Generating Visually Realistic Adversarial Patch
Not on the map. Why?
Abstract (arXiv)
Deep neural networks (DNNs) are vulnerable to various types of adversarial examples, bringing huge threats to security-critical applications. Among these, adversarial patches have drawn increasing attention due to their good applicability to fool DNNs in the physical world. However, existing works often generate patches with meaningless noise or patterns, making it conspicuous to humans. To address this issue, we explore how to generate visually realistic adversarial patches to fool DNNs. Firstly, we analyze that a high-quality adversarial patch should be realistic, position irrelevant, and printable to be deployed in the physical world. Based on this analysis, we propose an effective attack called VRAP, to generate visually realistic adversarial patches. Specifically, VRAP constrains the patch in the neighborhood of a real image to ensure the visual reality, optimizes the patch at the poorest position for position irrelevance, and adopts Total Variance loss as well as gamma transformation to make the generated patch printable without losing information. Empirical evaluations on the ImageNet dataset demonstrate that the proposed VRAP exhibits outstanding attack performance in the digital world. Moreover, the generated adversarial patches can be disguised as the scrawl or logo in the physical world to fool the deep models without being detected, bringing significant threats to DNNs-enabled applications.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 53 of its 67 references that are in the map. First posted on arXiv 5 Dec 2023.
Builds on
53 of 67 references.
References · 53
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
- 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
- 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
38 more
- 2016Adversarial examples in the physical worldcited by 1,762
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
- 2020Fast is better than free: Revisiting adversarial trainingcited by 723
- 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
- 2017Adversarial Patchcited by 514
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2019Simple Black-box Adversarial Attackscited by 249
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
- 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
- 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
- 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
- 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
- 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
- 2018LaVAN: Localized and Visible Adversarial Noisecited by 112
- 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
- 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
- 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
- 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
- 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 92
- 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
- 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
- 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
- 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
- 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
- 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
- 2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
- 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
- 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
- 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
- 2021Generative Dynamic Patch Attackcited by 19
- 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
- 2022Robust Textual Embedding against Word-level Adversarial Attackscited by 12
50 most cited of 53 All 53 (JSON)
Built on by
Citing papers per year: 2025: 1.
1 paper.