mlsanityData to 7 Oct 2026

Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectors

arXiv 2303.04238 ↗First posted 7 Mar 2023cs.CV cs.AI cs.NEcited by 5

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks on deep learning models have received increased attention in recent years. Work in this area has mostly focused on gradient-based techniques, so-called 'white-box' attacks, where the attacker has access to the targeted model's internal parameters; such an assumption is usually untenable in the real world. Additionally, some attacks use the entire pixel space to fool a given model, which is neither practical nor physical. To accommodate these problems we propose the BBNP algorithm (Black-Box Naturalistic Patch): a direct, black-box, naturalistic, gradient-free method that uses the learned image manifold of a pretrained, generative adversarial network (GAN) to generate naturalistic adversarial patches for object detectors. This method performs model-agnostic black-box naturalistic attacks on object detection models by relying solely on the outputs of the model. Comparing our approach against five models, five black-box and two white-box attacks, we show that our proposed method achieves state-of-the-art results, outperforming all other tested black-box approaches.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 41 of its 64 references that are in the map. First posted on arXiv 7 Mar 2023.

Builds on

41 of 64 references.

References · 41

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  8. 2022Generative Adversarial Networkscited by 5,603
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  11. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  12. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
29 more
  1. 2018YOLOv3: An Incremental Improvementcited by 2,652
  2. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  3. 2019Searching for MobileNetV3cited by 1,984
  4. 2016Adversarial examples in the physical worldcited by 1,762
  5. 2020YOLOv4: Optimal Speed and Accuracy of Object Detectioncited by 1,624
  6. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  7. 2016Least Squares Generative Adversarial Networkscited by 1,000
  8. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  9. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  10. 2017Adversarial Patchcited by 514
  11. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  12. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  13. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  14. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  15. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  16. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  17. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  18. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  19. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  20. 2017A General Framework for Adversarial Examples with Objectivescited by 82
  21. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  22. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  23. 2017TextureGAN: Controlling Deep Image Synthesis with Texture Patchescited by 47
  24. 2022Generating natural images with direct Patch Distributions Matchingcited by 26
  25. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  26. 2022Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarioscited by 20
  27. 2021Training Meta-Surrogate Model for Transferable Adversarial Attackcited by 15
  28. 2022Foiling Explanations in Deep Neural Networkscited by 14
  29. 2022An Evolutionary, Gradient-Free, Query-Efficient, Black-Box Algorithm for Generating Adversarial Instances in Deep Networkscited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 2; 2026: 1.

5 papers.

  1. 2024Enhancing Object Detection Robustness: Detecting and Restoring Confidence in the Presence of Adversarial Patch Attackscited by 2
  2. 2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 2
  3. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  4. 2025PolyJuice Makes It Real: Black-Box, Universal Red Teaming for Synthetic Image Detectorscited by 1
  5. 2026Budget-Aware Adaptive Adversarial Patches for Black-Box Object Detectioncited by 0