Pith. sign in

REVIEW 4 major objections 7 minor 43 references

AdvGrasp: Adversarial Attacks on Robotic Grasping from a Physical Perspective

T0 review · 4 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Deforming an object's shape can make robot grasps fail.

desk verdict A new physically grounded attack idea with a solid benchmark, but the 'systematically degrades' claim is undercut by the paper's own tables showing the optimized metrics don't transfer to the evaluation metrics. read the letter →

arxiv 2507.09857 v1 pith:UO4SNI4K submitted 2025-07-14 cs.RO cs.CR

Xiaofei Wang , Mingliang Han , Tianyu Hao , Cegang Li , Yunbo Zhao , Keke Tang This is my paper · ORCID
classification cs.ROcs.CR
keywords adversarialattacksroboticgraspinggraspstabilityliftcapabilitywrenchspaceshapedeformationqualitymetricsAdvGrasp-20
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that a robot's grasp can be broken by changing the object itself rather than the perception network. AdvGrasp deforms the object's mesh so that gravity produces more torque on the held object and so that the set of wrenches the fingers can exert moves closer to the edge of feasibility, degrading both lift capability and grasp stability. These two objectives are optimized together with a smoothing term, producing adversarial objects whose overall shape is preserved. The attack is evaluated in simulation on a 20-object benchmark and in physical tests with a real gripper, where deformed objects slip and drop while the original objects lift cleanly. This matters because prior attacks mainly fool the network that scores grasps, leaving the physical grasp itself untouched.

What carries the argument

The machinery is the wrench-space formulation of grasp quality. For each contact, a wrench combines force and torque about the object's centroid, and a grasp is stable when the origin lies inside the convex hull of the wrenches the contacts can generate; lift capability is the ratio of the gravitational wrench to the normal force needed to balance it. AdvGrasp places control points on a bounding box around the object and deforms the mesh through iterative mean-value-coordinate warping, using simulated annealing to minimize the combined objective while the Laplacian term suppresses implausible geometry. The deformation acts on exactly the two quantities that change with shape: the center of mass that sets the gravitational torque and the surface normals that set the direction of each contact wrench.

What would settle it

A decisive check is to compute, for every object in AdvGrasp-20, the change in the two optimized analytic scores alongside the change in minimal grasp force, maximal lifting mass, and maximal external disturbance; the central claim would be falsified if a substantial share of objects show physical metrics staying flat or improving while the analytic scores drop. A second check is to 3D-print adversarial versions of additional objects and run the same lift-and-disturbance protocol used for the two reported physical objects.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that two analytic grasp-quality quantities can serve as adversarial objectives: lift capability, the minimal normal gripper force needed to balance gravity, and grasp stability, the distance from the origin to the convex hull of the wrenches the contacts can exert. AdvGrasp perturbs vertices near the contacts and elsewhere on the object to minimize a weighted sum of these two quantities plus a Laplacian regularization term. Reducing lift capability is achieved by shifting geometry so the gravitational wrench becomes harder to counter, and reducing stability is achieved by changing surface normals near the contacts so the wrench hull passes closer to the origin. In simulation the resulting adversarial objects require more force to lift, lower the maximum liftable mass, and survive smaller external disturbances; in physical tests a two-finger gripper drops the deformed objects while lifting the originals. The paper also reports that a learned grasp evaluator often still judges the adversarial grasps as good, while the physical metric marks them as bad.

Load-bearing premise

The argument assumes that reducing the analytic lift-capability and stability scores will make simulated and physical grasps fail more often, even though the evaluation uses different physical metrics and the reported tables show this transfer is not clean for every object.

