ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection

Deliang Xiang; Guhang Qiu; Ligang Li; Rui Feng; Tiannuo Guo; Yuzhen Xie

REVIEW 4 major objections 4 minor 41 references

ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection

T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Black-box attacker erases aircraft with colored patches.

desk verdict ColorFD is a genuinely novel black-box physical attack for aerial detectors, but its headline margins rest on single stochastic runs, and the paper will only be fully convincing after repeated-seed experiments and code release. read the letter →

arxiv 2608.04559 v2 pith:H7VOE7XW submitted 2026-08-05 cs.CV

Tiannuo Guo , Guhang Qiu , Yuzhen Xie , Rui Feng , Ligang Li , Deliang Xiang This is my paper · ORCID

classification cs.CV

keywords adversarialpatchblack-boxattackdifferentialevolutionremotesensingobjectdetectionphysicalfinite-differenceprobingdisappearancepure-colorpatches

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a black-box attacker, with access only to the detection results returned by a remote sensing object detector, can force aircraft to disappear by optimizing the positions and pure colors of a few small square patches. The optimization is carried out by Differential Evolution, guided by a target-wise fitness signal and by search-space constraints obtained from finite-difference color probing. On YOLOv3u, YOLOv5u, and Faster R-CNN, the method reports attack success rates of 78.87%, 79.61%, and 88.21% with key-region guidance, outperforming the tested black-box patch method and matching or exceeding white-box baselines on two of the three detectors. Physical experiments with printed colored patches under a fixed camera setup show that the attacks transfer from the digital domain to real images. The authors position the method as a practical robustness-evaluation tool for optical remote sensing systems under restricted model access.

What carries the argument

Differential Evolution with rand-to-best/1 mutation, crossover, and selection operates on individuals that encode each patch as a position (h,w) and color (r,g,b); a target-wise fitness function sums per-target maximum valid detection confidence, and a target-wise selection mechanism exchanges better components per target when the offspring does not improve overall fitness. The search space is constrained by key-region localization, which slides a window across the target box, applies pure colors from a fixed set, records confidence changes as finite-difference responses, and greedily selects the strongest connected component; and by common-feature extraction, which aligns and aggregates key-region heatmaps across instances of a category to yield class-level prior regions. Together these mechanisms reduce the number of DE decision variables and concentrate patches on detector-sensitive regions.

What would settle it

Run the digital attack on YOLOv3u and YOLOv5u with key regions replaced by randomly sampled regions of equal size; if random-region guidance matches key-region-guided ASR, the probe is not contributing the reported gain.

Watch

Extended reading notes

Core claim

The paper's central claim is that object-level disappearance in remote sensing detection can be achieved with a query-only black-box attack by representing perturbations as a small set of pure-color square patches and optimizing their positions and colors with Differential Evolution. The attack uses only the final detections returned by the detector, without gradients or intermediate features. On the DIOR aircraft subset, key-region-guided ColorFD reaches ASR 78.87% on YOLOv3u, 79.61% on YOLOv5u, and 88.21% on Faster R-CNN, outperforming the DE-based black-box patch baseline Bbox-Att and matching or exceeding the white-box baselines AP-PA and BADEI on YOLOv5u and Faster R-CNN. Physical experiments under a fixed camera setup show printed patches transferring from digital to physical imaging with consistent detection suppression.

Load-bearing premise

The finite-difference color probe, which reads only final detection confidence, must identify regions whose perturbation actually suppresses detection after DE optimization.

