/Physical-Adversarial-Attacks-Survey

Physical-Adversarial-Attacks-Survey

Image Recognition

Year-Venue Title Source|code Adversarial Knowledge Robust
Technique		 Threat
Model		 Remark Adversarial
Specificity		 Physical Test Type Space
2017-ICLR 【I-FGSM】Adversarial examples in the physical world paper|code White-box Classification - Pixel-wise Targeted
Nontargeted		 Static 2D
2018-ICML 【EOT】Synthesizing robust adversarial examples paper|code White-box Classification EOT Pixel-wise Targeted Static 2D
2019-AAAI 【D2P】Connecting the digital and physical world: Improving the robustness of adversarial attacks paper|code White-box Classification EOT, D2P Pixel-wise Targeted Static 2D
2020-NeurIPS 【ABBA】Watch out! motion is blluurrrri inngg the vision of your deep neural networks paper|code White-box Classification EOT Pixel-wise Nontargeted Static 2D
2021-ICCV 【MetaAttack】Meta-Attack: Class-agnostic and Model-agnostic Physical Adversarial Attack paper|code White-box Classification - Pixel-wise Targeted Static 2D
2021-CVPR 【ISPAttack】Adversarial imaging pipelines paper|code White-box Classification EOT Pixel-wise Targeted
Nontargeted		 Static 2D
2017-NeurIPS 【AdvPatch】Adversarial patch paper|code White-box Classification EOT Patch Targeted Static 2D
2020-ECCV 【ACOsAttack】Bias-based universal adversarial patch attack for automatic check-out paper|code White-box Classification EOT Patch Nontargeted Static 2D
2021-TIP 【ACOsAttack2】Universal adversarial patch attack for automatic checkout using perceptual and attentional bias paper|code White-box Classification - Patch Nontargeted Static 2D
2022-TIFS 【TnTAttack】TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systems paper|Project white-box Classification EOT,TV Patch Targeted
Nontargeted		 Static 2D
2022-NeurIPS 【Copy/PasteAttack】Robust feature-level adversaries are interpretability tools paper|code white-box Classification - Patch Targeted Static 2D
2020-NeurIPS 【ViewFool】ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpoints paper|code white-box Classification EOT Position Nontargeted Static 3D
2018-AAAI-S 【LightAttack】Projecting trouble: Light based adversarial attacks on deep learning classifiers paper|code Black-box Classification - Optical Targeted
Nontargeted		 Static 2D
2019-S&P 【ProjectorAttack】Poster: Perceived adversarial examples paper|code white-box Classification EOT Optical Targeted Static 2D
2021-CVPR 【OPAD】Optical adversarial attack paper|code white-box Classification Optical Targeted
Nontargeted		 Static 2D
2021-CVPR 【LEDAttack】Invisible perturbations: Physical adversarial examples exploiting the rolling shutter effect paper|code white-box Classification EOT Optical Targeted
Nontargeted		 Static 2D
2021-CVPR 【AdvLB】Adversarial laser beam: Effective physical-world attack to dnns in a blink paper|code Black-box Classification - Optical Nontargeted Static 2D
2021-arXiv 【SLMAttack】Light Lies: Optical Adversarial Attack paper|code white-box Classification - Optical Nontargeted Static 2D
2022-VR 【SPAA】SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers paper|code white-box Classification D2P Optical Targeted
Nontargeted		 Static 3D
2022-CVPR 【ShadowAttack】Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon paper|code Black-box Classification EOT Optical Nontargeted Static 2D