Editorial extensions

If this is right

  • Adversarial objects can be generated without access to the robot's perception network, so the attack applies to analytic grasp planners as well as learned ones.
  • A grasp that succeeds on the original object can be made to fail by a localized deformation that preserves the object's overall shape.
  • The AdvGrasp-20 benchmark gives later work a fixed set of objects and grasp configurations for comparing physical attacks on two- and three-finger grippers.
  • Because a learned grasp evaluator often approves adversarial grasps that the physical metric rejects, grasp-quality networks may need physics-based training signals to remain trustworthy under attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is combining this physical attack with an image- or point-cloud-based attack on the perception stage, since the two failures may compound end-to-end.
  • The reported tables show the analytic-to-physical transfer is not perfect for every object, so adversary success may be object-dependent and per-object correlations would clarify where AdvGrasp can be relied on.
  • The same wrench-space objectives could be inverted for defense, for instance by choosing contacts or adding surface features that increase the stability margin without changing the intended grasp.
  • Extending the real-world validation to all twenty objects under varied friction and gripper stiffness would map where the simulation-based transfer holds.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes AdvGrasp, a framework that generates adversarial 3D object shapes by deforming an object to reduce two analytic grasp metrics: Ferrari's lift capability LC (Eq. 4) and grasp stability score GS (Eq. 6). The authors introduce AdvGrasp-20, a benchmark of 20 objects with two- and three-finger grasps, and evaluate attack success using simulation-based metrics MinGF, MaxLM, and MaxED in PyBullet, plus two real-world 3D-printed objects. The stated central claim is that AdvGrasp 'systematically degrades' grasp performance.

Significance. If the central claim held, this would be a valuable contribution: it addresses an underexplored class of physical adversarial attacks and provides a benchmark and real-world validation. The use of physically grounded attack objectives (LC/GS) rather than network scores is conceptually sound, and the paper presents per-object tables rather than only qualitative examples. However, the paper's own data do not currently support the word 'systematically': a non-negligible fraction of entries in Tables 1 and 2 move opposite to the claimed direction. The manuscript therefore needs substantial additional evidence or a sharpened claim before the contribution can be accepted.

major comments (4)
  1. [§6.2, Tables 1–2] The abstract and Section 7 state that AdvGrasp 'systematically degrades' grasp performance, but Table 1 shows multiple counterexamples: for two-finger MinGF, MUSTARD BOTTLE changes 22.6→20.7, RACQUETBALL 21.9→20.8, TOY AIRPLANE 29.2→14.6, CAMEL 15.5→9.7, and SHAMPOO 21.9→14.0, i.e., the minimal grasp force decreases (grasp becomes easier). Table 2 shows MaxED increases after AdvGrasp for several entries (e.g., two-finger CHIPS CAN 33→35; three-finger CRACKER BOX 24→36, KNIFE 7→13, BAOKE MARKER 15→40, CAMEL 23→27). These cases are not negligible noise; the paper provides no per-object analysis, no rate of 'successful' degradation, and no statistical test. To support the central claim, the authors should report the failure rate, add error bars/confidence intervals, and either refine the method or restrict the claim to the majority of cases with quantified confidence.
  2. [§4.1–4.3, Eq. (8); §6.2] The optimization objective is a sum of LC and GS (plus Laplacian regularization), but the evaluation never reports these optimized quantities. The abstract's phrase 'degrades these two key grasping metrics' is therefore not directly verified: LC and GS are not in Tables 1–2. Instead, the paper reports transfer metrics (MinGF, MaxLM, MaxED), and the mapping from reduced LC/GS to these simulation outcomes is assumed. I ask the authors to include a table or scatter plot of LC and GS before/after attack, and a correlation or per-object comparison showing that reductions in LC/GS translate to lower MinGF, lower MaxLM, and lower MaxED.
  3. [§6.1, Evaluation Metrics] The evaluation protocol is deterministic in description, but no repeated runs or seeds are reported; the increments (0.2 N force steps, 1 N disturbance steps, 0.1 kg mass steps) also discretize the metrics coarsely. For example, many MaxLM changes are 0.1–0.3, which is at the step granularity. Without variance estimates or a significance test, the observed improvements in some rows could be attributed to quantization or simulation noise. I request error bars over multiple optimization runs (or at least multiple simulation seeds) and a statistical comparison (e.g., paired test over objects) for the aggregate claim.
  4. [Abstract; §6.3] The real-world validation reports only two objects (DABAO SOD and TOMATO SOUP CAN) with a single qualitative outcome (lifted versus dropped) and no repeated trials, force calibration details, or measured slip/pose values. This is too thin to support the abstract's 'robustness and practical applicability.' Either add quantitative repeated trials or soften the claim.
minor comments (7)
  1. [Eq. (4)] The definition of LC is ambiguous: please define the set G(w_gravity) explicitly and specify whether the norm in the numerator and denominator is taken in the wrench space or the force space.
  2. [Eq. (6)] The notation Disp2s(0, S) is not defined; specify the distance function and the space in which the convex hull is computed.
  3. [§5, Grasp Generation] The post-processing step retains only grasps that successfully lift objects, but the paper does not report how many of the initially generated grasps were filtered out per object; this could bias the benchmark toward easy grasps and should be stated.
  4. [Tables 1–2] The table captions do not state units for MinGF, MaxLM, and MaxED; the units appear only in the text of Section 6.1, and repeating them in the captions would greatly improve readability.
  5. [Figure 7] The figure lacks axis labels, a definition of the thresholds for 'good' and 'bad' under each metric, and error bars; since the DNN-based and physical metrics use different failure criteria, the comparison is hard to interpret without this information.
  6. [References] The reference to Alharthi and Brandão [2024] lists the page range as '1907–1902', which is inconsistent; please correct it.
  7. [§6.2] The experimental comparisons are limited to the three proposed variants (ALC, AGS, AdvGrasp); adding a comparison with existing adversarial grasp attacks (e.g., Alharthi and Brandão, and Wang et al.) would make the benchmark more informative.

