Pith. sign in

REVIEW 3 major objections 5 minor 38 references

Adversarial Attacks and Detection in Visual Place Recognition for Safer Robot Navigation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper shows that an adversarial attack detector with only 75 percent true positives and 25 percent false positives roughly halves the mean localization error of VPR-based robot navigation.

desk verdict A useful simulation-based study of VPR adversarial attacks and a closed-loop AAD navigation paradigm; the headline 75% TP / 25% FP result is real as a simulation finding, but its transfer to real detectors is not established. read the letter →

arxiv 2506.15988 v1 pith:ILFXYSS6 submitted 2025-06-19 cs.CV cs.RO

Connor Malone , Owen Claxton , Iman Shames , Michael Milford This is my paper
classification cs.CVcs.RO
keywords visualplacerecognitionadversarialattacksattackdetectionrobotnavigationlocalizationerrorperceptualaliasingfastgradientsignmethodclosed-loop
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that visual place recognition (VPR), the perceptual backbone of many robot navigation systems, is dangerously exposed to adversarial attacks, and that a moderately accurate attack detector is enough to make it substantially safer. In a simulated hostile environment where the robot must guess which speed keeps it safe from attacks, the authors show that adding a detector with a 75% true-positive rate and 25% false-positive rate reduces mean along-track localization error by about 50% compared to a robot with no detector. They also identify the most threatening attack type: copying feature values from the reference database into the query, which induces perceptual aliasing—false matches between different places—that random-noise attacks do not. A separate first study of FGSM attacks finds that VPR networks are vulnerable but that attacks transfer less cleanly between networks than they do in image classification.

What carries the argument

The load-bearing mechanism is the simulated Adversarial Attack Detector (AAD), a module that independently flags each query as attacked or clean according to specified true-positive and false-positive probabilities. It is embedded in an active navigation loop: after enough detected attacks, the robot probes each of its two speeds for a fixed number of frames and then continues at the speed that produced fewer detections. The other key object is the reference-based feature-space attack, which copies values from a random reference image representation into the query, creating the perceptual aliasing that drives large localization errors, while the experiment paradigm itself—randomly allocated safe-speed zones with a 10% attack chance when safe and 70% when not—is what makes the AAD benefit measurable.

What would settle it

Run the same speed-zone experiment with a real attack detector and measure its empirical true- and false-positive rates on the same query stream; if a detector at 75% true positives and 25% false positives does not roughly halve mean along-track error, or if its in-loop false-positive rate exceeds the simulated bound, the paper's headline result collapses.

Watch

Extended reading notes

Core claim

The central claim is that closing the loop between VPR, an Adversarial Attack Detector (AAD), and active navigation decisions can substantially mitigate attacks, and that the detector does not need to be highly accurate to help. Across AP-GeM, NetVLAD, and DinoV2 SALAD descriptors on indoor and outdoor datasets, the paper reports that a simulated AAD operating at 75% true-positive detection with 25% false positives roughly halves the mean along-track localization error relative to no detection, with diminishing returns at higher accuracy. The authors attribute modern descriptors' resilience to simple random or flat attacks to the near-orthogonality of hyperdimensional feature vectors, while the reference-based attack, which copies feature values from a reference image into the query, exploits perceptual aliasing and is consistently the most damaging. Using a proposed Loss-of-Vehicle criterion, they show that at a 33% attacked-traverse threshold, detectors with true-positive rates above 60% complete 100% of traverses, whereas the undefended baseline completes only 10–20%. Finally, the paper reports a first assessment of FGSM in VPR: an attack generated with MixVPR drops that network's Recall@1 from 86.2 to 24.5, while the other tested networks degrade much less, suggesting limited black-box transferability.

Load-bearing premise

The quantitative results rest on simulating the attack detector as independent random draws at fixed true-positive and false-positive rates; if a real detector's errors are correlated, delayed, or attack-dependent, the reported 75% true-positive requirement may not transfer to deployed systems.

