Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Attacks Beyond the Image Space
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Attack physical scene parameters instead of image pixels | ShapeNetCore-v2 classification, AlexNet · ShapeNetCore-v2 | attack success rate: 100.00 -> 94.42 | Hurt |
| Attack physical scene parameters instead of image pixels | ShapeNetCore-v2 classification, ResNet-34 · ShapeNetCore-v2 | attack success rate: 99.57 -> 94.85 | Hurt |
| Attack physical scene parameters instead of image pixels | CLEVR visual question answering, IEP · CLEVR | attack success rate: 96.33 -> 90.67 | Hurt |
| Jointly perturb surface normals, illumination, and material rather than surface normals alone (ablation) | ShapeNetCore-v2 classification, AlexNet · ShapeNetCore-v2 | attack success rate: 89.27 -> 94.42 | Helped |
| Jointly perturb surface normals, illumination, and material rather than surface normals alone (ablation) | ShapeNetCore-v2 classification, ResNet-34 · ShapeNetCore-v2 | attack success rate: 88.41 -> 94.85 | Helped |
| Jointly perturb surface normals, illumination, and material rather than surface normals alone (ablation) | CLEVR visual question answering, IEP · CLEVR | attack success rate: 83.67 -> 90.67 | Helped |
| Perturb surface normals rather than illumination or material (ablation) | ShapeNetCore-v2 classification · ShapeNetCore-v2 | attack success rate: 89.27 vs 29.61 and 18.88 (AlexNet); 88.41 vs 14.16 and 3.43 (ResNet-34) | Helped |
| Perturb surface normals rather than illumination or material (ablation) | CLEVR visual question answering, IEP · CLEVR | attack success rate: 83.67 vs 48.67 and 8.33 | Helped |
| Use image-space perturbations rather than combined physical-space perturbations | ShapeNetCore-v2 classification, AlexNet · ShapeNetCore-v2 | perceptibility p (10^-3): 18.1 -> 5.7 | Helped |
| Use image-space perturbations rather than combined physical-space perturbations | ShapeNetCore-v2 classification, ResNet-34 · ShapeNetCore-v2 | perceptibility p (10^-3): 16.4 -> 5.1 | Helped |
| Use image-space perturbations rather than combined physical-space perturbations | CLEVR visual question answering, IEP · CLEVR | perceptibility p (10^-3): 8.8 -> 2.1 | Helped |
| Add rotation perturbation to a color attack (ablation) | Non-differentiable ShapeNet object classification, second example · ShapeNetCore-v2 | accuracy drop: 26% | Helped |
Closest papers by meaning
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.88)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.88)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.88)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.87)
- Contrasting Adversarial Perturbations: The Space of Harmless Perturbations (AAAI 2025 · similarity 0.87)
- NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.