Pith. sign in

REVIEW 5 major objections 5 minor 50 references

Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Physical adversarial patches can hide products from unmanned-store object-detection models in roughly 69–78% of frames, and a color-histogram loss improves attacks that invent or relabel products.

desk verdict A solid, honest applied evaluation of adversarial patch attacks for unmanned-store detection, with a convincing Hiding-attack result; the new loss and the threat-level claims are weaker than the abstract suggests, but the paper deserves peer review. read the letter →

arxiv 2505.08835 v1 pith:OEACNWSC submitted 2025-05-13 cs.CR cs.AIcs.CV

Hyunsik Na , Wonho Lee , Seungdeok Roh , Sohee Park , Daeseon Choi This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords adversarialpatchesobjectdetectionunmannedstoresphysicalattackscolorhistogramlossblack-boxYOLOv5FasterR-CNN
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Fully unmanned stores that rely on AI object detection to charge customers are vulnerable to physical adversarial patches—printed images that look innocuous but change what the detector reports. This paper builds a shelf testbed with RGB cameras and shows that Hiding patches erase real products from the detector in about 69% of frames for snacks and 78% for fruit over 150-frame runs. It also demonstrates Creating attacks that make the system detect nonexistent products and Altering attacks that misclassify a product as another class, and it introduces a color histogram similarity loss that improves those two attack types (for example, fruit Creating success rises from 0.440 to 0.480). The paper's bounding-box metric CIoU captures whether a false detection is plausible in size, and black-box experiments show that shadow-model attacks recover much of the white-box threat. If these results hold in production settings, vision-only checkout systems face low-cost, physically realizable attacks that current real-time defenses are not designed to stop.

What carries the argument

The load-bearing mechanism is the adversarial patch itself: a printed square optimized against the victim detector's outputs (objectness score $y_{\text{obj}}$ and class confidence $y_{\text{cls}}$) while constrained by total-variation smoothing and a non-printability score so that ink reproduction is feasible. For hiding, the loss minimizes the maximum objectness and class confidence inside the patch region; for creating and altering, it maximizes the target class confidence, and the new color histogram similarity loss adds a chi-square distance between the HSV histogram of the patch and that of a cropped reference product, pushing the patch's color distribution toward the target class. Patch placement uses an affine mask with rotation and scaling, and training applies random contrast, brightness, and noise to mimic physical capture. A second mechanism is the bounding-box-based metric CIoU, which measures whether an attack preserves or destroys the natural size of the predicted box, capturing practical impact beyond class confusion.

What would settle it

Train the same snack and fruit datasets on a transformer-based detector and run the printed patches through the same testbed: if Hiding success drops to the level of random noise occlusion, the claim that adversarial patches severely disrupt unmanned-store object detectors does not generalize beyond YOLO and Faster R-CNN.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial patch attacks, previously shown mainly against person detectors and aerial surveillance, transfer to the object-detection workloads of fully unmanned retail and remain effective when printed and filmed by an ordinary webcam. On YOLOv5l6 and Faster R-CNN models trained on snack and fruit datasets, Hiding attacks achieve average success rates of 0.691 and 0.776 in the physical testbed, while Creating and Altering attacks succeed strongly on particular target classes and fail on others, producing a consistent pattern of robust and non-robust classes. The authors further claim that an attacker with knowledge of the target product's color can exploit that information: the proposed color histogram similarity loss, a chi-square distance between HSV histograms of the patch and a cropped reference product, improves attack success rates for Creating and Altering attacks, and shadow-model attacks in the black-box setting raise Hiding CM as high as 0.717.

Load-bearing premise

The measured attack success rates assume the YOLOv5l6 and Faster R-CNN models trained on the paper's snack and fruit datasets represent the detectors and product appearance distribution deployed in real fully unmanned stores; production systems with different architectures, training data, or camera geometries may not be attacked at the same rates.

