Year-Venue | Title | Source|code | Adversarial Knowledge | Robust Technique |
Threat Model |
Remark | Adversarial Specificity |
Physical Test Type | Space |
---|---|---|---|---|---|---|---|---|---|
2017-ICLR | 【I-FGSM】Adversarial examples in the physical world | paper|code | White-box | Classification | - | Pixel-wise | Targeted Nontargeted |
Static | 2D |
2018-ICML | 【EOT】Synthesizing robust adversarial examples | paper|code | White-box | Classification | EOT | Pixel-wise | Targeted | Static | 2D |
2019-AAAI | 【D2P】Connecting the digital and physical world: Improving the robustness of adversarial attacks | paper|code | White-box | Classification | EOT, D2P | Pixel-wise | Targeted | Static | 2D |
2020-NeurIPS | 【ABBA】Watch out! motion is blluurrrri inngg the vision of your deep neural networks | paper|code | White-box | Classification | EOT | Pixel-wise | Nontargeted | Static | 2D |
2021-ICCV | 【MetaAttack】Meta-Attack: Class-agnostic and Model-agnostic Physical Adversarial Attack | paper|code | White-box | Classification | - | Pixel-wise | Targeted | Static | 2D |
2021-CVPR | 【ISPAttack】Adversarial imaging pipelines | paper|code | White-box | Classification | EOT | Pixel-wise | Targeted Nontargeted |
Static | 2D |
2017-NeurIPS | 【AdvPatch】Adversarial patch | paper|code | White-box | Classification | EOT | Patch | Targeted | Static | 2D |
2020-ECCV | 【ACOsAttack】Bias-based universal adversarial patch attack for automatic check-out | paper|code | White-box | Classification | EOT | Patch | Nontargeted | Static | 2D |
2021-TIP | 【ACOsAttack2】Universal adversarial patch attack for automatic checkout using perceptual and attentional bias | paper|code | White-box | Classification | - | Patch | Nontargeted | Static | 2D |
2022-TIFS | 【TnTAttack】TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systems | paper|Project | white-box | Classification | EOT,TV | Patch | Targeted Nontargeted |
Static | 2D |
2022-NeurIPS | 【Copy/PasteAttack】Robust feature-level adversaries are interpretability tools | paper|code | white-box | Classification | - | Patch | Targeted | Static | 2D |
2020-NeurIPS | 【ViewFool】ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpoints | paper|code | white-box | Classification | EOT | Position | Nontargeted | Static | 3D |
2018-AAAI-S | 【LightAttack】Projecting trouble: Light based adversarial attacks on deep learning classifiers | paper|code | Black-box | Classification | - | Optical | Targeted Nontargeted |
Static | 2D |
2019-S&P | 【ProjectorAttack】Poster: Perceived adversarial examples | paper|code | white-box | Classification | EOT | Optical | Targeted | Static | 2D |
2021-CVPR | 【OPAD】Optical adversarial attack | paper|code | white-box | Classification | Optical | Targeted Nontargeted |
Static | 2D | |
2021-CVPR | 【LEDAttack】Invisible perturbations: Physical adversarial examples exploiting the rolling shutter effect | paper|code | white-box | Classification | EOT | Optical | Targeted Nontargeted |
Static | 2D |
2021-CVPR | 【AdvLB】Adversarial laser beam: Effective physical-world attack to dnns in a blink | paper|code | Black-box | Classification | - | Optical | Nontargeted | Static | 2D |
2021-arXiv | 【SLMAttack】Light Lies: Optical Adversarial Attack | paper|code | white-box | Classification | - | Optical | Nontargeted | Static | 2D |
2022-VR | 【SPAA】SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers | paper|code | white-box | Classification | D2P | Optical | Targeted Nontargeted |
Static | 3D |
