Pith. sign in

REVIEW 4 major objections 5 minor 55 references

Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that physical-world adversarial examples can be made transferable and robust by injecting target-class robust features, and that its RFCoA method achieves this while keeping perturbations nearly invisible.

desk verdict Plausible physical-world attack with strong numbers, but the robust-feature assumption needs direct validation before I'd trust the transferability claims. read the letter →

arxiv 2412.16958 v1 pith:DQUSWVYA submitted 2024-12-22 cs.CV

Yichen Wang , Yuxuan Chou , Ziqi Zhou , Hangtao Zhang , Wei Wan , Shengshan Hu , Minghui Li This is my paper · ORCID
classification cs.CV
keywords physical-worldadversarialexamplesrobustfeaturestransferabilitystealthinesstargetedattackfeaturefusionperturbationslargevision-languagemodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that the long-standing trade-off in physical-world adversarial examples—between attack strength and stealth, and between white-box success and black-box transfer—can be overcome by attacking through robust features rather than the fragile non-robust features that ordinary adversarial perturbations exploit. It proposes RFCoA, a two-stage perturbation-based attack that first disentangles target-class robust features in the latent space of an autoencoder and then fuses them onto clean images using attention weights and a sparse pattern mask. Experiments claim that RFCoA beats current state-of-the-art PAE methods on transferability, robustness to distance and angle, and visual stealthiness, and that it also fools large vision-language models. A sympathetic reader would care because if the claim holds, printed adversarial objects could be both nearly invisible and effective against unknown black-box systems, including multimodal ones.

What carries the argument

The central object is the robust feature (RF), defined as features whose predictive power persists under worst-case perturbations within a set $\Delta(x)$ (Eq. 2). The machinery is two coupled optimizations: Eq. (3) extracts target-class RFs by minimizing the ensemble cross-entropy of decoded, noise-perturbed features, and Eq. (10) fuses them into clean images by jointly optimizing attention weights $\alpha$ and a pattern mask $m$ under an adversarial loss $L_{\mathrm{adv}}$ and a cognitive loss $L_{\mathrm{cog}}$ that enforces sparsity, smoothness, and SSIM similarity. A gradient-based spatial attention map (Eq. 4) locates the clean image's predictive features to weaken, and the pattern mask strips away non-essential perturbations, making the final adversarial example visually close to the original.

What would settle it

Feed an RFCoA adversarial image to a black-box model whose architecture and training are far from the surrogate set, such as a CLIP zero-shot classifier, and measure target attack success rate; if it is near zero even in the digital world, the extracted features are not genuinely model-consistent. Alternatively, re-photograph the printed adversarial examples at angles beyond 45 degrees or under night lighting and check whether tASR drops sharply, which would reveal that the reported physical robustness only holds in the narrow tested range.

Watch

Extended reading notes

Core claim

The paper's central claim is that RFCoA, a perturbation-based physical-world adversarial attack, achieves simultaneously high transferability to unseen black-box models, robustness to physical distortions such as distance and angle, and stealthiness, outperforming state-of-the-art patch-, optical-, and perturbation-based methods. It argues that this is possible because the attack injects robust features of the target class—image patterns that are semantically predictive, survive noise, and are perceived similarly across different models—into the clean image, instead of manipulating the brittle non-robust features that ordinary adversarial examples exploit. In the first stage, Robust Feature Disentanglement extracts these features by optimizing a feature vector through an autoencoder so that an ensemble of surrogate models classifies the decoded, noised image as the target class. In the second stage, Adversarial Feature Fusion uses a gradient-based spatial attention map to weaken the clean image's own predictive features, overlays the target-class features with learned per-position weights, and optimizes a sparse pattern mask so that only the essential adversarial pattern remains. The paper reports that this yields tASR gains of roughly 10 to 50 points over baselines across black-box models, maintains tASR above 0.22 on black-box models even at 45 degrees angle and 20 cm distance, and achieves SSIM 0.89 and LPIPS 0.14.

