{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T17:55:26Z","timestamp":1776275726425,"version":"3.50.1"},"reference-count":186,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"name":"Technology Innovation Institute (TII) under the \u201cCASTLE: Cross-Layer Security for Machine Learning Systems Internet of Things (IoT)\u201d Project"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/access.2023.3321118","type":"journal-article","created":{"date-parts":[[2023,10,2]],"date-time":"2023-10-02T18:03:09Z","timestamp":1696269789000},"page":"109617-109668","source":"Crossref","is-referenced-by-count":42,"title":["Physical Adversarial Attacks for Camera-Based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook"],"prefix":"10.1109","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8992-7958","authenticated-orcid":false,"given":"Amira","family":"Guesmi","sequence":"first","affiliation":[{"name":"EBrain Laboratory, Division of Engineering, New York University (NYU), Abu Dhabi, United Arab Emirates"}]},{"given":"Muhammad Abdullah","family":"Hanif","sequence":"additional","affiliation":[{"name":"EBrain Laboratory, Division of Engineering, New York University (NYU), Abu Dhabi, United Arab Emirates"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6534-9295","authenticated-orcid":false,"given":"Bassem","family":"Ouni","sequence":"additional","affiliation":[{"name":"AI and Digital Science Research Center, Technology Innovation Institute (TII), Abu Dhabi, United Arab Emirates"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2607-8135","authenticated-orcid":false,"given":"Muhammad","family":"Shafique","sequence":"additional","affiliation":[{"name":"EBrain Laboratory, Division of Engineering, New York University (NYU), Abu Dhabi, United Arab Emirates"}]}],"member":"263","reference":[{"key":"ref57","article-title":"AdvRain: Adversarial raindrops to attack camera-based smart vision systems","author":"guesmi","year":"2023","journal-title":"arXiv 2303 01338"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN55064.2022.9892612"},{"key":"ref59","article-title":"Rogue signs: Deceiving traffic sign recognition with malicious ads and logos","author":"sitawarin","year":"2018","journal-title":"arXiv 1801 02780"},{"key":"ref58","article-title":"DARTS: Deceiving autonomous cars with toxic signs","author":"sitawarin","year":"2018","journal-title":"arXiv 1802 06430"},{"key":"ref53","first-page":"33093","article-title":"Robust feature-level adversaries are interpretability tools","volume":"35","author":"casper","year":"2022","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3198857"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/VR51125.2022.00073"},{"key":"ref168","article-title":"Feasibility of inconspicuous GAN-generated adversarial patches against object detection","author":"pavlitskaya","year":"2022","journal-title":"arXiv 2207 07347"},{"key":"ref54","article-title":"Adversarial color film: Effective physical-world attack to DNNs","author":"hu","year":"2022","journal-title":"arXiv 2209 02430"},{"key":"ref169","first-page":"1","article-title":"CARLA: An open urban driving simulator","author":"dosovitskiy","year":"2017","journal-title":"Proc Conf Robot Learn"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00411"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1145\/383259.383320"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3087709"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3127849"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2001.990517"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01580"},{"key":"ref176","author":"giorgianni","year":"1998","journal-title":"Digital Color Management Encoding Solutions"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1016\/j.cub.2004.09.041"},{"key":"ref174","year":"2023","journal-title":"Face++"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00546"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1145\/3306346.3323035"},{"key":"ref46","article-title":"Light lies: Optical adversarial attack","author":"kim","year":"2021","journal-title":"arXiv 2106 09908"},{"key":"ref45","article-title":"ViewFool: Evaluating the robustness of visual recognition to adversarial viewpoints","author":"dong","year":"2022","journal-title":"arXiv 2210 03895"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01443"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00769"},{"key":"ref42","article-title":"Bias-based universal adversarial patch attack for automatic check-out","author":"liu","year":"2020","journal-title":"arXiv 2005 09257"},{"key":"ref41","first-page":"1","article-title":"Poster: Perceived adversarial examples","author":"man","year":"2019","journal-title":"Proc IEEE Symp Secur Privacy"},{"key":"ref44","first-page":"975","article-title":"Watch out! Motion is blurring the vision of your deep neural networks","volume":"33","author":"guo","year":"2020","journal-title":"Advances in neural information processing systems"},{"key":"ref179","article-title":"Face recognition vendor test (FRVT): Performance of face identification algorithms","author":"grother","year":"2014"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413976"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01579"},{"key":"ref8","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2014","journal-title":"arXiv 1412 6572"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.527"},{"key":"ref7","first-page":"601","article-title":"Stealing machine learning models via