mlsanityData to 14 Oct 2026

Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches

arXiv 2207.04718 ↗First posted 11 Jul 2022cs.CVcited by 57

Not on the map. Why?

Abstract (arXiv)

Deep learning has substantially boosted the performance of Monocular Depth Estimation (MDE), a critical component in fully vision-based autonomous driving (AD) systems (e.g., Tesla and Toyota). In this work, we develop an attack against learning-based MDE. In particular, we use an optimization-based method to systematically generate stealthy physical-object-oriented adversarial patches to attack depth estimation. We balance the stealth and effectiveness of our attack with object-oriented adversarial design, sensitive region localization, and natural style camouflage. Using real-world driving scenarios, we evaluate our attack on concurrent MDE models and a representative downstream task for AD (i.e., 3D object detection). Experimental results show that our method can generate stealthy, effective, and robust adversarial patches for different target objects and models and achieves more than 6 meters mean depth estimation error and 93% attack success rate (ASR) in object detection with a patch of 1/9 of the vehicle's rear area. Field tests on three different driving routes with a real vehicle indicate that we cause over 6 meters mean depth estimation error and reduce the object detection rate from 90.70% to 5.16% in continuous video frames.

Key facts. Cited by 57 papers in the map (data through 14 Oct 2026). Builds on 46 of its 72 references that are in the map. First posted on arXiv 11 Jul 2022.

Builds on

46 of 72 references.

References · 46

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2018PointPillars: Fast Encoders for Object Detection from Point Cloudscited by 1,715
  5. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  6. 2017Adversarial Patchcited by 517
  7. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  8. 2018Pseudo-LiDAR from Visual Depth Estimation: Bridging the Gap in 3D Object Detection for Autonomous Drivingcited by 457
  9. 20193D Packing for Self-Supervised Monocular Depth Estimationcited by 439
  10. 2017DeepXplore: Automated Whitebox Testing of Deep Learning Systemscited by 311
  11. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  12. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
34 more
  1. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
  2. 2020D3VO: Deep Depth, Deep Pose and Deep Uncertainty for Monocular Visual Odometrycited by 206
  3. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  4. 2018Spatially Transformed Adversarial Examplescited by 195
  5. 2021The Temporal Opportunist: Self-Supervised Multi-Frame Monocular Depthcited by 190
  6. 2017Deep Photo Style Transfercited by 168
  7. 2018Physical Adversarial Examples for Object Detectorscited by 163
  8. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  9. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  10. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 152
  11. 2019Self-Supervised Monocular Depth Hintscited by 127
  12. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  13. 2021BBAM: Bounding Box Attribution Map for Weakly Supervised Semantic and Instance Segmentationcited by 105
  14. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  15. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  16. 2021SG-Net: Spatial Granularity Network for One-Stage Video Instance Segmentationcited by 87
  17. 2020Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attackcited by 64
  18. 2020MonoRec: Semi-Supervised Dense Reconstruction in Dynamic Environments from a Single Moving Cameracited by 59
  19. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  20. 2020Bidirectional Attention Network for Monocular Depth Estimationcited by 48
  21. 2019Attacking Optical Flowcited by 41
  22. 2020Targeted Adversarial Perturbations for Monocular Depth Predictioncited by 40
  23. 2021TF-Blender: Temporal Feature Blender for Video Object Detectioncited by 37
  24. 2021Single Image Depth Prediction with Wavelet Decompositioncited by 34
  25. 2020DenserNet: Weakly Supervised Visual Localization Using Multi-scale Feature Aggregationcited by 33
  26. 2019Characterizing Attacks on Deep Reinforcement Learningcited by 31
  27. 2019Defending against Whitebox Adversarial Attacks via Randomized Discretizationcited by 29
  28. 2020Adversarial Patch Attacks on Monocular Depth Estimation Networkscited by 29
  29. 2020LM-Reloc: Levenberg-Marquardt Based Direct Visual Relocalizationcited by 28
  30. 2020Drift with Devil: Security of Multi-Sensor Fusion based Localization in High-Level Autonomous Driving under GPS Spoofing (Extended Version)cited by 25
  31. 2020Adversarial Attacks on Monocular Depth Estimationcited by 20
  32. 2018Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensorscited by 10
  33. 2019Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Trackingcited by 9
  34. 2020Monocular Depth Estimators: Vulnerabilities and Attackscited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 8; 2023: 18; 2024: 18; 2025: 11; 2026: 2.