Load-bearing premise

The method assumes that the features extracted by optimizing over a few surrogate models are the target class's truly robust, model-consistent features; if they only fit the surrogates, transferability and physical robustness collapse outside the evaluation set.

Editorial extensions

If this is right

  • If RFCoA is correct, printed adversarial objects can transfer to black-box models never used in crafting the attack, including transformer-based classifiers.
  • Physical robustness holds over a range of re-photography distances (10 to 20 cm) and angles (15 to 45 degrees), with black-box tASR staying near or above 0.22 even in the hardest tested condition.
  • Adversarial examples can be both effective and nearly invisible: SSIM 0.89 and LPIPS 0.14 place the perturbations below what prior patch-based and most optical attacks achieve.
  • The attack retains high success against PGD adversarial training and DiffPure purification, because robust features survive both defenses.
  • The same adversarial example generation procedure extends to large vision-language models, suggesting a path toward attacks on visual question answering and image captioning systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that the optimization in Eq. (3) does not literally enforce the infimum over all perturbations in the definition of Eq. (2); it samples random noise and averages loss, so the extracted features may be only weakly robust and could overfit the surrogate ensemble.
  • If the robust-feature story is right, then a testable prediction follows: the same RFCoA procedure should transfer to any model trained on similar visual semantics, including CLIP-style zero-shot classifiers, with little or no adaptation.
  • The success on LVLMs suggests that robust features may act as semantic bridges that shift multimodal alignment; this could be used as a probe to study what image-text models actually ground on.
  • The attention-plus-mask fusion recipe is general enough that other perturbation-based PAE methods could adopt it, potentially improving the transferability and stealth trade-off without redesigning the attack from scratch.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes RFCoA, a two-stage perturbation-based physical-world adversarial attack. Stage 1 ('Robust Feature Disentanglement', Eq. 3) optimizes a latent code in a pretrained autoencoder by minimizing cross-entropy over an ensemble of three surrogate classifiers under bounded noise, aiming to extract target-class 'robust features' in the sense of Eq. (2). Stage 2 ('Adversarial Feature Fusion', Eqs. 4-10) fuses these features into a clean image using a gradient-derived spatial attention map, while jointly optimizing a pattern mask and transparency to preserve stealthiness. The authors evaluate targeted attack success on ImageNet with 12 models (three white-box surrogates, nine black-box), compare against TPA, Copy/Paste, RFLA, and CleanSheet, and report results for physical prints at different distances/angles, under PGD-AT and DiffPure defenses, and on LVLMs (MiniGPT-4, LLaVA). They claim superior transferability, robustness, and stealthiness relative to existing state-of-the-art PAE methods.

Significance. If the central claims hold, RFCoA would be a meaningful advance: a perturbation-based physical attack that transfers to unseen black-box models, survives physical transformations, and remains stealthier than patch/optical alternatives. The paper has concrete strengths: the code is released; the digital evaluation spans a broad model zoo (ResNet, WRN, VGG, DenseNet, ShuffleNet, ViT, GoogleNet) with three surrogate architectures; both digital and physical results are reported; and the method is checked against two defenses and two LVLMs. However, the key explanatory mechanism—that the optimized latent code actually instantiates the robust-feature definition of Eq. (2)—is not directly validated. The results show large tASR gaps between surrogate and some black-box architectures (e.g., ViT-b32), which is consistent with partial overfitting to the surrogate ensemble. The physical experiment is small (100 images, one print/capture session, no error bars), and LVLM results lack a comparison against the same baseline attacks. These weaknesses do not refute the empirical gains but they do limit the strength of the 'robust feature' and 'physical robustness' generalizations.

