{"total":517,"rows":[{"id":"2402.04249","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","created":"2024-02-06","cited_by_count":1429,"area":"safety"},{"id":"2105.10497","title":"Intriguing Properties of Vision Transformers","created":"2021-05-21","cited_by_count":446,"area":null},{"id":"2306.04528","title":"PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts","created":"2023-06-07","cited_by_count":226,"area":"safety"},{"id":"2310.11868","title":"To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now","created":"2023-10-18","cited_by_count":210,"area":"diffusion"},{"id":"2309.00236","title":"Image Hijacks: Adversarial Images can Control Generative Models at Runtime","created":"2023-09-01","cited_by_count":172,"area":null},{"id":"2302.06588","title":"Raising the Cost of Malicious AI-Powered Image Editing","created":"2023-02-13","cited_by_count":163,"area":"diffusion"},{"id":"2402.08567","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","created":"2024-02-13","cited_by_count":153,"area":"mllm"},{"id":"2101.06549","title":"AdvSim: Generating Safety-Critical Scenarios for Self-Driving Vehicles","created":"2021-01-16","cited_by_count":137,"area":null},{"id":"2103.01050","title":"Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World","created":"2021-03-01","cited_by_count":127,"area":null},{"id":"2108.00401","title":"Advances in adversarial attacks and defenses in computer vision: A survey","created":"2021-08-01","cited_by_count":127,"area":null},{"id":"2308.07026","title":"AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learning","created":"2023-08-14","cited_by_count":103,"area":null},{"id":"2106.09249","title":"Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks","created":"2021-06-17","cited_by_count":101,"area":"driving"},{"id":"2105.03162","title":"Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition","created":"2021-05-07","cited_by_count":97,"area":null},{"id":"2203.03373","title":"Adversarial Texture for Fooling Person Detectors in the Physical World","created":"2022-03-07","cited_by_count":96,"area":null},{"id":"2104.06728","title":"Adversarial Sticker: A Stealthy Attack Method in the Physical World","created":"2021-04-14","cited_by_count":93,"area":null},{"id":"2106.15058","title":"Improving Transferability of Adversarial Patches on Face Recognition with Generative Models","created":"2021-06-29","cited_by_count":80,"area":null},{"id":"2103.06504","title":"Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink","created":"2021-03-11","cited_by_count":75,"area":null},{"id":"2109.07193","title":"FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attack","created":"2021-09-15","cited_by_count":74,"area":null},{"id":"2411.13587","title":"Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics","created":"2024-11-18","cited_by_count":73,"area":"vla"},{"id":"2112.04532","title":"Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection","created":"2021-12-08","cited_by_count":67,"area":null},{"id":"2209.15179","title":"Physical Adversarial Attack meets Computer Vision: A Decade Survey","created":"2022-09-30","cited_by_count":67,"area":null},{"id":"2305.16494","title":"Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability","created":"2023-05-25","cited_by_count":66,"area":null},{"id":"2108.09135","title":"PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier","created":"2021-08-20","cited_by_count":65,"area":null},{"id":"2302.09491","title":"X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection","created":"2023-02-19","cited_by_count":59,"area":null},{"id":"2207.04718","title":"Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches","created":"2022-07-11","cited_by_count":57,"area":null},{"id":"2103.00218","title":"Countering Malicious DeepFakes: Survey, Battleground, and Horizon","created":"2021-02-27","cited_by_count":56,"area":null},{"id":"2108.06179","title":"Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks","created":"2021-08-13","cited_by_count":55,"area":null},{"id":"2203.08392","title":"Patch-Fool: Are Vision Transformers Always Robust Against Adversarial Perturbations?","created":"2022-03-16","cited_by_count":49,"area":null},{"id":"2107.11630","title":"Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them","created":"2021-07-24","cited_by_count":48,"area":null},{"id":"2306.06123","title":"Adversarial attacks and defenses in explainable artificial intelligence: A survey","created":"2023-06-06","cited_by_count":48,"area":null},{"id":"2101.06784","title":"Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving","created":"2021-01-17","cited_by_count":45,"area":null},{"id":"2110.07719","title":"Certified Patch Robustness via Smoothed Vision Transformers","created":"2021-10-11","cited_by_count":45,"area":null},{"id":"2110.14189","title":"Robust Contrastive Learning Using Negative Samples with Diminished Semantics","created":"2021-10-27","cited_by_count":43,"area":null},{"id":"2210.05927","title":"Efficient Adversarial