Pith. sign in

REVIEW 5 major objections 5 minor 61 references

Towards an End-to-End (E2E) Adversarial Learning and Application in the Physical World

T0 review · 5 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial patches can be learned and applied entirely in the physical world using a projector-camera loop.

desk verdict Genuinely new projector-in-the-loop attack, but the PL-PA vs DL-PA comparison is confounded by medium, and the loop mechanics are underspecified. read the letter →

arxiv 2501.08258 v2 pith:HR5NGLXA submitted 2025-01-14 cs.CV cs.CR

Dudi Biton , Jacob Shams , Satoru Koda , Asaf Shabtai , Yuval Elovici , Ben Nassi This is my paper · ORCID
classification cs.CVcs.CR
keywords adversarialpatchesphysical-domainattacksobjectdetectionevasionprojector-basedtransferabilityend-to-endlearningPAPLAdeepsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that the failure of adversarial patches to survive the jump from computer images to the physical world can be avoided by learning the patch in the physical world itself. It introduces PAPLA, a closed loop in which a projector shines the current patch on a static object, a camera photographs the scene, and an ordinary digital patch attack updates the patch from that photograph before the next projection. Across lab and outdoor tests, this physical learning–physical application route lowered object-detector confidence far more than the standard print-a-digital-patch route, and in an outdoor test it drove a parked car's detection confidence from 0.95 to 0 and a stop sign's from 0.95 to 0.39. The claim is explicitly conditional: it holds for static objects with a suitable projection surface and line of sight, and it trades away image quality, producing more visible distortion than printed stickers.

What carries the argument

The machinery is the PAPLA closed loop: project the current patch onto the target, capture the scene with a camera, feed that frame into an existing digital patch attack to update the patch pixels, then repeat, and finally project the optimized patch as the attack. The load-bearing property is that learning and application share the same physical channel, so projector color response, surface color, ambient light, and camera viewpoint enter the optimization rather than appearing as a mismatch after training. The paper also relies on the standard digital attacks it wraps, DPatch and NAP, as the update rule that turns each camera frame into the next patch.

What would settle it

Run PAPLA on a static object while holding all environmental factors fixed, and record the detector's confidence after every iteration; if the confidence does not fall over iterations, or if the final projected patch is no better than the same patch evaluated digitally on a clean frame, then the claim that physical learning eliminates the transferability problem fails in that setting.

Watch

Extended reading notes

Core claim

PAPLA's central claim is that when patch learning and application both happen in the physical domain, the transferability problem disappears: success of the learning process implies success of the attack in that scene. The evidence is comparative: digitally learned patches that dropped YOLOv3 and Faster R-CNN confidence to about 0.55 and 0.77 when applied digitally only brought them down to 0.88 and 0.93 when printed as stickers, while the same attacks converted to physical learning drove confidence on tested objects to 0, 0.16, 0.26, and 0.15 in monocular lab settings. In a realistic outdoor run, the parked car's confidence fell from 0.95 to 0 and the stop sign's from 0.95 to 0.39. The paper frames this as a framework, PAPLA, that wraps existing digital attacks such as DPatch and NAP and executes their iterative updates inside a projector-camera loop, with the environmental conditions baked into the optimization.

Load-bearing premise

The load-bearing premise is that the closed loop actually optimizes: each camera picture of the projected patch has to let the attack software compute pixel updates that make the next projection better at hiding the object, rather than drifting, oscillating, or failing to improve.

