Research map / Adversarial robustness and security / Attacks on text and graphs
Beyond Digital Domain: Fooling Deep Learning Based Recognition System in Physical World
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| perturb whole plate background (mask 2) instead of only blank left part (mask 1) (ablation) | physical adversarial license plate · SSD Inception indoor | detection rate (%): 29.4% -> 11.2% | Helped |
| perturb whole plate background (mask 2) instead of only blank left part (mask 1) (ablation) | physical adversarial license plate · SSD Inception outdoor | detection rate (%): 79.9% -> 26.8% | Helped |
| exclude character area from perturbation (mask 3 vs mask 2) (ablation) | physical adversarial license plate · YOLO commercial API indoor | detection rate (%): 0.2% -> 73.0% | Hurt |
| transfer mask 2 plate from SSD Inception to Faster R-CNN | physical adversarial license plate · Faster R-CNN indoor | detection rate (%): 94.8% -> 9.1% | Helped |
| transfer mask 2 plate to commercial YOLO API | physical adversarial license plate · YOLO commercial API indoor | detection rate (%): 95.8% -> 0.2% | Helped |
| transfer mask 2 plate to non-DNN OpenALPR | physical adversarial license plate · OpenALPR outdoor | detection rate (%): 100.0% -> 0.3% | Helped |
| deploy defense: adversarial training (ablation) | SSD model vs mask 2 attack · indoor | detection rate (%): 11.2% -> 64.7% | Hurt |
| deploy defense: distillation (ablation) | SSD model vs mask 2 attack · indoor | detection rate (%): 11.2% -> 1.8% | No clear effect |
| deploy defense: input transformation (ablation) | SSD model vs mask 2 attack · indoor | detection rate (%): 11.2% -> 13.4% | No clear effect |
| move from indoor to outdoor environment | physical adversarial license plate mask 1 · SSD Inception | detection rate (%): 29.4% -> 79.9% | Hurt |
Closest papers by meaning
- Robust Physical-World Attacks on Deep Learning Visual Classification (CVPR 2018 · similarity 0.89)
- Full-Distance Evasion of Pedestrian Detectors in the Physical World (NeurIPS 2024 · similarity 0.86)
- NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors (AAAI 2025 · similarity 0.85)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.84)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.84)
- Adversarial Attacks on Event-Based Pedestrian Detectors: A Physical Approach (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.