Training without Attacking: Worst-Case-Aware Robust Reinforcement Learning","created":"2022-10-12","cited_by_count":43,"area":null},{"id":"2212.12995","title":"Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks","created":"2022-12-26","cited_by_count":42,"area":null},{"id":"2304.06719","title":"RoboBEV: Towards Robust Bird's Eye View Perception under Corruptions","created":"2023-04-13","cited_by_count":42,"area":null},{"id":"2103.08951","title":"Generating Interpretable Counterfactual Explanations By Implicit Minimisation of Epistemic and Aleatoric Uncertainties","created":"2021-03-16","cited_by_count":41,"area":null},{"id":"2307.01778","title":"Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modeling","created":"2023-07-04","cited_by_count":41,"area":null},{"id":"2402.08577","title":"Test-Time Backdoor Attacks on Multimodal Large Language Models","created":"2024-02-13","cited_by_count":40,"area":"mllm"},{"id":"2109.07986","title":"Harnessing Perceptual Adversarial Patches for Crowd Counting","created":"2021-09-16","cited_by_count":39,"area":null},{"id":"2111.10659","title":"Are Vision Transformers Robust to Patch Perturbations?","created":"2021-11-20","cited_by_count":39,"area":null},{"id":"2203.14195","title":"How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspective","created":"2022-03-27","cited_by_count":39,"area":null},{"id":"2208.00780","title":"Visual correspondence-based explanations improve AI robustness and human-AI team accuracy","created":"2022-07-26","cited_by_count":39,"area":null},{"id":"2303.13868","title":"Physically Adversarial Infrared Patches with Learnable Shapes and Locations","created":"2023-03-24","cited_by_count":39,"area":null},{"id":"2112.07668","title":"Dual-Key Multimodal Backdoors for Visual Question Answering","created":"2021-12-14","cited_by_count":37,"area":"safety"},{"id":"2303.17297","title":"Understanding the Robustness of 3D Object Detection with Bird's-Eye-View Representations in Autonomous Driving","created":"2023-03-30","cited_by_count":37,"area":null},{"id":"2308.11894","title":"Does Physical Adversarial Example Really Matter to Autonomous Driving? Towards System-Level Effect of Adversarial Object Evasion Attack","created":"2023-08-23","cited_by_count":37,"area":null},{"id":"2111.09999","title":"TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systems","created":"2021-11-19","cited_by_count":36,"area":null},{"id":"2108.11765","title":"Physical Adversarial Attacks on an Aerial Imagery Object Detector","created":"2021-08-26","cited_by_count":35,"area":null},{"id":"2111.12965","title":"Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks","created":"2021-11-25","cited_by_count":34,"area":null},{"id":"2408.07362","title":"BadMerging: Backdoor Attacks Against Model Merging","created":"2024-08-14","cited_by_count":34,"area":null},{"id":"2502.13175","title":"Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks","created":"2025-02-18","cited_by_count":34,"area":null},{"id":"2307.12280","title":"Downstream-agnostic Adversarial Examples","created":"2023-07-23","cited_by_count":32,"area":null},{"id":"2403.17301","title":"Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving","created":"2024-03-26","cited_by_count":32,"area":null},{"id":"2404.16452","title":"PAD: Patch-Agnostic Defense against Adversarial Patch Attacks","created":"2024-04-25","cited_by_count":32,"area":null},{"id":"2106.03805","title":"3DB: A Framework for Debugging Computer Vision Models","created":"2021-06-07","cited_by_count":31,"area":null},{"id":"2306.07713","title":"Robustness of SAM: Segment Anything Under Corruptions and Beyond","created":"2023-06-13","cited_by_count":31,"area":null},{"id":"2308.07009","title":"ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Universal and Robust Vehicle Evasion","created":"2023-08-14","cited_by_count":31,"area":null},{"id":"2201.01850","title":"On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving","created":"2022-01-05","cited_by_count":30,"area":null},{"id":"2207.01795","title":"PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch","created":"2022-07-05","cited_by_count":30,"area":null},{"id":"2102.02956","title":"DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks","created":"2021-02-05","cited_by_count":29,"area":null},{"id":"2103.04302","title":"Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domain","created":"2021-03-07","cited_by_count":29,"area":null},{"id":"2103.10480","title":"Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neurons","created":"2021-03-18","cited_by_count":29,"area":null},{"id":"2104.12609","title":"PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches","created":"2021-04-26","cited_by_count":29,"area":null},{"id":"2403.04306","title":"Effectiveness Assessment of Recent Large Vision-Language Models","created":"2024-03-07","cited_by_count":29,"area":"mllm"},{"id":"2110.03605","title":"Robust Feature-Level Adversaries are Interpretability