Editorial extensions

If this is right

  • If the central claim holds, a practitioner no longer needs to simulate the physical world to attack a static object: pointing a projector and camera at it and running the loop produces a patch that works in that exact scene.
  • Environmental factors are not equal: distance was the strongest tested factor (median confidence reduction rose from 0.65% at 0.5 m to 76.53% at 1.5 m), lighter projection surfaces worked better, higher-lumen projectors helped, and ambient light had little measured effect in the tested range.
  • The same physically learned patches also transferred across detectors better on average than digitally learned patches (e.g., average confidence difference 52.4% vs 39.1% for NAP patches, and 35.6% vs 19.8% for DPatch patches), so the benefit is not limited to the detector used during learning.
  • The method is not universal: moving objects, hollow objects such as bicycles, and setups without line of sight remain the domain where printed patches are preferred, and the physical patches are more visually conspicuous.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the loop converges as shown, a static object with a clear line of sight becomes an attack surface for remote light projection, which is a materially different threat model from placing a sticker on the object.
  • A natural extension the paper leaves implicit is mapping the convergence region of the loop over distance, angle, and projector power; the ANOVA results here suggest distance is the decisive variable and would be the first thing to test.
  • Because PAPLA wraps off-the-shelf digital attacks rather than defining a new loss, newer digital patch attacks could be dropped into the same loop and could inherit the physical-domain benefit if their update rule tolerates the projector-camera noise.
  • A testable consequence of the same-channel argument is that the loop's final patch should outperform a digitally optimized patch even when both are projected under identical conditions; the paper's DL-PA baseline uses printed stickers, so a projector-only comparison would isolate the learning-channel effect.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes PAPLA, a framework that adapts digital patch attacks (DPatch and NAP) to run end-to-end in the physical domain: a patch is projected onto a static target object, the scene is captured with a camera, and the patch pixels are updated iteratively using the chosen digital attack. The authors compare this physical-learning/physical-application (PL-PA) setting against digital-learning/digital-application (DL-DA) and digital-learning/physical-application (DL-PA, printed sticker) baselines, report factor analyses over projector strength, ambient light, distance, angle, and surface color, and present outdoor demonstrations against a parked car and a stop sign. The central claim is that, under specific conditions, performing adversarial learning in the physical domain eliminates the digital-to-physical transferability issue and ensures evasion.

Significance. If the central claim were established, PAPLA would be a notable new capability for physical adversarial attacks, with a clear security implication for camera-based perception systems. The paper's strengths include the breadth of the empirical study (81 controlled runs in the factor analysis, multiple target objects and detectors, and outdoor demonstrations), the honest enumeration of limitations in Section VI, and the explicit comparison of three learning/application scenarios. However, the evidence as presented does not yet isolate the effect of end-to-end physical learning: the main comparison is confounded by application medium and illumination, and the learning loop itself is not specified at the level needed to show that gradient-based optimization is actually taking place through the physical channel.