Editorial extensions

If this is right

  • Even a moderately accurate detector helps: at 75% true positives and 25% false positives, mean along-track error drops by roughly half for every tested VPR descriptor in both environments, with diminishing returns above that point.
  • Detectors at or below 50% true positives provide no mean-error advantage over no detector and, through false-positive probing, can trigger unnecessary speed changes.
  • Defences should prioritize protecting the reference database and mitigating perceptual aliasing, since reference-based attacks are the most damaging while random and flat attacks are largely absorbed by hyperdimensional descriptors.
  • AADs change the risk profile: at a 33% Loss-of-Vehicle threshold, detectors above 60% true positives complete all traverses, whereas the undefended baseline completes only 10–20%.
  • FGSM attacks can sharply degrade the generating network in VPR, but transfer weakly to other VPR networks, so black-box transferability of such attacks is not guaranteed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, if a real detector produces correlated error bursts rather than independent random draws, the 25% false-positive tolerance is likely optimistic; the same experiment with temporally correlated detection noise would test how much margin remains.
  • Beyond the paper, the same closed-loop strategy should work for any switchable operating state—different sensors, routes, or redundant localization modes—not just robot speed, so the paper's paradigm is a template for quantifying detector requirements in those settings.
  • Beyond the paper, protecting read access to the reference database is likely the highest-value defence, since reference-based attacks are the most damaging; an empirical extension would measure how much damage remains when the attacker can only use past queries.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper studies adversarial attacks on Visual Place Recognition (VPR) and proposes an active navigation strategy in which simulated Adversarial Attack Detectors (AADs) trigger speed changes to reduce attack exposure. Four existing black-box attacks (Flat, Random) and four novel VPR-specific attacks (Query-based, Reference-based, with noise/patch variants) are evaluated on AP-GeM, NetVLAD, and DinoV2 SALAD across indoor (QCR Office) and outdoor (QCR Campus) datasets. The experiment paradigm models attacks as independent Bernoulli events with 10% probability at the 'safe' speed and 70% at the unsafe speed, and AADs as independent binary decisions with fixed true-positive (TP) and false-positive (FP) rates. The principal quantitative claim is that an AAD with 75% TP and 25% FP reduces mean along-track localization error by approximately 50% relative to a no-detector baseline. The paper also presents a first study of Fast Gradient Sign Method (FGSM) attacks in VPR, reporting limited transferability from MixVPR to other VPR descriptors.

Significance. If the headline result holds, the paper provides a reusable framework and public code for reasoning about the detection accuracy needed to mitigate VPR attacks, and it identifies reference-based attacks as a specific and realistic vulnerability. The paper is transparent about simulating AADs and attacks, evaluates multiple state-of-the-art VPR descriptors, and reports consistent trends across environments, which strengthens the qualitative conclusions. The main scientific value is the proposed experiment paradigm and the attack analysis; the specific 75% TP / 25% FP operating point, however, is only as credible as the independent-Bernoulli assumptions used to generate it, and the FGSM investigation is appropriately preliminary but under-specified.

major comments (3)
  1. The headline ~50% mean-error reduction at 75% TP / 25% FP is derived from a simulation in which both attacks (10%/70% per-query probabilities) and AAD detections (independent Bernoulli draws with fixed TP/FP rates) are i.i.d. per query. Real detectors are unlikely to produce independent errors: missed detections may cluster during a sustained adversarial campaign, false positives may concentrate in visually ambiguous places, and detectability will likely differ between the Flat/Random attacks and the more damaging Reference-based attacks. The paper does not test sensitivity to correlated or attack-dependent detection errors, so the abstract's 'quantitative requirements for system design' overstates the confidence in this operating point. Please add an ablation that perturbs the error structure (e.g., bursty errors, attack-type-dependent TP/FP) or temper the claim to explicitly condition on the i.i.d. detector model.
  2. The conclusion that FGSM attacks transfer less effectively in VPR than in classification rests on a single surrogate network (MixVPR), a single dataset pair (Oxford RobotCar overcast/sunny), and a single unstated attack magnitude. The paper does not report the value of epsilon or a sweep over epsilon, and transfer to AP-GeM, NetVLAD, and SALAD is tested only in one configuration. As a first study this is an acceptable preliminary result, but the conclusion should be more cautious and should state the attack parameters used; otherwise the 'may not be as transferable' claim is not well supported.
  3. The active-navigation parameters—probe trigger threshold of 10 detected attacks and probe duration of 10 query images per speed—are fixed without a sensitivity analysis. The ~50% mean-error reduction at 75% TP could shift with these parameters, since they determine how often the robot switches speed and how reliable the speed-selection decision is. Please provide an ablation over trigger threshold and probe duration, or at least discuss the expected dependence.
minor comments (5)
  1. The column header row appears garbled ('OfficeBaseline Random Adversarial Attack DetectorVPR Speed'); please reformat the table so that each column is clearly labeled.
  2. The figure uses a split linear-logarithmic axis, but the caption does not explain this; please describe the axis scaling to make the comparisons interpretable.
  3. The Loss-of-Vehicle (LoV) definition says 'more than 50% of the traverse is attacked' after earlier defining the metric as the percentage of query images attacked; please use consistent terminology (e.g., 'more than 50% of query images are attacked').
  4. The sentence 'across both environments and number of incurred attacks' is unclear; it likely means 'and reduces the number of incurred attacks', but the current phrasing is confusing.
  5. The paper reports point estimates from 100 random traverses without standard errors or confidence intervals; providing them would help assess the stability of the reported means and the claimed ~50% reduction.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the AAD results are Monte Carlo outcomes of an explicitly simulated detector sweep, and the few self-citations are not load-bearing.