Tools","created":"2021-10-07","cited_by_count":27,"area":null},{"id":"2203.04412","title":"ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patches","created":"2022-03-07","cited_by_count":27,"area":null},{"id":"2212.05709","title":"HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Design","created":"2022-12-12","cited_by_count":27,"area":null},{"id":"2307.07859","title":"Unified Adversarial Patch for Cross-modal Attacks in the Physical World","created":"2023-07-15","cited_by_count":27,"area":null},{"id":"2405.10529","title":"Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors","created":"2024-05-17","cited_by_count":27,"area":"mllm"},{"id":"2104.12146","title":"3D Adversarial Attacks Beyond Point Cloud","created":"2021-04-25","cited_by_count":26,"area":null},{"id":"2106.04823","title":"Taxonomy of Machine Learning Safety: A Survey and Primer","created":"2021-06-09","cited_by_count":25,"area":null},{"id":"2209.14262","title":"A Survey on Physical Adversarial Attack in Computer Vision","created":"2022-09-28","cited_by_count":25,"area":null},{"id":"2102.04154","title":"Efficient Certified Defenses Against Patch Attacks on Image Classifiers","created":"2021-02-08","cited_by_count":24,"area":null},{"id":"2509.18953","title":"Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations","created":"2025-09-23","cited_by_count":24,"area":"vla"},{"id":"2410.23687","title":"Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey","created":"2024-10-31","cited_by_count":23,"area":"mllm"},{"id":"2202.01811","title":"ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Masking","created":"2022-02-03","cited_by_count":22,"area":null},{"id":"2401.00148","title":"TPatch: A Triggered Physical Adversarial Patch","created":"2023-12-30","cited_by_count":22,"area":null},{"id":"2510.13237","title":"Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models","created":"2025-10-15","cited_by_count":22,"area":"vla"},{"id":"2204.07932","title":"Towards Comprehensive Testing on the Robustness of Cooperative Multi-agent Reinforcement Learning","created":"2022-04-17","cited_by_count":21,"area":null},{"id":"2210.16765","title":"Benchmarking Adversarial Patch Against Aerial Detection","created":"2022-10-30","cited_by_count":21,"area":null},{"id":"2302.10894","title":"Red Teaming Deep Neural Networks with Feature Synthesis Tools","created":"2023-02-08","cited_by_count":21,"area":"safety"},{"id":"2303.11917","title":"Efficient Decision-based Black-box Patch Attacks on Video Recognition","created":"2023-03-21","cited_by_count":21,"area":null},{"id":"2307.14682","title":"Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical World","created":"2023-07-27","cited_by_count":21,"area":null},{"id":"2403.10801","title":"Securely Fine-tuning Pre-trained Encoders Against Adversarial Examples","created":"2024-03-16","cited_by_count":21,"area":null},{"id":"2109.02765","title":"Robustness and Generalization via Generative Adversarial Training","created":"2021-09-06","cited_by_count":20,"area":null},{"id":"2203.02269","title":"Do Explanations Explain? Model Knows Best","created":"2022-03-04","cited_by_count":20,"area":null},{"id":"2204.06213","title":"Defensive Patches for Robust Recognition in the Physical World","created":"2022-04-13","cited_by_count":20,"area":null},{"id":"2304.01482","title":"Defending Against Patch-based Backdoor Attacks on Self-Supervised Learning","created":"2023-04-04","cited_by_count":20,"area":null},{"id":"2306.06209","title":"Backdoor Attack with Sparse and Invisible Trigger","created":"2023-05-11","cited_by_count":20,"area":null},{"id":"2308.06173","title":"Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook","created":"2023-08-11","cited_by_count":20,"area":null},{"id":"2101.11453","title":"Meta Adversarial Training against Universal Patches","created":"2021-01-27","cited_by_count":19,"area":null},{"id":"2111.04266","title":"Generative Dynamic Patch Attack","created":"2021-11-08","cited_by_count":19,"area":null},{"id":"2307.00477","title":"Query-Efficient Decision-based Black-Box Patch Attack","created":"2023-07-02","cited_by_count":19,"area":null},{"id":"2310.00633","title":"A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks","created":"2023-10-01","cited_by_count":19,"area":null},{"id":"2103.12469","title":"RPATTACK: Refined Patch Attack on General Object Detectors","created":"2021-03-23","cited_by_count":18,"area":null},{"id":"2106.15202","title":"Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices","created":"2021-06-29","cited_by_count":18,"area":null},{"id":"2212.05680","title":"REAP: A Large-Scale Realistic Adversarial Patch Benchmark","created":"2022-12-12","cited_by_count":18,"area":null},{"id":"2405.19424","title":"Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policies","created":"2024-05-29","cited_by_count":18,"area":"diffusion"},{"id":"2109.00124","title":"Learning Coated Adversarial Camouflages for Object Detectors","created":"2021-09-01","cited_by_count":17,"area":null}],"next_cursor":"100"}