Circularity Check

1 steps flagged · score 1.0 of 10

One minor self-definitional phrasing: the abstract's claim of degrading the two key grasping metrics restates the optimization objective (Eq. 8), but the main evaluation uses independent simulation metrics, so the central result is not circular.

  1. self definitional [Abstract and Section 4.3 (Eq. 8)]
    "By deforming the object's shape to increase gravitational torque and reduce stability margin in the wrench space, our method systematically degrades these two key grasping metrics ... O′ = arg min_O LC(GSP, O)+λ1 GS(GSP, O)+λ2 Lap(O)."

    The claimed outcome, systematically degrading the two key grasping metrics (lift capability LC and grasp stability GS), is literally the objective being optimized. Equation 8 minimizes LC and GS directly, and Eqs. 5 and 7 minimize each individually. Thus lower LC and GS values for the generated adversarial objects are guaranteed by construction whenever the optimizer succeeds; this is not an empirical prediction derived from the method. The paper's independent evidence (MinGF, MaxLM, MaxED in Tables 1-2 and real-world tests) is not circular, but the abstract's wording that the method 'systematically degrades these two key grasping metrics' is a restatement of the loss function rather than a verified result.

full rationale

The paper's central attack optimizes two standard static wrench-space metrics, LC (Eq. 4) and GS (Eq. 6), both taken from Ferrari et al. 1992, under a deformation regularizer. The evaluation, however, uses distinct PyBullet-simulated metrics: MinGF, MaxLM, and MaxED. These are not algebraically equivalent to LC or GS and are not fitted from the optimized quantities, so the main empirical claim of compromised grasp performance is independently measured rather than circular. The numerous self-citations to Tang et al. in the related-work section are background references and are not load-bearing; no uniqueness theorem or prior result by the same authors is invoked to force the method. The backfire cases in Tables 1-2 (e.g., two-finger MinGF increases for MUSTARD BOTTLE, CAMEL, SHAMPOO after AdvGrasp) are a correctness and evidence-quality concern about the word 'systematically', but they are not circularity. The only circular element is the abstract's phrasing that the method 'systematically degrades these two key grasping metrics', which is simply the optimization objective itself; the paper does not present LC/GS reductions as a predicted outcome, so this is a minor self-definitional statement rather than a flaw in the main derivation chain.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical entities. It relies on standard contact models and classical grasp-quality metrics. The hand-set weights λ1, λ2 and the failure thresholds are the main free choices; the validity of LC/GS as proxies for simulated grasp success is the least supported assumption.