2022-CVPR | 【ShadowAttack】Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon | paper|code | Black-box | Classification | EOT | Optical | Nontargeted | Static | 2D |
2019-ICCV | 【AdvPattern】advPattern: physical-world attacks on deep person re-identification via adversarially transformable patterns | paper|code | White-box | ReID | EOT,TV | Patch | Targeted Nontargeted |
Static | 2D |
2016-CCS | 【AdvEyeglass】Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition | paper|code | White-box | Face Recognition | TV,NPS | Eyeglasses | Targeted Nontargeted |
Static | 2D |
2019-TOPS | 【AdvEyeglass2】A general framework for adversarial examples with objectives | paper|code | White-box | Face Recognition | Color Alignment | Eyeglasses | Targeted Nontargeted |
Static | 2D |
2021-BIOSIG | 【CLBAAttack】On brightness agnostic adversarial examples against face recognition systems | paper|code | White-box | Face Recognition | EOT | Eyeglasses | Targeted Nontargeted |
Static | 2D |
2020-CVIU | 【ReplayAttack】Adversarial examples for replay attacks against CNN-based face recognition with anti-spoofing capability | paper|code | White-box | Face Recognition | EOT, Position Alignment | Patch | Targeted Nontargeted |
Static | 2D |
2019-SIBIRCON | 【ArcFaceAttack】On adversarial patches: real-world attack on arcface-100 face recognition system | paper|code | White-box | Face Recognition | TV | Sticker | Targeted Nontargeted |
Static | 2D |
2020-ICPR | 【AdvHat】Advhat: Real-world adversarial attack on arcface face id system | paper|code | White-box | Face Recognition | TV, Bending | Sticker | Nontargeted | Static | 2D |
2021-CVPR | 【TAP】Improving transferability of adversarial patches on face recognition with generative models | paper|code | White-box | Face Recognition | EOT | Sticker | Targeted Nontargeted |
Static | 2D |
2022-TPAMI | 【AdvSticker】Adversarial Sticker: A Stealthy Attack Method in the Physical World | paper|[code](https://github.com/jinyugy21/Adv-Stickers RHDE) | Black-box | Face Recognition | Bending | Sticker | Targeted Nontargeted |
Static | 3D |
2022-TPAMI | 【SOPP】Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks | paper|code | Black-box | Face Recognition | - | Sticker | Targeted Nontargeted |
Static | 2D |
2022-ECMLPKDD | 【AdvMask】Adversarial Mask: Real-World Adversarial Attack Against Face Recognition Models | paper|code | White-box | Face Recognition | Rendering | Mask | Targeted Nontargeted |
Static | 3D |
2020-CVPR-W | 【LPA】Adversarial light projection attacks on face recognition systems: A feasibility study | paper|code | White-box | Face Recognition | Position/Color Alignment | Optical | Targeted Nontargeted |
Static | 2D |
2018-CVPR | 【RP2】Robust physical-world attacks on deep learning visual classification | paper|code | White-box | Traffic Sign Recognition | D2P | Patch | Targeted Nontargeted |
Static | 2D |
2018-arXiv | 【RogueSigns】Rogue signs: Deceiving traffic sign recognition with malicious ads and logos | paper|code | White-box | Traffic Sign Recognition | EOT | Pixel-wise | Targeted | Dynamic | 2D |
2019-AAAI | 【PS_GAN】Perceptual-sensitive gan for generating adversarial patches | paper|code | White-box | Traffic Sign Recognition | - | Patch | Nontargeted | Static | 2D |
2020-CVPR | 【AdvCam】Adversarial camouflage: Hiding physical-world attacks with natural styles | paper|code | White-box | Traffic Sign Recognition | EOT | Pixel-wise | Targeted Nontargeted |
Static | 2D |
2020-CVPR | 【PhysGAN】Physgan: Generating physical-world-resilient adversarial examples for autonomous driving | paper|code | White-box | Steering Model | D2P | Pixel-wise | Nontargeted | Dynamic | 2D |