Editorial extensions

If this is right

  • Vision-only automated checkout can be attacked with a printer and a webcam: Hiding patches erase real items in most frames, Creating patches summon phantom products, and Altering patches change one product's identity.
  • Bounding-box-size anomaly detection is not a complete defense: Hiding attacks often preserve plausible box sizes, while Creating attacks tend to produce implausibly small boxes (CIoU near 0.2), so size checks catch only part of the threat.
  • Product classes differ sharply in vulnerability, and the vulnerable classes are similar across YOLO and Faster R-CNN, so defenders can identify and harden the most exposed items rather than treating all classes alike.
  • Query access to a deployed detector enables a shadow-model attack that approximates white-box results, meaning that simply hiding the model parameters is insufficient in the black-box setting.
  • The best loss target for Hiding attacks depends on the detector family—objectness scores for YOLO, class confidence for Faster R-CNN—so robust defenses should account for the architecture in use.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If color similarity is the active ingredient, products with distinctive hues should be more attackable than neutral-colored ones; a direct test would vary packaging colorfulness under a fixed patch budget.
  • Because the most vulnerable classes appear to transfer across two very different architectures, the weakness likely lives in shared non-robust features of the training data, suggesting that data-centric hardening (e.g., removing spurious color cues) could mitigate attacks without changing the detector.
  • Real unmanned stores often combine RGB cameras with weight sensors or RFID; re-running these attacks with a weight-based cross-check would test whether the end-to-end theft scenario actually succeeds, and would likely show that sensor fusion cuts the practical risk.
  • The CIoU metric could be turned into a real-time heuristic—flag detections whose box size deviates from class-typical statistics—but the paper's data suggest it would miss most Hiding attacks, so it should be paired with temporal consistency analysis.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper evaluates three physical-world adversarial patch attacks—Hiding, Creating, and Altering—against YOLO v5l6 and Faster R-CNN detectors trained on self-collected snack and fruit datasets. It introduces a color histogram similarity loss (LHis) intended to improve Creating and Altering attacks, and a bounding-box-based metric (CIoU) for measuring the practical impact of attacks. Experiments cover digital attacks, a physical unmanned-store testbed, and black-box transfer and shadow attacks. The main quantitative findings are that Hiding attacks achieve average CM of about 0.91 in the digital setting and about 0.69–0.78 in the physical testbed, while Creating and Altering attacks are much less effective overall but show class-dependent peaks. The paper also reports that shadow attacks improve black-box attack success over model-transfer attacks.

Significance. If the results are robust, the paper provides a useful empirical demonstration that physical adversarial patches can disrupt retail-scale object detectors, and it identifies class-dependent vulnerabilities that are relevant for automated checkout security. The study's strengths include its explicit threat model, the use of printable-patch losses (TV and NPS), the combination of two detector architectures, the physical testbed, and the inclusion of black-box shadow attacks. However, the contribution of the proposed LHis loss is modest and is supported by small, unreplicated differences without significance testing; the CIoU metric is defined ambiguously; and the extrapolation from custom Roboflow datasets and a single lab testbed to real fully unmanned stores is not justified by the evidence. No code or data is released, which limits reproducibility.