free parameters (4)
  • lambda_1 (stability weight) = 10000
    Chosen by hand to balance stability and lift objectives in Eq. 8; no sensitivity analysis provided.
  • lambda_2 (laplacian regularization weight) = 50
    Chosen by hand; controls smoothness penalty in Eq. 8. The values of both weights affect the optimization trajectory and final deformation.
  • failure thresholds = displacement > 0.02 m or rotation > 10 deg
    Used to define 'significant slippage' for MinGF, MaxLM, and MaxED. These thresholds determine whether an attack is counted as successful, but are not varied or justified.
  • friction coefficients = mu=0.6, gamma=0.3
    Simulation contact model parameters. Standard values but not varied; the real-world gripper friction is not matched.
assumptions (4)
  • domain assumption Coulomb friction law limits tangential force at each contact
    Section 3.1; standard contact model.
  • domain assumption Soft finger contact allows bounded torsional torque
    Section 3.2, from Mahler et al. 2018.
  • standard math Grasp wrench equilibrium (Eq. 1) is the correct stability condition
    Section 3.2; classic grasp theory.
  • domain assumption Ferrari and Canny's lift capability LC and stability score GS are valid objective functions that correlate with physical grasp success
    Eqs. 4 and 6; the paper assumes these metrics are suitable optimization targets for the simulation outcome, which is the weakest empirical link.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AdvGrasp: Adversarial Attacks on Robotic Grasping from a Physical Perspective." pith.science (2026). https://pith.science/paper/UO4SNI4K

@misc{pith2026250709857,
  author       = {Pith},
  title        = {Pith review of: AdvGrasp: Adversarial Attacks on Robotic Grasping from a Physical Perspective},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UO4SNI4K}},
  note         = {Machine review of arXiv:2507.09857}
}
read the original abstract

Adversarial attacks on robotic grasping provide valuable insights into evaluating and improving the robustness of these systems. Unlike studies that focus solely on neural network predictions while overlooking the physical principles of grasping, this paper introduces AdvGrasp, a framework for adversarial attacks on robotic grasping from a physical perspective. Specifically, AdvGrasp targets two core aspects: lift capability, which evaluates the ability to lift objects against gravity, and grasp stability, which assesses resistance to external disturbances. By deforming the object's shape to increase gravitational torque and reduce stability margin in the wrench space, our method systematically degrades these two key grasping metrics, generating adversarial objects that compromise grasp performance. Extensive experiments across diverse scenarios validate the effectiveness of AdvGrasp, while real-world validations demonstrate its robustness and practical applicability

Figures

Figures reproduced from arXiv: 2507.09857 by the authors.

Figure 1
Figure 1. Illustration of the limitations of relying solely on neural [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of AdvGrasp: Given a 3D object and its corresponding grasp configuration as inputs, AdvGrasp deforms the object [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Visualization of the 20 objects in the AdvGrasp-20 benchmark. The first row includes: [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Visualization of the effects of AdvGrasp. (a) The original object, (b) the grasp configuration on the original object, (c) the adversarial [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: The deformation introduced by AdvGrasp, measured by [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Visualization of the adversarial attack on robotic grasping in a physical scenario: (a) assembly process with lead balls, (b) assembled [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Proportion of original and adversarial grasps generated by [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 41 canonical work pages

  1. [1]

    Physical and digital adversarial attacks on grasp quality networks

    Naif Wasel Alharthi and Martim Brand \ a o. Physical and digital adversarial attacks on grasp quality networks. In 2024 IEEE International Conference on Robotics and Automation (ICRA) , pages 1907--1902. IEEE, 2024

    work page 2024

  2. [2]

    Vision-based safety system for barrierless human-robot collaboration

    Lina Mar \' a Amaya-Mej \' a, Nicol \'a s Duque-Su \'a rez, Daniel Jaramillo-Ram \' rez, and Carol Martinez. Vision-based safety system for barrierless human-robot collaboration. In 2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) , pages 7331--7336. IEEE, 2022

    work page 2022

  3. [3]