2019-ICCV 【AdvPattern】advPattern: physical-world attacks on deep person re-identification via adversarially transformable patterns paper|code White-box ReID EOT,TV Patch Targeted
Nontargeted		 Static 2D
2016-CCS 【AdvEyeglass】Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition paper|code White-box Face Recognition TV,NPS Eyeglasses Targeted
Nontargeted		 Static 2D
2019-TOPS 【AdvEyeglass2】A general framework for adversarial examples with objectives paper|code White-box Face Recognition Color Alignment Eyeglasses Targeted
Nontargeted		 Static 2D
2021-BIOSIG 【CLBAAttack】On brightness agnostic adversarial examples against face recognition systems paper|code White-box Face Recognition EOT Eyeglasses Targeted
Nontargeted		 Static 2D
2020-CVIU 【ReplayAttack】Adversarial examples for replay attacks against CNN-based face recognition with anti-spoofing capability paper|code White-box Face Recognition EOT, Position Alignment Patch Targeted
Nontargeted		 Static 2D
2019-SIBIRCON 【ArcFaceAttack】On adversarial patches: real-world attack on arcface-100 face recognition system paper|code White-box Face Recognition TV Sticker Targeted
Nontargeted		 Static 2D
2020-ICPR 【AdvHat】Advhat: Real-world adversarial attack on arcface face id system paper|code White-box Face Recognition TV, Bending Sticker Nontargeted Static 2D
2021-CVPR 【TAP】Improving transferability of adversarial patches on face recognition with generative models paper|code White-box Face Recognition EOT Sticker Targeted
Nontargeted		 Static 2D
2022-TPAMI 【AdvSticker】Adversarial Sticker: A Stealthy Attack Method in the Physical World paper|[code](https://github.com/jinyugy21/Adv-Stickers RHDE) Black-box Face Recognition Bending Sticker Targeted
Nontargeted		 Static 3D
2022-TPAMI 【SOPP】Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks paper|code Black-box Face Recognition - Sticker Targeted
Nontargeted		 Static 2D
2022-ECMLPKDD 【AdvMask】Adversarial Mask: Real-World Adversarial Attack Against Face Recognition Models paper|code White-box Face Recognition Rendering Mask Targeted
Nontargeted		 Static 3D
2020-CVPR-W 【LPA】Adversarial light projection attacks on face recognition systems: A feasibility study paper|code White-box Face Recognition Position/Color Alignment Optical Targeted
Nontargeted		 Static 2D
2018-CVPR 【RP2】Robust physical-world attacks on deep learning visual classification paper|code White-box Traffic Sign Recognition D2P Patch Targeted
Nontargeted		 Static 2D
2018-arXiv 【RogueSigns】Rogue signs: Deceiving traffic sign recognition with malicious ads and logos paper|code White-box Traffic Sign Recognition EOT Pixel-wise Targeted Dynamic 2D
2019-AAAI 【PS_GAN】Perceptual-sensitive gan for generating adversarial patches paper|code White-box Traffic Sign Recognition - Patch Nontargeted Static 2D
2020-CVPR 【AdvCam】Adversarial camouflage: Hiding physical-world attacks with natural styles paper|code White-box Traffic Sign Recognition EOT Pixel-wise Targeted
Nontargeted		 Static 2D
2020-CVPR 【PhysGAN】Physgan: Generating physical-world-resilient adversarial examples for autonomous driving paper|code White-box Steering Model D2P Pixel-wise Nontargeted Dynamic 2D
2020-Computers
& Security		 【LPRAttack】Spot evasion attacks: Adversarial examples for license plate recognition systems with convolutional neural networks paper|code Black-box License Plate Recognition - Patch Targeted Static 2D

