Research map / Adversarial robustness and security / Attacks on text and graphs
Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RFCoA, a perturbation-based black-box physical-world adversarial attack that injects target-class robust features into clean images via attention-based fusion and minimizes adversarial patterns for stealthiness.
Problem
Physical-world adversarial examples suffer from poor transferability, insufficient robustness to environmental changes (distance, angle, lighting), and a trade-off between attack effectiveness and stealthiness.
Approach
Deceptive RF injection covers robust features of the target class onto predictive features of clean images (via attention-weighted fusion in autoencoder feature space), and adversarial semantic pattern minimization uses a learned pattern mask with cognitive loss to keep only essential perturbation patterns.
Key results
- In the digital world, RFCoA reaches tASR 0.65 on WRN-50 and 0.96 on DenseNet-201... (see table: ours 0.79 on DN-201 digital)
- In the physical world, RFCoA achieves 0.60 tASR on WRN-50 and 0.92 on VGG-16 (white-box), outperforming C/P-A, TPA, RFLA and CleanSheet on nearly all black-box models.
- At 45-degree sampling angle on black-box models, RFCoA keeps tASR 0.22 vs at most 0.09 for baselines; SSIM 0.89 and LPIPS 0.14 are best among compared methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RFCoA instead of the strongest listed baseline | Targeted physical-world attacks on ImageNet classifiers · ImageNet, RN-101 | tASR: 0.22 -> 0.38 | Helped |
| Use RFCoA instead of the strongest listed baseline | Targeted physical-world attacks on ImageNet classifiers · ImageNet, WRN-50 | tASR: 0.21 -> 0.60 | Helped |
| Use RFCoA instead of the strongest listed baseline | Targeted attacks on ImageNet classifiers · ImageNet, ViT-b32, physical | tASR: 0.02 -> 0.14 | Helped |
| Use RFCoA rather than the strongest listed baseline | Physical-world attacks under varied capture distances · ImageNet, black-box models, 20cm | tASR: 0.12 -> 0.38 | Helped |
| Use RFCoA rather than the strongest listed baseline | Physical-world attacks under varied capture angles · ImageNet, black-box models, 45° | tASR: 0.09 -> 0.22 | Helped |
| Use RFCoA instead of RFLA | ImageNet adversarial examples · ImageNet | SSIM: 0.84 -> 0.89 | Helped |
| Use RFCoA instead of RFLA | ImageNet adversarial examples · ImageNet | LPIPS: 0.20 -> 0.14 | Helped |
| Append the target class name or related terms to the prompt | RFCoA with MiniGPT-4 · VQA | tASR: 0.36 -> 0.57 | Helped |
| Append the target class name or related terms to the prompt | RFCoA with MiniGPT-4 · Image description | tASR: 0.44 -> 0.65 | Helped |
| Append the target class name or related terms to the prompt | RFCoA with LLaVA · VQA | tASR: 0.32 -> 0.50 | Helped |
| Append the target class name or related terms to the prompt | RFCoA with LLaVA · Image description | tASR: 0.41 -> 0.57 | Helped |
Surprising findings
- Adversarial training (PGD-AT) reduces sensitivity to non-robust features but does not remove the injected robust features, so the attack remains effective against AT and DiffPure defenses (average tASR above 50%).
Limitations
- Physical-world evaluation uses only 100 printed AEs on 10cm white paper with a single iPhone camera.
- Attack on LVLMs achieves only moderate tASR (0.32-0.65), and the paper does not analyze other physical conditions such as lighting.
Experimental setup
Datasets: ImageNet ILSVRC 2012
Benchmarks: ImageNet ILSVRC 2012
Metrics: target attack success rate clean accuracy SSIM LPIPS
Baselines: C/P Attack TPA RFLA CleanSheet
Builds on: minimal cognitive pattern Grad-CAM expectation over transformation
Closest papers by meaning
- Connecting the Digital and Physical World: Improving the Robustness of Adversarial Attacks (AAAI 2019 · similarity 0.91)
- Robust Physical-World Attacks on Deep Learning Visual Classification (CVPR 2018 · similarity 0.90)
- Cross-Domain Transferability of Adversarial Perturbations (NeurIPS 2019 · similarity 0.89)
- Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks (CVPR 2019 · similarity 0.88)
- Pixel2Feature Attack (P2FA): Rethinking the Perturbed Space to Enhance Adversarial Transferability (ICML 2025 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.