    Bicchi and V

    A. Bicchi and V. Kumar. Robotic grasping and contact: a review. In Proceedings 2000 ICRA. Millennium Conference. IEEE International Conference on Robotics and Automation. Symposia Proceedings (Cat. No.00CH37065) , volume 1, pages 348--353 vol.1, 2000

    work page 2000

  4. [4]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy , pages 39--57, 2017

    work page 2017

  5. [5]

    The intelligent techniques in robot kejia--the champion of robocup@ home 2014

    Kai Chen, Dongcai Lu, Yingfeng Chen, Keke Tang, Ningyang Wang, and Xiaoping Chen. The intelligent techniques in robot kejia--the champion of robocup@ home 2014. In RoboCup 2014: Robot World Cup XVIII 18 , pages 130--141, 2015

    work page 2014

  6. [6]

    Pybullet, a python module for physics simulation for games, robotics and machine learning

    Erwin Coumans and Yunfei Bai. Pybullet, a python module for physics simulation for games, robotics and machine learning. http://pybullet.org, 2016. Accessed: 2024

    work page 2016

  7. [7]

    On grasp choice, grasp models, and the design of hands for manufacturing tasks

    Mark R Cutkosky et al. On grasp choice, grasp models, and the design of hands for manufacturing tasks. IEEE Transactions on robotics and automation , 5(3):269--279, 1989

    work page 1989

  8. [8]

    Security for the robot operating system

    Bernhard Dieber, Benjamin Breiling, Sebastian Taurer, Severin Kacianka, Stefan Rass, and Peter Schartner. Security for the robot operating system. Robotics and Autonomous Systems , 98:192--203, 2017

    work page 2017

Show all 43 references
  1. [9]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR , pages 9185--9193, 2018

    2018

  2. [10]

    Graspnet-1billion: A large-scale benchmark for general object grasping

    Hao-Shu Fang, Chenxi Wang, Minghao Gou, and Cewu Lu. Graspnet-1billion: A large-scale benchmark for general object grasping. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 11444--11453, 2020

    2020

  3. [11]

    Robust grasping across diverse sensor qualities: The graspnet-1billion dataset

    Hao-Shu Fang, Minghao Gou, Chenxi Wang, and Cewu Lu. Robust grasping across diverse sensor qualities: The graspnet-1billion dataset. The International Journal of Robotics Research , 2023

    2023

  4. [12]

    Planning optimal grasps

    Carlo Ferrari, John F Canny, et al. Planning optimal grasps. In ICRA , volume 3, page 6, 1992

    1992

  5. [13]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR , 2015

    2015

  6. [14]

    Detection of cyber-attacks to indoor real time localization systems for autonomous robots

    \'A ngel Manuel Guerrero-Higueras, Noem \' DeCastro-Garc \' a, and Vicente Matell \'a n. Detection of cyber-attacks to indoor real time localization systems for autonomous robots. Robotics and Autonomous Systems , 99:75--83, 2018

    2018

  7. [15]

    Mean value coordinates for closed triangular meshes

    Tao Ju, Scott Schaefer, and Joe Warren. Mean value coordinates for closed triangular meshes. In Seminal Graphics Papers: Pushing the Boundaries, Volume 2 , pages 223--228. Association for Computing Machinery, 2023

    2023

  8. [16]

    Analysis of binning of normals for spherical harmonic cross-correlation

    Robert L Larkins, Michael J Cree, and Adrian A Dorrington. Analysis of binning of normals for spherical harmonic cross-correlation. In Three-Dimensional Image Processing (3DIP) and Applications II , volume 8290, pages 195--206. SPIE, 2012

    2012

  9. [17]

    Gendexgrasp: Generalizable dexterous grasping

    Puhao Li, Tengyu Liu, Yuyang Li, Yixin Zhu, Yaodong Yang, and Siyuan Huang. Gendexgrasp: Generalizable dexterous grasping. arXiv preprint arXiv:2210.00722 , 2022

    2022 arXiv

  10. [18]

