation While IAP is initially designed as a white-box method, it can be successfully adap...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.