Editorial extensions

If this is right

A query-only attacker can induce object disappearance on one-stage remote sensing detectors using only the detector's returned boxes and scores, with no access to gradients or intermediate features.
Pure-color patches suffice for strong attacks, making physical deployment as simple as printing and attaching colored paper rather than optimizing pixel-wise textures.
The common-feature variant transfers localized key regions across instances of the same category, reducing query cost relative to per-target key-region localization while keeping competitive attack success rates.
On YOLOv5u and Faster R-CNN, the method matches or exceeds the white-box baselines AP-PA and BADEI under comparable perturbation budgets.
The reported physical experiments support digital-to-physical transfer of the optimized patches under fixed camera position and viewing angle.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the finite-difference probe is noisy for a given architecture, key-region guidance can hurt rather than help; the Faster R-CNN drop from 95.09% to 88.21% is already one instance, so a practical deployment should test unguided DE alongside the guided variant before trusting the probe.
The physical validation is confined to a controlled setup with fixed viewpoint and scale; under variable viewing conditions the patches may misalign with critical regions, so the method's real-world promise likely depends on multi-view robustness training.
Because the patch representation and common-feature extraction are category-agnostic, the same pipeline should transfer to ships, vehicles, and other remote sensing object classes; a direct test would be to run ColorFD on a multi-class subset of DIOR.
The target-wise selection mechanism could be reused in other black-box multi-object problems wherever per-target feedback can be extracted from the model output.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here is my read, for what it is worth. ColorFD is a reasonably honest extension of Bbox-Att: it replaces textured sub-patches with pure-color square patches, adds a target-wise fitness and selection mechanism to DE, and introduces two spatial guidance strategies (finite-difference key-region probing and a category-level common-feature prior). The writing is clear, the baselines are sensible, and the authors openly report a negative result that key-region guidance actually hurts on Faster R-CNN. That candor counts for something.

The problem is that every headline number in Tables I-IV is a single run of a stochastic DE optimizer. The paper itself says in Section VI.B that DE causes performance variability across runs and that some samples need multiple attempts, yet no standard deviation, seed count, or paired comparison appears anywhere. The reported margins over Bbox-Att are large, roughly 20 to 38 percentage points, so they might survive variance, but "consistently outperforms" is not supported by the evidence as it stands. This is the main load-bearing weakness, and it is entirely addressable with repeated-seed experiments.

Two smaller soft spots. First, the common-feature heatmaps are aggregated from the same 306 aircraft instances used in the subcategory evaluation, so the category prior is not independent of the test set. That likely inflates the common-feature results to some degree. Second, the physical experiment is qualitative: four models, one fixed camera angle, no reported ASR or error analysis. It demonstrates feasibility, not much more.

Credit where it is due. The pure-color parameterization is genuinely simpler for physical deployment. The target-wise selection mechanism is a sensible response to a real multi-target optimization problem. The finite-difference probing idea is clearly described, and the comparison against Bbox-Att, AP-PA, and BADEI under standardized perturbation budgets is more than many attack papers do.

This paper is for researchers working on adversarial robustness in remote sensing object detection, especially black-box and physical settings. It is a solid niche contribution, but the empirical claims need verification. It deserves a serious referee: the novelty is real and the approach is worth engaging with. Send it to review, with the requirement that authors report repeated-seed runs with variance and ideally release code and data. Without that, the central comparison cannot be assessed.

Referee Report

4 major / 4 minor

Summary. The paper proposes ColorFD, a black-box physical adversarial patch attack for remote sensing object detectors. Perturbations are modeled as multiple pure-color square patches whose positions and colors are jointly optimized by Differential Evolution (DE) using only the detector's returned detection results. The method contributes a target-wise fitness and selection mechanism for multi-target attacks, a finite-difference-based key-region localization procedure, and a common-feature category prior to constrain the search space. Experiments on a DIOR-based aircraft subset compare ColorFD against the black-box method Bbox-Att and the white-box methods AP-PA and BADEI on YOLOv3u, YOLOv5u, and Faster R-CNN, and a small physical deployment study with four target models is reported.

Significance. If the reported results hold, ColorFD would offer a practical query-only attack that outperforms the tested black-box baseline and matches or exceeds strong white-box baselines on some detectors. The pure-color patch representation is physically simple, and the target-wise fitness/selection mechanism is well motivated for multi-target optimization. The finite-difference probing idea is interesting and the paper provides clear algorithmic descriptions (Algorithms 1-3). The main limitation is that the empirical evidence is currently based on single-run point estimates from a stochastic optimizer and a qualitative physical study, so the significance of the claims is conditional on additional repeated-run experiments and more thorough physical evaluation.

major comments (4)