major comments (5)
  1. [Section V-A and V-C] The central PL-PA versus DL-PA comparison is confounded. In Section V-A1, PL-PA uses a 6000 ANSI lumen projector while DL-PA uses a printed sticker, and Section V-C reports an average L2 norm of 26,295.67 for PL-PA versus 6,606.05 for DL-PA. The two conditions therefore differ simultaneously in the learning domain, the application medium, and the amount of scene-level illumination. Without a same-modality control in which a digitally learned patch is projected with the same projector at the same brightness, or a random-projection control with matched illumination and coverage, the observed confidence reductions cannot be attributed to end-to-end physical learning rather than to brightness, contrast, or accidental occlusion. This is load-bearing for the abstract's claim that E2E physical learning 'eliminates the transferability issue.'
  2. [Section III-B1] The paper does not specify the mechanism that makes the physical learning loop optimizable. Section III-B1 says to 'capture the physical scene' and 'update the patch pixels iteratively using the chosen attack,' but DPatch and NAP are digital attacks that assume a differentiable input image and a known patch location and mask. The manuscript does not explain how the projected patch is registered in each camera frame, how gradients are obtained across the non-differentiable projector-camera channel (including projector transfer function, surface reflectance, and camera ISP), or how projection, capture, and update are synchronized. Without these details, the reported convergence is not established as adversarial optimization; a non-adversarial effect of the projected light could produce the same qualitative results.
  3. [Section III-A3] The statement 'ensuring the success of the learning process to imply the success of the attack' is definitional rather than empirical. If learning and application occur in the same physical loop, then a patch that reduces confidence in that loop is, by construction, successful in that loop. The interesting question is whether the learned patch transfers to reasonable variations in viewpoint, distance, and illumination. The paper's own Section IV-A results show strong sensitivity to distance (median reduction 0.65% at 0.5 m versus 76.53% at 1.5 m), and Section VI lists multiple constraints. The claim that PAPLA 'eliminates' the transferability issue therefore overstates what the evidence supports.
  4. [Section V-D] The transferability evaluation compares PL-PA patches with DL-DA patches, not with DL-PA patches, even though the paper's headline comparison is PL-PA versus DL-PA. Tables IV and V report average confidence differences of 52.4% versus 39.1% for NAP and 35.6% versus 19.8% for DPatch, but the DL-DA baseline is not the physical-application baseline used in Sections V-A and V-B. To support the claim that physical learning improves cross-detector transferability relative to the current practice of printed stickers, the paper should compare PL-PA patches against DL-PA patches in the same transferability protocol.
  5. [Sections V-A2, V-B2, and Table III] The main evaluation reports single confidence scores without error bars or repeated trials, despite the paper's own Table III showing substantial pixel-level noise between consecutive captures of the same scene in controlled conditions (average L0 of 78.26%). Given that noise level, a point estimate from one or a few frames is insufficient to establish that the observed confidence differences are stable. The paper should report means and variances over multiple runs for the headline PL-PA versus DL-PA comparisons, as is already done for the surface-color analysis in Section IV-B.
minor comments (5)
  1. [Section IV-B2] Insight 10 contains a typo: 'highly effected' should be 'highly affected.'
  2. [Section IV-A2] The text repeatedly writes 'ANOV A' instead of 'ANOVA.'
  3. [Section V-A1] The setup text says 'identical parameters in each scenario' but then specifies different distances and patch sizes per target object; the sentence should be reworded to say the parameters were identical across scenarios for a given target object.
  4. [Tables II and III] The L0 percentages are reported without a threshold definition; since L0 normally counts nonzero pixel differences, the reader cannot tell whether a one-unit pixel change counts as a difference. A threshold or a reference to the code would make these tables reproducible.
  5. [References] Reference [48] attributes RetinaNet to 'T.-Y. Ross and G. Dollár'; the correct first author is Tsung-Yi Lin. Please correct the citation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PAPLA's central claims are empirical, in-distribution attack evaluations, and the same-domain premise is a definitional assumption rather than a derived result.

full rationale

The paper's derivation chain is empirical rather than formal: PAPLA adapts existing digital attacks (DPatch, NAP) to a physical projection loop, and the reported results are in-distribution attack-performance measurements, not out-of-sample predictions made from fitted constants. The phrase in Section III-A3 that 'the success of the learning process' will 'imply the success of the attack' is an assumption about same-domain generalization, not a step in which an output is defined in terms of an input; it is the method's motivation rather than a derived equivalence. No equation in the paper defines one quantity in terms of another in a way that reduces a prediction to its own input, and no fitted parameter is renamed as a predicted result. The self-citations to prior projector work, including reference [44] by overlapping authors, are contextual support for the threat model and are not load-bearing for the core empirical comparison. The comparison between digital learning-physical application (DL-PA) and physical learning-physical application (PL-PA) may carry confounds, such as the difference in projector brightness (average L2 norm 26,295.67 versus 6,606.05 in Section V-C), but a confound is a correctness or validity risk, not a circular reduction. According to the review rules, the absence of a fitted-input-called-prediction step, a self-citation chain, or a uniqueness theorem imported from prior work means the appropriate finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper is an empirical attack evaluation. No fitted theoretical constants, no parameter-free derivations, and no new physical entities are introduced. The load-bearing premises are domain assumptions about the physical optimization loop and the threat model, not mathematical axioms.

