{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T16:07:02Z","timestamp":1770739622004,"version":"3.49.0"},"reference-count":86,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476018"],"award-info":[{"award-number":["62476018"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Zhongguancun Laboratory"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Pattern Anal. Mach. Intell."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tpami.2025.3626068","type":"journal-article","created":{"date-parts":[[2025,10,28]],"date-time":"2025-10-28T17:33:50Z","timestamp":1761672830000},"page":"2413-2430","source":"Crossref","is-referenced-by-count":0,"title":["DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Time"],"prefix":"10.1109","volume":"48","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-5564-9331","authenticated-orcid":false,"given":"Jin","family":"Hu","sequence":"first","affiliation":[{"name":"State Key Laboratory of Complex & Critical Software Environment, Beihang University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8425-4195","authenticated-orcid":false,"given":"Xianglong","family":"Liu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex & Critical Software Environment, Beihang University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5884-3412","authenticated-orcid":false,"given":"Jiakai","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhongguancun Lab, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-8840-234X","authenticated-orcid":false,"given":"Junkai","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex & Critical Software Environment, Beihang University, Beijing, China"}]},{"given":"Xianqi","family":"Yang","sequence":"additional","affiliation":[{"name":"Zhongguancun Lab, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7391-7539","authenticated-orcid":false,"given":"Haotong","family":"Qin","sequence":"additional","affiliation":[{"name":"ETH Zurich, Zürich, Switzerland"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1936-9396","authenticated-orcid":false,"given":"Yuqing","family":"Ma","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex & Critical Software Environment, Beihang University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6241-8352","authenticated-orcid":false,"given":"Ke","family":"Xu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex & Critical Software Environment, Beihang University, Beijing, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3435937"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1038\/s41591-018-0316-z"},{"key":"ref3","article-title":"A survey of large language models","author":"Zhao","year":"2023"},{"key":"ref4","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Proc. Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3331087"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3127849"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00846"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00407"},{"key":"ref9","first-page":"3781","article-title":"X-Adv: Physical adversarial object attacks against X-ray prohibited item detection","volume-title":"Proc. USENIX Secur. Symp.","author":"Liu"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2023.3259322"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-022-32611-7"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52729.2023.02069"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680659"},{"key":"ref16","first-page":"1","article-title":"Dynamic adversarial attacks on autonomous driving systems","volume-title":"Proc. Robot.: Sci. Syst.","author":"Chahe"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02322"},{"key":"ref18","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref19","first-page":"402","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ma"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref21","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow"},{"key":"ref22","first-page":"1","article-title":"Adversarial examples in the physical world","volume-title":"Proc. Int. Conf. Learn. Representations (Workshop)","author":"Kurakin"},{"key":"ref23","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevLett.55.449"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19842-7_22"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2019.2952353"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3430860"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354259"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02314"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3330769"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/543"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3231886"},{"key":"ref33","first-page":"1","article-title":"Adversarial patch","volume-title":"Proc. NeurIPS Workshop Mach. Learn. Comput. Secur.","author":"Brown"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560566"},{"key":"ref35","first-page":"679","article-title":"CAPatch: Physical adversarial patch against image captioning systems","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Zhang"},{"key":"ref36","article-title":"Physical adversarial examples for object detectors","volume-title":"Proc. USENIX Conf. Offensive Technol.","author":"Song"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00775"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01965"},{"key":"ref39","first-page":"73919","article-title":"Diffattack: Evasion attacks against diffusion-based adversarial purification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Kang"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref41","first-page":"11918","article-title":"Generative modeling by estimating gradients of the data distribution","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Song"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2694"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00189"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/0167-2789(92)90242-F"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02098-4"},{"key":"ref47","first-page":"18613","article-title":"Randaugment: Practical automated data augmentation with a reduced search space","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Cubuk"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.2307\/2987742"},{"key":"ref49","first-page":"9256","article-title":"Large scale GAN training for high fidelity natural image synthesis","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Brock"},{"key":"ref50","article-title":"Beta-VAE: Learning basic visual concepts with a constrained variational framework","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Higgins"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2005.177"},{"key":"ref53","first-page":"4138","article-title":"Towards deep learning models resistant to adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Madry"},{"key":"ref54","first-page":"8047","article-title":"Revisiting adversarial patches for designing camera-agnostic attacks against person detection","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wei"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.5244\/C.35.142"},{"key":"ref56","first-page":"3260","article-title":"PixelDefend: Leveraging generative models to understand and defend against adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Song"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02300"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/694"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01628"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2025.128967"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"ref62","first-page":"1","article-title":"CARLA: An open urban driving simulator","volume-title":"Proc. Annu. Conf. Robot Learn","author":"Dosovitskiy"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/WACV45572.2020.9093363"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11672"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref67","first-page":"8322","article-title":"Constructing unrestricted adversarial examples with generative models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Song"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301962"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00401"},{"key":"ref70","first-page":"68702","article-title":"UV-attack: Physical-world adversarial attacks on person detection via dynamic-neRF-based UV mapping","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Li"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2013.50"},{"key":"ref72","first-page":"16784","article-title":"GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nichol"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevLett.120.143001"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1038\/s42004-024-01233-z"},{"key":"ref75","first-page":"2894","article-title":"Diffusion-based adversarial sample generation for improved stealthiness and controllability","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Xue"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3194988"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01295"},{"key":"ref78","first-page":"1889","article-title":"Real-time neural voice camouflage","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chiquier"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcp.2018.10.045"},{"key":"ref80","first-page":"26548","article-title":"Characterizing possible failure modes in physics-informed neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Krishnapriyan"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1016\/j.jcp.2022.111260"},{"key":"ref82","first-page":"1039","article-title":"GEP-PG: Decoupling exploration and exploitation in deep reinforcement learning algorithms","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Colas"},{"key":"ref83","first-page":"2326","article-title":"Large language models as optimizers","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Yang"},{"key":"ref84","first-page":"61478","article-title":"Are aligned neural networks adversarially aligned?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Carlini"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-021-24916-w"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-020-03152-0"}],"container-title":["IEEE Transactions on Pattern Analysis and Machine Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/34\/11372200\/11219170.pdf?arnumber=11219170","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,9]],"date-time":"2026-02-09T21:05:24Z","timestamp":1770671124000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11219170\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":86,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tpami.2025.3626068","relation":{},"ISSN":["0162-8828","2160-9292","1939-3539"],"issn-type":[{"value":"0162-8828","type":"print"},{"value":"2160-9292","type":"electronic"},{"value":"1939-3539","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}