mlsanityData to 7 Oct 2026

Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles

arXiv 2003.08757 ↗First posted 8 Mar 2020cs.CVcited by 126

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are known to be vulnerable to adversarial examples. Existing works have mostly focused on either digital adversarial examples created via small and imperceptible perturbations, or physical-world adversarial examples created with large and less realistic distortions that are easily identified by human observers. In this paper, we propose a novel approach, called Adversarial Camouflage (AdvCam), to craft and camouflage physical-world adversarial examples into natural styles that appear legitimate to human observers. Specifically, AdvCam transfers large adversarial perturbations into customized styles, which are then "hidden" on-target object or off-target background. Experimental evaluation shows that, in both digital and physical-world scenarios, adversarial examples crafted by AdvCam are well camouflaged and highly stealthy, while remaining effective in fooling state-of-the-art DNN image classifiers. Hence, AdvCam is a flexible approach that can help craft stealthy attacks to evaluate the robustness of DNNs. AdvCam can also be used to protect private information from being detected by deep learning systems.

Key facts. Cited by 126 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 29; 2022: 26; 2023: 36; 2024: 15; 2025: 10; 2026: 10.

126 papers.

Sort:

By area:

  1. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  2. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  3. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  4. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  5. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  6. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
  7. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  8. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  9. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  10. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
  11. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  12. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
38 more
  1. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  2. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  3. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
  4. 2023StyleAdv: Meta Style Adversarial Training for Cross-Domain Few-Shot Learningcited by 53
  5. 2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
  6. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  7. 2023Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modelingcited by 41
  8. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  9. 2021Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safetycited by 35
  10. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  11. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  12. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  13. 20213D Adversarial Attacks Beyond Point Cloudcited by 26
  14. 2021Robust Physical-World Attacks on Face Recognitioncited by 26
  15. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  16. 2021Unrestricted Adversarial Attacks on ImageNet Competitioncited by 23
  17. 2024SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environmentscited by 22
  18. 2022Benchmarking Adversarial Patch Against Aerial Detectioncited by 21
  19. 2022Defensive Patches for Robust Recognition in the Physical Worldcited by 20
  20. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  21. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  22. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  23. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  24. 2022StyleFool: Fooling Video Classification Systems via Style Transfercited by 18
  25. 2023Towards Benchmarking and Assessing Visual Naturalness of Physical World Adversarial Attackscited by 18
  26. 2024Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policiescited by 17
  27. 2021Adversarial Imaging Pipelinescited by 15
  28. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  29. 2022Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attackscited by 12
  30. 2022Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNscited by 11
  31. 2022Adversarial Camouflage for Node Injection Attack on Graphscited by 11
  32. 2022Adversarial Color Film: Effective Physical-World Attack to DNNscited by 11
  33. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  34. 2023Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical Worldcited by 11
  35. 2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
  36. 2023Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detectioncited by 11
  37. 2022Location-Free Camouflage Generation Networkcited by 10
  38. 2023APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigationcited by 10

50 most cited of 126 All 126 (JSON)