major comments (4)
  1. [Sec. 3.4, Eq. (3) and Table 2] The optimization in Eq. (3) is never validated against the robust-feature definition in Eq. (2). Eq. (2) requires the features to remain predictive for all perturbations in a set and to be consistent across models, but Eq. (3) only minimizes cross-entropy on three surrogate models with a single fixed noise bound. The paper does not report any held-out check of the extracted features, such as target-class accuracy under larger or different perturbation types, or on architectures outside the training ensemble. Table 2 actually suggests limited cross-architecture consistency: RFCoA's digital tASR on the DenseNet-121 surrogate is 0.99 while on ViT-b32 it is 0.18 and on GoogleNet 0.30. That is a much larger gap than a model-consistent robust feature would be expected to show. The transferability results are still positive relative to baselines, but the paper's central explanatory claim—that the method works because it attacks robust features—is not yet supported. Please add an explicit validation of Eq. (2), e.g., measuring the predictive power of D(f_t) under held-out perturbations and on held-out architectures, or at least a thorough analysis of per-model feature activation consistency.
  2. [Sec. 4.2 and Sec. 4.3] The physical-world evaluation is too small to support the robustness claims as stated. The paper uses 100 printed AEs, a single print job, a single capture session with one phone, and reports only point estimates without error bars, confidence intervals, or a breakdown across repeated trials. Table 3 shows large drops in tASR from digital to physical (e.g., 0.65 to 0.60 for WRN-50, and 0.18 to 0.14 for ViT-b32), and the physical robustness conclusions depend on these numbers. Since physical attacks are subject to printer color variability, lighting, lens distortion, and random placement, the claimed robustness over 'various distances and angles' requires multiple independent print/capture sessions and some variance reporting. Please report means and standard deviations over at least several sessions, or justify why a single session is representative.
  3. [Sec. 4.1 and Eqs. (7), (9), (10)] The method depends on a large number of hand-selected hyperparameters (w1-w5, tau, epsilon, N, plus the autoencoder architecture), but the paper defers all settings and ablations to a supplementary that is not provided in the submission. This makes the main results non-reproducible from the text alone and leaves open the question of how sensitive the reported gains are to these choices. The main text should at least give the exact parameter values used for Tables 2-4, and ideally include a sensitivity analysis or ablation for the most critical weights (w1/w2 and tau). Without this, the load-bearing 'superior transferability/stealthiness' numbers cannot be independently verified.
  4. [Sec. 4.4, Table 5] The LVLM experiments report tASR numbers for RFCoA only, with no comparison to the baseline attacks (TPA, C/P-A, RFLA, CleanSheet) under the same VQA/description setting. The abstract claims the method's effectiveness 'can extend to LVLMs', which requires at least a baseline to show that the effect is not simply a trivial consequence of image corruption. Please add the same baselines to Table 5, or explicitly reframe the LVLM section as a qualitative feasibility study rather than a comparative result.
minor comments (5)
  1. [Sec. 3.4, Eq. (3)] The notation is inconsistent: Eq. (2) uses 'E' as the robust feature extractor, while Eq. (3) optimizes a parameter 'f' initialized from E(x), and the symbol f is also used for the victim classifier in Eq. (1). Please use distinct symbols for the classifier, the feature extractor, and the optimized latent code.
  2. [Sec. 4.2] The physical sampling description states that images are photographed from a 10 cm distance, while Table 3 evaluates 10, 15, and 20 cm distances. Please clarify whether the 100 printed AEs used for the main transferability table were all captured at 10 cm, and whether the distance/angle variations in Table 3 reuse the same prints.
  3. [Table 2 and Table 3] There are no error bars or confidence intervals anywhere in the tables. Given that some differences between methods are small (e.g., Ours vs. CleanSheet on several models), the absence of variance information makes it hard to judge whether the improvements are statistically meaningful. The authors should add standard deviations across images or bootstrap confidence intervals.
  4. [Sec. 3.5, Eq. (9)] The cognitive loss includes SSIM as a maximization term, but SSIM is not a convex penalty and its gradient can be unstable; please specify the implementation details (e.g., which SSIM variant, kernel size, and whether it is differentiable in the chosen framework).
  5. [References] There are formatting errors in the reference list: 'NerIPS' should be 'NeurIPS' in several entries, and 'InProceedings' appears as a single word in the PB-UAP entry. Please proofread the bibliography.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: transferability and physical robustness are genuine predictions, while white-box success is the direct effect of the optimized objective.