[Tables I-IV and Section VI.B] All ASR and AP50 values are single-run point estimates of a stochastic DE optimizer: Eq. (7) uses randomly selected individuals r1, r2, r3, and Eq. (8) samples r_j from U(0,1). Section VI.B explicitly admits that 'the stochastic nature of the DE-based black-box optimization leads to performance variability across different runs' and that 'for certain samples, multiple optimization attempts are required to achieve satisfactory results.' No standard deviation, confidence interval, number of seeds, or paired statistical test is reported for any experiment. The central claim in Section V.B.3 that ColorFD 'consistently outperforms the tested black-box attack method' rests on point-estimate margins of 35.38, 37.10, and 38.58 percentage points over Bbox-Att (computed from Table III), which cannot be assessed without repeated runs. Please report means and standard deviations over at least 5-10 independent runs and include paired statistical comparisons (e.g., Wilcoxon signed-rank tests) for the main head-to-head results.
[Section V.B.1 and Table I] The key-region guidance, a central contribution, decreases attack performance on Faster R-CNN: ASR drops from 95.09% (unguided) to 88.21% (key-region) and AP50 worsens from 0.0169 to 0.0974. The paper attributes this to the unavailability of RPN information in a black-box setting, but this explanation is a hypothesis rather than a verified mechanism. Because the finite-difference probe is the basis of the guidance, the current evidence shows that the key-region strategy is not generally architecture-agnostic. The statement in V.B.1 that key-region guidance 'consistently outperforms both the unguided variant and noise-based baselines on one-stage detectors' is carefully scoped, but the contribution would be stronger if the paper either characterized the architectural conditions under which the probe is reliable or proposed an alternative probing signal that works for two-stage detectors.
[Section V.B.2 and Algorithm 3] The common-feature heatmap is constructed from the same 306 dual-engine wing-mounted jet instances that are later used for evaluation in Table IV. This means the category-level prior is not independent of the test set: the attack is evaluated on the very instances that defined the prior. To support the claim that common-feature guidance provides 'generalizable priors' (Section V.B.2), the heatmap should be built on a disjoint training split or a separate set of instances not used in the reported attack evaluation. Otherwise, the reported gains from common-feature guidance may overestimate performance on unseen aircraft.
[Section V.C] The physical-world experiment is purely qualitative: no ASR or AP50 is reported for the physical images, only four target models are used, the camera is fixed, and Section VI.B admits that 'significant shifts in viewpoint, scale, or camera position can disrupt the alignment between patches and critical target regions.' The sentence 'ColorFD effectively suppresses YOLOv5u detections for all evaluated aircraft targets under the tested imaging conditions' describes four favorable images, not a demonstration of digital-to-physical transferability. Please provide quantitative physical-world metrics (e.g., detection rate before/after patch placement) and at least a few variations in viewing conditions, or explicitly scope the physical claim as a preliminary case study.

minor comments (4)

[Eq. (4)] The set B_t is used but not explicitly defined; please define it as the set of predicted bounding boxes of the same class as the target.
[Algorithm 2] In lines 4-9, it is unclear whether the response map M accumulates the maximum over colors or the sum of finite-difference responses; please clarify the aggregation rule.
[Fig. 3 and Fig. 7] The bar charts would benefit from error bars even if the tables do not report them; adding error bars or seed counts would directly address the main reproducibility concern.
[General] There are minor copyediting issues, such as inconsistent capitalization in references (e.g., '[5] ... CVPR Workshops' vs '[6] ... arXiv preprint') and informal phrasing like 'the proposed method possesses robust attack capabilities even within a black-box setting'; please revise for consistency and precision.

Circularity Check

1 steps flagged · score 2.0 of 10

Common-feature heatmap is built from the same 306 test instances on which the subcategory attack results are measured; main full-dataset comparisons are unaffected.

fitted input called prediction [Section V.B.2, paragraph before Fig. 4 (results in Tables II and IV)]
"To evaluate the guiding capability of common-feature priors, experiments are conducted on a subcategory of dual-engine wing-mounted jet aircraft. A total of 306 instances are cropped, aligned, and normalized. Subsequently, a common-feature heatmap is constructed by aggregating the key-region distributions of these instances."

The common-feature prior is fitted to the evaluation set: the heatmap is aggregated from the key-region masks of the same 306 dual-engine jet instances whose ASR/AP50 are then reported in Tables II and IV. Guiding DE with a heatmap built from the test instances and measuring attack success on those same instances makes the reported gain of common-feature guidance over the unguided variant partly forced, because the prior already encodes the sensitive locations of the exact objects being attacked. This is evaluation contamination / fitted-input reuse rather than equation-level circularity, and it does not affect the main full-aircraft comparisons (Tables I and III), which use unguided or key-region-guided variants.

