# Robust Adversarial Perturbation on Deep Proposal-based Models

arXiv: https://arxiv.org/abs/1809.05962 · HTML: https://mlsanity.com/paper/1809.05962/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Sep 2018.

## Built on by (most cited first, 26 of 26)

- [Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection](https://mlsanity.com/paper/2201.08970/) (2022)
- [T-SEA: Transfer-based Self-Ensemble Attack on Object Detection](https://mlsanity.com/paper/2211.09773/) (2022)
- [Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving](https://mlsanity.com/paper/2101.06784/) (2021)
- [Class-Aware Robust Adversarial Training for Object Detection](https://mlsanity.com/paper/2103.16148/) (2021)
- [Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarios](https://mlsanity.com/paper/2202.04781/) (2022)
- [Context-Aware Transfer Attacks for Object Detection](https://mlsanity.com/paper/2112.03223/) (2021)
- [NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors](https://mlsanity.com/paper/2412.16955/) (2024)
- [Adversarial Feature Augmentation and Normalization for Visual Recognition](https://mlsanity.com/paper/2103.12171/) (2021)
- [Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detector](https://mlsanity.com/paper/2307.08076/) (2023)
- [Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images](https://mlsanity.com/paper/2302.06060/) (2023)
- [Integer-arithmetic-only Certified Robustness for Quantized Neural Networks](https://mlsanity.com/paper/2108.09413/) (2021)
- [A Survey and Evaluation of Adversarial Attacks for Object Detection](https://mlsanity.com/paper/2408.01934/) (2024)
- [Exploring Model Learning Heterogeneity for Boosting Ensemble Robustness](https://mlsanity.com/paper/2310.02237/) (2023)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignments](https://mlsanity.com/paper/2212.05387/) (2022)
- [Adversarial Attention Perturbations for Large Object Detection Transformers](https://mlsanity.com/paper/2508.02987/) (2025)
- [Robust and Accurate Object Detection via Self-Knowledge Distillation](https://mlsanity.com/paper/2111.07239/) (2021)
- [Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices](https://mlsanity.com/paper/2412.02171/) (2024)
- [AdvMono3D: Advanced Monocular 3D Object Detection with Depth-Aware Robust Adversarial Training](https://mlsanity.com/paper/2309.01106/) (2023)
- [GLOW: Global Layout Aware Attacks on Object Detection](https://mlsanity.com/paper/2302.14166/) (2023)
- [Adversarial Attacks on LiDAR-Based Tracking Across Road Users: Robustness Evaluation and Target-Aware Black-Box Method](https://mlsanity.com/paper/2410.20893/) (2024)
- [Towards Generic and Controllable Attacks Against Object Detection](https://mlsanity.com/paper/2307.12342/) (2023)
- [Adversarial Patch Attack for Ship Detection via Localized Augmentation](https://mlsanity.com/paper/2508.21472/) (2025)
- [A Unified Spatial Alignment Framework for Highly Transferable Transformation-Based Attacks on Spatially Structured Tasks](https://mlsanity.com/paper/2603.25230/) (2026)
- [LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection](https://mlsanity.com/paper/2607.06592/) (2026)
- [Corrupting Attention: Evasion-Based Adversarial Attacks on Encoder Attention in Detection Transformers](https://mlsanity.com/paper/2608.06674/) (2026)

## Abstract (arXiv)

Adversarial noises are useful tools to probe the weakness of deep learning based computer vision algorithms. In this paper, we describe a robust adversarial perturbation (R-AP) method to attack deep proposal-based object detectors and instance segmentation algorithms. Our method focuses on attacking the common component in these algorithms, namely Region Proposal Network (RPN), to universally degrade their performance in a black-box fashion. To do so, we design a loss function that combines a label loss and a novel shape loss, and optimize it with respect to image using a gradient based iterative algorithm. Evaluations are performed on the MS COCO 2014 dataset for the adversarial attacking of 6 state-of-the-art object detectors and 2 instance segmentation algorithms. Experimental results demonstrate the efficacy of the proposed method.