full rationale

The paper's central contributions are empirical. The white-box tASR values are the direct result of optimizing alpha and m in Eq. (10) against the surrogate ensemble, so they are the objective, not a prediction. The claims that carry evidentiary weight are transferability to nine unseen architectures (including ViT-b32 and GoogleNet) and robustness to physical distance and angle changes; these quantities are measured on data and conditions not used in the optimization, so they are genuine predictions. The robust-feature definition in Eq. (2) and the extraction objective in Eq. (3) are not identical: Eq. (3) minimizes average cross-entropy under a single bounded noise level over three surrogate models, which is a heuristic proxy for the infimum over all perturbations and all models, not a restatement of Eq. (2). That gap is an unvalidated assumption and a correctness risk, but it is not circular because the method does not define robust features as 'whatever minimizes Eq. (3)' and then claim the result as a theorem; it claims an empirical attack method. There is no load-bearing self-citation: the robust-feature concept is attributed to external prior work (Ilyas et al. 2019; Springer et al. 2021), and the paper's own prior citations appear only in related-work context. Consequently, the derivation chain does not reduce to its inputs.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method depends on an autoencoder and several hand-chosen weights. The formal robust feature definition (Eq. 2) is not used directly; the optimization heuristic replaces it. No sensitivity analysis is reported for the weights.

free parameters (5)
  • epsilon (noise bound in Eq. 3) = not specified
    Limits the magnitude of noise added during robust feature extraction; hand-chosen.
  • w1, w2 (adversarial loss weights in Eq. 7) = not specified
    Balance target-class push and source-class suppression; set without reported sensitivity analysis.
  • w3, w4, w5 (cognitive loss weights in Eq. 9) = not specified
    Trade off mask sparsity, smoothness, and SSIM; likely from Huang et al. 2023b, but not stated.
  • tau (transparency parameter) = not specified
    Controls final visual appearance in Eq. (8); hand-set.
  • N (number of ensembled models) = 3
    ResNet-50, VGG-16, DenseNet-121; arbitrary choice.
assumptions (4)
  • domain assumption Robust features exist and satisfy the properties in Eq. (2): they are predictive, robust to perturbations, and consistent across models.
    The method inherits this from Ilyas et al. (2019) and Springer et al. (2021); the paper provides only a visual intuition (Fig. 2), not a formal proof for the extracted features.
  • domain assumption The pretrained autoencoder (E, D) reconstructs natural images sufficiently well for the fused image to remain realistic and perceptible.
    The fusion D(alpha*ft + fc') assumes the decoder can map latent sums to valid images; no reconstruction quality is reported.
  • domain assumption An ensemble of three surrogate models (ResNet-50, VGG-16, DenseNet-121) is a sufficient proxy for unseen black-box models.
    Transferability is measured against models outside the ensemble, but the ensemble choice is arbitrary and may not cover diverse architectures (e.g., ViT is only tested as a target, not as a surrogate).
  • domain assumption The minimal cognitive pattern approach (Huang et al. 2023b) removes perturbations while preserving attack effectiveness.
    Used as a component (Section 3.5); its effectiveness is taken from the cited paper without re-validation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature." pith.science (2026). https://pith.science/paper/DQUSWVYA

@misc{pith2026241216958,
  author       = {Pith},
  title        = {Pith review of: Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DQUSWVYA}},
  note         = {Machine review of arXiv:2412.16958}
}
read the original abstract