    Pointnetgpd: Detecting grasp configurations from point sets

    Hongzhuo Liang, Xiaojian Ma, Shuang Li, Michael G \"o rner, Song Tang, Bin Fang, Fuchun Sun, and Jianwei Zhang. Pointnetgpd: Detecting grasp configurations from point sets. In 2019 International Conference on Robotics and Automation (ICRA) , pages 3629--3635. IEEE, 2019

    2019

  11. [19]

    Manipulation planning from demonstration via goal-conditioned prior action primitive decomposition and alignment

    Nan Lin, Yuxuan Li, Keke Tang, Yujun Zhu, Xiayu Zhang, Ruolin Wang, Jianmin Ji, Xiaoping Chen, and Xinming Zhang. Manipulation planning from demonstration via goal-conditioned prior action primitive decomposition and alignment. IEEE Robotics and Automation Letters , 7(2):1387-...

    2022

  12. [20]

    Dex-net 2.0: Deep learning to plan robust grasps with synthetic point clouds and analytic grasp metrics

    Jeffrey Mahler, Jacky Liang, Sherdil Niyaz, Michael Laskey, Richard Doan, Xinyu Liu, Juan Aparicio, and Ken Goldberg. Dex-net 2.0: Deep learning to plan robust grasps with synthetic point clouds and analytic grasp metrics. In Proceedings of Robotics: Science and Systems , Camb...

    2017

  13. [21]

    Dex-net 3.0: Computing robust vacuum suction grasp targets in point clouds using a new analytic model and deep learning

    Jeffrey Mahler, Matthew Matl, Xinyu Liu, Albert Li, David Gealy, and Ken Goldberg. Dex-net 3.0: Computing robust vacuum suction grasp targets in point clouds using a new analytic model and deep learning. In 2018 IEEE International Conference on robotics and automation (ICRA) ,...

    2018

  14. [22]

    Robot Hands and the Mechanics of Manipulation

    Matthew T Mason, Joey K Parker, and J Kenneth Salisbury. Robot Hands and the Mechanics of Manipulation . The American Society of Mechanical Engineers (ASME), 1989

    1989

  15. [23]

    Benchmarking grasping and manipulation: Properties of the objects of daily living

    Kayla Matheus and Aaron M Dollar. Benchmarking grasping and manipulation: Properties of the objects of daily living. In IROS , pages 5020--5027, 2010

    2010

  16. [24]

    Tros: Protecting humanoids ros from privileged attackers

    Giovanni Mazzeo and Mariacarla Staffa. Tros: Protecting humanoids ros from privileged attackers. International Journal of Social Robotics , 12(3):827--841, 2020

    2020

  17. [25]

    Dynamic projection of human motion for safe and efficient human-robot collaboration

    Xuming Meng and Roman Weitschat. Dynamic projection of human motion for safe and efficient human-robot collaboration. In 2021 IEEE International Conference on Robotics and Automation (ICRA) , pages 3765--3771, 2021

    2021

  18. [26]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In CVPR , pages 2574--2582, 2016

    2016

  19. [27]

    Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp

    John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System D...

    2020

  20. [28]

    Springer handbook of robotics , volume 200

    Bruno Siciliano, Oussama Khatib, and Torsten Kr \"o ger. Springer handbook of robotics , volume 200. Springer, 2008

    2008

  21. [29]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR , 2014

    2014

  22. [30]

    Rethinking perturbation directions for imperceptible adversarial attacks on point clouds

    Keke Tang, Yawen Shi, Tianrui Lou, Weilong Peng, Xu He, Peican Zhu, Zhaoquan Gu, and Zhihong Tian. Rethinking perturbation directions for imperceptible adversarial attacks on point clouds. IEEE Internet of Things Journal , 10(6):5158--5169, 2022

    2022

  23. [31]

    Deep manifold attack on point clouds via parameter plane stretching

    Keke Tang, Jianpeng Wu, Weilong Peng, Yawen Shi, Peng Song, Zhaoquan Gu, Zhihong Tian, and Wenping Wang. Deep manifold attack on point clouds via parameter plane stretching. In AAAI , volume 37, pages 2420--2428, 2023

    2023

  24. [32]

