mlsanityData to 7 Oct 2026

REAP: A Large-Scale Realistic Adversarial Patch Benchmark

arXiv 2212.05680 ↗First posted 12 Dec 2022cs.CV cs.AI cs.CRcited by 17

Not on the map. Why?

Abstract (arXiv)

Machine learning models are known to be susceptible to adversarial perturbation. One famous attack is the adversarial patch, a sticker with a particularly crafted pattern that makes the model incorrectly predict the object it is placed on. This attack presents a critical threat to cyber-physical systems that rely on cameras such as autonomous cars. Despite the significance of the problem, conducting research in this setting has been difficult; evaluating attacks and defenses in the real world is exceptionally costly while synthetic data are unrealistic. In this work, we propose the REAP (REalistic Adversarial Patch) benchmark, a digital benchmark that allows the user to evaluate patch attacks on real images, and under real-world conditions. Built on top of the Mapillary Vistas dataset, our benchmark contains over 14,000 traffic signs. Each sign is augmented with a pair of geometric and lighting transformations, which can be used to apply a digitally generated patch realistically onto the sign. Using our benchmark, we perform the first large-scale assessments of adversarial patch attacks under realistic conditions. Our experiments suggest that adversarial patch attacks may present a smaller threat than previously believed and that the success rate of an attack on simpler digital simulations is not predictive of its actual effectiveness in practice. We release our benchmark publicly at https://github.com/wagner-group/reap-benchmark.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Builds on 50 of its 76 references that are in the map. First posted on arXiv 12 Dec 2022.

Builds on

50 of 76 references.

References · 50

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  5. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2022A ConvNet for the 2020scited by 3,545
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2017CARLA: An Open Urban Driving Simulatorcited by 2,431
  12. 2016Adversarial examples in the physical worldcited by 1,762
38 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2022DINO: DETR with Improved DeNoising Anchor Boxes for End-to-End Object Detectioncited by 1,306
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  4. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  5. 2016Universal adversarial perturbationscited by 774
  6. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  8. 2017Adversarial Patchcited by 514
  9. 2019Kornia: an Open Source Differentiable Computer Vision Library for PyTorchcited by 231
  10. 2020Understanding and Improving Fast Adversarial Trainingcited by 213
  11. 2018Physical Adversarial Examples for Object Detectorscited by 163
  12. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  13. 2017The Space of Transferable Adversarial Examplescited by 156
  14. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  15. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  16. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  17. 2021You Only Look One-level Featurecited by 116
  18. 2018LaVAN: Localized and Visible Adversarial Noisecited by 112
  19. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  20. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  21. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  22. 2018Adversarial examples from computational constraintscited by 79
  23. 2020Understanding Catastrophic Overfitting in Single-step Adversarial Trainingcited by 75
  24. 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
  25. 2020Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attackcited by 64
  26. 2019Efficient Adversarial Training with Transferable Adversarial Examplescited by 54
  27. 2018DARTS: Deceiving Autonomous Cars with Toxic Signscited by 53
  28. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  29. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  30. 20213DB: A Framework for Debugging Computer Vision Modelscited by 31
  31. 2019APRICOT: A Dataset of Physical Adversarial Attacks on Object Detectioncited by 30
  32. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  33. 2022ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patchescited by 27
  34. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  35. 2020Dynamic Adversarial Patch for Evading Object Detection Modelscited by 20
  36. 2021Universal Adversarial Training with Class-Wise Perturbationscited by 13
  37. 2022ANTI-CARLA: An Adversarial Testing Framework for Autonomous Vehicles in CARLAcited by 8
  38. 2022Synthetic Dataset Generation for Adversarial Machine Learning Researchcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 3; 2025: 4; 2026: 7.

17 papers.

Sort:

By area:

  1. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  2. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  3. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
  4. 2023A Comprehensive Study on the Robustness of Image Classification and Object Detection in Remote Sensing: Surveying and Benchmarkingcited by 5
  5. 2024Secure Traffic Sign Recognition: An Attention-Enabled Universal Image Inpainting Mechanism against Light Patch Attackscited by 4
  6. 2025AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systemscited by 4
  7. 2025TabAttackBench: A Benchmark for Adversarial Attacks on Tabular Datacited by 4
  8. 2025Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systemscited by 2
  9. 2026AdvSerial: Physical Adversarial Attacks on Infrastructure-mounted Pedestrian Detectors via Semantic Feature Suppressioncited by 1
  10. 2024PADetBench: Towards Benchmarking Physical Attacks against Object Detectioncited by 0
  11. 2025VISAT: Benchmarking Adversarial and Distribution Shift Robustness in Traffic Sign Recognition with Visual Attributescited by 0
  12. 2026Diffusion-Driven Deceptive Patches: Adversarial Manipulation and Forensic Detection in Facial Identity Verificationcited by 0
5 more
  1. 2026Physical Evaluation of Naturalistic Adversarial Patches for Camera-Based Traffic-Sign Detectioncited by 0
  2. 2026Physical Adversarial Attacks on AI Surveillance Systems:Detection, Tracking, and Visible--Infrared Evasioncited by 0
  3. 2026AdvScene: Rethinking Adversarial Patch Evaluation Through Scene Robustnesscited by 0
  4. 2026Hybrid Robustness Verification for Spatio-Temporal Neural Networkscited by 0
  5. 2026TwinIR: Coordinated Invisible Dual-Point Attacks on Online HD Map Constructioncited by 0