2020-Computers & Security |
【LPRAttack】Spot evasion attacks: Adversarial examples for license plate recognition systems with convolutional neural networks | paper|code | Black-box | License Plate Recognition | - | Patch | Targeted | Static | 2D |
Year-Venue | Title | Source|code | Adversarial Knowledge | Robust Technique |
Threat Model |
Remark | Victim Model | Adversarial Specificity | Physical Test Type | Space |
---|---|---|---|---|---|---|---|---|---|---|
2018-ECMLPKDD | 【ShapeShifter】Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector | paper|code | White-box | EOT | Object Detection | Pixel-wise | Faster RCNN | Targeted Nontargeted |
Dynamic | 2D |
2018-USENIX-W | 【RP2+】Physical adversarial examples for object detectors | paper|code | White-box | TV,NPS, D2P | Object Detection | Patch | YOLOv2, Faster RCNN | Targeted Nontargeted |
Static | 2D |
2019-CVPR-W | 【AdvPatch】Fooling automated surveillance cameras: adversarial patches to attack person detection | paper|code | White-box | EOT,TV,NPS | Object Detection | Patch | YOLOv2 | Nontargeted | Dynamic | 2D |
2019-CCS | 【NestedAE】Seeing isn't believing: Towards more robust adversarial attack against real world object detectors | paper|code | White-box | D2P, Physical Alignment | Object Detection | Patch | YOLOv3, Faster RCNN | Targeted Nontargeted |
Dynamic | 3D |
2019-arXiv | 【DPatch2】On physical adversarial patches for object detection | paper|code | White-box | EOT | Object Detection | Patch | YOLOv3 | Targeted Nontargeted |
Static | 2D |
2020-AAAI | 【LPAttack】Beyond digital domain: Fooling deep learning based recognition system in physical world | paper|code | White-box | EOT | Object Detection | Pixel-wise | SSD | Targeted | Static | 2D |
2021-CVPR | 【TranslucentPatch】The translucent patch: A physical and universal attack on object detectors | paper|code | White-box | Affine, NPS | Object Detection | Patch | YOLOv5 | Targeted Nontargeted |
Static | 2D |
2020-arXiv | 【ScreenAttack】Dynamic adversarial patch for evading object detection models | paper|code | White-box | TV | Object Detection | Patch | YOLOv2 | Targeted | Static | 2D |
2022-arXiv | 【Switch Patch】Attacking Object Detector Using A Universal Targeted Label-Switch Patch | paper|code | White-box | TV | Object Detection | Patch | YOLO, Faster RCNN | Targeted | Static | 2D |
2018-UEMCON | 【Invisible Cloak1】Building Towards" Invisible Cloak": Robust Physical Adversarial Attack on YOLO Object Detector | paper|code | White-box | EOT,TV | Object Detection | Wearable Patch | YOLO | Nontargeted | Static | 3D |
2020-ECCV | 【Adversarial T-Shirt】Adversarial t-shirt! evading person detectors in a physical world | paper|code | White-box | EOT,TPS | Object Detection | Wearable Patch | YOLOv2,Faster RCNN | Targeted | Static | 2D |
2020-ECCV | 【Invisible Cloak2】Making an invisibility cloak: Real world adversarial attacks on object detectors | paper|code | White-box | TPS | Object Detection | Wearable Patch | YOLOv2/3, Faster RCNN | Nontargeted | Static | 2D |
2021-MM | 【LAP】Legitimate Adversarial Patches: Evading Human Eyes and Detection Models in the Physical World | paper|code | White-box | TV,NPS | Object Detection | Wearable Patch | YOLOv2 | Nontargeted | Static | 2D |
2021-ICCV | 【NaturalisticPatch】Naturalistic physical adversarial patch for object detectors | paper|code | White-box | TV | Object Detection | Wearable Patch | YOLO,Faster RCNN | Nontargeted | Static | 2D |