full rationale

ColorFD is an empirical query-based optimization method rather than a derivation, so there is no equation-level circularity in the method itself. The fitness (Eqs. 9-11) is a standard max-confidence minimization, and ASR/AP50 are evaluated on the resulting optimized patches rather than being identical to the DE search signal by construction. There is no load-bearing self-citation: the reference list contains no prior work by the present authors, and no uniqueness theorem is imported. The one circularity-adjacent flaw is in the common-feature evaluation: the heatmap (Algorithm 3) is aggregated from key regions of the same 306 dual-engine jet instances on which Tables II and IV measure attack success. This means the 'category-level prior' is fitted to the evaluation set, so the reported benefit of common-feature guidance over the unguided variant is not an independent generalization result. This contamination does not affect the central full-dataset comparison against Bbox-Att and white-box baselines (Tables I and III), which use unguided or key-region-guided variants on the full 407-instance aircraft subset. The paper's own Limitations section acknowledges DE stochastic variability and reduced key-region efficacy on two-stage detectors; those are correctness risks, not circularity. Overall circularity is therefore minor rather than structural.

Assumptions & free parameters 9 free parameters · 5 assumptions · 0 invented entities

The central claim rests on empirically chosen hyperparameters and on assumptions about detector responses to local color perturbations. No new physical entities are introduced; the pure-color patch is a parameterization of existing adversarial patches. The main free parameters are DE and patch configuration choices, several of which are selected by sensitivity analysis or left unspecified.

free parameters (9)

DE population size multiplier (popmul) = 3
Selected by sensitivity analysis in Fig. 11; controls the number of candidate patch sets per generation.
Maximum DE iterations = 100
Selected by sensitivity analysis in Fig. 10; controls query budget and optimization depth.
Patch ratio = 0.15
Patch edge length relative to target bounding box; selected by sensitivity analysis in Fig. 12.
Number of patches per target = 4
Set in Section V.A; no sensitivity analysis is reported for this choice.
IoU matching threshold tau = 0.3
Used in attack success criterion Eq. (4) and fitness Eq. (10).
Key-region selection threshold = 0.85
Used to extract prominent connected components in key-region and common-feature localization.
DE scaling factor F and crossover rate CR = not reported
Appear in Eqs. (7) and (8), but no values are given in the Implementation Details section.
Color candidate set C = 75 colors (physical); digital set not specified
Key-region probing iterates over color set C in Algorithm 2, but the composition of C is not specified for digital experiments.
Number of key regions K = not reported
Algorithms 2 and 3 require K, but its value is not reported in the experiments.

assumptions (5)

domain assumption Object disappearance with IoU threshold tau is a meaningful and sufficient attack objective
All ASR numbers use this criterion from Eq. (4); a different threshold or a different attack objective would change the reported success rates.
domain assumption Finite-difference color probing with final detection scores localizes sensitive regions
Section IV-C relies on this premise, and the paper's own Table I shows it is less reliable on Faster R-CNN.
domain assumption Common-feature heatmaps computed from evaluation instances provide valid category-level priors
Section V.B.2 aggregates heatmaps from the same 306 jet instances later used for evaluation, so the prior may encode test-set structure rather than a transferable category prior.
domain assumption Differential evolution with random initialization is an effective optimizer for this patch search under 100 iterations
Section III-B adopts DE without convergence guarantees; Section VI.B concedes run-to-run variability.
domain assumption Printed colored paper patches adequately approximate digital RGB patches under the tested fixed camera conditions
Section V.C validates transfer only with four alloy models, a fixed camera, and no quantitative ASR, so the physical approximation is assumed rather than measured.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection." pith.science (2026). https://pith.science/paper/H7VOE7XW

@misc{pith2026260804559,
  author       = {Pith},
  title        = {Pith review of: ColorFD: A Finite-Difference Guided Black-Box Physical Adversarial Attack for Remote Sensing Object Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H7VOE7XW}},
  note         = {Machine review of arXiv:2608.04559}
}

read the original abstract

Although deep neural network-based remote sensing object detectors have achieved strong performance, they remain vulnerable to adversarial perturbations. Existing studies mainly focus on digital or white-box settings, whereas black-box physical attacks remain underexplored. These attacks are often constrained by limited physical feasibility and inefficient optimization in high-dimensional search spaces. To address these challenges, this paper proposes ColorFD, a black-box physical attack based on multiple pure-color patches. The patch positions and color parameters are jointly optimized using Differential Evolution (DE). A target-wise fitness and selection mechanism evaluates the attack state of each target and preserves target-specific improvements during evolution. Two guidance strategies further constrain the patch search space. Key-region localization identifies sensitive regions through finite-difference color probing. Common-feature extraction provides category-level spatial priors and avoids repeated localization. Although evaluated on aircraft, the formulation is not inherently restricted to this category. Experiments on YOLOv3u, YOLOv5u, and Faster R-CNN show that ColorFD outperforms the tested black-box patch method across all evaluated detectors and remains competitive with strong white-box baselines. Physical-world experiments further demonstrate that the optimized pure-color patches can be transferred from the digital domain to real imaging conditions.

