mlsanityData to 7 Oct 2026

Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World

arXiv 2103.01050 ↗First posted 1 Mar 2021cs.CVcited by 127

Not on the map. Why?

Abstract (arXiv)

Deep learning models are vulnerable to adversarial examples. As a more threatening type for practical deep learning systems, physical adversarial examples have received extensive research attention in recent years. However, without exploiting the intrinsic characteristics such as model-agnostic and human-specific patterns, existing works generate weak adversarial perturbations in the physical world, which fall short of attacking across different models and show visually suspicious appearance. Motivated by the viewpoint that attention reflects the intrinsic characteristics of the recognition process, this paper proposes the Dual Attention Suppression (DAS) attack to generate visually-natural physical adversarial camouflages with strong transferability by suppressing both model and human attention. As for attacking, we generate transferable adversarial camouflages by distracting the model-shared similar attention patterns from the target to non-target regions. Meanwhile, based on the fact that human visual attention always focuses on salient items (e.g., suspicious distortions), we evade the human-specific bottom-up attention to generate visually-natural camouflages which are correlated to the scenario context. We conduct extensive experiments in both the digital and physical world for classification and detection tasks on up-to-date models (e.g., Yolo-V5) and significantly demonstrate that our method outperforms state-of-the-art methods.

Key facts. Cited by 127 papers in the map (data through 7 Oct 2026). Builds on 32 of its 52 references that are in the map. First posted on arXiv 1 Mar 2021.

Builds on

32 of 52 references.

References · 32

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Mask R-CNNcited by 7,259
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  12. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
20 more
  1. 2014Sequence to Sequence Learning with Neural Networkscited by 2,974
  2. 2017CARLA: An Open Urban Driving Simulatorcited by 2,431
  3. 2015Learning Deep Features for Discriminative Localizationcited by 2,430
  4. 2016Adversarial examples in the physical worldcited by 1,762
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  6. 2017Grad-CAM++: Improved Visual Explanations for Deep Convolutional Networkscited by 936
  7. 2018Robustness May Be at Odds with Accuracycited by 873
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  9. 2017Adversarial Patchcited by 514
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  11. 2020Binary Neural Networks: A Surveycited by 184
  12. 2019Forward and Backward Information Retention for Accurate Binary Neural Networkscited by 169
  13. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  14. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  15. 2018Adversarial Examples that Fool both Computer Vision and Time-Limited Humanscited by 73
  16. 2020BiPointNet: Binary Neural Network for Point Cloudscited by 30
  17. 2019RPC: A Large-Scale Retail Product Checkout Datasetcited by 27
  18. 2019Interpreting and Improving Adversarial Robustness of Deep Neural Networks with Neuron Sensitivitycited by 6
  19. 2019Enhancing Cross-task Transferability of Adversarial Examples with Dispersion Reductioncited by 4
  20. 2020Bias-based Universal Adversarial Patch Attack for Automatic Check-outcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 20; 2023: 34; 2024: 36; 2025: 21; 2026: 10.

127 papers.

Sort:

By area:

  1. 2022CDDFuse: Correlation-Driven Dual-Branch Feature Decomposition for Multi-Modality Image Fusioncited by 222
  2. 2023DDFM: Denoising Diffusion Model for Multi-Modality Image Fusioncited by 153
  3. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  4. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  5. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  6. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  7. 2024FusionMamba: Dynamic Feature Enhancement for Multimodal Image Fusion with Mambacited by 81
  8. 2021Towards Transferable Adversarial Attacks on Vision Transformerscited by 80
  9. 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
  10. 2023Towards Accurate Post-Training Quantization for Vision Transformercited by 70
  11. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  12. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
38 more
  1. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  2. 2022DTA: Physical Camouflage Attacks using Differentiable Transformation Networkcited by 51
  3. 2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMscited by 48
  4. 2023Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modelingcited by 41
  5. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  6. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  7. 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
  8. 2024MambaDFuse: A Mamba-based Dual-phase Model for Multi-modality Image Fusioncited by 35
  9. 2024Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attackscited by 35
  10. 2024Visual Adversarial Attack on Vision-Language Models for Autonomous Drivingcited by 35
  11. 2024Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Drivingcited by 32
  12. 2024PTQ4SAM: Post-Training Quantization for Segment Anythingcited by 32
  13. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  14. 2023ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Universal and Robust Vehicle Evasioncited by 31
  15. 2024GenderBias-VL: Benchmarking Gender Bias in Vision Language Models via Counterfactual Probingcited by 31
  16. 2021Towards Real-world X-ray Security Inspection: A High-Quality Benchmark and Lateral Inhibition Module for Prohibited Items Detectioncited by 30
  17. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 29
  18. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  19. 2025Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findingscited by 24
  20. 2023Latent Imitator: Generating Natural Individual Discriminatory Instances for Black-Box Fairness Testingcited by 23
  21. 2023RFLA: A Stealthy Reflected Light Adversarial Attack in the Physical Worldcited by 23
  22. 2022SoK: On the Semantic AI Security in Autonomous Drivingcited by 22
  23. 2023BiBench: Benchmarking and Analyzing Network Binarizationcited by 22
  24. 2022Towards Comprehensive Testing on the Robustness of Cooperative Multi-agent Reinforcement Learningcited by 21
  25. 2022Defensive Patches for Robust Recognition in the Physical Worldcited by 20
  26. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  27. 2022Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentationcited by 19
  28. 2023RobustMQ: Benchmarking Robustness of Quantized Modelscited by 19
  29. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  30. 2023Towards Benchmarking and Assessing Visual Naturalness of Physical World Adversarial Attackscited by 18
  31. 2024RAUCA: A Novel Physical Adversarial Attack on Vehicle Detectors via Robust and Accurate Camouflage Generationcited by 18
  32. 2024LanEvil: Benchmarking the Robustness of Lane Detection to Environmental Illusionscited by 18
  33. 2025Improving SAM for Camouflaged Object Detection via Dual Stream Adapterscited by 13
  34. 2022Adversarial Color Film: Effective Physical-World Attack to DNNscited by 11
  35. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  36. 2023Dynamic Adversarial Attacks on Autonomous Driving Systemscited by 11
  37. 2023Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attackscited by 10
  38. 2023Adversarial Examples in the Physical World: A Surveycited by 10

50 most cited of 127 All 127 (JSON)