major comments (5)
  1. [Abstract; §IV-A/B; §V-B] The headline claim that adversarial patches 'can severely disrupt object detection models used in unmanned stores' rests on detectors trained only on the authors' Roboflow snack and fruit datasets and tested in a single laboratory testbed with one webcam, one shelf, five objects per class, and 150-frame single-run sessions. No evidence is provided that these models or the product appearance distribution are representative of production systems in fully unmanned stores. The conclusion should either be restricted to the evaluated setup or supplemented with transfer experiments on public retail/checkout datasets and off-the-shelf detectors, plus repeated physical trials under varied camera geometry and lighting.
  2. [§V-D2; Fig. 10; Eq. (13)–(14)] The evidence for the proposed color histogram similarity loss is weak and potentially circular. Figure 10 shows CM increases from 0.165 to 0.180 for the Altering attack on snacks and from 0.440 to 0.480 for the Creating attack on fruit, with no error bars, no confidence intervals, and no significance tests. Moreover, λHis = 0.3 is selected on the same evaluation data used for the main comparisons, so the reported benefit of LHis in Tables III–V includes selection on the test set. A held-out validation procedure or a multiple-seed analysis with variance reporting is needed to support the claim that LHis improves attack success.
  3. [Tables IV and V] The 'Random Patch (Top 3)' rows report attack success rates (e.g., Creating CM of 0.329 in Table IV snack and 0.452 in Table V fruit) that are obtained by selecting the three best-performing target classes on the same evaluation set after the fact. This post hoc selection inflates the apparent black-box threat because an attacker cannot know in advance which target classes will succeed without access to the evaluation data. The paper should report the average over all classes, or apply a proper multiple-comparison correction, or specify an a priori selection rule.
  4. [§III-D; §IV-D] The CIoU metric is not defined consistently with the cited source. The text defines CIoU as 'BGT∩BP' for all three attack types, which is an intersection area or size comparison, not a normalized IoU, and the reference [36] defines a different 'Distance-IoU' loss. As written, the metric conflates box shrinkage with box disappearance and is not scale-invariant, making the reported CIoU values difficult to interpret. The authors should replace it with a normalized quantity (e.g., IoU or a box-size ratio) or explicitly define the computation and justify the name.
  5. [§V-B; Fig. 6–7] The physical experiments report average CM over 150 consecutive frames but provide no repeated trials, variance measures, or statistics; a single run per object/class configuration is used. The paper claims 'robust and non-robust classes' based on these single runs, and the physical evaluation covers only YOLO v5, not Faster R-CNN. Repeating each condition at least three times and reporting per-session variability is necessary to support the quantitative claims about physical attack success rates and class-level robustness.
minor comments (5)
  1. [§III-B; Eq. (3)–(4)] The intervals for pcenter_x and pcenter_y mix normalized coordinates with pixel dimensions: multiplying the interval by W and H after subtracting values that already appear normalized is dimensionally inconsistent and should be clarified or corrected.
  2. [Table III] The random-noise baseline for Hiding attacks on Faster R-CNN already produces high CM (0.657 and 0.704 for snack and fruit), which is comparable to some adversarial-patch results. The discussion should acknowledge that part of the reported threat for this model is due to the model's intrinsic sensitivity to occlusion, not only to the optimized patch.
  3. [Fig. 6–7] The y-axis labels describe 'values for all 150 frames' while the bars are counts of frames; the caption should state explicitly that the bar height is the number of frames out of 150, and the 'CM' notation should be defined in the caption.
  4. [Algorithm 1] The proposed LHis is essentially a chi-square histogram distance in HSV space; the novelty relative to standard histogram-matching losses should be stated more precisely, and the choice of 256 bins per channel should be justified.
  5. [General] The datasets, trained victim models, and adversarial patch training code are not made available; given that the empirical claims are central, providing these artifacts or precise instructions for reproducing the experiments would substantially strengthen the paper.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular reasoning identified; the empirical attack evaluation is self-contained and does not reduce any claim to its own inputs.

full rationale

The paper makes no first-principles derivation that reduces to its inputs. Patch attacks are optimized against the victim detectors (YOLOv5l6 and Faster R-CNN) and evaluated on held-out images and a physical testbed, so the reported CM values are empirical measurements rather than identities. The color histogram similarity loss is motivated by an observed correlation between HSV chi-square histogram similarity and attack success (Table II), then ablated in Fig. 10; although lambda_His = 0.3 is selected from this ablation, this is hyperparameter selection on the test setup, not a fitted parameter relabeled as a prediction. The cited prior work (Shrestha, Du, Hu, Thys, etc.) supplies standard patch initialization, printability, and loss components, and no load-bearing self-citation chain or imported uniqueness theorem is present. The strongest claims are empirical and model/dataset-specific; potential lack of transfer to production stores is a generalization concern, not circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The paper rests on several domain assumptions about representativeness of models, datasets, and the physical testbed, plus standard adversarial-patch training assumptions borrowed from prior work. It introduces no new physical entities. The main free parameters are loss weights and the loss-variant choice, tuned on the evaluation data.