full rationale

The paper's central quantitative claim — that an AAD with 75% true-positive and 25% false-positive rates reduces mean along-track localization error by roughly 50% — is not derived from a fitted parameter or from a self-citation chain. In Section IV-C the authors state plainly: "We simulate the performance of AADs across a range of different possible attack detection accuracies. We parameterize these simulated AADs using a nominated rate of True Positive (TP) detection and False Positive (FP) detection, which we implement using randomly sampled binary values with these rates as probabilities." The TP/FP values are swept inputs, not quantities fitted to the output error, and the mean-error reduction emerges from the full navigation simulation (zone allocation, probing threshold, VPR descriptor matching), so it is not equivalent to the detector parameters by construction. The reference-based attack conclusion is an empirical result about descriptor behavior, and the paper itself explains it through hyperdimensional orthogonality arguments rather than by definition. The self-citations, notably [18] for the QCR datasets and [36]–[38] as pointers for future AAD design, do not carry the argument; the datasets and code are publicly available and the core experiments are self-contained Monte Carlo evaluations. No uniqueness theorem, prior-work ansatz, or renamed metric is used to force the headline result. Concerns about whether independent-Bernoulli simulated detectors transfer to real detectors with correlated errors are validity threats, not circularity, and the paper is transparent that the AADs are simulated. Therefore no circular step meets the quote-and-reduction standard, and the appropriate score is 0.

Assumptions & free parameters 9 free parameters · 5 assumptions · 0 invented entities

The central results depend on several hand-chosen simulation parameters (attack probabilities, AAD TP/FP grid, probing thresholds) and on domain assumptions about AAD fidelity and feature-space attack realism. No new physical or mathematical entities are introduced; the AAD is a simulated stand-in for an existing concept.

free parameters (9)
  • safe-speed attack probability = 0.1
    Hand-chosen in Section IV-A2; sets the attack baseline in 'safe' zones and affects all error metrics.
  • unsafe-speed attack probability = 0.7
    Hand-chosen in Section IV-A2; drives the benefit of switching to the correct speed.
  • fraction of query data attacked = 10% to 50%
    Randomly varied per attack in Section IV-G; Figure 7 shows error rises sharply beyond 40-50%.
  • AAD true positive rate = 0.50, 0.60, 0.75, 0.85, 0.95
    Simulation grid in Section IV-C; the headline result is the 0.75 point.
  • AAD false positive rate = 0.50, 0.40, 0.25, 0.15, 0.05
    Set equal to 1 - TP in Section IV-C; couples FP to TP in the sweep.
  • probe trigger threshold = 10 detected attacks
    Hand-chosen in Section IV-G; controls how often the robot probes speeds.
  • probe duration = 10 query images per speed
    Hand-chosen in Section IV-G; determines the accuracy of the speed comparison.
  • Loss-of-Vehicle threshold = 50% of traverse attacked
    Hand-chosen in Section IV-D with ablation in Figure 9; affects the LoV completion metric.
  • FGSM attack magnitude (epsilon) = not reported
    The FGSM strength is not stated in Section IV-H; the transfer results depend on it.
assumptions (5)
  • domain assumption Random binary decisions with fixed TP/FP rates model real AAD behavior
    Section IV-C simulates AADs as randomly sampled binary values with specified probabilities; the headline quantitative claims assume this is a faithful proxy for real detectors.
  • domain assumption Feature-space perturbations represent realistic adversarial attacks
    Section III-A and Section IV-G apply attacks to VPR feature vectors after extraction, while a real black-box attacker would perturb input images or the physical scene.
  • ad hoc to paper Speed as operating-state proxy with 10%/70% attack probabilities
    Section IV-A2 creates an artificial environment where speed determines attack likelihood; these probabilities are chosen by the authors and not derived from real threat models.
  • standard math Nearest-reference Euclidean-distance matching is a valid VPR model
    Section IV-F computes VPR match distances using Euclidean distance; this is standard practice but is an assumption about how VPR systems are used.
  • domain assumption Zones uniformly distributed with 50/50 safe-speed allocation and 100 independent trials provide stable estimates
    Section IV-A2 randomizes zone allocations and repeats 100 times but does not report confidence intervals for the headline metrics.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks and Detection in Visual Place Recognition for Safer Robot Navigation." pith.science (2026). https://pith.science/paper/ILFXYSS6