As deep neural networks (DNNs) are widely applied in the physical world, many researches are focusing on physical-world adversarial examples (PAEs), which introduce perturbations to inputs and cause the model's incorrect outputs. However, existing PAEs face two challenges: unsatisfactory attack performance (i.e., poor transferability and insufficient robustness to environment conditions), and difficulty in balancing attack effectiveness with stealthiness, where better attack effectiveness often makes PAEs more perceptible. In this paper, we explore a novel perturbation-based method to overcome the challenges. For the first challenge, we introduce a strategy Deceptive RF injection based on robust features (RFs) that are predictive, robust to perturbations, and consistent across different models. Specifically, it improves the transferability and robustness of PAEs by covering RFs of other classes onto the predictive features in clean images. For the second challenge, we introduce another strategy Adversarial Semantic Pattern Minimization, which removes most perturbations and retains only essential adversarial patterns in AEsBased on the two strategies, we design our method Robust Feature Coverage Attack (RFCoA), comprising Robust Feature Disentanglement and Adversarial Feature Fusion. In the first stage, we extract target class RFs in feature space. In the second stage, we use attention-based feature fusion to overlay these RFs onto predictive features of clean images and remove unnecessary perturbations. Experiments show our method's superior transferability, robustness, and stealthiness compared to existing state-of-the-art methods. Additionally, our method's effectiveness can extend to Large Vision-Language Models (LVLMs), indicating its potential applicability to more complex tasks.

Figures

Figures reproduced from arXiv: 2412.16958 by the authors.

Figure 1
Figure 1. Our strategies Deceptive RF Injection and Adver [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Attention maps calculated by Grad-CAM. (a) is [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The overview of our method. (a) and (b) are the two modules of our method. After optimizing the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualization results of PAEs in the physical world. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: The average tASR of attacks on white-box models [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

55 extracted references · 42 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al

    Achiam, J.; Adler, S.; Agarwal, S.; Ahmad, L.; Akkaya, I.; Aleman, F. L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  4. [4]

    Athalye, A.; Engstrom, L.; Ilyas, A.; and Kwok, K. 2018. Synthesizing Robust Adversarial Examples. In Proceedings of the 35th International Conference on Machine Learning, (ICML'18), 284--293

    work page 2018

  5. [5]

    Benz, P.; Zhang, C.; and Kweon, I. S. 2021. Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'21), 7818--7827

    work page 2021

  6. [6]

    B.; Man \'e , D.; Roy, A.; Abadi, M.; and Gilmer, J

    Brown, T. B.; Man \'e , D.; Roy, A.; Abadi, M.; and Gilmer, J. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665

    arXiv 2017

  7. [7]

    Carlini, N.; and Wagner, D. A. 2017. Towards Evaluating the Robustness of Neural Networks. In Proceedings of 2017 IEEE Symposium on Security and Privacy (S&P'17) , 39--57

    work page 2017

  8. [8]

    Casper, S.; Nadeau, M.; Hadfield - Menell, D.; and Kreiman, G. 2022. Robust Feature-Level Adversaries are Interpretability Tools. In Proceedings of the 35th Advances in Neural Information Processing Systems (NeurIPS'22), 33093--33106

    work page 2022

Show all 55 references
  1. [9]

    G.; Xue, M.; Ma, S.; Abbasnejad, E.; and Ranasinghe, D

    Doan, B. G.; Xue, M.; Ma, S.; Abbasnejad, E.; and Ranasinghe, D. C. 2022. Tnt attacks! universal naturalistic adversarial patches against deep neural network systems. IEEE Transactions on Information Forensics and Security, 17: 3816--3830

    2022

  2. [10]

    K.; Chen, Y.; Ye, S.; He, Y.; and Yang, Y

    Duan, R.; Mao, X.; Qin, A. K.; Chen, Y.; Ye, S.; He, Y.; and Yang, Y. 2021. Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21), 16062--16071

    2021

  3. [11]

    Eykholt, K.; Evtimov, I.; Fernandes, E.; Li, B.; Rahmati, A.; Xiao, C.; Prakash, A.; Kohno, T.; and Song, D. 2018. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'1...