2022-CVPR | 【AdvTexture】Adversarial Texture for Fooling Person Detectors in the Physical World | paper|code | White-box | EOT,TPS | Object Detection | Wearable Patch | YOLO,Faster/Mask RCNN | Nontargeted | Static | 2D |
2021-USENIX Security | 【SLAP】SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations | paper|code | White-box | EOT,TV | Object Detection | Optical | YOLOv3,Mask RCNN | Nontargeted | Static | 2D |
2019-CVPR | 【MeshAdv】Meshadv: Adversarial meshes for visual recognition | paper|code | White-box | - | Object Detection | Shape | YOLOv3 | Nontargeted | Static | 3D |
2019-ICLR | 【CAMOU】CAMOU: Learning A Vehicle Camouflage For Physical Adversarial Attack On Object Detections In The Wild | paper|code | White-box | EOT | Object Detection | Camouflage | YOLOv3,Mask RCNN | Nontargeted | Static | 2D |
2020-arXiv | 【ER】Physical adversarial attack on vehicle detector in the carla simulator | paper|code | Black-box | - | Object Detection | Camouflage | Light-Head RCNN | Nontargeted | Static | 3D |
2020-CVPR | 【UPC】Universal physical camouflage attacks on object detectors | paper|code | White-box | EOT | Object Detection | Camouflage | Faster RCNN | Targeted Nontargeted |
Static | 3D |
2021-CVPR | 【DAS】Dual attention suppression attack: Generate adversarial camouflage in physical world | paper|code | White-box | TV | Object Detection | Camouflage | YOLOV4 | Nontargeted | Static | 3D |
2022-AAAI | 【FCA】Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack | paper|code | White-box | TV | Object Detection | Camouflage | YOLOV3 | Nontargeted | Static | 3D |
2022-IJCAI | 【CAC】Learning Coated Adversarial Camouflages for Object Detectors | paper|code | White-box | EOT | Object Detection | Camouflage | Faster RCNN | Targeted | Static | 3D |
2022-CVPR | 【DPA】DTA: Physical Camouflage Attacks using Differentiable Transformation Network | paper|code | White-box | EOT | Object Detection | Camouflage | YOLOv4,EffDetD0 | Nontargeted | Static | 3D |
2021-AAAI | 【BulbAttack】Fooling thermal infrared pedestrian detectors in real world using small bulbs | paper|code | White-box | EOT,TV | Infrared Object Detection | Optical | YOLOv3 | Nontargeted | Static | 2D |
2022-CVPR | 【QRAttack】Infrared Invisible Clothing: Hiding from Infrared Detectors at Multiple Angles in Real World | paper|code | White-box | EOT | Infrared Object Detection | Patch | YOLOv3 | Nontargeted | Static | 2D |
2022-WACV | 【AerialAttack】Physical adversarial attacks on an aerial imagery object detector | paper|code | White-box | EOT,TV,NPS | Object detection in Aerial Images | Patch | YOLOv3 | Targeted | Dynamic | 2D |
2022-WACV | 【RWAE】Evaluating the robustness of semantic segmentation for autonomous driving against real-world adversarial patch attacks | paper|code | White-box | EOT | Semantic Segmentation | Patch | DDRNet, BiSeNet, ICNet | Nontargeted | Static | 2D |
2022-ECCV | 【MDEAttack】Physical attack on monocular depth estimation with optimal adversarial patches | paper|code | White-box | EOT | Monocular Depth Estimation | Patch | Monodepth2, Depthhints, Manydepth | Nontargeted | Static | 2D |
2019-ICCV | 【PATAttack】Physical adversarial textures that fool visual object tracking | paper|code | White-box | EOT | Object Tracking | Patch | GOTURN | Targeted Nontargeted |
Dynamic | 2D |
2021-AAAI | 【MTD】Towards Universal Physical Attacks on Single Object Tracking | paper|code | White-box | EOT,TV | Object Tracking | Patch | SiamMask and SiamRPN++ | Targeted | Dynamic | 2D |