% Key papers for Adversarial perturbations beyond images (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{cvpr2018_robust_13543,
  title = {{Robust Physical-World Attacks on Deep Learning Visual Classification}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2018},
  url = {https://openaccess.thecvf.com/content_cvpr_2018/html/Eykholt_Robust_Physical-World_Attacks_CVPR_2018_paper.html},
}

@inproceedings{icml2018_synthesizing_37026,
  title = {{Synthesizing Robust Adversarial Examples}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2018},
  url = {https://icml.cc/virtual/2018/poster/2307},
}

@inproceedings{cvpr2018_generative_13150,
  title = {{Generative Adversarial Perturbations}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2018},
  url = {https://openaccess.thecvf.com/content_cvpr_2018/html/Poursaeed_Generative_Adversarial_Perturbations_CVPR_2018_paper.html},
}

@inproceedings{cvpr2018_on_13443,
  title = {{On the Robustness of Semantic Segmentation Models to Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2018},
  url = {https://openaccess.thecvf.com/content_cvpr_2018/html/Arnab_On_the_Robustness_CVPR_2018_paper.html},
}

@inproceedings{cvpr2019_comdefend_13947,
  title = {{ComDefend: An Efficient Image Compression Model to Defend Adversarial Examples}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{iclr2018_spatially_28570,
  title = {{Spatially Transformed Adversarial Examples}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/18},
}

@inproceedings{cvpr2019_feature_14203,
  title = {{Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examples}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2020_a_15080,
  title = {{A Self-supervised Approach for Adversarial Robustness}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{aaai2019_perceptual_100185,
  title = {{Perceptual-Sensitive GAN for Generating Adversarial Patches}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2019},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/3893},
}

@inproceedings{cvpr2020_physically_16036,
  title = {{Physically Realizable Adversarial Examples for LiDAR Object Detection}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{icml2019_imperceptible_37436,
  title = {{Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2019},
  url = {https://icml.cc/virtual/2019/poster/4300},
}

@inproceedings{cvpr2019_sparsefool_14850,
  title = {{SparseFool: A Few Pixels Make a Big Difference}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2021_dual_16906,
  title = {{Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{neurips2018_adversarial_56845,
  title = {{Adversarial Examples that Fool both Computer Vision and Time-Limited Humans}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2018},
  url = {https://nips.cc/virtual/2018/poster/11389},
}

@inproceedings{cvpr2020_physgan_16035,
  title = {{PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2022_frequency_18885,
  title = {{Frequency-Driven Imperceptible Adversarial Attack on Semantic Similarity}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2022},
}

@inproceedings{cvpr2019_adversarial_13832,
  title = {{Adversarial Attacks Beyond the Image Space}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2021_adversarial_16584,
  title = {{Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{aaai2019_sparse_103528,
  title = {{Sparse Adversarial Perturbations for Videos}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2019},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/4927},
}

@inproceedings{cvpr2018_art_12846,
  title = {{Art of Singular Vectors and Universal Adversarial Perturbations}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2018},
  url = {https://openaccess.thecvf.com/content_cvpr_2018/html/Khrulkov_Art_of_Singular_CVPR_2018_paper.html},
}

@inproceedings{cvpr2024_transferable_25085,
  title = {{Transferable Structural Sparse Adversarial Attack Via Exact Group Sparsity Training}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/30057},
}

@inproceedings{aaai2024_nerfail_6750,
  title = {{NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/30113},
}

@inproceedings{aaai2025_breaking_8299,
  title = {{Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32870},
}

@inproceedings{aaai2024_attacking_5215,
  title = {{Attacking CNNs in Histopathology with SNAP: Sporadic and Naturalistic Adversarial Patches (Student Abstract)}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2024},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/30468},
}

@inproceedings{cvpr2024_slowformer_24838,
  title = {{SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/29941},
}

@inproceedings{cvpr2025_advancing_25449,
  title = {{Advancing Adversarial Robustness in GNeRFs: The IL2-NeRF Attack}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/32423},
}

@inproceedings{neurips2024_desparsify_71113,
  title = {{DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/96104},
}

@inproceedings{neurips2025_latency_76866,
  title = {{Latency NMS Attacks: Is It Real Life or Is It Just Fantasy?}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=Nk9QDWOFt8},
}

@inproceedings{neurips2025_impact_77246,
  title = {{IMPACT: Irregular Multi-Patch Adversarial Composition Based on Two‑Phase Optimization}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=RsZv37DGka},
}

@inproceedings{neurips2025_advedm_78926,
  title = {{AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=jmLCBLeEC4},
}

@inproceedings{neurips2025_towards_79993,
  title = {{Towards Irreversible Attack: Fooling Scene Text Recognition via Multi-Population Coevolution Search}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=v31jzDdDts},
}

@inproceedings{iclr2026_concept_86688,
  title = {{Concept-based Adversarial Attack: a Probabilistic Perspective}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2026},
  url = {https://openreview.net/forum?id=SoVgrFEgWt},
}