prediction APIs","author":"tram\u00e8r","year":"2016","journal-title":"Proc 25th USENIX Secur Symp"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref9","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2016","journal-title":"arXiv 1607 02533"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1080\/01691864.2017.1365009"},{"key":"ref3","author":"liu","year":"2018","journal-title":"Deep learning in natural language processing"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1093\/bib\/bbx044"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2017.7995703"},{"key":"ref100","article-title":"FCA: Learning a 3D full-coverage vehicle camouflage for multi-view physical adversarial attack","author":"wang","year":"2021","journal-title":"arXiv 2109 07193"},{"key":"ref101","article-title":"Learning coated adversarial camouflages for object detectors","author":"duan","year":"2021","journal-title":"arXiv 2109 00124"},{"key":"ref40","first-page":"3896","article-title":"Adversarial camera stickers: A physical camera-based attack on deep learning systems","volume":"97","author":"li","year":"2019","journal-title":"Proc 36th Int Conf Mach Learn (ICML)"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01186"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01219-9_25"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.179"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.713"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.322"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref34","article-title":"SAAM: Stealthy adversarial attack on monoculor depth estimation","author":"guesmi","year":"2023","journal-title":"arXiv 2308 03108"},{"key":"ref37","first-page":"2507","article-title":"LaVAN: Localized and visible adversarial noise","author":"karmon","year":"2018","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref36","first-page":"284","article-title":"Synthesizing robust adversarial examples","author":"athalye","year":"2017","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref31","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013","journal-title":"arXiv 1312 6199"},{"key":"ref148","article-title":"OverFeat: Integrated recognition, localization and detection using convolutional networks","author":"sermanet","year":"2014","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3465397"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.169"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00700"},{"key":"ref32","article-title":"HopSkipJumpAttack: A query-efficient decision-based attack","author":"chen","year":"2019","journal-title":"arXiv 1904 02144"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1145\/3503250"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301962"},{"key":"ref38","first-page":"1","article-title":"Projecting trouble: Light based adversarial attacks on deep learning classifiers","author":"nichols","year":"2018","journal-title":"Proc AAAI Fall Symp"},{"key":"ref155","article-title":"YOLOv4: Optimal speed and accuracy of object detection","author":"bochkovskiy","year":"2020","journal-title":"arXiv 2004 10934"},{"key":"ref156","author":"jocher","year":"2020","journal-title":"Ultralytics\/Yolov5 V3 1—Bug Fixes and Performance Improvements"},{"key":"ref153","article-title":"YOLO9000: Better, faster, stronger","author":"redmon","year":"2016","journal-title":"arXiv 1612 08242"},{"key":"ref154","article-title":"YOLOv3: An incremental improvement","author":"redmon","year":"2018","journal-title":"arXiv 1804 02767"},{"key":"ref151","article-title":"SSD: Single shot MultiBox detector","author":"liu","year":"2015","journal-title":"arXiv 1512 02325"},{"key":"ref152","article-title":"You only look once: Unified, real-time object detection","author":"redmon","year":"2015","journal-title":"arXiv 1506 02640"},{"key":"ref150","article-title":"Faster R-CNN: Towards real-time object detection with region proposal networks","author":"ren","year":"2015","journal-title":"arXiv 1506 01497"},{"key":"ref24","first-page":"6106","article-title":"Poison frogs! Targeted clean-label poisoning attacks on neural networks","author":"shafahi","year":"2018","journal-title":"Proc Annu Conf Neural Inf Process Syst"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref25","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"chen","year":"2017","journal-title":"arXiv 1712 05526"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref159","author":"solawetz","year":"2023","journal-title":"YOLOv5 by Ultralytics"},{"key":"ref22","first-page":"317","article-title":"GhostImage: Remote perception attacks against camera-based image classification systems","author":"man","year":"2020","journal-title":"Proc 23rd Int Symp Res Attacks Intrusions Defenses"},{"key":"ref157","article-title":"YOLOv6: A single-stage object detection framework for industrial applications","author":"li","year":"2022","journal-title":"arXiv 2209 02976"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref158","article-title":"YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors","author":"wang","year":"2022","journal-title":"arXiv 2207 02696"},{"key":"ref28","first-page":"1","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc 3rd Int Conf Learn Represent"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref29","article-title":"Intriguing properties of adversarial examples","author":"cubuk","year":"2017","journal-title":"arXiv 1711 02846"},{"key":"ref166","article-title":"A style-based generator architecture for