free parameters (2)
  • Patch size per target object = 4.5x4.5 cm (car), 10x10 cm (stop sign), 4x4 cm (potted plant and cup)
    Hand-chosen experimental settings that affect how much of the object is covered by the projected perturbation; no principled rule or sensitivity analysis is given.
  • Training epochs for NAP attack = 50 epochs instead of the original 100
    The authors reduced the epoch count with no reported justification or ablation, which could affect convergence and final attack success.
assumptions (4)
  • domain assumption The projector-camera loop is optimizable: gradients of detector loss with respect to patch pixels can be obtained from captured physical frames and used to update the projected patch.
    Section III-B1 says to update patch pixels using the chosen attack, but the paper does not describe how gradients are computed through the physical projection or how patch alignment is maintained.
  • domain assumption The target object is static, has a projection-suitable surface, and is in line of sight during learning and application.
    Section III-A states this threat model, and Section VI lists moving and hollow objects as limitations.
  • domain assumption Attack update rules designed for digital images remain valid when applied to a camera image of a projected patch.
    Section V-A1 uses default settings from DPatch and NAP without describing any adaptation for the physical capture loop.
  • domain assumption The same camera and viewpoint used during learning are representative of the deployment scenario.
    Section II-A states that the same camera was used for patch learning and application, so the measured confidence reductions may not generalize to other cameras, distances, or angles.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards an End-to-End (E2E) Adversarial Learning and Application in the Physical World." pith.science (2026). https://pith.science/paper/HR5NGLXA

@misc{pith2026250108258,
  author       = {Pith},
  title        = {Pith review of: Towards an End-to-End (E2E) Adversarial Learning and Application in the Physical World},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HR5NGLXA}},
  note         = {Machine review of arXiv:2501.08258}
}
read the original abstract

The traditional learning process of patch-based adversarial attacks, conducted in the digital domain and then applied in the physical domain (e.g., via printed stickers), may suffer from reduced performance due to adversarial patches' limited transferability from the digital domain to the physical domain. Given that previous studies have considered using projectors to apply adversarial attacks, we raise the following question: can adversarial learning (i.e., patch generation) be performed entirely in the physical domain with a projector? In this work, we propose the Physical-domain Adversarial Patch Learning Augmentation (PAPLA) framework, a novel end-to-end (E2E) framework that converts adversarial learning from the digital domain to the physical domain using a projector. We evaluate PAPLA across multiple scenarios, including controlled laboratory settings and realistic outdoor environments, demonstrating its ability to ensure attack success compared to conventional digital learning-physical application (DL-PA) methods. We also analyze the impact of environmental factors, such as projection surface color, projector strength, ambient light, distance, and angle of the target object relative to the camera, on the effectiveness of projected patches. Finally, we demonstrate the feasibility of the attack against a parked car and a stop sign in a real-world outdoor environment. Our results show that under specific conditions, E2E adversarial learning in the physical domain eliminates the transferability issue and ensures evasion by object detectors. Finally, we provide insights into the challenges and opportunities of applying adversarial learning in the physical domain and explain where such an approach is more effective than using a sticker.

Figures

Figures reproduced from arXiv: 2501.08258 by the authors.

Figure 1
Figure 1. Application of adversarial patches in different learning [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. PAPLA learning process: an adversary points a projec [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Confidence reduction percentage for different angles, distances, ambient light levels, and projectors. Each cell shows [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Box plots illustrating the impact of each environmental factor on the confidence reduction percentage of the DPatch [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Impact of surface color on patch projection effec [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Target object confidence scores for different attack and camera setups. The purple bar represents the confidence score [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Performance comparison of NAP on a potted plant [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 9
Figure 9. Figure 9: Left: PAPLA setup visualization. Right: Confidence [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 47 canonical work pages

  1. [1]

    Enhanc- ing object detection in smart video surveillance: A survey of occlusion-handling approaches,

    Z. Ouardirhi, S. A. Mahmoudi, and M. Zbakh, “Enhanc- ing object detection in smart video surveillance: A survey of occlusion-handling approaches,” Electronics, vol. 13, no. 3, p. 541, 2024

    work page 2024

  2. [2]

    Automatic number plate recognition: A detailed survey of relevant algo- rithms,

    Lubna, N. Mufti, and S. A. A. Shah, “Automatic number plate recognition: A detailed survey of relevant algo- rithms,” Sensors, vol. 21, no. 9, p. 3028, 2021

    work page 2021

  3. [3]

    Deep learning meth- ods for object detection in autonomous vehicles,

    A. Juyal, S. Sharma, and P. Matta, “Deep learning meth- ods for object detection in autonomous vehicles,” in 2021 5th International Conference on Trends in Electronics and Informatics (ICOEI) . IEEE, 2021, pp. 751–755

    work page 2021

  4. [4]

