{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T18:36:09Z","timestamp":1775154969612,"version":"3.50.1"},"reference-count":116,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2024,12,1]],"date-time":"2024-12-01T00:00:00Z","timestamp":1733011200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,12,1]],"date-time":"2024-12-01T00:00:00Z","timestamp":1733011200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,12,1]],"date-time":"2024-12-01T00:00:00Z","timestamp":1733011200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100000923","name":"Australian Research Council (ARC) through the Discovery Project","doi-asserted-by":"publisher","award":["DP200101942"],"award-info":[{"award-number":["DP200101942"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Neural Netw. Learning Syst."],"published-print":{"date-parts":[[2024,12]]},"DOI":"10.1109\/tnnls.2023.3321432","type":"journal-article","created":{"date-parts":[[2023,10,12]],"date-time":"2023-10-12T17:46:48Z","timestamp":1697132808000},"page":"17036-17056","source":"Crossref","is-referenced-by-count":14,"title":["Physical Adversarial Attacks for Surveillance: A Survey"],"prefix":"10.1109","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3466-9218","authenticated-orcid":false,"given":"Kien","family":"Nguyen","sequence":"first","affiliation":[{"name":"School of Electrical Engineering and Robotics, Queensland University of Technology, Brisbane, QLD, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6935-1816","authenticated-orcid":false,"given":"Tharindu","family":"Fernando","sequence":"additional","affiliation":[{"name":"School of Electrical Engineering and Robotics, Queensland University of Technology, Brisbane, QLD, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8515-6324","authenticated-orcid":false,"given":"Clinton","family":"Fookes","sequence":"additional","affiliation":[{"name":"School of Electrical Engineering and Robotics, Queensland University of Technology, Brisbane, QLD, Australia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4316-9001","authenticated-orcid":false,"given":"Sridha","family":"Sridharan","sequence":"additional","affiliation":[{"name":"School of Electrical Engineering and Robotics, Queensland University of Technology, Brisbane, QLD, Australia"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Adversarial Fashion","year":"2020"},{"key":"ref2","volume-title":"Computer Vision Dazzle Camouflage","year":"2020"},{"key":"ref3","volume-title":"Igconito Face Jewellery to Avoid Facial Recognition","year":"2020"},{"key":"ref4","volume-title":"Led Light Privacy Visor","year":"2020"},{"key":"ref5","volume-title":"A Projector Can be Used to Project Faces and Images Onto Your Own Face to Disguise Surveillance Face Recognition Software","year":"2020"},{"key":"ref6","volume-title":"Reflectacles Privacy Eyewear","year":"2020"},{"key":"ref7","volume-title":"This Scarf Scrambles Fascists","year":"2020"},{"key":"ref8","volume-title":"URME Personal Surveillance Identity Prosthetic","year":"2020"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/IROS51168.2021.9636638"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2004.10934"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA51294.2020.00202"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.3031625"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00405"},{"key":"ref15","article-title":"Adversarial patch","author":"Brown","year":"2017","journal-title":"arXiv:1712.09665"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2018.01.092"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00644"},{"key":"ref18","article-title":"Adversarial objects against LiDAR-based autonomous driving systems","author":"Cao","year":"2019","journal-title":"arXiv:1907.05418"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.502"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2019.00281"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10925-7_4"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1117\/12.2304348"},{"key":"ref24","first-page":"321","article-title":"Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks","volume-title":"Proc. USENIX Security Symp.","author":"Demonti"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00038"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i2.16211"},{"key":"ref28","article-title":"Adversarial attack on facial recognition using visible light","author":"Frearson","year":"2020","journal-title":"arXiv:2011.12680"},{"key":"ref29","first-page":"1440","article-title":"Fast R-CNN [region-based convolutional neural network]","volume-title":"Proc. IEEE Int. Conf. Comput. Vis. (ICCV)","author":"Girshick"},{"key":"ref30","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Goodfellow"},{"key":"ref31","article-title":"Adversarial sticker: A stealthy attack method in the physical world","author":"Wei","year":"2021","journal-title":"arXiv:2104.06728"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.322"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46448-0_45"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.imavis.2017.01.010"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00775"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01628"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01295"},{"key":"ref38","volume-title":"Labeled faces in the wild: A database for studying face recognition in unconstrained environments","author":"Huang","year":"2007"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00080"},{"key":"ref40","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Ilyas"},{"key":"ref41","first-page":"2017","article-title":"Spatial transformer networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"28","author":"Jaderberg"},{"key":"ref42","article-title":"Adversarial YOLO: Defense human detection patch attacks via detecting adversarial patches","author":"Ji","year":"2021","journal-title":"arXiv:2103.08860"},{"key":"ref43","first-page":"1","article-title":"Fooling detection alone is not enough: Adversarial attack against multiple object tracking","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Jia"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-68238-5_48"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.527"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP43922.2022.9747896"},{"key":"ref47","article-title":"AdvHat: Real-world adversarial attack on ArcFace face ID system","author":"Komkov","year":"2019","journal-title":"arXiv:1908.08705"},{"key":"ref48","first-page":"99","article-title":"Adversarial examples in the physical world","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Kurakin"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01298"},{"key":"ref50","article-title":"On physical adversarial patches for object detection","author":"Lee","year":"2019","journal-title":"arXiv:1906.11897"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00441"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02366"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01222"},{"key":"ref55","first-page":"1","article-title":"DPatch: An adversarial patch attack on object detectors","volume-title":"Proc. AAAI Workshop Artif. Intell. Saf.","volume":"2301","author":"Liu"},{"key":"ref56","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Liu"},{"key":"ref57","volume-title":"Fooling Facial Detection With Fashion","author":"MacDonald","year":"2019"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref59","volume-title":"Camouflage\/Introduction by Jonathan Miller","author":"Newark","year":"2007"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SIBIRCON48586.2019.8958134"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00058"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.690"},{"key":"ref64","article-title":"YOLOv3: An incremental improvement","author":"Redmon","year":"2018","journal-title":"arXiv:1804.02767"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/tpami.2016.2577031"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref67","first-page":"1","article-title":"Are adversarial examples inevitable?","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Shafahi"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3317611"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00086"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1212.0402"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref72","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Szegedy"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941154"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00414"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref76","first-page":"1","article-title":"Exploring adversarial robustness of multi-sensor perception systems in self driving","volume-title":"Proc. Conf. Robot Learn.","author":"Tu"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01373"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01283"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33018933"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00042"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00552"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00249"},{"key":"ref83","article-title":"Deep face recognition: A survey","author":"Wang","year":"2018","journal-title":"arXiv:1804.06655"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01482"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6906"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.08.087"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00843"},{"key":"ref88","article-title":"Visually adversarial attacks and defenses in the physical world: A survey","author":"Wei","year":"2022","journal-title":"arXiv:2211.01671"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01187"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46478-7_31"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-92273-3_18"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00492"},{"key":"ref93","article-title":"Adversarial examples in modern machine learning: A review","author":"Reza Wiyatno","year":"2019","journal-title":"arXiv:1911.05268"},{"key":"ref94","article-title":"Defending against physically realizable attacks on image classification","author":"Wu","year":"2019","journal-title":"arXiv:1909.09552"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58548-8_1"},{"key":"ref96","article-title":"A random-patch based defense strategy against physical attacks for face recognition systems","author":"Xie","year":"2023","journal-title":"arXiv:2304.07822"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.12328"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9053574"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00798"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/UEMCON.2018.8796670"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00401"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3054775"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/173"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3217375"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00185"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58589-1_46"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.109009"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3024149"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/3159171"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3069237"},{"key":"ref113","article-title":"Invisible mask: Practical attacks on face recognition with infrared","author":"Zhou","year":"2018","journal-title":"arXiv:1803.04683"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01296"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i4.16477"},{"key":"ref116","article-title":"Adversarial mask: Real-world adversarial attack against face recognition models","author":"Zolfi","year":"2021","journal-title":"arXiv:2111.10759"}],"container-title":["IEEE Transactions on Neural Networks and Learning Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/5962385\/10772360\/10284006.pdf?arnumber=10284006","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,3]],"date-time":"2024-12-03T19:09:24Z","timestamp":1733252964000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10284006\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12]]},"references-count":116,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tnnls.2023.3321432","relation":{},"ISSN":["2162-237X","2162-2388"],"issn-type":[{"value":"2162-237X","type":"print"},{"value":"2162-2388","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,12]]}}}