@misc{pith2026250615988,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks and Detection in Visual Place Recognition for Safer Robot Navigation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ILFXYSS6}},
  note         = {Machine review of arXiv:2506.15988}
}
read the original abstract

Stand-alone Visual Place Recognition (VPR) systems have little defence against a well-designed adversarial attack, which can lead to disastrous consequences when deployed for robot navigation. This paper extensively analyzes the effect of four adversarial attacks common in other perception tasks and four novel VPR-specific attacks on VPR localization performance. We then propose how to close the loop between VPR, an Adversarial Attack Detector (AAD), and active navigation decisions by demonstrating the performance benefit of simulated AADs in a novel experiment paradigm -- which we detail for the robotics community to use as a system framework. In the proposed experiment paradigm, we see the addition of AADs across a range of detection accuracies can improve performance over baseline; demonstrating a significant improvement -- such as a ~50% reduction in the mean along-track localization error -- can be achieved with True Positive and False Positive detection rates of only 75% and up to 25% respectively. We examine a variety of metrics including: Along-Track Error, Percentage of Time Attacked, Percentage of Time in an `Unsafe' State, and Longest Continuous Time Under Attack. Expanding further on these results, we provide the first investigation into the efficacy of the Fast Gradient Sign Method (FGSM) adversarial attack for VPR. The analysis in this work highlights the need for AADs in real-world systems for trustworthy navigation, and informs quantitative requirements for system design.

Figures

Figures reproduced from arXiv: 2506.15988 by the authors.

Figure 1
Figure 1. We investigate the under-explored effects of adversarial attacks in VPR [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Example Adversarial Attacks in the image space. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Left: Our Experimental design for evaluating the effect of adversarial attacks and AADs on VPR localization. Each zone is randomly allocated a speed that corresponds with being safest from attacks. If the robot is not driving at the ‘safe’ speed, there is a high likelihood of an attack. Right: Our proposed active navigation behavior for closing the loop between VPR, AAD, and navigation decisions. The robot travels a… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Example images from the datasets [18] used throughout the proposed [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 7
Figure 7. Figure 7: Box plots showing how the along-track localization error is correlated [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: Left: Office. Right: Campus. Box plots visualizing the attack-based metrics across our proposed experiment both with and without an AAD. In general, the random speed selection for each zone is approximately equivalent to selecting one speed across the traverse - likely…
Figure 9
Figure 9. Figure 9: Ablation of the threshold of a traverse that must be attacked before [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 32 canonical work pages

  1. [1]

    VPR-Bench: An open-source visual place recog- nition evaluation framework with quantifiable viewpoint and appearance change,

    M. Zaffar and et al., “VPR-Bench: An open-source visual place recog- nition evaluation framework with quantifiable viewpoint and appearance change,” International Journal of Computer Vision , May 2021

    work page 2021

  2. [2]

    Mixvpr: Feature mixing for visual place recognition,

    A. Ali-Bey, B. Chaib-Draa, and P. Gigu ´ere, “Mixvpr: Feature mixing for visual place recognition,” in IEEE/CVF Winter Conference on Applications of Computer Vision , 2023, pp. 2997–3006

    work page 2023

  3. [3]

    AnyLoc: Towards Universal Visual Place Recognition

    N. Keetha and et al., “Anyloc: Towards universal visual place recogni- tion,” arXiv preprint arXiv:2308.00688 , 2023

    work page Pith review arXiv 2023

  4. [4]

    Optimal transport aggregation for visual place recognition,

    S. Izquierdo and J. Civera, “Optimal transport aggregation for visual place recognition,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 17 658–17 668

    work page 2024

  5. [5]

    Adversarial attacks and defenses in deep learning for image recognition: A survey,

    J. Wang, C. Wang, Q. Lin, C. Luo, C. Wu, and J. Li, “Adversarial attacks and defenses in deep learning for image recognition: A survey,” Neurocomputing, vol. 514, pp. 162–181, 2022

    work page 2022

  6. [6]