    2018

  4. [12]

    Ge, Y.; Wang, Q.; Huang, H.; Li, Q.; Wang, C.; Shen, C.; Zhao, L.; Jiang, P.; Fang, Z.; and Zhang, S. 2024. Hijacking Attacks against Neural Networks by Analyzing Training Data. arXiv preprint arXiv:2401.09740

    2024 arXiv

  5. [13]

    J.; Shlens, J.; and Szegedy, C

    Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and Harnessing Adversarial Examples. In Proceedings of the 3rd International Conference on Learning Representations (ICLR'15)

    2015

  6. [14]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'16), 770--778

    2016

  7. [15]

    Hore, A.; and Ziou, D. 2010. Image quality metrics: PSNR vs. SSIM. In Proceedings of the 20th International Conference on Pattern Recognition (ICPR'10), 2366--2369

    2010

  8. [16]

    Huang, H.; Chen, Z.; Chen, H.; Wang, Y.; and Zhang, K. 2023 a . T-SEA: Transfer-Based Self-Ensemble Attack on Object Detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23), 20514--20523

    2023

  9. [17]

    M.; and Bailey, J

    Huang, H.; Ma, X.; Erfani, S. M.; and Bailey, J. 2023 b . Distilling Cognitive Backdoor Patterns within an Image. In Proceedings of the 11th International Conference on Learning Representations (ICLR'23)

    2023

  10. [18]

    Iandola, F.; Moskewicz, M.; Karayev, S.; Girshick, R.; Darrell, T.; and Keutzer, K. 2014. Densenet: Implementing efficient convnet descriptor pyramids. arXiv preprint arXiv:1404.1869

    2014 arXiv

  11. [19]

    Ilyas, A.; Santurkar, S.; Tsipras, D.; Engstrom, L.; Tran, B.; and Madry, A. 2019. Adversarial Examples Are Not Bugs, They Are Features. In Proceedings of the 32nd Advances in Neural Information Processing (NeurIPS'19), 125--136

    2019

  12. [20]

    Jia, W.; Lu, Z.; Zhang, H.; Liu, Z.; Wang, J.; and Qu, G. 2022. Fooling the Eyes of Autonomous Vehicles: Robust Physical Adversarial Examples Against Traffic Sign Recognition Systems. In Proceedings of the 29th Annual Network and Distributed System Security Symposium (NDSS'22)

    2022

  13. [21]

    Li, M.; Wang, J.; Zhang, H.; Zhou, Z.; Hu, S.; and Pei, X. 2024. Transferable Adversarial Facial Images for Privacy Protection. In Proceedings of the 32nd ACM International Conference on Multimedia (MM'24)

    2024

  14. [22]

    Liu, H.; Li, C.; Wu, Q.; and Lee, Y. J. 2023. Visual instruction tuning. In Proceedings of the 36th Advances in Neural Information Processing Systems (NeurIPS'23)

    2023

  15. [23]

    Liu, X.; Yang, H.; Liu, Z.; Song, L.; Li, H.; and Chen, Y. 2018. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299

    2018 arXiv

  16. [24]

    L.; Qi, P.; Xie, Z.; Hannun, A

    Maas, A. L.; Qi, P.; Xie, Z.; Hannun, A. Y.; Lengerich, C. T.; Jurafsky, D.; and Ng, A. Y. 2017. Building DNN acoustic models for large vocabulary speech recognition. Computer Speech & Language, 41: 195--213

    2017

  17. [25]

    Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083

    2017 arXiv

  18. [26]

    Nie, W.; Guo, B.; Huang, Y.; Xiao, C.; Vahdat, A.; and Anandkumar, A. 2022. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460

    2022 arXiv

  19. [27]

    Russakovsky, O.; Deng, J.; Su, H.; Krause, J.; Satheesh, S.; Ma, S.; Huang, Z.; Karpathy, A.; Khosla, A.; and Bernstein, M. 2015. Imagenet large scale visual recognition challenge. International journal of computer vision, 115: 211--252

    2015

  20. [28]

    R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D

    Selvaraju, R. R.; Cogswell, M.; Das, A.; Vedantam, R.; Parikh, D.; and Batra, D. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'17 , 618--626