Figures

Figures reproduced from arXiv: 2608.04559 by the authors.

**Figure 1.** Overview of the proposed ColorFD framework. The method first localizes key regions through finite-difference analysis to constrain the search space, [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

**Figure 2.** Pipeline of the proposed key-region localization process based on greedy finite-difference guidance. Key regions are iteratively identified by evaluating [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Performance comparison of unguided and key-region-guided ColorFD [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (7 more)

**Figure 4.** Figure 4: Common-Feature heatmaps and overlay visualizations across different [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: ASR versus average total query per image under different guidance [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 7.** Figure 7: Performance comparison of ColorFD and other attack methods on [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

**Figure 8.** Figure 8: Detection results of different attack methods on three object detectors. ColorFD outperforms the tested black-box method and is comparable to [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]

**Figure 9.** Figure 9: Comparison of digital and physical adversarial attack results for [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

**Figure 11.** Figure 11: Impact of the DE popmul value on attack performance. Notable [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]

**Figure 12.** Figure 12: Impact of the patch ratio value on attack performance. Notable [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 1 canonical work pages

[1]

Intriguing properties of neural networks,

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations (ICLR), 2014

2014
[2]

Explaining and harnessing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inInternational Conference on Learning Repre- sentations (ICLR), 2015

2015
[3]

Position guided dynamic receptive field network: A small object detection friendly to optical and sar images,

L. Wang, J. Li, J. Zhang, L. Zhuo, and Q. Tian, “Position guided dynamic receptive field network: A small object detection friendly to optical and sar images,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 8, pp. 8265–8282, 2025

2025
[4]

Fldet: Faster and lighter aerial object detector,

S. Wang, K. Liu, J. Huang, and X. Li, “Fldet: Faster and lighter aerial object detector,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 5, pp. 4450–4463, 2025

2025
[5]

Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,

S. Thys, W. Van Ranst, and T. Goedeme, “Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, June 2019

2019
[6]

Adversarial patch,

T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,”arXiv preprint arXiv:1712.09665, 2018

arXiv 2018
[7]

A unified framework for adversarial patch attacks against visual 3d object detection in autonomous driving,

J. Wang, F. Li, and L. He, “A unified framework for adversarial patch attacks against visual 3d object detection in autonomous driving,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 5, pp. 4949–4962, 2025

2025
[8]

Dual attention suppression attack: Generate adversarial camouflage in physical world,

J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu, “Dual attention suppression attack: Generate adversarial camouflage in physical world,” inIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 8565–8574

2021

Show all 41 references

[9]

Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack,

D. Wang, T. Jiang, J. Sun, W. Zhou, Z. Gong, X. Zhang, W. Yao, and X. Chen, “Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 36, 2022, pp. 2414–2422

2022
[10]

Naturalistic physical adversarial camouflage for object detection via differentiable rendering and style learning,

Z. Liu, Z. Yan, Q. Ning, Y . Lu, Z. Wang, and H. Wang, “Naturalistic physical adversarial camouflage for object detection via differentiable rendering and style learning,”Pattern Recognit., vol. 172, p. 112621, 2026

2026
[11]

Practical black-box attacks against machine learning,

N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, 2017, pp. 506–519

2017
[12]

One pixel attack for fooling deep neural networks,

J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,”IEEE Trans. Evol. Comput., vol. 23, no. 5, pp. 828– 841, 2019

2019
[13]

Rfla: A stealthy reflected light adversarial attack in the physical world,

D. Wang, W. Yao, T. Jiang, C. Li, and X. Chen, “Rfla: A stealthy reflected light adversarial attack in the physical world,” inProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), October 2023, pp. 4455–4465

2023
[14]

Black-box adversarial patch attacks using differential evolution against aerial imagery object detectors,

G. Tang, W. Yao, C. Li, T. Jiang, and S. Yang, “Black-box adversarial patch attacks using differential evolution against aerial imagery object detectors,”Eng. Appl. Artif. Intell., vol. 137, p. 109141, 2024

2024
[15]

