# Synthesizing Robust Adversarial Examples

arXiv: https://arxiv.org/abs/1707.07397 · HTML: https://mlsanity.com/paper/1707.07397/

## Key facts

- Cited by 39 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Jul 2017.

## Built on by (most cited first, 30 of 39)

- [Raising the Cost of Malicious AI-Powered Image Editing](https://mlsanity.com/paper/2302.06588/) (2023)
- [Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information](https://mlsanity.com/paper/2204.05255/) (2022)
- [WaveGuard: Understanding and Mitigating Audio Adversarial Examples](https://mlsanity.com/paper/2103.03344/) (2021)
- [Image Shortcut Squeezing: Countering Perturbative Availability Poisons with Compression](https://mlsanity.com/paper/2301.13838/) (2023)
- [Copyright Protection in Generative AI: A Technical Perspective](https://mlsanity.com/paper/2402.02333/) (2024)
- [A Survey on Physical Adversarial Attack in Computer Vision](https://mlsanity.com/paper/2209.14262/) (2022)
- [Improving Robustness against Real-World and Worst-Case Distribution Shifts through Decision Region Quantification](https://mlsanity.com/paper/2205.09619/) (2022)
- [Robust Deep Reinforcement Learning through Bootstrapped Opportunistic Curriculum](https://mlsanity.com/paper/2206.10057/) (2022)
- [Do Perceptually Aligned Gradients Imply Adversarial Robustness?](https://mlsanity.com/paper/2207.11378/) (2022)
- [Demystifying the Adversarial Robustness of Random Transformation Defenses](https://mlsanity.com/paper/2207.03574/) (2022)
- [Object Detectors in the Open Environment: Challenges, Solutions, and Outlook](https://mlsanity.com/paper/2403.16271/) (2024)
- [Targeted Adversarial Attacks on Generalizable Neural Radiance Fields](https://mlsanity.com/paper/2310.03578/) (2023)
- [PRIME: Protect Your Videos From Malicious Editing](https://mlsanity.com/paper/2402.01239/) (2024)
- [Benchmarking Robustness to Adversarial Image Obfuscations](https://mlsanity.com/paper/2301.12993/) (2023)
- [How Deep Networks Learn Sparse and Hierarchical Data: the Sparse Random Hierarchy Model](https://mlsanity.com/paper/2404.10727/) (2024)
- [CDUPatch: Color-Driven Universal Adversarial Patch Attack for Dual-Modal Visible-Infrared Detectors](https://mlsanity.com/paper/2504.10888/) (2025)
- [When Vision Fails: Text Attacks Against ViT and OCR](https://mlsanity.com/paper/2306.07033/) (2023)
- [Universally Unfiltered and Unseen:Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguards](https://mlsanity.com/paper/2508.05658/) (2025)
- [TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches](https://mlsanity.com/paper/2603.23117/) (2026)
- [Rethinking and Red-Teaming Protective Perturbation in Personalized Diffusion Models](https://mlsanity.com/paper/2406.18944/) (2024)
- [TRAP: Tail-aware Ranking Attack for World-Model Planning](https://mlsanity.com/paper/2605.01950/) (2026)
- [Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training](https://mlsanity.com/paper/2103.15385/) (2021)
- [Detect and Defense Against Adversarial Examples in Deep Learning using Natural Scene Statistics and Adaptive Denoising](https://mlsanity.com/paper/2107.05780/) (2021)
- [Causal Scene BERT: Improving object detection by searching for challenging groups of data](https://mlsanity.com/paper/2202.03651/) (2022)
- [Adversarial Confusion Attack: Disrupting Multimodal Large Language Models](https://mlsanity.com/paper/2511.20494/) (2025)
- [Just Noticeable Difference Modeling for Deep Visual Features](https://mlsanity.com/paper/2601.21933/) (2026)
- [Why Don't You Clean Your Glasses? Perception Attacks with Dynamic Optical Perturbations](https://mlsanity.com/paper/2307.13131/) (2023)
- [Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification](https://mlsanity.com/paper/2506.06027/) (2025)
- [Is Face Recognition Safe from Realizable Attacks?](https://mlsanity.com/paper/2210.08178/) (2022)
- [DePatch: Towards Robust Adversarial Patch for Evading Person Detectors in the Real World](https://mlsanity.com/paper/2408.06625/) (2024)

## Abstract (arXiv)

Standard methods for generating adversarial examples for neural networks do not consistently fool neural network classifiers in the physical world due to a combination of viewpoint shifts, camera noise, and other natural transformations, limiting their relevance to real-world systems. We demonstrate the existence of robust 3D adversarial objects, and we present the first algorithm for synthesizing examples that are adversarial over a chosen distribution of transformations. We synthesize two-dimensional adversarial images that are robust to noise, distortion, and affine transformation. We apply our algorithm to complex three-dimensional objects, using 3D-printing to manufacture the first physical adversarial objects. Our results demonstrate the existence of 3D adversarial objects in the physical world.