free parameters (5)
  • Lambda_His (histogram loss weight) = 0.3
    Selected in Section V-D2 by scanning values from 0 to 1 on the same snack and fruit test data used for the main results; gains are small (CM +0.015 to +0.04).
  • Adversarial loss variant for Hiding = max(yobj * max(ycls))
    Chosen after comparing three variants in Section V-D1; model-specific conclusions (YOLO favors yobj, Faster R-CNN favors ycls) are post hoc.
  • Altering loss weighting factor = 2
    Hand-set in Eq. (11) because the authors found raising target confidence from zero difficult; no independent justification.
  • Patch size = 64
    Initial patch size s=64 fixed in Section IV-E; no ablation on patch size in digital experiments.
  • Reference initialization std = 0.3
    Gaussian standard deviation for reference patches in Section III-D2; chosen by hand.
assumptions (4)
  • domain assumption YOLO v5l6 and Faster R-CNN (ResNet-50) are representative object detectors for fully unmanned store checkout.
    The threat model and conclusions treat these models as proxies for deployed systems (Section IV-B).
  • domain assumption The Roboflow snack and fruit datasets capture the visual distribution of products in real unmanned stores.
    Datasets were collected via Roboflow, not from a deployed store; color and shape distribution may differ (Section IV-A).
  • domain assumption The physical testbed with one webcam and artificial lighting reproduces real unmanned store conditions.
    Testbed described in Section IV-C; no validation that lighting, angles, and camera quality match production stores.
  • standard math Standard adversarial patch training assumptions (printability, TV smoothness, affine invariance) apply.
    Loss terms in Eqs. (7)-(8) are taken from prior work [21], [30].

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores." pith.science (2026). https://pith.science/paper/OEACNWSC

@misc{pith2026250508835,
  author       = {Pith},
  title        = {Pith review of: Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OEACNWSC}},
  note         = {Machine review of arXiv:2505.08835}
}
read the original abstract

The advent of convenient and efficient fully unmanned stores equipped with artificial intelligence-based automated checkout systems marks a new era in retail. However, these systems have inherent artificial intelligence security vulnerabilities, which are exploited via adversarial patch attacks, particularly in physical environments. This study demonstrated that adversarial patches can severely disrupt object detection models used in unmanned stores, leading to issues such as theft, inventory discrepancies, and interference. We investigated three types of adversarial patch attacks -- Hiding, Creating, and Altering attacks -- and highlighted their effectiveness. We also introduce the novel color histogram similarity loss function by leveraging attacker knowledge of the color information of a target class object. Besides the traditional confusion-matrix-based attack success rate, we introduce a new bounding-boxes-based metric to analyze the practical impact of these attacks. Starting with attacks on object detection models trained on snack and fruit datasets in a digital environment, we evaluated the effectiveness of adversarial patches in a physical testbed that mimicked a real unmanned store with RGB cameras and realistic conditions. Furthermore, we assessed the robustness of these attacks in black-box scenarios, demonstrating that shadow attacks can enhance success rates of attacks even without direct access to model parameters. Our study underscores the necessity for robust defense strategies to protect unmanned stores from adversarial threats. Highlighting the limitations of the current defense mechanisms in real-time detection systems and discussing various proactive measures, we provide insights into improving the robustness of object detection models and fortifying unmanned retail environments against these attacks.

Figures

Figures reproduced from arXiv: 2505.08835 by the authors.

Figure 1
Figure 1. Procedure of adversarial patch initialization. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Adversarial patch generation process per [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Histograms of reference image and adversarial patch in RGB (top) [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Bounding box generation results of adversarial patches for Creating [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Visualization of performance differences in adversarial patch attacks based on target classes. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Experimental results of the Hiding attack in a physical unmanned [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Experimental results of Creating and Altering attacks in a physical unmanned store testbed. The x-axis of each graph represents the target class, black [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Adversarial patch attacks on various original objects and target classes in a physical unmanned store testbed. Green borders indicate successful attacks, [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 10
Figure 10. Figure 10: Changes in attack success rates in the Creating and Altering attacks [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 9
Figure 9. Figure 9: Performance differences in Hiding attack based on the settings of the [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 34 canonical work pages

  1. [36]

    Distance-iou loss: Faster and better learning for bounding box regression,

    Z. Zheng, P. Wang, W. Liu, J. Li, R. Ye, and D. Ren, “Distance-iou loss: Faster and better learning for bounding box regression,” in Proceedings of the AAAI conference on artificial intelligence , vol. 34, no. 07, 2020, pp. 12 993–13 000

    2020

  2. [1]

    Phygital technologies and environments for breakthrough innovation in customers’ and citizens’ journey. a critical literature review and future agenda,

    P. Del Vecchio, G. Secundo, and A. Garzoni, “Phygital technologies and environments for breakthrough innovation in customers’ and citizens’ journey. a critical literature review and future agenda,” Technological Forecasting and Social Change , vol. 189, p. 122342, 2023

    work page 2023

  3. [2]

