Data to 7 Oct 2026

Defending Against Physically Realizable Attacks on Image Classification

arXiv 1909.09552 ↗First posted 20 Sep 2019cs.LG cs.AI cs.CVcited by 66

Not on the map. Why?

Abstract (arXiv)

We study the problem of defending deep neural network approaches for image classification from physically realizable attacks. First, we demonstrate that the two most scalable and effective methods for learning robust models, adversarial training with PGD attacks and randomized smoothing, exhibit very limited effectiveness against three of the highest profile physical attacks. Next, we propose a new abstract adversarial model, rectangular occlusion attacks, in which an adversary places a small adversarially crafted rectangle in an image, and develop two approaches for efficiently computing the resulting adversarial examples. Finally, we demonstrate that adversarial training using our new attack yields image classification models that exhibit high robustness against the physically realizable attacks we study, offering the first effective generic defense against such attacks.

Key facts. Cited by 66 papers in the map (data through 7 Oct 2026). First posted on arXiv 20 Sep 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 21; 2022: 11; 2023: 13; 2024: 14; 2025: 5; 2026: 2.

66 papers.

Sort:

By area:

2021Trustworthy AI: From Principles to Practicescited by 206
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 31
2021Towards Defending against Adversarial Examples via Attack-Invariant Featurescited by 25
2021Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attackscited by 24
2021Efficient Certified Defenses Against Patch Attacks on Image Classifierscited by 23

38 more

2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
2022Open-set Adversarial Defense with Clean-Adversarial Mutual Learningcited by 21
2021Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box settingcited by 20
2021Meta Adversarial Training against Universal Patchescited by 19
2021Generative Dynamic Patch Attackcited by 19
2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 19
2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
2021Removing Adversarial Noise in Class Activation Feature Spacecited by 18
2021Adversarial YOLO: Defense Human Detection Patch Attacks via Detecting Adversarial Patchescited by 17
2022Robust Deep Reinforcement Learning through Bootstrapped Opportunistic Curriculumcited by 15
2022Certified Defences Against Adversarial Patch Attacks on Semantic Segmentationcited by 15
2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
2024LLM Whisperer: An Inconspicuous Attack to Bias LLM Responsescited by 15
2021FACESEC: A Fine-grained Robustness Evaluation Framework for Face Recognition Systemscited by 14
2021Jujutsu: A Two-stage Defense against Adversarial Patch Attacks on Deep Neural Networkscited by 13
2022Why adversarial training can hurt robust accuracycited by 12
2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
2021DoubleStar: Long-Range Attack Towards Depth Estimation based Obstacle Avoidance in Autonomous Systemscited by 10
2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10
2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 10
2023Adversarial Examples in the Physical World: A Surveycited by 10
2024Verification of Neural Networks' Global Robustnesscited by 10
2022Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Framecited by 9
2025Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videoscited by 9
2021Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysiscited by 7
2022Self-recoverable Adversarial Examples: A New Effective Protection Mechanism in Social Networkscited by 6
2024Out-of-Distribution Data: An Acquaintance of Adversarial Examples -- A Surveycited by 6
2023Revisiting Image Classifier Training for Improved Certified Robust Defense against Adversarial Patchescited by 5
2024Meta Invariance Defense Towards Generalizable Robustness to Unknown Adversarial Attackscited by 5
2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
2024Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patchescited by 4
2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
2024CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defensecited by 4
2021Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Trainingcited by 3
2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
2023RADAP: A Robust and Adaptive Defense Against Diverse Adversarial Patches on Face Recognitioncited by 3
2024Fall Leaf Adversarial Attack on Traffic Sign Classificationcited by 3

50 most cited of 66 All 66 (JSON)