mlsanityData to 7 Oct 2026

A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks

arXiv 2310.00633 ↗First posted 1 Oct 2023cs.LG cs.AIcited by 19

Not on the map. Why?

Abstract (arXiv)

Benefiting from the rapid development of deep learning, 2D and 3D computer vision applications are deployed in many safe-critical systems, such as autopilot and identity authentication. However, deep learning models are not trustworthy enough because of their limited robustness against adversarial attacks. The physically realizable adversarial attacks further pose fatal threats to the application and human safety. Lots of papers have emerged to investigate the robustness and safety of deep learning models against adversarial attacks. To lead to trustworthy AI, we first construct a general threat model from different perspectives and then comprehensively review the latest progress of both 2D and 3D adversarial attacks. We extend the concept of adversarial examples beyond imperceptive perturbations and collate over 170 papers to give an overview of deep learning model robustness against various adversarial attacks. To the best of our knowledge, we are the first to systematically investigate adversarial attacks for 3D models, a flourishing field applied to many real-world applications. In addition, we examine physical adversarial attacks that lead to safety violations. Last but not least, we summarize present popular topics, give insights on challenges, and shed light on future research on trustworthy AI.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 146 of its 178 references that are in the map. First posted on arXiv 1 Oct 2023.

Builds on

146 of 178 references.

References · 146

  1. 2017Attention Is All You Needcited by 59,932
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2016PointNet: Deep Learning on Point Sets for 3D Classification and Segmentationcited by 5,223
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  9. 2018Dynamic Graph CNN for Learning on Point Cloudscited by 2,220
  10. 2016Adversarial examples in the physical worldcited by 1,762
  11. 2020Point Transformercited by 1,462
  12. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
38 more
  1. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  2. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  3. 2016Colorful Image Colorizationcited by 1,113
  4. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  5. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  6. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  7. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  8. 2016Universal adversarial perturbationscited by 774
  9. 2020PCT: Point cloud transformercited by 730
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  11. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  13. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  14. 2017One pixel attack for fooling deep neural networkscited by 579
  15. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  16. 2017Adversarial Patchcited by 514
  17. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  18. 2022Diffusion Models for Adversarial Purificationcited by 469
  19. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  20. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  21. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  22. 2017Neural 3D Mesh Renderercited by 437
  23. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  24. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  25. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  26. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  27. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  28. 2019Simple Black-box Adversarial Attackscited by 249
  29. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  30. 2018Spatially Transformed Adversarial Examplescited by 195
  31. 2017Generating Natural Adversarial Examplescited by 182
  32. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  33. 2017The Space of Transferable Adversarial Examplescited by 156
  34. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  35. 2017Generative Adversarial Perturbationscited by 153
  36. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
  37. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
  38. 2019Enhancing Adversarial Example Transferability with an Intermediate Level Attackcited by 139

50 most cited of 146 All 146 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 8; 2025: 7; 2026: 4.

19 papers.

Sort:

By area:

  1. 2025A Neurosymbolic Framework for Interpretable Cognitive Attack Detection in Augmented Realitycited by 8
  2. 2024Feint and Attack: Attention-Based Strategies for Jailbreaking and Protecting LLMscited by 5
  3. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  4. 2024Attack Anything: Blind DNNs via Universal Background Adversarial Attackcited by 3
  5. 2024Navigating Threats: A Survey of Physical Adversarial Attacks on LiDAR Perception Systems in Autonomous Vehiclescited by 3
  6. 2024RenderBender: A Survey on Adversarial Attacks Using Differentiable Renderingcited by 3
  7. 2024A Survey of Neural Network Robustness Assessment in Image Recognitioncited by 2
  8. 2024Joint Universal Adversarial Perturbations with Interpretationscited by 2
  9. 2025GSBAK: top-K Geometric Score-based Black-box Attackcited by 2
  10. 20253DGAA: Realistic and Robust 3D Gaussian-based Adversarial Attack for Autonomous Drivingcited by 2
  11. 2025An Investigation of Visual Foundation Models Robustnesscited by 2
  12. 2026RESQ: A Unified Framework for REliability- and Security Enhancement of Quantized Deep Neural Networkscited by 1
7 more
  1. 2024Deep Learning Under Siege: Identifying Security Vulnerabilities and Risk Mitigation Strategiescited by 0
  2. 2024On the Robustness of Machine Learning Models in Predicting Thermodynamic Properties: a Case of Searching for New Quasicrystal Approximantscited by 0
  3. 20253D Gaussian Splat Vulnerabilitiescited by 0
  4. 2025ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflagescited by 0
  5. 2026QShield: Securing Neural Networks Against Adversarial Attacks using Quantum Circuitscited by 0
  6. 2026Towards Universal Physical Adversarial Attacks via a Joint Multi-Objective and Multi-Model Optimization Frameworkcited by 0
  7. 2026Privacy-Preserving Action Recognition: Taxonomy, Methods, and Privacy-Utility Trade-offscited by 0