    Service innovation, experiential relationship quality and shopping outcomes in a smart unmanned store,

    H.-C. Wu, H. Xu, and T.-P. Wu, “Service innovation, experiential relationship quality and shopping outcomes in a smart unmanned store,” Journal of Marketing Communications , vol. 30, no. 3, pp. 344–367, 2024

    work page 2024

  4. [3]

    Rfgo: a seamless self-checkout system for ap- parel stores using rfid,

    C. Bocanegra, M. A. Khojastepour, M. Y . Arslan, E. Chai, S. Rangarajan, and K. R. Chowdhury, “Rfgo: a seamless self-checkout system for ap- parel stores using rfid,” in Proceedings of the 26th Annual International Conference on Mobile Computing and Networking , 2020, pp. 1–14

    work page 2020

  5. [4]

    Full-dimension relative positioning for rfid-enabled self-checkout services,

    C. Duan, J. Liu, X. Ding, Z. Li, and Y . Liu, “Full-dimension relative positioning for rfid-enabled self-checkout services,” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies , vol. 5, no. 1, pp. 1–23, 2021. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 13

    work page 2021

  6. [5]

    Just walk-out technology and its challenges: A case of amazon go,

    K. Wankhede, B. Wukkadada, and V . Nadar, “Just walk-out technology and its challenges: A case of amazon go,” in 2018 International Conference on Inventive Research in Computing Applications (ICIRCA). IEEE, 2018, pp. 254–257

    work page 2018

  7. [6]

    Business

    C. Business. (2024) Amazon closing some of its cashier-free stores [Online]. Available: https://edition.cnn.com/2023/03/06/business/ amazon-closing-some-amazon-go-stores/index.html. [Accessed: 12 May 2024]

    work page 2024

  8. [7]

    Available: https://standard.ai/

    Standard ai. Available: https://standard.ai/. [Accessed: 12 May 2024]

    work page 2024

Show all 50 references
  1. [8]

    Adversarial patch,

    T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” arXiv preprint arXiv:1712.09665 , 2017

    2017 arXiv

  2. [9]

    Unified adversarial patch for cross- modal attacks in the physical world,

    X. Wei, Y . Huang, Y . Sun, and J. Yu, “Unified adversarial patch for cross- modal attacks in the physical world,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 4445–4454

    2023

  3. [10]

    On physical adversarial patches for object detection,

    M. Lee and Z. Kolter, “On physical adversarial patches for object detection,” arXiv preprint arXiv:1906.11897 , 2019

    1906 arXiv

  4. [11]

    Naturalistic physical adversarial patch for object detectors,

    Y .-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, and W.-H. Cheng, “Naturalistic physical adversarial patch for object detectors,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7848–7857

    2021

  5. [12]

    Evaluate the consumer acceptance of aiot-based unmanned convenience stores based on perceived risks and technological acceptance models,

    I.-C. Wang, C.-W. Liao, K.-P. Lin, C.-H. Wang, and C.-L. Tsai, “Evaluate the consumer acceptance of aiot-based unmanned convenience stores based on perceived risks and technological acceptance models,” Mathematical Problems in Engineering , vol. 2021, pp. 1–12, 2021

    2021

  6. [13]

    Towards a robust adversarial patch attack against unmanned aerial vehicles object detection,

    S. Shrestha, S. Pathak, and E. K. Viegas, “Towards a robust adversarial patch attack against unmanned aerial vehicles object detection,” in 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2023, pp. 3256–3263

    2023

  7. [14]

    Physical adversarial attacks on an aerial imagery object detector,

    A. Du, B. Chen, T.-J. Chin, Y . W. Law, M. Sasdelli, R. Rajasegaran, and D. Campbell, “Physical adversarial attacks on an aerial imagery object detector,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2022, pp. 1796–1806

    2022

  8. [15]

    Are adversarial examples inevitable?