    Manifold constraints for imperceptible adversarial attacks on point clouds

    Keke Tang, Xu He, Weilong Peng, Jianpeng Wu, Yawen Shi, Daizong Liu, Pan Zhou, Wenping Wang, and Zhihong Tian. Manifold constraints for imperceptible adversarial attacks on point clouds. In AAAI , volume 38, pages 5127--5135, 2024

    2024

  25. [33]

    Flat: Flux-aware imperceptible adversarial attacks on 3d point clouds

    Keke Tang, Lujie Huang, Weilong Peng, Daizong Liu, Xiaofei Wang, Yang Ma, Ligang Liu, and Zhihong Tian. Flat: Flux-aware imperceptible adversarial attacks on 3d point clouds. In ECCV , pages 198--215, 2024

    2024

  26. [34]

    Effective single-step adversarial training with energy-based models

    Keke Tang, Tianrui Lou, Weilong Peng, Nenglun Chen, Yawen Shi, and Wenping Wang. Effective single-step adversarial training with energy-based models. IEEE Transactions on Emerging Topics in Computational Intelligence , 2024

    2024

  27. [35]

    Symattack: Symmetry-aware imperceptible adversarial attacks on 3d point clouds

    Keke Tang, Zhensu Wang, Weilong Peng, Lujie Huang, Le Wang, Peican Zhu, Wenping Wang, and Zhihong Tian. Symattack: Symmetry-aware imperceptible adversarial attacks on 3d point clouds. In MM , pages 3131--3140, 2024

    2024

  28. [36]

    Imperceptible 3d point cloud attacks on lattice-based barycentric coordinates

    Keke Tang, Ziyong Du, Weilong Peng, Xiaofei Wang, Daizong Liu, Ligang Liu, and Zhihong Tian. Imperceptible 3d point cloud attacks on lattice-based barycentric coordinates. In AAAI , volume 39, pages 20814--20822, 2025

    2025

  29. [37]

    Imperceptible adversarial attacks on point clouds guided by point-to-surface field

    Keke Tang, Weiyao Ke, Weilong Peng, Xiaofei Wang, Ziyong Du, Zhize Wu, Peizan Zhu, and Zhihong Tian. Imperceptible adversarial attacks on point clouds guided by point-to-surface field. In ICASSP , pages 1--5, 2025

    2025

  30. [38]

    Adversarial grasp objects

    David Wang, David Tseng, Pusong Li, Yiding Jiang, Menglong Guo, Michael Danielczuk, Jeffrey Mahler, Jeffrey Ichnowski, and Ken Goldberg. Adversarial grasp objects. In 2019 IEEE 15th International Conference on Automation Science and Engineering (CASE) , pages 241--248. IEEE, 2019

    2019

  31. [39]

    Eia: Edge-aware imperceptible adversarial attacks on 3d point clouds

    Zhensu Wang, Weilong Peng, Le Wang, Zhizhe Wu, Peican Zhu, and Keke Tang. Eia: Edge-aware imperceptible adversarial attacks on 3d point clouds. In MMM , pages 348--361, 2025

    2025

  32. [40]

    Qi, and Bo Li

    Chong Xiang, Charles R. Qi, and Bo Li. Generating 3d adversarial point clouds. In CVPR , pages 9136--9144, 2019

    2019

  33. [41]

    Robotics cyber security: Vulnerabilities, attacks, countermeasures, and recommendations

    Jean-Paul A Yaacoub, Hassan N Noura, Ola Salman, and Ali Chehab. Robotics cyber security: Vulnerabilities, attacks, countermeasures, and recommendations. International Journal of Information Security , 21(1):115--158, 2022

    2022

  34. [42]

    Black-box adversarial attacks on commercial speech platforms with minimal information

    Baolin Zheng, Peipei Jiang, Qian Wang, Qi Li, Chao Shen, Cong Wang, Yunjie Ge, Qingyang Teng, and Shenyi Zhang. Black-box adversarial attacks on commercial speech platforms with minimal information. In Proceedings of the 2021 ACM SIGSAC conference on computer and communication...

    2021

  35. [43]

    write newline

    " write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence '...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.