Lesep: Boosting adversarial transferability via latent encoding and semantic embedding perturbations,

Y . Gan, C. Wu, D. Ouyang, S. Tang, M. Ye, and T. Xiang, “Lesep: Boosting adversarial transferability via latent encoding and semantic embedding perturbations,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 4, pp. 3368–3382, 2025

2025
[16]

Query efficient black- box adversarial attack on deep neural networks,

Y . Bai, Y . Wang, Y . Zeng, Y . Jiang, and S.-T. Xia, “Query efficient black- box adversarial attack on deep neural networks,”Pattern Recognit., vol. 133, p. 109037, 2023. IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS FOR VIDEO TECHNOLOGY 13

2023
[17]

Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” inProceedings of the 10th ACM Workshop on Artificial Intelligence and Security, 2017, pp. 15–26

2017
[18]

Genattack: practical black-box attacks with gradient- free optimization,

M. Alzantot, Y . Sharma, S. Chakraborty, H. Zhang, C.-J. Hsieh, and M. B. Srivastava, “Genattack: practical black-box attacks with gradient- free optimization,” inProceedings of the Genetic and Evolutionary Computation Conference, 2019, pp. 1111–1119

2019
[19]

Pso-based closed box adversarial patch attack against face recognition,

H. Ma, X. Jiang, K. Xu, and T. Sun, “Pso-based closed box adversarial patch attack against face recognition,”IEEE Trans. Circuits Syst. Video Technol., vol. 36, no. 6, pp. 8833–8844, 2026

2026
[20]

Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,

X. Wei, Y . Guo, J. Yu, and B. Zhang, “Simultaneously optimizing perturbations and positions for black-box adversarial patch attacks,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 7, pp. 9041–9054, 2023

2023
[21]

Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” inProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016, pp. 1528–1540

2016
[22]

A general framework for adversarial examples with objectives,

——, “A general framework for adversarial examples with objectives,” ACM Trans. Priv. Secur., vol. 22, no. 3, pp. 1–30, 2019

2019
[23]

Adversarial sticker: A stealthy attack method in the physical world,

X. Wei, Y . Guo, and J. Yu, “Adversarial sticker: A stealthy attack method in the physical world,”IEEE Trans. Pattern Anal. Mach. Intell., vol. 45, no. 3, pp. 2711–2725, 2023

2023
[24]

Facenet: A unified embed- ding for face recognition and clustering,

F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embed- ding for face recognition and clustering,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2015, pp. 815–823

2015
[25]

Yolo9000: Better, faster, stronger,

J. Redmon and A. Farhadi, “Yolo9000: Better, faster, stronger,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017, pp. 7263–7271

2017
[26]

Adversarial t-shirt! evading person detectors in a physical world,

K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y . Chen, Y . Wang, and X. Lin, “Adversarial t-shirt! evading person detectors in a physical world,” inComputer Vision – ECCV 2020. Springer, 2020, pp. 665–681

2020
[27]

Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,

S.-T. Chen, C. Cornelius, J. Martin, and D. H. Chau, “Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,” in Machine Learning and Knowledge Discovery in Databases. Springer, 2018, pp. 52–68

2018
[28]

Faster r-cnn: Towards real-time object detection with region proposal networks,

S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” inAdvances in Neural Information Processing Systems, vol. 28, 2015

2015
[29]

Generative adversarial nets,

I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Advances in Neural Information Processing Systems, vol. 27, 2014

2014
[30]

Tnt attacks! universal naturalistic adversarial patches against deep neural network systems,

B. G. Doan, M. Xue, S. Ma, E. Abbasnejad, and D. C. Ranasinghe, “Tnt attacks! universal naturalistic adversarial patches against deep neural network systems,”IEEE Trans. Inf. Forensics Secur., vol. 17, pp. 3816– 3830, 2022

2022
[31]

Distillation-enhanced physical adversarial attacks,

W. Liu, Y . Wu, C. Li, Z. Liu, and H. Yan, “Distillation-enhanced physical adversarial attacks,”arXiv preprint arXiv:2501.02232, 2025

2025 arXiv
[32]

Adversarial camouflage: Hiding physical-world attacks with natural styles,

R. Duan, X. Ma, Y . Wang, J. Bailey, A. K. Qin, and Y . Yang, “Adversarial camouflage: Hiding physical-world attacks with natural styles,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020

2020
[33]