    A. Shafahi, W. R. Huang, C. Studer, S. Feizi, and T. Goldstein, “Are adversarial examples inevitable?”arXiv preprint arXiv:1809.02104, 2018

    2018 arXiv

  9. [16]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  10. [17]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  11. [18]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp) . Ieee, 2017, pp. 39–57

    2017

  12. [19]

    Adversarial attacks and defenses in machine learning-empowered communication systems and networks: A contemporary survey,

    Y . Wang, T. Sun, S. Li, X. Yuan, W. Ni, E. Hossain, and H. V . Poor, “Adversarial attacks and defenses in machine learning-empowered communication systems and networks: A contemporary survey,” IEEE Communications Surveys & Tutorials , 2023

    2023

  13. [20]

    Tpatch: a triggered physical adversarial patch,

    W. Zhu, X. Ji, Y . Cheng, S. Zhang, and W. Xu, “Tpatch: a triggered physical adversarial patch,” in Proceedings of the 32nd USENIX Con- ference on Security Symposium , 2023, pp. 661–678

    2023

  14. [21]

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,

    M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the 2016 acm sigsac conference on computer and communications security, 2016, pp. 1528–1540

    2016

  15. [22]

    Wip: Adversarial retroreflective patches: A novel stealthy attack on traffic sign recognition at night,

    G. Tsuruoka, T. Sato, Q. A. Chen, K. Nomoto, Y . Tanaka, R. Kobayashi, and T. Mori, “Wip: Adversarial retroreflective patches: A novel stealthy attack on traffic sign recognition at night,” in NDSS, 2024

    2024

  16. [23]

    Dpatch: An adversarial patch attack on object detectors,

    X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y . Chen, “Dpatch: An adversarial patch attack on object detectors,” arXiv preprint arXiv:1806.02299, 2018

    2018 arXiv

  17. [24]

    Fooling automated surveil- lance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedem ´e, “Fooling automated surveil- lance cameras: adversarial patches to attack person detection,” in Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    2019

  18. [25]

    Adversarial patch-based false positive creation attacks against aerial imagery object detectors,

    G. Tang, W. Yao, T. Jiang, Y . Zhao, and J. Sun, “Adversarial patch-based false positive creation attacks against aerial imagery object detectors,” Neurocomputing, p. 127431, 2024

    2024

  19. [26]

    Universal adversarial patch attack for automatic checkout using perceptual and attentional bias,

    J. Wang, A. Liu, X. Bai, and X. Liu, “Universal adversarial patch attack for automatic checkout using perceptual and attentional bias,” IEEE Transactions on Image Processing , vol. 31, pp. 598–611, 2021

    2021

  20. [27]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” Advances in neural information processing systems , vol. 28, 2015

    2015

  21. [28]

    ultralytics/yolov5: v5. 0-yolov5-p6 1280 models, aws, supervise. ly and youtube integrations,

    G. Jocher, A. Stoken, J. Borovec, A. Chaurasia, L. Changyu, A. Hogan, J. Hajek, L. Diaconu, Y . Kwon, Y . Defretinet al., “ultralytics/yolov5: v5. 0-yolov5-p6 1280 models, aws, supervise. ly and youtube integrations,” Zenodo, 2021

    2021

  22. [29]

    Learning non-maximum suppression,

    J. Hosang, R. Benenson, and B. Schiele, “Learning non-maximum suppression,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2017, pp. 4507–4515

    2017

  23. [30]

    Nonlinear total variation based noise removal algorithms,

    L. I. Rudin, S. Osher, and E. Fatemi, “Nonlinear total variation based noise removal algorithms,” Physica D: nonlinear phenomena , vol. 60, no. 1-4, pp. 259–268, 1992

    1992

  24. [31]

    {CAPatch}: Physical adversarial patch against image captioning systems,

    S. Zhang, Y . Cheng, W. Zhu, X. Ji, and W. Xu, “ {CAPatch}: Physical adversarial patch against image captioning systems,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 679–696

    2023

  25. [32]

    Comparative study of histogram distance measures for re-identification,

    P. A. Marin-Reyes, J. Lorenzo-Navarro, and M. Castrill ´on- Santana, “Comparative study of histogram distance measures for re-identification,” arXiv preprint arXiv:1611.08134 , 2016

    2016 arXiv

  26. [33]

    Available: https://roboflow.com/

    Roboflow. Available: https://roboflow.com/. [Accessed: 12 May 2024]

    2024

  27. [34]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

    2016

  28. [35]

    Searching for mobilenetv3,

    A. Howard, M. Sandler, G. Chu, L.-C. Chen, B. Chen, M. Tan, W. Wang, Y . Zhu, R. Pang, V . Vasudevan et al. , “Searching for mobilenetv3,” in Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 1314–1324