    Naturalistic physical ad- versarial patch for object detectors,

    Y .-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.- L. Hua, and W.-H. Cheng, “Naturalistic physical ad- versarial patch for object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7848–7857

    work page 2021

  5. [5]

    Hop- skipjumpattack: A query-efficient decision-based attack,

    J. Chen, M. I. Jordan, and M. J. Wainwright, “Hop- skipjumpattack: A query-efficient decision-based attack,” in 2020 ieee symposium on security and privacy (sp) . IEEE, 2020, pp. 1277–1294

    work page 2020

  6. [6]

    Simple black-box adversarial attacks,

    C. Guo, J. Gardner, Y . You, A. G. Wilson, and K. Wein- berger, “Simple black-box adversarial attacks,” in Inter- national conference on machine learning. PMLR, 2019, pp. 2484–2493

    work page 2019

  7. [7]

    Decision- based adversarial attacks: Reliable attacks against black-box machine learning models,

    W. Brendel, J. Rauber, and M. Bethge, “Decision- based adversarial attacks: Reliable attacks against black-box machine learning models,” arXiv preprint arXiv:1712.04248, 2017

    arXiv 2017

  8. [8]

    Synthesizing robust adversarial examples,

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” 2018. [Online]. Available: https://arxiv.org/abs/1707.07397

    arXiv 2018

Show all 61 references
  1. [9]

    Phys- 14 ical adversarial examples for object detectors,

    D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Phys- 14 ical adversarial examples for object detectors,” in 12th USENIX workshop on offensive technologies (WOOT 18), 2018

    2018

  2. [10]

    On physical adversarial patches for object detection,

    M. Lee and Z. Kolter, “On physical adversarial patches for object detection,” arXiv preprint arXiv:1906.11897 , 2019

    1906 arXiv

  3. [11]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rah- mati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 1625–1634

    2018

  4. [12]

    Adversarialeak: External information leak- age attack using adversarial samples on face recognition systems,

    R. Katzav, A. Giloni, E. Grolman, H. Saito, T. Shibata, T. Omino, M. Komatsu, Y . Hanatani, Y . Elovici, and A. Shabtai, “Adversarialeak: External information leak- age attack using adversarial samples on face recognition systems,” in European Conference on Computer Vision . S...

    2025

  5. [13]

    Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,

    S.-T. Chen, C. Cornelius, J. Martin, and D. H. Chau, “Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,” in Machine Learning and Knowledge Discovery in Databases: European Confer- ence, ECML PKDD 2018, Dublin, Ireland, September 10–14, 2018, Pro...

    2018

  6. [14]

    Dpatch: An adversarial patch attack on object detec- tors,

    X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y . Chen, “Dpatch: An adversarial patch attack on object detec- tors,” arXiv preprint arXiv:1806.02299 , 2018

    2018 arXiv

  7. [15]

    Camou: Learning physical vehicle camouflages to adversarially attack detectors in the wild,

    Y . Zhang, H. Foroosh, P. David, and B. Gong, “Camou: Learning physical vehicle camouflages to adversarially attack detectors in the wild,” in International Conference on Learning Representations , 2018

    2018

  8. [16]

    Fooling automated surveillance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedem ´e, “Fooling automated surveillance cameras: adversarial patches to attack person detection,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    2019

  9. [17]

    Adversarial t-shirt! evading person detectors in a physical world,

    K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y . Chen, Y . Wang, and X. Lin, “Adversarial t-shirt! evading person detectors in a physical world,” in Com- puter Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V

    2020

  10. [18]

    Springer, 2020, pp. 665–681

    2020

  11. [19]

    Universal physical camouflage attacks on object detectors,

    L. Huang, C. Gao, Y . Zhou, C. Xie, A. L. Yuille, C. Zou, and N. Liu, “Universal physical camouflage attacks on object detectors,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 720–729

    2020

  12. [20]

    Mak- ing an invisibility cloak: Real world adversarial attacks on object detectors,

    Z. Wu, S.-N. Lim, L. S. Davis, and T. Goldstein, “Mak- ing an invisibility cloak: Real world adversarial attacks on object detectors,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23– 28, 2020, Proceedings, Part IV 16 . Springer, 2020, pp. 1–17