    Robust physical-world attacks on deep learn- ing visual classification,

    K. Eykholt and et al., “Robust physical-world attacks on deep learn- ing visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 1625–1634

    work page 2018

  7. [7]

    Role of spatial context in adversarial robustness for object detection,

    A. Saha, A. Subramanya, K. Patil, and H. Pirsiavash, “Role of spatial context in adversarial robustness for object detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, 2020, pp. 784–785

    work page 2020

  8. [8]

    Securing au- tonomous vehicles visual perception: Adversarial patch attack and defense schemes with experimetal validations,

    J. Liang, R. Yi, J. Chen, Y . Nie, and H. Zhang, “Securing au- tonomous vehicles visual perception: Adversarial patch attack and defense schemes with experimetal validations,” IEEE Transactions on Intelligent Vehicles, 2024

    work page 2024

Show all 38 references
  1. [9]

    Beyond digital domain: Fooling deep learning based recognition system in physical world,

    K. Yang, T. Tsai, H. Yu, T.-Y . Ho, and Y . Jin, “Beyond digital domain: Fooling deep learning based recognition system in physical world,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 34, no. 01, 2020, pp. 1088–1095

    2020

  2. [10]

    Perceptual aliasing++: Adversarial attack for visual slam front-end and back-end,

    M. H. Ikram, S. Khaliq, M. L. Anjum, and W. Hussain, “Perceptual aliasing++: Adversarial attack for visual slam front-end and back-end,” IEEE Robotics and Automation Letters , vol. 7, no. 2, 2022

    2022

  3. [11]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    2014 arXiv

  4. [12]

    A survey on deep visual place recognition,

    C. Masone and B. Caputo, “A survey on deep visual place recognition,” IEEE Access, vol. 9, pp. 19 516–19 547, 2021

    2021

  5. [13]

    Where is your place, visual place recognition?

    S. Garg, T. Fischer, and M. Milford, “Where is your place, visual place recognition?” in 13th International Joint Conference on Artificial Intelligence, Z.-H. Zhou, Ed., 2021, pp. 4416–4425

    2021

  6. [14]

    Visual place recognition: A tutorial,

    S. Schubert, P. Neubert, S. Garg, M. Milford, and T. Fischer, “Visual place recognition: A tutorial,” IEEE Robotics & Automation Magazine , pp. 2–16, 2023

    2023

  7. [15]

    Fast and robust bio- inspired teach and repeat navigation,

    D. Dall’Osto, T. Fischer, and M. Milford, “Fast and robust bio- inspired teach and repeat navigation,” in 2021 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) , 2021

    2021

  8. [16]

    Netvlad: Cnn architecture for weakly supervised place recognition,

    R. Arandjelovi ´c, P. Gronat, A. Torii, T. Pajdla, and J. Sivic, “Netvlad: Cnn architecture for weakly supervised place recognition,” IEEE Trans- actions on Pattern Analysis and Machine Intelligence , vol. 40, no. 6, pp. 1437–1451, 2018

    2018

  9. [17]

    Learning with average precision: Training image retrieval with a listwise loss,

    J. Revaud, J. Almaz ´an, R. S. Rezende, and C. R. d. Souza, “Learning with average precision: Training image retrieval with a listwise loss,” in IEEE/CVF International Conference on Computer Vision , 2019

    2019

  10. [18]

    Improving visual place recognition based robot navigation by verifying localization estimates,

    O. Claxton and et al., “Improving visual place recognition based robot navigation by verifying localization estimates,” IEEE Robotics and Automation Letters, 2024

    2024

  11. [19]

    Intriguing properties of neural networks,

    C. Szegedy and et al., “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  12. [20]

    Adversarial example attacks in the physical world,

    H. Ren and T. Huang, “Adversarial example attacks in the physical world,” in Machine Learning for Cyber Security . Springer, 2020, pp. 572–582

    2020

  13. [21]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” arXiv:1711.01991, 2017

    2017 arXiv

  14. [22]

    Defense against adversarial attacks using high-level representation guided de- noiser,

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided de- noiser,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1778–1787

    2018

  15. [23]

    A study of the effect of jpg compression on adversarial images,

    G. K. Dziugaite, Z. Ghahramani, and D. M. Roy, “A study of the effect of jpg compression on adversarial images,” arXiv preprint arXiv:1608.00853, 2016

    2016 arXiv

  16. [24]