    2019

  29. [37]

    Transferable black-box attack against face recognition with spatial mutable adversarial patch,

    H. Ma, K. Xu, X. Jiang, Z. Zhao, and T. Sun, “Transferable black-box attack against face recognition with spatial mutable adversarial patch,” IEEE Transactions on Information Forensics and Security , 2023

    2023

  30. [38]

    Generat- ing adversarial examples with shadow model,

    R. Zhang, H. Xia, C. Hu, C. Zhang, C. Liu, and F. Xiao, “Generat- ing adversarial examples with shadow model,” IEEE Transactions on Industrial Informatics, vol. 18, no. 9, pp. 6283–6289, 2022

    2022

  31. [39]

    Tnt attacks! universal naturalistic adversarial patches against deep neural network systems,

    B. G. Doan, M. Xue, S. Ma, E. Abbasnejad, and D. C. Ranasinghe, “Tnt attacks! universal naturalistic adversarial patches against deep neural network systems,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 3816–3830, 2022

    2022

  32. [40]

    How many dimensions are required to find an adversarial example?

    C. Godfrey, H. Kvinge, E. Bishoff, M. Mckay, D. Brown, T. Doster, and E. Byler, “How many dimensions are required to find an adversarial example?” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 2352–2359

    2023

  33. [41]

    Distilling robust and non-robust features in adversarial examples by information bottleneck,

    J. Kim, B.-K. Lee, and Y . M. Ro, “Distilling robust and non-robust features in adversarial examples by information bottleneck,” Advances in Neural Information Processing Systems , vol. 34, pp. 17 148–17 159, 2021

    2021

  34. [42]

    Fca: A causal inference based method for analyzing the failure causes of object detection algorithms,

    L. Yuanxin, L. Rui, M. Yuxi, X. Yunzhi, and M. Lingzhong, “Fca: A causal inference based method for analyzing the failure causes of object detection algorithms,” in 2023 IEEE 23rd International Conference on Software Quality, Reliability, and Security Companion (QRS-C). IEEE, ...

    2023

  35. [43]

    Adversarial patch detection and mitigation by detecting high entropy regions,

    N. Bunzel, A. Siwakoti, and G. Klause, “Adversarial patch detection and mitigation by detecting high entropy regions,” in 2023 53rd An- nual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W). IEEE, 2023, pp. 124–128

    2023

  36. [44]

    Defending from physically-realizable adversarial attacks through internal over- activation analysis,

    G. Rossolini, F. Nesti, F. Brau, A. Biondi, and G. Buttazzo, “Defending from physically-realizable adversarial attacks through internal over- activation analysis,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 12, 2023, pp. 15 064–15 072

    2023

  37. [45]

    Jedi: entropy-based localization and removal of adversarial patches,

    B. Tarchoun, A. Ben Khalifa, M. A. Mahjoub, N. Abu-Ghazaleh, and I. Alouani, “Jedi: entropy-based localization and removal of adversarial patches,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 4087–4095

    2023

  38. [46]

    Objectseeker: Certifiably robust object detection against patch hiding attacks via patch- agnostic masking,

    C. Xiang, A. Valtchanov, S. Mahloujifar, and P. Mittal, “Objectseeker: Certifiably robust object detection against patch hiding attacks via patch- agnostic masking,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 1329–1347

    2023

  39. [47]

    {PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier,

    C. Xiang, S. Mahloujifar, and P. Mittal, “ {PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 2065–2082

    2022

  40. [48]

    Patchguard++: Efficient provable attack de- tection against adversarial patches,

    C. Xiang and P. Mittal, “Patchguard++: Efficient provable attack de- tection against adversarial patches,” arXiv preprint arXiv:2104.12609 , 2021

    2021 arXiv

  41. [49]

    Adversarial training against location- optimized adversarial patches,

    S. Rao, D. Stutz, and B. Schiele, “Adversarial training against location- optimized adversarial patches,” in European conference on computer vision. Springer, 2020, pp. 429–448

    2020

  42. [50]

    Vax-a-net: Training-time defence against adversarial patch attacks,

    T. Gittings, S. Schneider, and J. Collomosse, “Vax-a-net: Training-time defence against adversarial patch attacks,” in Proceedings of the Asian Conference on Computer Vision , 2020

    2020

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.