    2020

  13. [21]

    The translucent patch: A physical and universal attack on object detectors,

    A. Zolfi, M. Kravchik, Y . Elovici, and A. Shabtai, “The translucent patch: A physical and universal attack on object detectors,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 15 232–15 241

    2021

  14. [22]

    Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,

    P. Jing, Q. Tang, Y . Du, L. Xue, X. Luo, T. Wang, S. Nie, and S. Wu, “Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 3237–3254

    2021

  15. [23]

    Legitimate adver- sarial patches: Evading human eyes and detection models in the physical world,

    J. Tan, N. Ji, H. Xie, and X. Xiang, “Legitimate adver- sarial patches: Evading human eyes and detection models in the physical world,” in Proceedings of the 29th ACM international conference on multimedia, 2021, pp. 5307– 5315

    2021

  16. [24]

    Dta: Physical camouflage attacks using differentiable transformation network,

    N. Suryanto, Y . Kim, H. Kang, H. T. Larasati, Y . Yun, T.- T.-H. Le, H. Yang, S.-Y . Oh, and H. Kim, “Dta: Physical camouflage attacks using differentiable transformation network,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp...

    2022

  17. [25]

    Adversarial texture for fooling person detectors in the physical world,

    Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, and X. Hu, “Adversarial texture for fooling person detectors in the physical world,” in Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition , 2022, pp. 13 307–13 316

    2022

  18. [26]

    The adversarial implications of variable-time inference,

    D. Biton, A. Misra, E. Levy, J. Kotak, R. Bitton, R. Schuster, N. Papernot, Y . Elovici, and B. Nassi, “The adversarial implications of variable-time inference,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security , 2023, pp. 103–114

    2023

  19. [27]

    Fooling the eyes of autonomous vehicles: Robust phys- ical adversarial examples against traffic sign recognition systems,

    W. Jia, Z. Lu, H. Zhang, Z. Liu, J. Wang, and G. Qu, “Fooling the eyes of autonomous vehicles: Robust phys- ical adversarial examples against traffic sign recognition systems,” arXiv preprint arXiv:2201.06192 , 2022

    2022 arXiv

  20. [28]

    T-sea: Transfer-based self-ensemble attack on object detection,

    H. Huang, Z. Chen, H. Chen, Y . Wang, and K. Zhang, “T-sea: Transfer-based self-ensemble attack on object detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 20 514–20 523

    2023

  21. [29]

    {TPatch}: A triggered physical adversarial patch,

    W. Zhu, X. Ji, Y . Cheng, S. Zhang, and W. Xu, “{TPatch}: A triggered physical adversarial patch,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 661–678

    2023

  22. [30]

    Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,

    Z. Hu, W. Chu, X. Zhu, H. Zhang, B. Zhang, and X. Hu, “Physically realizable natural-looking clothing textures evade person detectors via 3d modeling,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 975–16 984

    2023

  23. [31]

    Dap: A dynamic adversarial patch for evading person detectors,

    A. Guesmi, R. Ding, M. A. Hanif, I. Alouani, and M. Shafique, “Dap: A dynamic adversarial patch for evading person detectors,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 595–24 604

    2024

  24. [32]

    Revisiting adversarial patches for designing camera-agnostic attacks against person detection,

    H. Wei, Z. Wang, K. Zhang, J. Hou, Y . Liu, H. Tang, and Z. Wang, “Revisiting adversarial patches for designing camera-agnostic attacks against person detection,” in The Thirty-eighth Annual Conference on Neural Information Processing Systems

  25. [33]

    Full-distance evasion of pedestrian detectors in the physical world,

    Z. Cheng, Z. Hu, Y . Liu, J. Li, H. Su, and X. Hu, “Full-distance evasion of pedestrian detectors in the physical world,” in The Thirty-eighth Annual Conference 15 on Neural Information Processing Systems

  26. [34]

    Infrared invisible clothing: Hiding from infrared detectors at multiple angles in real world,

