mlsanityData to 7 Oct 2026

Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon

arXiv 2203.03818 ↗First posted 8 Mar 2022cs.CVcited by 101

Not on the map. Why?

Abstract (arXiv)

Estimating the risk level of adversarial examples is essential for safely deploying machine learning models in the real world. One popular approach for physical-world attacks is to adopt the "sticker-pasting" strategy, which however suffers from some limitations, including difficulties in access to the target or printing by valid colors. A new type of non-invasive attacks emerged recently, which attempt to cast perturbation onto the target by optics based tools, such as laser beam and projector. However, the added optical patterns are artificial but not natural. Thus, they are still conspicuous and attention-grabbed, and can be easily noticed by humans. In this paper, we study a new type of optical adversarial examples, in which the perturbations are generated by a very common natural phenomenon, shadow, to achieve naturalistic and stealthy physical-world adversarial attack under the black-box setting. We extensively evaluate the effectiveness of this new attack on both simulated and real-world environments. Experimental results on traffic sign recognition demonstrate that our algorithm can generate adversarial examples effectively, reaching 98.23% and 90.47% success rates on LISA and GTSRB test sets respectively, while continuously misleading a moving camera over 95% of the time in real-world scenarios. We also offer discussions about the limitations and the defense mechanism of this attack.

Key facts. Cited by 101 papers in the map (data through 7 Oct 2026). Builds on 23 of its 34 references that are in the map. First posted on arXiv 8 Mar 2022.

Builds on

23 of 34 references.

References · 23

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2017A Survey on Deep Learning in Medical Image Analysiscited by 1,182
  7. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  8. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  9. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  10. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  11. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  12. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
11 more
  1. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  2. 2019Stereo R-CNN based 3D Object Detection for Autonomous Drivingcited by 163
  3. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  4. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  5. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  6. 2021Optical Adversarial Attackcited by 43
  7. 2020Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Studycited by 40
  8. 2020Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effectcited by 40
  9. 2020Physics-based Shadow Image Decomposition for Shadow Removalcited by 38
  10. 2020Learning Black-Box Attackers with Transferable Priors and Query Feedbackcited by 32
  11. 2017Improving Shadow Suppression for Illumination Robust Face Recognitioncited by 29

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 14; 2023: 28; 2024: 31; 2025: 15; 2026: 13.

101 papers.

Sort:

By area:

  1. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 66
  2. 2023Physically Realizable Natural-Looking Clothing Textures Evade Person Detectors via 3D Modelingcited by 41
  3. 2022HOTCOLD Block: Fooling Thermal Infrared Detectors with a Novel Wearable Designcited by 27
  4. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
  5. 2023RFLA: A Stealthy Reflected Light Adversarial Attack in the Physical Worldcited by 23
  6. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  7. 2023Distracting Downpour: Adversarial Weather Attacks for Motion Estimationcited by 15
  8. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  9. 2024Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perceptioncited by 14
  10. 2023Adversarial Attacks on Traffic Sign Recognition: A Surveycited by 13
  11. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  12. 2024Regional Attention for Shadow Removalcited by 12
38 more
  1. 2022Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNscited by 11
  2. 2022Adversarial Color Film: Effective Physical-World Attack to DNNscited by 11
  3. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  4. 2023Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical Worldcited by 11
  5. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  6. 2023Adversarial Infrared Curves: An Attack on Infrared Pedestrian Detectors in the Physical Worldcited by 10
  7. 2025SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinationscited by 9
  8. 2023AdvRain: Adversarial Raindrops to Attack Camera-based Smart Vision Systemscited by 8
  9. 2023State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systemscited by 8
  10. 2024Machine Learning Robustness: A Primercited by 8
  11. 2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 8
  12. 2023Adversarial Attack with Raindropscited by 7
  13. 2023Improving Viewpoint Robustness for Visual Recognition via Adversarial Trainingcited by 7
  14. 2024Flexible Physical Camouflage Generation Based on a Differential Approachcited by 7
  15. 2024Single-Image Shadow Removal Using Deep Learning: A Comprehensive Surveycited by 7
  16. 2022Adversarial Neon Beam: A Light-based Physical Attack to DNNscited by 6
  17. 2024Unveiling Deep Shadows: A Survey and Benchmark on Image and Video Shadow Detection, Removal, and Generation in the Deep Learning Eracited by 6
  18. 2024Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspectivecited by 6
  19. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  20. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  21. 2022Adversarial Zoom Lens: A Novel Physical-World Attack to DNNscited by 4
  22. 2022Be Careful with Rotation: A Uniform Backdoor Pattern for 3D Shapecited by 4
  23. 2023Stealthy Physical Masked Face Recognition Attack via Adversarial Style Optimizationcited by 4
  24. 2023Embodied Laser Attack:Leveraging Scene Priors to Achieve Agent-based Robust Non-contact Attackscited by 4
  25. 2024Catastrophic Overfitting: A Potential Blessing in Disguisecited by 4
  26. 2024Secure Traffic Sign Recognition: An Attention-Enabled Universal Image Inpainting Mechanism against Light Patch Attackscited by 4
  27. 2024BadPatch: Diffusion-Based Generation of Physical Adversarial Patchescited by 4
  28. 2024Unified Physical-Digital Attack Detection Challengecited by 3
  29. 2024Out-of-Bounding-Box Triggers: A Stealthy Approach to Cheat Object Detectorscited by 3
  30. 2024Fall Leaf Adversarial Attack on Traffic Sign Classificationcited by 3
  31. 2024Adversarial Attacks on Hyperbolic Networkscited by 3
  32. 2024Physics-Based Adversarial Attack on Near-Infrared Human Detector for Nighttime Surveillance Camera Systemscited by 3
  33. 2023Fooling Polarization-based Vision using Locally Controllable Polarizing Projectioncited by 2
  34. 2023Self-supervised Adaptive Pre-training of Multilingual Speech Models for Language and Dialect Identificationcited by 2
  35. 2024Cloud Adversarial Example Generation for Remote Sensing Image Classificationcited by 2
  36. 2022A Human-in-the-Middle Attack against Object Detection Systemscited by 1
  37. 2022Shadows Aren't So Dangerous After All: A Fast and Robust Defense Against Shadow-Based Adversarial Attackscited by 1
  38. 2022Adversarial Color Projection: A Projector-based Physical Attack to DNNscited by 1

50 most cited of 101 All 101 (JSON)