mlsanityData to 7 Oct 2026

Adversarial examples in the physical world

arXiv 1607.02533 ↗First posted 8 Jul 2016cs.CV cs.CR cs.LGcited by 1,762

Not on the map. Why?

Cited by 47 in Diffusion models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Most existing machine learning classifiers are highly vulnerable to adversarial examples. An adversarial example is a sample of input data which has been modified very slightly in a way that is intended to cause a machine learning classifier to misclassify it. In many cases, these modifications can be so subtle that a human observer does not even notice the modification at all, yet the classifier still makes a mistake. Adversarial examples pose security concerns because they could be used to perform an attack on machine learning systems, even if the adversary has no access to the underlying model. Up to now, all previous work have assumed a threat model in which the adversary can feed data directly into the machine learning classifier. This is not always the case for systems operating in the physical world, for example those which are using signals from cameras and other sensors as an input. This paper shows that even in such physical world scenarios, machine learning systems are vulnerable to adversarial examples. We demonstrate this by feeding adversarial images obtained from cell-phone camera to an ImageNet Inception classifier and measuring the classification accuracy of the system. We find that a large fraction of adversarial examples are classified incorrectly even when perceived through the camera.

Key facts. Cited by 1,762 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 Jul 2016.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 424; 2022: 362; 2023: 354; 2024: 281; 2025: 232; 2026: 109.

1,762 papers.

Sort:

By area:

  1. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  2. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  3. 2021Improving Robustness using Generated Datacited by 233
  4. 2021ConSERT: A Contrastive Framework for Self-Supervised Sentence Representation Transfercited by 231
  5. 2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 218
  6. 2021Trustworthy AI: From Principles to Practicescited by 206
  7. 2021PeCo: Perceptual Codebook for BERT Pre-training of Vision Transformerscited by 204
  8. 2023Data-centric Artificial Intelligence: A Surveycited by 202
  9. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  10. 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 200
  11. 2021Data Augmentation Can Improve Robustnesscited by 193
  12. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
38 more
  1. 2022DE-FAKE: Detection and Attribution of Fake Images Generated by Text-to-Image Generation Modelscited by 167
  2. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 160
  3. 2024Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Modelscited by 158
  4. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  5. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
  6. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  7. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  8. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  9. 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
  10. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  11. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  12. 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Eraserscited by 118
  13. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  14. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
  15. 2021Split Computing and Early Exiting for Deep Learning Applications: Survey and Research Challengescited by 114
  16. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 114
  17. 2021BERT: A Review of Applications in Natural Language Processing and Understandingcited by 109
  18. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  19. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  20. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 92
  21. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  22. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  23. 2021Domain Impression: A Source Data Free Domain Adaptation Methodcited by 91
  24. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  25. 2021Semantic Communications: Principles and Challengescited by 90
  26. 2022A Comparative Survey of Deep Active Learningcited by 88
  27. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  28. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  29. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  30. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  31. 2021Towards Improving Adversarial Training of NLP Modelscited by 79
  32. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
  33. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  34. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  35. 2022Frequency-driven Imperceptible Adversarial Attack on Semantic Similaritycited by 76
  36. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  37. 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
  38. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74

50 most cited of 1,762 All 1,762 (JSON)