    X. Zhu, Z. Hu, S. Huang, J. Li, and X. Hu, “Infrared invisible clothing: Hiding from infrared detectors at multiple angles in real world,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 13 317–13 326

    2022

  27. [35]

    Hotcold block: Fooling thermal infrared detectors with a novel wearable design,

    H. Wei, Z. Wang, X. Jia, Y . Zheng, H. Tang, S. Satoh, and Z. Wang, “Hotcold block: Fooling thermal infrared detectors with a novel wearable design,” in Proceedings of the AAAI conference on artificial intelligence , vol. 37, no. 12, 2023, pp. 15 233–15 241

    2023

  28. [36]

    Infrared adversarial patches with learnable shapes and locations in the phys- ical world,

    X. Wei, J. Yu, and Y . Huang, “Infrared adversarial patches with learnable shapes and locations in the phys- ical world,” International Journal of Computer Vision , vol. 132, no. 6, pp. 1928–1944, 2024

    1928

  29. [37]

    Infrared adversarial car stickers,

    X. Zhu, Y . Liu, Z. Hu, J. Li, and X. Hu, “Infrared adversarial car stickers,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 284–24 293

    2024

  30. [38]

    {SLAP}: Improving physical adver- sarial examples with {Short-Lived} adversarial perturba- tions,

    G. Lovisotto, H. Turner, I. Sluganovic, M. Strohmeier, and I. Martinovic, “ {SLAP}: Improving physical adver- sarial examples with {Short-Lived} adversarial perturba- tions,” in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 1865–1882

    2021

  31. [39]

    Opticloak: Blinding vision-based autonomous driving systems through adversarial optical projection,

    H. Wen, S. Chang, L. Zhou, W. Liu, and H. Zhu, “Opticloak: Blinding vision-based autonomous driving systems through adversarial optical projection,” IEEE Internet of Things Journal , 2024

    2024

  32. [40]

    Adversarial color projection: A projector-based physical-world attack to dnns,

    C. Hu, W. Shi, and L. Tian, “Adversarial color projection: A projector-based physical-world attack to dnns,” Image and Vision Computing , vol. 140, p. 104861, 2023

    2023

  33. [41]

    Adversarial patch attacks on deep-learning-based face recognition systems using generative adversarial networks,

    R.-H. Hwang, J.-Y . Lin, S.-Y . Hsieh, H.-Y . Lin, and C.-L. Lin, “Adversarial patch attacks on deep-learning-based face recognition systems using generative adversarial networks,” Sensors, vol. 23, no. 2, p. 853, 2023

    2023

  34. [42]

    Advhat: Real-world ad- versarial attack on arcface face id system,

    S. Komkov and A. Petiushko, “Advhat: Real-world ad- versarial attack on arcface face id system,” in 2020 25th international conference on pattern recognition (ICPR) . IEEE, 2021, pp. 819–826

    2020

  35. [43]

    Real- world adversarial examples via makeup,

    C.-S. Lin, C.-Y . Hsu, P.-Y . Chen, and C.-M. Yu, “Real- world adversarial examples via makeup,” in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2022, pp. 2854–2858

    2022

  36. [44]

    Unified adversarial patch for cross-modal attacks in the physical world,

    X. Wei, Y . Huang, Y . Sun, and J. Yu, “Unified adversarial patch for cross-modal attacks in the physical world,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 4445–4454

    2023

  37. [45]

    Phantom of the adas: Secur- ing advanced driver-assistance systems from split-second phantom attacks,

    B. Nassi, Y . Mirsky, D. Nassi, R. Ben-Netanel, O. Drokin, and Y . Elovici, “Phantom of the adas: Secur- ing advanced driver-assistance systems from split-second phantom attacks,” in Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, 2020, p...

