mlsanityData to 14 Oct 2026

Adversarial Examples in the Physical World: A Survey

arXiv 2311.01473 ↗First posted 1 Nov 2023cs.CV cs.AI cs.LGcited by 10

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) have demonstrated high vulnerability to adversarial examples, raising broad security concerns about their applications. Besides the attacks in the digital world, the practical implications of adversarial examples in the physical world present significant challenges and safety concerns. However, current research on physical adversarial examples (PAEs) lacks a comprehensive understanding of their unique characteristics, leading to limited significance and understanding. In this paper, we address this gap by thoroughly examining the characteristics of PAEs within a practical workflow encompassing training, manufacturing, and re-sampling processes. By analyzing the links between physical adversarial attacks, we identify manufacturing and re-sampling as the primary sources of distinct attributes and particularities in PAEs. Leveraging this knowledge, we develop a comprehensive analysis and classification framework for PAEs based on their specific characteristics, covering over 100 studies on physical-world adversarial examples. Furthermore, we investigate defense strategies against PAEs and identify open challenges and opportunities for future research. We aim to provide a fresh, thorough, and systematic understanding of PAEs, thereby promoting the development of robust adversarial learning and its application in open-world scenarios to provide the community with a continuously updated list of physical world adversarial sample resources, including papers, code, etc, within the proposed framework

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Builds on 110 of its 165 references that are in the map. First posted on arXiv 1 Nov 2023.

Builds on

110 of 165 references.

References · 110

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2016Adversarial examples in the physical worldcited by 1,769
  6. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
  7. 2019Soft Rasterizer: A Differentiable Renderer for Image-based 3D Reasoningcited by 420
  8. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  9. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 274
  10. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  11. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
  12. 2018Physical Adversarial Examples for Object Detectorscited by 163
38 more
  1. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 163
  2. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  3. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  4. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
  5. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  6. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  7. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  8. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  9. 2020Certified Defenses for Adversarial Patchescited by 101
  10. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  11. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  12. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  13. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
  14. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  15. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  16. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  17. 2017A General Framework for Adversarial Examples with Objectivescited by 84
  18. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 79
  19. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  20. 2021FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attackcited by 74
  21. 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 70
  22. 2017Adversarial Attacks Beyond the Image Spacecited by 67
  23. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  24. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  25. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  26. 2019Training Robust Deep Neural Networks via Adversarial Noise Propagationcited by 62
  27. 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
  28. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  29. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 59
  30. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  31. 2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
  32. 2022DTA: Physical Camouflage Attacks using Differentiable Transformation Networkcited by 51
  33. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  34. 2020SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbationscited by 50
  35. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  36. 2020Unadversarial Examples: Designing Objects for Robust Visioncited by 45
  37. 2018Robust Audio Adversarial Example for a Physical Attackcited by 44
  38. 2022Towards Practical Certifiable Patch Defense with Vision Transformercited by 44

50 most cited of 110 All 110 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 3; 2025: 3; 2026: 4.

10 papers.

  1. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  2. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  3. 2024DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Timecited by 4
  4. 2025AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systemscited by 4
  5. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Modelscited by 0
  6. 2025NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbationscited by 0
  7. 2026On the Adversarial Robustness of 3D Large Vision-Language Modelscited by 0
  8. 2026Physical Adversarial Attacks on AI Surveillance Systems:Detection, Tracking, and Visible--Infrared Evasioncited by 0
  9. 2026AdvTiles: Physical Adversarial Camouflage Clothing against Person Detectors via Learnable Tilescited by 0
  10. 2026FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Modelscited by 0