generative adversarial networks","author":"karras","year":"2018","journal-title":"arXiv 1812 04948"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.471"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1145\/3439723"},{"key":"ref165","first-page":"9786","article-title":"Unsupervised discovery of interpretable directions in the GAN latent space","author":"voynov","year":"2020","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref162","first-page":"3","article-title":"A thin-plate spline and the decomposition of deformations","volume":"2","author":"bookstein","year":"1993","journal-title":"Mathematical Methods in Medical Imaging"},{"key":"ref163","first-page":"2017","article-title":"Spatial transformer networks","author":"jaderberg","year":"2015","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref160","article-title":"Faster R-CNN: Towards real-time object detection with region proposal networks","volume":"28","author":"ren","year":"2015","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2005.177"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446747"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref15","article-title":"State-of-the-art optical-based physical adversarial attacks for deep learning computer vision systems","author":"fang","year":"2023","journal-title":"arXiv 2303 12249"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref14","article-title":"Physical adversarial attack meets computer vision: A decade survey","author":"wei","year":"2022","journal-title":"arXiv 2209 15179"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58601-0_24"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00091"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3105725"},{"key":"ref96","article-title":"Dynamic adversarial patch for evading object detection models","author":"hoory","year":"2020","journal-title":"arXiv 2010 13070"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00858"},{"key":"ref11","article-title":"Towards evaluating the robustness of neural networks","author":"carlini","year":"2016","journal-title":"arXiv 1608 04644"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01487"},{"key":"ref124","first-page":"3237","article-title":"Too good to be safe: Tricking lane detection in autonomous driving with crafted perturbations","author":"jing","year":"2021","journal-title":"Proc 30th USENIX Secur Symp"},{"key":"ref10","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7299155"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref16","article-title":"A survey on physical adversarial attack in computer vision","author":"wang","year":"2022","journal-title":"arXiv 2209 14262"},{"key":"ref19","article-title":"Adversarial patch","author":"brown","year":"2017","journal-title":"arXiv 1712 09665"},{"key":"ref18","first-page":"99","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2017","journal-title":"Proc 5th Int Conf Learn Represent"},{"key":"ref93","article-title":"Adversarial infrared blocks: A multi-view black-box attack to thermal infrared detectors in physical world","author":"hu","year":"2023","journal-title":"arXiv 2304 10712"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00765"},{"key":"ref92","article-title":"Physically adversarial infrared patches with learnable shapes and locations","author":"xingxing","year":"2023","journal-title":"arXiv 2303 13868"},{"key":"ref134","first-page":"139","article-title":"Generative adversarial networks","author":"goodfellow","year":"2014","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref95","article-title":"Physical adversarial attack on vehicle detector in the Carla simulator","author":"wu","year":"2020","journal-title":"arXiv 2007 16118"},{"key":"ref131","article-title":"NO need to worry about adversarial examples in object detection in autonomous vehicles","author":"lu","year":"2017","journal-title":"arXiv 1707 03501"},{"key":"ref94","first-page":"1","article-title":"CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild","author":"zhang","year":"2019","journal-title":"Proc Int Conf Learn Represent"},{"key":"ref132","article-title":"Foveation-based mechanisms alleviate adversarial examples","author":"luo","year":"2015","journal-title":"arXiv 1511 06292"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref91","first-page":"15233","article-title":"HOTCOLD block: Fooling thermal infrared detectors with a novel wearable design","author":"wei","year":"2022","journal-title":"Proc AAAI Conf Artif Intell"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01296"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i4.16477"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.3390\/s20143860"},{"key":"ref86","article-title":"AdvART: Adversarial art for camouflaged object detection attacks","author":"guesmi","year":"2023","journal-title":"arXiv 2303 01734"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/TCI.2016.2644865"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01295"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/ICNN.1995.488968"},{"key":"ref88","article-title":"DAP: A dynamic adversarial patch for evading person detectors","author":"guesmi","year":"2023","journal-title":"arXiv 2305 11618"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.3389\/fnbeh.2019.00280"},{"key":"ref87","article-title":"Patch of invisibility: Naturalistic black-box adversarial attacks on object detectors","author":"lapid","year":"2023","journal-title":"arXiv 2303 