57 papers.

Sort:

By area:

  1. 2022Physical Adversarial Attack meets Computer Vision: A Decade Surveycited by 67
  2. 2022Visual Recognition with Deep Nearest Centroidscited by 59
  3. 2023RoboDepth: Robust Out-of-Distribution Depth Estimation under Corruptionscited by 49
  4. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 34
  5. 2023TransFlow: Transformer as Flow Learnercited by 32
  6. 2023CLUSTSEG: Clustering for Universal Segmentationcited by 32
  7. 2024Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Drivingcited by 32
  8. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 25
  9. 2022A Comprehensive Study of the Robustness for LiDAR-based 3D Object Detectors against Adversarial Attackscited by 22
  10. 2023Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlookcited by 20
  11. 2022Learning Equivariant Segmentation with Instance-Unique Queryingcited by 17
  12. 2023Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attackscited by 17
38 more
  1. 2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
  2. 2023The RoboDepth Challenge: Methods and Advancements Towards Robust Depth Estimationcited by 13
  3. 2023SAAM: Stealthy Adversarial Attack on Monocular Depth Estimationcited by 12
  4. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  5. 2022Solve the Puzzle of Instance Segmentation in Videos: A Weakly Supervised Framework with Spatio-Temporal Collaborationcited by 11
  6. 2023Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detectioncited by 11
  7. 2023APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigationcited by 10
  8. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  9. 2025Learning-based 3D Reconstruction in Autonomous Driving: A Comprehensive Surveycited by 9
  10. 2022Towards Unbiased Label Distribution Learning for Facial Pose Estimation Using Anisotropic Spherical Gaussiancited by 7
  11. 2023CBA: Contextual Background Attack against Optical Aerial Detection in the Physical Worldcited by 7
  12. 2024Flexible Physical Camouflage Generation Based on a Differential Approachcited by 7
  13. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  14. 2024Towards Deviation-Robust Agent Navigation via Perturbation-Aware Contrastive Learningcited by 6
  15. 2023Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Surveycited by 5
  16. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  17. 2024ProMotion: Prototypes As Motion Learnerscited by 5
  18. 2024Self-supervised Adversarial Training of Monocular Depth Estimation against Physical-World Attackscited by 5
  19. 2023A Study on the Generality of Neural Network Structures for Monocular Depth Estimationcited by 4
  20. 2024SSAP: A Shape-Sensitive Adversarial Patch for Comprehensive Disruption of Monocular Depth Estimation in Autonomous Navigation Applicationscited by 4
  21. 2024On the Robustness of Language Guidance for Low-Level Vision Tasks: Findings from Depth Estimationcited by 4
  22. 2024Prototypical Transformer as Unified Motion Learnerscited by 4
  23. 2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
  24. 2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
  25. 2024BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Taskscited by 3
  26. 2024Optical Lens Attack on Deep Learning Based Monocular Depth Estimationcited by 3
  27. 2024Left-right Discrepancy for Adversarial Attack on Stereo Networkscited by 2
  28. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  29. 2023Holistic Prototype Attention Network for Few-Shot VOScited by 1
  30. 2024Optical Lens Attack on Monocular Depth Estimation for Autonomous Drivingcited by 1
  31. 2024MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agentscited by 1
  32. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  33. 2025Learning Fourier shapes to probe the geometric world of deep neural networkscited by 1
  34. 2025Guided Diffusion-based Generation of Adversarial Objects for Real-World Monocular Depth Estimation Attackscited by 1
  35. 2024Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patchescited by 0
  36. 2024PADetBench: Towards Benchmarking Physical Attacks against Object Detectioncited by 0
  37. 2024Adversarial Manhole: Challenging Monocular Depth Estimation and Semantic Segmentation Models with Patch Attackcited by 0
  38. 2024Natural Adversaries: Fuzzing Autonomous Vehicles with Realistic Roadside Object Placementscited by 0

50 most cited of 57 All 57 (JSON)