    2017

  21. [29]

    Sengupta, A.; Ye, Y.; Wang, R.; Liu, C.; and Roy, K. 2019. Going deeper in spiking neural networks: VGG and residual architectures. Frontiers in neuroscience, 13: 95

    2019

  22. [30]

    A.; Xu, Z.; Dickerson, J.; Studer, C.; Davis, L

    Shafahi, A.; Najibi, M.; Ghiasi, M. A.; Xu, Z.; Dickerson, J.; Studer, C.; Davis, L. S.; Taylor, G.; and Goldstein, T. 2019. Adversarial training for free! In Proceedings of the 32nd Advances in Neural Information Processing Systems (NerIPS'17), 3353--3364

    2019

  23. [31]

    Song, Y.; Zhou, Z.; Li, M.; Wang, X.; Deng, M.; Wan, W.; Hu, S.; and Zhang, L. Y. 2025. PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP'25)

    2025

  24. [32]

    M.; Mitchell, M.; and Kenyon, G

    Springer, J. M.; Mitchell, M.; and Kenyon, G. T. 2021 a . Adversarial Perturbations Are Not So Weird: Entanglement of Robust and Non-Robust Features in Neural Network Classifiers. CoRR, abs/2102.05110

    2021 arXiv

  25. [33]

    M.; Mitchell, M.; and Kenyon, G

    Springer, J. M.; Mitchell, M.; and Kenyon, G. T. 2021 b . A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attacks. In Proceedings of the 34th Advances in Neural Information Processing Systems (NeurIPS'21), 9759--9773

    2021

  26. [34]

    Szegedy, C.; Liu, W.; Jia, Y.; Sermanet, P.; Reed, S.; Anguelov, D.; Erhan, D.; Vanhoucke, V.; and Rabinovich, A. 2015. Going Deeper With Convolutions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'15)

    2015

  27. [35]

    Tan, W.; Li, Y.; Zhao, C.; Liu, Z.; and Pan, Q. 2023. DOEPatch: Dynamically Optimized Ensemble Model for Adversarial Patches Generation. arXiv preprint arXiv:2312.16907

    2023 arXiv

  28. [36]

    N.; Kaiser, .; and Polosukhin, I

    Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, .; and Polosukhin, I. 2017. Attention is all you need. In Proceedings of the 30th Advances in Neural Information Processing Systems (NerIPS'17)

    2017

  29. [37]

    Wang, D.; Yao, W.; Jiang, T.; Li, C.; and Chen, X. 2023 a . RFLA: A Stealthy Reflected Light Adversarial Attack in the Physical World. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'23), 4455--4465

    2023

  30. [38]

    Wang, H.; Deng, Y.; Yoo, S.; and Lin, Y. 2024 a . Exploring robust features for improving adversarial robustness. IEEE Transactions on Cybernetics

    2024

  31. [39]

    Wang, J.; Wang, D.; Hu, J.; Wu, S.; Jiang, T.; Yao, W.; Liu, A.; and Liu, X. 2023 b . Adversarial Examples in the Physical World: A Survey. CoRR, abs/2311.01473

    2023 arXiv

  32. [40]

    Wang, X.; Li, M.; Liu, W.; Zhang, H.; Hu, S.; Zhang, Y.; Zhou, Z.; and Jin, H. 2024 b . Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need. In The 38th Conference on Neural Information Processing Systems (NeurIPS'24)

    2024

  33. [41]

    Wang, X.; Pan, H.; Zhang, H.; Li, M.; Hu, S.; Zhou, Z.; Xue, L.; Guo, P.; Wang, Y.; Wan, W.; et al. 2024 c . TrojanRobot: Backdoor Attacks Against Robotic Manipulation in the Physical World. arXiv preprint arXiv:2411.11683

    2024

  34. [42]

    Yang, C.; Kortylewski, A.; Xie, C.; Cao, Y.; and Yuille, A. 2020. Patchattack: A black-box texture-based attack with reinforcement learning. In Proceedings of the 16th European Conference on Computer Vision (ECCV'22), 681--698