04238"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1006\/nimg.1999.0491"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58548-8_1"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.312"},{"key":"ref81","first-page":"1","article-title":"Adversarial t-shirt! Evading person detectors in a physical world","author":"xu","year":"2019","journal-title":"Proc Eur Conf Comput Vis"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01550"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3474085.3475653"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.244"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00775"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0823-z"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.632"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00080"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref108","first-page":"304","article-title":"Adversarial mask: Real-world universal adversarial attack on face recognition model","author":"zolfi","year":"2022","journal-title":"Proc Eur Conf Mach Learn Knowl Discovery Databases"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/UEMCON.2018.8796670"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2020.102988"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00415"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412236"},{"key":"ref75","first-page":"1865","article-title":"SLAP: Improving physical adversarial examples with short-lived adversarial perturbations","author":"lovisotto","year":"2020","journal-title":"Proc Usenix Secur Symp"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/SIBIRCON48586.2019.8958134"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01498"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01167"},{"key":"ref77","article-title":"Adversarial attack with raindrops","author":"liu","year":"2023","journal-title":"arXiv 2302 14267"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3317611"},{"key":"ref76","article-title":"Adversarial rain attack and defensive deraining for DNN perception","author":"zhai","year":"2020","journal-title":"arXiv 2009 09205"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/BIOSIG52210.2021.9548291"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.690"},{"key":"ref1","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2014","journal-title":"arXiv 1409 1556"},{"key":"ref71","first-page":"1","article-title":"Physical adversarial examples for object detectors","author":"eykholt","year":"2018","journal-title":"Proc 12th USENIX Conf Offensive Technol"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/173"},{"key":"ref70","article-title":"Attacking object detector using a universal targeted label-switch patch","author":"shapira","year":"2022","journal-title":"arXiv 2211 08859"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3231886"},{"key":"ref73","first-page":"1989","article-title":"Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors","author":"zhao","year":"2019","journal-title":"Proc ACM SIGSAC Conf Comput Commun Secur"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10925-7_4"},{"key":"ref110","first-page":"2711","article-title":"Adversarial sticker: A stealthy attack method in the physical world","volume":"45","author":"wei","year":"2023","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"ref68","article-title":"Object hider: Adversarial patch attack against object detectors","author":"zhao","year":"2020","journal-title":"arXiv 2010 14974"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00249"},{"key":"ref67","article-title":"On physical adversarial patches for object detection","author":"lee","year":"2019","journal-title":"arXiv 1906 11897"},{"key":"ref117","article-title":"APARATE: Adaptive adversarial patch for CNN-based monocular depth estimation for autonomous navigation","author":"guesmi","year":"2023","journal-title":"arXiv 2303 01351"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5459"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1587\/transinf.2022MUL0001"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01426"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3027372"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01491"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19839-7_30"},{"key":"ref66","article-title":"DPatch: An adversarial patch attack on object detectors","author":"liu","year":"2018","journal-title":"arXiv 1806 02299"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3102492"},{"key":"ref65","first-page":"1","article-title":"TPatch: A triggered physical adversarial patch","author":"zhu","year":"2023","journal-title":"Proc 32th USENIX Secur Symp"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00843"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560566"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2021.3103441"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW54120.2021.00016"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-023-00145-0"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00108"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00288"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/10005208\/10268441.pdf?arnumber=10268441","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,6]],"date-time":"2023-11-06T19:50:16Z","timestamp":1699300216000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10268441\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":186,"URL":"https:\/\/doi.org\/10.1109\/access.2023.3321118","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}