Research map / Adversarial robustness and security / Attacks on text and graphs
Latency and driving-perception attacks
Attack autonomous-driving perception by increasing latency or fooling multiple modules.
25 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2020–2026) · an approach in Attacks on text and graphs, keyword cluster “physical · object · patches”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
12 papers in 2023–24 and 10 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 4.3% to 2.1%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2020 · Fooling Detection Alone is Not Enough: Adversarial Attack against Multiple Object Tracking (ICLR 2020 · 54 citations)
- 2021 · Sequential Attacks on Kalman Filter-based Forward Collision Warning Systems (AAAI 2021 · 6 citations)
- 2022 · EyePAD++: A Distillation-Based Approach for Joint Eye Authentication and Presentation Attack Detection Using Periocular Images (CVPR 2022 · 11 citations)
- 2023 · SlowLiDAR: Increasing the Latency of LiDAR-Based Detection Using Adversarial Examples (CVPR 2023 · 33 citations)
- 2024 · SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · 22 citations)
- 2025 · Is Your Autonomous Vehicle Safe? Understanding the Threat of Electromagnetic Signal Injection Attacks on Traffic Scene Perception (AAAI 2025 · 5 citations)
- 2026 · All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inference (CVPR 2026 · 1 citation)
Earliest papers here
- Fooling Detection Alone is Not Enough: Adversarial Attack against Multiple Object Tracking (ICLR 2020 · 54 citations)
- Sequential Attacks on Kalman Filter-based Forward Collision Warning Systems (AAAI 2021 · 6 citations)
- EyePAD++: A Distillation-Based Approach for Joint Eye Authentication and Presentation Attack Detection Using Periocular Images (CVPR 2022 · 11 citations)
What has been tried
18 papers here report 171 measured changes (a component added, removed or swapped, compared with a baseline): helped 59%, no clear effect 9%, hurt 23%, mixed 8%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add score loss | MOT17, 2080 Ti, SORT (Y5) · R-Lat | 0.0 -> 50.9 | Helped | SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · 22 citations) |
| add object-area minimization loss | Adversarial example generation, batch size 16, NVIDIA V100 · time (s) | 180 -> 240 | Hurt | Overload: Latency Attacks on Object Detection for Edge Devices (CVPR 2024 · 19 citations) |
| Add the coordinate-shift loss (J_loc) | MS-COCO, Faster R-CNN (ResNet50) · mAP50 | Helped | NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors (AAAI 2025 · 5 citations) | |
| add PSO location search | nuScenes · ATD (m) | 7.212 -> 8.099 | Hurt | Enduring, Efficient and Robust Trajectory Prediction Attack in Autonomous Driving via Optimization-Driven Multi-Frame Perturbation Framework (CVPR 2025 · 3 citations) |
| Add EOT | Glass segmentation, digital world · MAE | 0.745 -> 0.719 (grid size 8); 0.735 -> 0.698 (grid size 16); 0.674 -> 0.678 (grid size 32) | Mixed | Fooling Polarization-Based Vision using Locally Controllable Polarizing Projection (CVPR 2024 · 3 citations) |
| Add model ensemble when generating the patch | Cross-model transfer · MRSR (ξr) | 0.009 -> 0.011; -0.023 -> -0.014; -0.067 -> -0.064 | No clear effect | Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · 2 citations) |
| add LResampleNet resampling to STIR | OTB100, VOT2019, and UAV123 under attacks · tracking score (precision or EAO) | 85.9 -> 86.9; 0.247 -> 0.255; 77.0 -> 77.7 | Helped | LRR: Language-Driven Resamplable Continuous Representation against Adversarial Tracking Attacks (ICLR 2024 · 1 citation) |
| Increase the mask size (unprotected area) | PASCAL-VOC · clean accuracy | Helped | Can't Slow Me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices (CVPR 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 5 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- MS-COCO · 2 of 5 papers
- PASCAL VOC · 2 of 5 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 22 papers; from OpenAlex and the papers' affiliations).
- Rochester Institute of Technology · 2 papers
- Purdue University · 2 papers
Use it
Download BibTeX of 24 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Biologically inspired robust vision (77 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Defenses against universal perturbations (97 papers)
- Vision-language model robustness (96 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Graph neural network robustness (71 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).