    Adversarial examples detection in deep networks with convolutional filter statistics,

    X. Li and F. Li, “Adversarial examples detection in deep networks with convolutional filter statistics,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 5764–5772

    2017

  17. [25]

    Orb-slam: a versatile and accurate monocular slam system,

    R. Mur-Artal, J. M. M. Montiel, and J. D. Tardos, “Orb-slam: a versatile and accurate monocular slam system,” IEEE transactions on robotics , vol. 31, no. 5, pp. 1147–1163, 2015

    2015

  18. [26]

    Remote attacks on automated vehicles sensors: Experiments on camera and lidar,

    J. Petit, B. Stottelaar, M. Feiri, and F. Kargl, “Remote attacks on automated vehicles sensors: Experiments on camera and lidar,” Black Hat Europe, vol. 11, no. 2015, p. 995, 2015

    2015

  19. [27]

    Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle,

    C. Yan, W. Xu, and J. Liu, “Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle,” Def Con , vol. 24, no. 8, p. 109, 2016

    2016

  20. [28]

    Adversarial sensor attack on lidar-based perception in autonomous driving,

    Y . Cao and et al., “Adversarial sensor attack on lidar-based perception in autonomous driving,” in ACM SIGSAC conference on computer and communications security, 2019, pp. 2267–2281

    2019

  21. [29]

    Illusion and dazzle: Adversar- ial optical channel exploits against lidars for automotive applications,

    H. Shin, D. Kim, Y . Kwon, and Y . Kim, “Illusion and dazzle: Adversar- ial optical channel exploits against lidars for automotive applications,” in Cryptographic Hardware and Embedded Systems–CHES 2017: 19th International Conference, Taipei, Taiwan, September 25-28, 2017, Pro...

    2017

  22. [30]

    A study on cyber-security of autonomous and unmanned vehicles,

    E. Ya ˘gdereli, C. Gemci, and A. Z. Aktas ¸, “A study on cyber-security of autonomous and unmanned vehicles,” The Journal of Defense Modeling and Simulation, vol. 12, no. 4, pp. 369–381, 2015

    2015

  23. [31]

    Potential cyberattacks on automated vehicles,

    J. Petit and S. E. Shladover, “Potential cyberattacks on automated vehicles,” IEEE Transactions on Intelligent transportation systems , vol. 16, no. 2, pp. 546–556, 2014

    2014

  24. [32]

    Cyber threats facing autonomous and connected vehicles: Future challenges,

    S. Parkinson, P. Ward, K. Wilson, and J. Miller, “Cyber threats facing autonomous and connected vehicles: Future challenges,” IEEE transactions on intelligent transportation systems , vol. 18, no. 11, pp. 2898–2915, 2017

    2017

  25. [33]

    1 Year, 1000km: The Oxford RobotCar Dataset,

    W. Maddern, G. Pascoe, C. Linegar, and P. Newman, “1 Year, 1000km: The Oxford RobotCar Dataset,” The International Journal of Robotics Research (IJRR), vol. 36, pp. 3–15, 2017

    2017

  26. [34]

    An introduction to hyperdi- mensional computing for robotics,

    P. Neubert, S. Schubert, and P. Protzel, “An introduction to hyperdi- mensional computing for robotics,” KI-K¨unstliche Intelligenz, vol. 33, no. 4, pp. 319–330, 2019

    2019

  27. [35]

    Hyperdimensional computing as a framework for systematic aggregation of image descriptors,

    P. Neubert and S. Schubert, “Hyperdimensional computing as a framework for systematic aggregation of image descriptors,” in 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 16 933–16 942

    2021

  28. [36]

    Predicting to improve: Integrity measures for assessing visual localization performance,

    H. Carson, J. J. Ford, and M. Milford, “Predicting to improve: Integrity measures for assessing visual localization performance,” IEEE Robotics and Automation Letters , vol. 7, no. 4, pp. 9627–9634, 2022

    2022

  29. [37]

    Unsupervised quality prediction for improved single-frame and weighted sequential visual place recognition,

    ——, “Unsupervised quality prediction for improved single-frame and weighted sequential visual place recognition,” in 2023 IEEE Interna- tional Conference on Robotics and Automation (ICRA) , 2023

    2023

  30. [38]

    On the estimation of image- matching uncertainty in visual place recognition,

    M. Zaffar, L. Nan, and J. F. Kooij, “On the estimation of image- matching uncertainty in visual place recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 17 743–17 753. 8

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.