    2020

  38. [46]

    Adversarial robustness toolbox v1. 0.0,

    M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V . Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig et al. , “Adversarial robustness toolbox v1. 0.0,” arXiv preprint arXiv:1807.01069, 2018

    2018 arXiv

  39. [47]

    Yolov3: An incremental improvement,

    J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” arXiv preprint arXiv:1804.02767 , 2018

    2018 arXiv

  40. [48]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” IEEE transactions on pattern analysis and machine intelligence , vol. 39, no. 6, pp. 1137–1149, 2016

    2016

  41. [49]

    Focal loss for dense object detection,

    T.-Y . Ross and G. Doll ´ar, “Focal loss for dense object detection,” in proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 2980– 2988

    2017

  42. [50]

    Ssd: Single shot multibox detector,

    W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, “Ssd: Single shot multibox detector,” in Computer Vision–ECCV 2016: 14th Euro- pean Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part I 14 . Springer, 2016, pp. 21–37

    2016

  43. [51]

    Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception,

    T. Sato, S. H. V . Bhupathiraju, M. Clifford, T. Sugawara, Q. A. Chen, and S. Rampazzi, “Invisible reflections: Leveraging infrared laser reflections to target traffic sign perception,” arXiv preprint arXiv:2401.03582 , 2024

    2024 arXiv

  44. [52]

    Light can be dangerous: Stealthy and effective physical-world adversarial attack by spot light,

    L. Yufeng, Y . Fengyu, L. Qi, L. Jiangtao, and C. Chen- hong, “Light can be dangerous: Stealthy and effective physical-world adversarial attack by spot light,” Com- puters & Security , vol. 132, p. 103345, 2023

    2023

  45. [53]

    On adversarial patches: real-world attack on arcface-100 face recognition system,

    M. Pautov, G. Melnikov, E. Kaziakhmedov, K. Kireev, and A. Petiushko, “On adversarial patches: real-world attack on arcface-100 face recognition system,” in 2019 International Multi-Conference on Engineering, Com- puter and Information Sciences (SIBIRCON) . IEEE, 2019, pp. 0391–0396

    2019

  46. [54]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 acm sigsac conference on computer and communi- cations security, 2016, pp. 1528–1540

    2016

  47. [55]

    Generating adversarial examples by makeup attacks on face recogni- tion,

    Z.-A. Zhu, Y .-Z. Lu, and C.-K. Chiang, “Generating adversarial examples by makeup attacks on face recogni- tion,” in 2019 IEEE International Conference on Image Processing (ICIP). IEEE, 2019, pp. 2516–2520

    2019

  48. [56]

    Adv-makeup: A new imperceptible and transferable attack on face recognition,

    B. Yin, W. Wang, T. Yao, J. Guo, Z. Kong, S. Ding, J. Li, and C. Liu, “Adv-makeup: A new imperceptible and transferable attack on face recognition,” arXiv preprint arXiv:2105.03162, 2021

    2021 arXiv

  49. [57]

    Adversarial laser beam: Effective physical- world attack to dnns in a blink,

    R. Duan, X. Mao, A. K. Qin, Y . Chen, S. Ye, Y . He, and Y . Yang, “Adversarial laser beam: Effective physical- world attack to dnns in a blink,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 16 062–16 071

    2021

  50. [58]

    Invisible mask: Practical attacks on face recognition with infrared,

    Z. Zhou, D. Tang, X. Wang, W. Han, X. Liu, and K. Zhang, “Invisible mask: Practical attacks on face recognition with infrared,” 2018. [Online]. Available: https://arxiv.org/abs/1803.04683

    2018 arXiv

  51. [59]

    Vla: A practical visible light-based attack on face recognition systems in physical world,

    M. Shen, Z. Liao, L. Zhu, K. Xu, and X. Du, “Vla: A practical visible light-based attack on face recognition systems in physical world,” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technolo- gies, vol. 3, no. 3, pp. 1–19, 2019. 16

    2019

  52. [60]

    Fooling thermal infrared pedestrian detectors in real world using small bulbs,

    X. Zhu, X. Li, J. Li, Z. Wang, and X. Hu, “Fooling thermal infrared pedestrian detectors in real world using small bulbs,” in Proceedings of the AAAI conference on artificial intelligence , vol. 35, no. 4, 2021, pp. 3616– 3624

    2021

  53. [61]

    I can see the light: Attacks on autonomous vehicles using invisible lights,

    W. Wang, Y . Yao, X. Liu, X. Li, P. Hao, and T. Zhu, “I can see the light: Attacks on autonomous vehicles using invisible lights,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 1930–1944

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.