    2020

  35. [43]

    Zagoruyko, S.; and Komodakis, N. 2016. Wide residual networks. arXiv preprint arXiv:1605.07146

    2016 arXiv

  36. [44]

    Y.; Zhou, Z.; Wang, X.; Zhang, Y.; and Chen, C

    Zhang, H.; Hu, S.; Wang, Y.; Zhang, L. Y.; Zhou, Z.; Wang, X.; Zhang, Y.; and Chen, C. 2024 a . Detector collapse: Backdooring object detection to catastrophic overload or blindness. In Proceedings of the 33rd International Joint Conference on Artificial Intelligence, IJCAI'24

    2024

  37. [45]

    Y.; Hu, S.; Chen, C.; Liew, A.; and Li, Z

    Zhang, H.; Yao, Z.; Zhang, L. Y.; Hu, S.; Chen, C.; Liew, A.; and Li, Z. 2023. Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning. In Proceedings of the 31st International Joint Conference on Artificial Intelligence, IJCAI'23

    2023

  38. [46]

    Zhang, H.; Zhu, C.; Wang, X.; Zhou, Z.; Yin, C.; Li, M.; Xue, L.; Wang, Y.; Hu, S.; Liu, A.; et al. 2024 b . BadRobot: Manipulating Embodied LLMs in the Physical World. arXiv preprint arXiv:2407.20242

    2024 arXiv

  39. [47]

    A.; Shechtman, E.; and Wang, O

    Zhang, R.; Isola, P.; Efros, A. A.; Shechtman, E.; and Wang, O. 2018 a . The Unreasonable Effectiveness of Deep Features as a Perceptual Metric. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'18)

    2018

  40. [48]

    Zhang, X.; Zhou, X.; Lin, M.; and Sun, J. 2018 b . Shufflenet: An extremely efficient convolutional neural network for mobile devices. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'18), 6848--6856

    2018

  41. [49]

    Zhong, Y.; Liu, X.; Zhai, D.; Jiang, J.; and Ji, X. 2022. Shadows Can Be Dangerous: Stealthy and Effective Physical-World Adversarial Attack by Natural Phenomenon. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22), 15345--15354

    2022

  42. [50]

    Zhou, Z.; Hu, S.; Li, M.; Zhang, H.; Zhang, Y.; and Jin, H. 2023 a . Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In Proceedings of the 32nd ACM International Conference on Multimedia (MM'23), 6311--6320

    2023

  43. [51]

    Y.; Hou, J.; and Jin, H

    Zhou, Z.; Hu, S.; Zhao, R.; Wang, Q.; Zhang, L. Y.; Hou, J.; and Jin, H. 2023 b . Downstream-agnostic adversarial examples. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'23), 4345--4355

    2023

  44. [52]

    Y.; Yao, D.; and Jin, H

    Zhou, Z.; Li, B.; Song, Y.; Hu, S.; Wan, W.; Zhang, L. Y.; Yao, D.; and Jin, H. 2025. NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors. In Proceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI'25)

    2025

  45. [53]

    Y.; Yao, D.; and Jin, H

    Zhou, Z.; Li, M.; Liu, W.; Hu, S.; Zhang, Y.; Wan, W.; Xue, L.; Zhang, L. Y.; Yao, D.; and Jin, H. 2024 a . Securely Fine-tuning Pre-trained Encoders Against Adversarial Examples. In Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP'24)

    2024

  46. [54]

    Y.; Yao, D.; and Jin, H

    Zhou, Z.; Song, Y.; Li, M.; Hu, S.; Wang, X.; Zhang, L. Y.; Yao, D.; and Jin, H. 2024 b . Darksam: Fooling segment anything model to segment nothing. In Proceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS'24)

    2024

  47. [55]

    Zhu, D.; Chen, J.; Shen, X.; Li, X.; and Elhoseiny, M. 2023. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304.10592

    2023 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.