Timeline.md

Order by Time

We track the latest work on Physical-Adversarial-Attack and organize them in the table below in chronological order.

Feel free to submit issues for addition. Thanks! (:heart::heart::heart:)

🔈🔈🔈 Notice: Updated to 2022.12.31⏰

2023

No.	Title	Victim Task	Paper	Code	Venue
1	TPatch: A Triggered Physical Adversarial Patch	Detection	link	link	USENIX Security

2022

No.	Title	Victim Task	Paper	Code	Venue
1	Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks	Semantic Segmentation	link	link	WACV
2	Harnessing Perceptual Adversarial Patches for Crowd Counting	Crowd Counting	link	link	ACM CCS
3	Learning Coated Adversarial Camouflages for Object Detectors	Vehicle Detection	link	---	IJCAI
4	FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attack	Vehicle Detection	link	link	AAAI
5	Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches	Depth Estimation	link	---	ECCV
6	Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon	Classification	link	link	CVPR
7	Adversarial Color Film: Effective Physical-World Attack to DNNs	Classification	link	---	Arxiv
8	DTA: Physical Camouflage Attacks using Differentiable Transformation Network	Vehicle Detection	link	---	CVPR
9	Adversarial Texture for Fooling Person Detectors in the Physical World	Person Detection	link	link	CVPR
10	Infrared Invisible Clothing: Hiding From Infrared Detectors at Multiple Angles in Real World	Person Detection	link	---	CVPR
11	Isometric 3D Adversarial Examples in the Physical World	3D Point Cloud Recognition	link	---	NIPS
12	Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks	Face Recognition	link	link	TPAMI

2021

No.	Title	Victim Task	Paper	Code	Venue
1	Too Good to Be Safe: Tricking Lane Detection in Autonomous Driving with Crafted Perturbations	Lane detection	link	---	USENIX Security
2	Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect	Classification	link	link	CVPR
3	Adversarial imaging pipelines	Classification	link	---	CVPR
4	Meta-Attack: Class-agnostic and Model-agnostic Physical Adversarial Attack	Classification	link	---	ICCV
5	Optical Adversarial Attack	Classification	link	---	ICCV
6	Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink	Classification	link	link	CVPR
7	The Translucent Patch: A Physical and Universal Attack on Object Detectors	Detection	link	---	CVPR
8	Naturalistic Physical Adversarial Patch for Object Detectors	Person Detection	link	link	ICCV
9	Legitimate Adversarial Patches: Evading Human Eyes and Detection Models in the Physical World	Person Detection	link	---	ACM MM
10	SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations	Sign Detection	link	link	USENIX SECURITY
11	Fooling Thermal Infrared Pedestrian Detectors in Real World Using Small Bulbs	Person Detection	link	---	AAAI
12	Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition	Face Recognition	link	link	IJCAI
13	Poltergeist: Acoustic Adversarial Machine Learning against Cameras and Computer Vision	Detection	link	link	IEEE SP

2020

No.	Title	Victim Task	Paper	Code	Venue
1	Bias-based universal adversarial patch attack for automatic check-out	Classification	link	---	ECCV
2	Adversarial camouflage: Hiding physical-world attacks with natural styles	Classification	link	link	CVPR
3	Physgan: Generating physical-world-resilient adversarial examples for autonomous driving	Classification	link	---	CVPR
4	Physical adversarial attack on vehicle detector in the carla simulator	Vehicle Detection	link	---	Arxiv
5	Adversarial T-shirt! Evading Person Detectors in A Physical World	Person Detection	link	link	ECCV
6	Universal Physical Camouflage Attacks on Object Detectors	Detection	link	link	CVPR
7	Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors	Person Detection	link	link	ECCV
8	Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study	Face Recognition	link	---	CVPRW
9	Advhat: Real-world adversarial attack on arcface face id system	Face Recognition	link	link	ICPR

2019

No.	Title	Victim Task	Paper	Code	Venue
1	Attacking Optical Flow	Optical Flow Estimation	link	link	ICCV
2	Adversarial camera stickers: A physical camera-based attack on deep learning systems	Classification	link	link	PMLR
3	Perceptual-sensitive gan for generating adversarial patches	Classification	link	---	AAAI
4	Fooling automated surveillance cameras: adversarial patches to attack person detection	Detection	link	link	CVPRW
5	AdvPattern: physical-world attacks on deep person re-identification via adversarially transformable patterns	Person Re-ID	link	link	ICCV
6	On Adversarial Patches: Real-World Attack on ArcFace-100 Face Recognition System	Face Recognition	link	---	SIBIRCON

2018

No.	Title	Victim Task	Paper	Code	Venue
1	Robust Physical-World Attacks on Deep Learning Visual Classification	Classification	link	link	CVPR
2	Adversarial examples in the physical world	Classification	link	link	AISS
3	Synthesizing robust adversarial examples	Classification	link	link	PMLR
4	CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild	Vehicle Detection	link	---	ICLR
5	Physical Adversarial Examples for Object Detectors	Detection	link	---	USENIX Workshop

2017

No.	Title	Victim Task	Paper	Code	Venue
1	Adversarial Patch	Classification	link	link	NIPS

2016

No.	Title	Victim Task	Paper	Code	Venue
1	Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition	Face Recognition	link	link	ACM SIGSAC

⬆ top