mlsanityData to 7 Oct 2026

Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection

arXiv 2201.08970 ↗First posted 22 Jan 2022cs.CVcited by 79

Not on the map. Why?

Abstract (arXiv)

Object detection has been widely used in many safety-critical tasks, such as autonomous driving. However, its vulnerability to adversarial examples has not been sufficiently studied, especially under the practical scenario of black-box attacks, where the attacker can only access the query feedback of predicted bounding-boxes and top-1 scores returned by the attacked model. Compared with black-box attack to image classification, there are two main challenges in black-box attack to detection. Firstly, even if one bounding-box is successfully attacked, another sub-optimal bounding-box may be detected near the attacked bounding-box. Secondly, there are multiple bounding-boxes, leading to very high attack cost. To address these challenges, we propose a Parallel Rectangle Flip Attack (PRFA) via random search. We explain the difference between our method with other attacks in Fig.~reffig1. Specifically, we generate perturbations in each rectangle patch to avoid sub-optimal detection near the attacked region. Besides, utilizing the observation that adversarial perturbations mainly locate around objects' contours and critical points under white-box attacks, the search space of attacked rectangles is reduced to improve the attack efficiency. Moreover, we develop a parallel mechanism of attacking multiple rectangles simultaneously to further accelerate the attack process. Extensive experiments demonstrate that our method can effectively and efficiently attack various popular object detectors, including anchor-based and anchor-free, and generate transferable adversarial examples.

Key facts. Cited by 79 papers in the map (data through 7 Oct 2026). Builds on 43 of its 55 references that are in the map. First posted on arXiv 22 Jan 2022.

Builds on

43 of 55 references.

References · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  4. 2017Mask R-CNNcited by 7,259
  5. 2016Feature Pyramid Networks for Object Detectioncited by 5,021
  6. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  7. 2014Going Deeper with Convolutionscited by 4,231
  8. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2018YOLOv3: An Incremental Improvementcited by 2,652
  11. 2019FCOS: Fully Convolutional One-Stage Object Detectioncited by 1,573
  12. 2016YOLO9000: Better, Faster, Strongercited by 1,429
31 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  2. 2018CornerNet: Detecting Objects as Paired Keypointscited by 763
  3. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  4. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  5. 2019CenterNet: Keypoint Triplets for Object Detectioncited by 654
  6. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  7. 2019Bridging the Gap Between Anchor-based and Anchor-free Detection via Adaptive Training Sample Selectioncited by 539
  8. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  9. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  11. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  12. 2019RepPoints: Point Set Representation for Object Detectioncited by 264
  13. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  14. 2019Bottom-up Object Detection by Grouping Extreme and Center Pointscited by 156
  15. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  16. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  17. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  18. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  19. 2020Efficient Adversarial Attacks for Visual Object Trackingcited by 66
  20. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  21. 2020Adv-watermark: A Novel Watermark Perturbation for Adversarial Examplescited by 56
  22. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  23. 2019Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reductioncited by 47
  24. 2019Structured Output Learning with Conditional Generative Flowscited by 37
  25. 2018Robust Adversarial Perturbation on Deep Proposal-based Modelscited by 26
  26. 2019Exact Adversarial Attack to Image Captioning via Structured Output Learning with Latent Variablescited by 26
  27. 2018Distributionally Adversarial Attackcited by 24
  28. 2018Adversarial Attacks on Face Detectors using Neural Net based Constrained Optimizationcited by 18
  29. 2021Distributed Learning Systems with First-order Methodscited by 17
  30. 2020Category-wise Attack: Transferable Adversarial Examples for Anchor Free Object Detectioncited by 5
  31. 2020Toward Adversarial Robustness via Semi-supervised Robust Trainingcited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 9; 2023: 14; 2024: 25; 2025: 20; 2026: 11.

79 papers.

Sort:

By area:

  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  3. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  4. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
  5. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  6. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  7. 2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMscited by 48
  8. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 42
  9. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  10. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  11. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 35
  12. 2024Visual Adversarial Attack on Vision-Language Models for Autonomous Drivingcited by 35
38 more
  1. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  2. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  3. 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
  4. 2022Towards Efficient Adversarial Training on Vision Transformerscited by 29
  5. 2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
  6. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 29
  7. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  8. 2024Towards Robust Physical-world Backdoor Attacks on Lane Detectioncited by 25
  9. 2024Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Cloudscited by 24
  10. 2025Black-Box Adversarial Attack on Vision Language Models for Autonomous Drivingcited by 23
  11. 2022Towards Comprehensive Testing on the Robustness of Cooperative Multi-agent Reinforcement Learningcited by 21
  12. 2023Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical Worldcited by 21
  13. 2022Adversarially-Aware Robust Object Detectorcited by 20
  14. 2024Interpreting Object-level Foundation Models via Visual Precision Searchcited by 20
  15. 2022Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentationcited by 19
  16. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  17. 2024LanEvil: Benchmarking the Robustness of Lane Detection to Environmental Illusionscited by 18
  18. 2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
  19. 2023Mitigating Accuracy-Robustness Trade-off via Balanced Multi-Teacher Adversarial Distillationcited by 13
  20. 2024Object Detectors in the Open Environment: Challenges, Solutions, and Outlookcited by 13
  21. 2023On the Importance of Backbone to the Adversarial Robustness of Object Detectorscited by 12
  22. 2025E2AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Modelscited by 12
  23. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  24. 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025cited by 11
  25. 2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Modelscited by 11
  26. 2023Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attackscited by 10
  27. 2024Efficient Black-box Adversarial Attacks via Bayesian Optimization Guided by a Function Priorcited by 10
  28. 2025Bench2ADVLM: A Closed-Loop Benchmark for Vision-language Models in Autonomous Drivingcited by 8
  29. 2023Improving Viewpoint Robustness for Visual Recognition via Adversarial Trainingcited by 7
  30. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
  31. 2023Face Encryption via Frequency-Restricted Identity-Agnostic Attackscited by 6
  32. 2024Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threatscited by 6
  33. 20253D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generationcited by 6
  34. 2026CtrlAttack: A Unified Attack on World-Model Control in Diffusion Modelscited by 6
  35. 2026WMAttack: Automated Attack Search for Adversarial Evaluation of World-Model Agentscited by 6
  36. 2024TrapFlow: Controllable Website Fingerprinting Defense via Dynamic Backdoor Learningcited by 5
  37. 2023Revisiting the Trade-off between Accuracy and Robustness via Weight Distribution of Filterscited by 4
  38. 2024Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysiscited by 4

50 most cited of 79 All 79 (JSON)