mlsanityData to 14 Oct 2026

Visual Adversarial Attacks and Defenses in the Physical World: A Survey

arXiv 2211.01671 ↗First posted 3 Nov 2022cs.CVcited by 11

Not on the map. Why?

Abstract (arXiv)

Although Deep Neural Networks (DNNs) have been widely applied in various real-world scenarios, they remain vulnerable to adversarial examples. Adversarial attacks in computer vision can be categorized into digital attacks and physical attacks based on their different forms. Compared to digital attacks, which generate perturbations in digital pixels, physical attacks are more practical in real-world settings. Due to the serious security risks posed by physically adversarial examples, many studies have been conducted to evaluate the physically adversarial robustness of DNNs in recent years. In this paper, we provide a comprehensive survey of current physically adversarial attacks and defenses in computer vision. We establish a taxonomy by organizing physical attacks according to attack tasks, attack forms, and attack methods. This approach offers readers a systematic understanding of the topic from multiple perspectives. For physical defenses, we categorize them into pre-processing, in-processing, and post-processing for DNN models to ensure comprehensive coverage of adversarial defenses. Based on this survey, we discuss the challenges facing this research field and provide an outlook on future directions.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Builds on 139 of its 237 references that are in the map. First posted on arXiv 3 Nov 2022.

Builds on

139 of 237 references.

References · 139

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,852
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  7. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,849
  8. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,626
  9. 2017CARLA: An Open Urban Driving Simulatorcited by 2,449
  10. 2016Adversarial examples in the physical worldcited by 1,769
  11. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
  12. 2016YOLO9000: Better, Faster, Strongercited by 1,431
38 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  3. 2016A Point Set Generation Network for 3D Object Reconstruction from a Single Imagecited by 979
  4. 2018CosFace: Large Margin Cosine Loss for Deep Face Recognitioncited by 971
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  6. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  7. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  9. 2016Fully-Convolutional Siamese Networks for Object Trackingcited by 568
  10. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  11. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  12. 2017AirSim: High-Fidelity Visual and Physical Simulation for Autonomous Vehiclescited by 523
  13. 2017Countering Adversarial Images using Input Transformationscited by 520
  14. 2017Adversarial Patchcited by 517
  15. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  16. 2022Diffusion Models for Adversarial Purificationcited by 476
  17. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
  18. 2018SiamRPN++: Evolution of Siamese Visual Tracking with Very Deep Networkscited by 446
  19. 2019From Big to Small: Multi-Scale Local Planar Guidance for Monocular Depth Estimationcited by 382
  20. 2017Embodied Question Answeringcited by 336
  21. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
  22. 2018Fast Online Object Tracking and Segmentation: A Unifying Approachcited by 272
  23. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  24. 2019Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNetcited by 260
  25. 2018Adversarial Attacks and Defences: A Surveycited by 259
  26. 2017Detecting Adversarial Samples from Artifactscited by 245
  27. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  28. 2018Physical Adversarial Examples for Object Detectorscited by 163
  29. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  30. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  31. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  32. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
  33. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 152
  34. 2019Self-Driving Cars: A Surveycited by 148
  35. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 147
  36. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  37. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  38. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127

50 most cited of 139 All 139 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 1; 2025: 5; 2026: 1.

11 papers.

  1. 2023Unified Adversarial Patch for Visible-Infrared Cross-modal Attacks in the Physical Worldcited by 21
  2. 2023Physical Adversarial Attacks for Surveillance: A Surveycited by 15
  3. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Modelscited by 9
  4. 2023Improving Viewpoint Robustness for Visual Recognition via Adversarial Trainingcited by 7
  5. 2025DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Modelscited by 6
  6. 2023Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Surveycited by 5
  7. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  8. 2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
  9. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Modelscited by 0
  10. 2025BackWeak: Backdooring Knowledge Distillation Simply with Weak Triggers and Fine-tuningcited by 0
  11. 2026AI Security Research Should Better Incentivize Defense Researchcited by 0