Object Detection

Year-Venue Title Source|code Adversarial Knowledge Robust
Technique		 Threat
Model		 Remark Victim Model Adversarial Specificity Physical Test Type Space
2018-ECMLPKDD 【ShapeShifter】Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector paper|code White-box EOT Object Detection Pixel-wise Faster RCNN Targeted
Nontargeted		 Dynamic 2D
2018-USENIX-W 【RP2+】Physical adversarial examples for object detectors paper|code White-box TV,NPS, D2P Object Detection Patch YOLOv2, Faster RCNN Targeted
Nontargeted		 Static 2D
2019-CVPR-W 【AdvPatch】Fooling automated surveillance cameras: adversarial patches to attack person detection paper|code White-box EOT,TV,NPS Object Detection Patch YOLOv2 Nontargeted Dynamic 2D
2019-CCS 【NestedAE】Seeing isn't believing: Towards more robust adversarial attack against real world object detectors paper|code White-box D2P, Physical Alignment Object Detection Patch YOLOv3, Faster RCNN Targeted
Nontargeted		 Dynamic 3D
2019-arXiv 【DPatch2】On physical adversarial patches for object detection paper|code White-box EOT Object Detection Patch YOLOv3 Targeted
Nontargeted		 Static 2D
2020-AAAI 【LPAttack】Beyond digital domain: Fooling deep learning based recognition system in physical world paper|code White-box EOT Object Detection Pixel-wise SSD Targeted Static 2D
2021-CVPR 【TranslucentPatch】The translucent patch: A physical and universal attack on object detectors paper|code White-box Affine, NPS Object Detection Patch YOLOv5 Targeted
Nontargeted		 Static 2D
2020-arXiv 【ScreenAttack】Dynamic adversarial patch for evading object detection models paper|code White-box TV Object Detection Patch YOLOv2 Targeted Static 2D
2022-arXiv 【Switch Patch】Attacking Object Detector Using A Universal Targeted Label-Switch Patch paper|code White-box TV Object Detection Patch YOLO, Faster RCNN Targeted Static 2D
2018-UEMCON 【Invisible Cloak1】Building Towards" Invisible Cloak": Robust Physical Adversarial Attack on YOLO Object Detector paper|code White-box EOT,TV Object Detection Wearable Patch YOLO Nontargeted Static 3D
2020-ECCV 【Adversarial T-Shirt】Adversarial t-shirt! evading person detectors in a physical world paper|code White-box EOT,TPS Object Detection Wearable Patch YOLOv2,Faster RCNN Targeted Static 2D
2020-ECCV 【Invisible Cloak2】Making an invisibility cloak: Real world adversarial attacks on object detectors paper|code White-box TPS Object Detection Wearable Patch YOLOv2/3, Faster RCNN Nontargeted Static 2D
2021-MM 【LAP】Legitimate Adversarial Patches: Evading Human Eyes and Detection Models in the Physical World paper|code White-box TV,NPS Object Detection Wearable Patch YOLOv2 Nontargeted Static 2D
2021-ICCV 【NaturalisticPatch】Naturalistic physical adversarial patch for object detectors paper|code White-box TV Object Detection Wearable Patch YOLO,Faster RCNN Nontargeted Static 2D
2022-CVPR 【AdvTexture】Adversarial Texture for Fooling Person Detectors in the Physical World paper|code White-box EOT,TPS Object Detection Wearable Patch YOLO,Faster/Mask RCNN Nontargeted Static 2D
2021-USENIX Security 【SLAP】SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations paper|code White-box EOT,TV Object Detection Optical YOLOv3,Mask RCNN Nontargeted Static 2D
2019-CVPR 【MeshAdv】Meshadv: Adversarial meshes for visual recognition paper|code White-box - Object Detection Shape YOLOv3 Nontargeted Static 3D
2019-ICLR 【CAMOU】CAMOU: Learning A Vehicle Camouflage For Physical Adversarial Attack On Object Detections In The Wild paper|code White-box EOT Object Detection Camouflage YOLOv3,Mask RCNN Nontargeted Static 2D
2020-arXiv 【ER】Physical adversarial attack on vehicle detector in the carla simulator paper|code Black-box - Object Detection Camouflage Light-Head RCNN Nontargeted Static 3D
2020-CVPR 【UPC】Universal physical camouflage attacks on object detectors paper|code White-box EOT Object Detection Camouflage Faster RCNN Targeted
Nontargeted		 Static 3D
2021-CVPR 【DAS】Dual attention suppression attack: Generate adversarial camouflage in physical world paper|code White-box TV Object Detection Camouflage YOLOV4 Nontargeted Static 3D
2022-AAAI 【FCA】Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack paper|code White-box TV Object Detection Camouflage YOLOV3 Nontargeted Static 3D
2022-IJCAI 【CAC】Learning Coated Adversarial Camouflages for Object Detectors paper|code White-box EOT Object Detection Camouflage Faster RCNN Targeted Static 3D
2022-CVPR 【DPA】DTA: Physical Camouflage Attacks using Differentiable Transformation Network paper|code White-box EOT Object Detection Camouflage YOLOv4,EffDetD0 Nontargeted Static 3D
2021-AAAI 【BulbAttack】Fooling thermal infrared pedestrian detectors in real world using small bulbs paper|code White-box EOT,TV Infrared Object Detection Optical YOLOv3 Nontargeted Static 2D
2022-CVPR 【QRAttack】Infrared Invisible Clothing: Hiding from Infrared Detectors at Multiple Angles in Real World paper|code White-box EOT Infrared Object Detection Patch YOLOv3 Nontargeted Static 2D
2022-WACV 【AerialAttack】Physical adversarial attacks on an aerial imagery object detector paper|code White-box EOT,TV,NPS Object detection in Aerial Images Patch YOLOv3 Targeted Dynamic 2D
2022-WACV 【RWAE】Evaluating the robustness of semantic segmentation for autonomous driving against real-world adversarial patch attacks paper|code White-box EOT Semantic Segmentation Patch DDRNet, BiSeNet, ICNet Nontargeted Static 2D
2022-ECCV 【MDEAttack】Physical attack on monocular depth estimation with optimal adversarial patches paper|code White-box EOT Monocular Depth Estimation Patch Monodepth2, Depthhints, Manydepth Nontargeted Static 2D
2019-ICCV 【PATAttack】Physical adversarial textures that fool visual object tracking paper|code White-box EOT Object Tracking Patch GOTURN Targeted
Nontargeted		 Dynamic 2D
2021-AAAI 【MTD】Towards Universal Physical Attacks on Single Object Tracking paper|code White-box EOT,TV Object Tracking Patch SiamMask and SiamRPN++ Targeted Dynamic 2D