Wasserstein generative adver- sarial networks,

M. Arjovsky, S. Chintala, and L. Bottou, “Wasserstein generative adver- sarial networks,” inProceedings of the 34th International Conference on Machine Learning, vol. 70, 2017, pp. 214–223

2017
[34]

Generating natural adversarial remote sensing images,

J.-C. Burnel, K. Fatras, R. Flamary, and N. Courty, “Generating natural adversarial remote sensing images,”IEEE Trans. Geosci. Remote Sens., vol. 60, pp. 1–14, 2022

2022
[35]

Universal adversarial examples in remote sensing: Methodology and benchmark,

Y . Xu and P. Ghamisi, “Universal adversarial examples in remote sensing: Methodology and benchmark,”IEEE Trans. Geosci. Remote Sens., vol. 60, pp. 1–15, 2022

2022
[36]

Dempaa: Deployable multi-mini-patch adversarial attack for remote sensing image classification,

J.-J. Huang, Z. Wang, T. Liu, W. Luo, Z. Chen, W. Zhao, and M. Wang, “Dempaa: Deployable multi-mini-patch adversarial attack for remote sensing image classification,”IEEE Trans. Geosci. Remote Sens., vol. 62, pp. 1–13, 2024

2024
[37]

Adversarial patch attack on multi-scale object detection for uav remote sensing images,

Y . Zhang, Y . Zhang, J. Qi, K. Bin, H. Wen, X. Tong, and P. Zhong, “Adversarial patch attack on multi-scale object detection for uav remote sensing images,”Remote Sens., vol. 14, no. 21, p. 5298, 2022

2022
[38]

Benchmarking adversarial patch against aerial detection,

J. Lian, S. Mei, S. Zhang, and M. Ma, “Benchmarking adversarial patch against aerial detection,”IEEE Trans. Geosci. Remote Sens., vol. 60, pp. 1–16, 2022

2022
[39]

Threatening patch attacks on object detection in optical remote sensing images,

X. Sun, G. Cheng, L. Pei, H. Li, and J. Han, “Threatening patch attacks on object detection in optical remote sensing images,”IEEE Trans. Geosci. Remote Sens., vol. 61, pp. 1–10, 2023

2023
[40]

Object detection in optical remote sensing images: A survey and a new benchmark,

K. Li, G. Wan, G. Cheng, L. Meng, and J. Han, “Object detection in optical remote sensing images: A survey and a new benchmark,”ISPRS J. Photogramm. Remote Sens., vol. 159, pp. 296–307, 2020

2020
[41]

Fooling aerial detectors by background attack via dual-adversarial-induced error identification,

X. Wang, S. Mei, J. Lian, and Y . Lu, “Fooling aerial detectors by background attack via dual-adversarial-induced error identification,” IEEE Trans. Geosci. Remote Sens., vol. 62, pp. 1–16, 2024. Tiannuo Guoreceived the B.S. degree in computer science and technology from China...

2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Intriguing properties of neural networks,

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations (ICLR), 2014

2014

[2] [2]

Explaining and harnessing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inInternational Conference on Learning Repre- sentations (ICLR), 2015

2015

[3] [3]

Position guided dynamic receptive field network: A small object detection friendly to optical and sar images,

L. Wang, J. Li, J. Zhang, L. Zhuo, and Q. Tian, “Position guided dynamic receptive field network: A small object detection friendly to optical and sar images,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 8, pp. 8265–8282, 2025

2025

[4] [4]

Fldet: Faster and lighter aerial object detector,

S. Wang, K. Liu, J. Huang, and X. Li, “Fldet: Faster and lighter aerial object detector,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 5, pp. 4450–4463, 2025

2025

[5] [5]

Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,

S. Thys, W. Van Ranst, and T. Goedeme, “Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, June 2019

2019

[6] [6]

Adversarial patch,

T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,”arXiv preprint arXiv:1712.09665, 2018

arXiv 2018

[7] [7]

A unified framework for adversarial patch attacks against visual 3d object detection in autonomous driving,

J. Wang, F. Li, and L. He, “A unified framework for adversarial patch attacks against visual 3d object detection in autonomous driving,”IEEE Trans. Circuits Syst. Video Technol., vol. 35, no. 5, pp. 4949–4962, 2025

2025

[8] [8]

Dual attention suppression attack: Generate adversarial camouflage in physical world,

J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu, “Dual attention suppression attack: Generate adversarial camouflage in physical world,” inIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 8565–8574

2021