{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T07:10:45Z","timestamp":1771657845642,"version":"3.50.1"},"reference-count":118,"publisher":"Zhejiang University Press","issue":"4","license":[{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Front Inform Technol Electron Eng"],"published-print":{"date-parts":[[2025,4]]},"DOI":"10.1631\/fitee.2300867","type":"journal-article","created":{"date-parts":[[2025,5,7]],"date-time":"2025-05-07T09:45:54Z","timestamp":1746611154000},"page":"510-533","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A comprehensive survey of physical adversarial vulnerabilities in autonomous driving systems","\u9762\u5411\u81ea\u52a8\u9a7e\u9a76\u7cfb\u7edf\u7684\u7269\u7406\u5bf9\u6297\u8106\u5f31\u6027\u7efc\u8ff0"],"prefix":"10.1631","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8745-9433","authenticated-orcid":false,"given":"Shuai","family":"Zhao","sequence":"first","affiliation":[]},{"given":"Boyuan","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Yucheng","family":"Shi","sequence":"additional","affiliation":[]},{"given":"Yang","family":"Zhai","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2768-1398","authenticated-orcid":false,"given":"Yahong","family":"Han","sequence":"additional","affiliation":[]},{"given":"Qinghua","family":"Hu","sequence":"additional","affiliation":[]}],"member":"635","published-online":{"date-parts":[[2025,5,7]]},"reference":[{"key":"ref1","first-page":"2189","article-title":"Ad-versarial attacks on camera- LiDAR models for 3D car detection","volume-title":"IEEE\/RSJ Int Conf on Intelligent Robots and Systems","author":"Abdelfattah","year":"2021a"},{"key":"ref2","first-page":"3592","article-title":"Towards universal physical attacks on cascaded camera- LiDAR 3D object detection models","volume-title":"IEEE Int Conf on Image Processing","author":"Abdelfattah","year":"2021b"},{"issue":"6","key":"ref3","doi-asserted-by":"crossref","first-page":"8759","DOI":"10.1007\/s11042-020-10103-4","article-title":"Human detection techniques for real time surveillance: a comprehensive survey","volume":"80","author":"Ansari","year":"2021","journal-title":"Multim Tools Appl"},{"issue":"12","key":"ref4","first-page":"9515","article-title":"Inconspicuous adversarial patches for fooling image-recognition systems on mobile devices","volume":"9","author":"Bai","year":"2022","journal-title":"IEEE Int Things J"},{"key":"ref5","first-page":"284","article-title":"Double targeted universal adversarial perturbations","volume-title":"Proc 15th Asian Conf on Computer Vision","author":"Benz","year":"2020"},{"key":"ref6","first-page":"1","article-title":"Simple physical adver-sarial examples against end-to-end autonomous driving models","volume-title":"IEEE Int Conf on Embedded Software and Systems","author":"Boloor","year":"2019"},{"key":"ref7","doi-asserted-by":"crossref","first-page":"101766","DOI":"10.1016\/j.sysarc.2020.101766","article-title":"Attacking vision- based perception in end- to-end autonomous driving models","volume":"110","author":"Boloor","year":"2020","journal-title":"J Syst Archit"},{"key":"ref8","author":"Brand","year":"2022","journal-title":"Adversarial attack against image-based localization neural networks"},{"key":"ref9","article-title":"Large scale GAN training for high fidelity natural image synthesis","volume-title":"7th Int Conf on Learning Representations","author":"Brock","year":"2018"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3339815"},{"key":"ref11","first-page":"176","article-title":"Invisible for both camera and LiDAR: security of multi-sensor fusion based perception in autonomous driving under physical-world attacks","author":"Cao","year":"2021","journal-title":"IEEE Symp on Security and Privacy"},{"key":"ref12","first-page":"36","article-title":"AdvDO: realistic adversarial attacks for trajectory prediction","volume-title":"17th European Conf on Computer Vision","author":"Cao","year":"2022"},{"key":"ref13","first-page":"2993","article-title":"You can\u2019t see me: physical removal attacks on LiDAR-based autonomous vehicles driving frameworks","author":"Cao","year":"2023","journal-title":"32nd USENIX Security Symp"},{"key":"ref14","author":"Chaubey","year":"2020","journal-title":"Universal adversarial perturbations: a survey"},{"key":"ref15","first-page":"827","article-title":"Leveraging model poisoning attacks on license plate recognition systems","volume-title":"IEEE Int Conf on Trust, Security and Privacy in Computing and Communications","author":"Chen","year":"2022"},{"key":"ref16","doi-asserted-by":"crossref","first-page":"52","DOI":"10.1007\/978-3-030-10925-7_4","article-title":"ShapeShifter: robust physical adversarial attack on faster R-CNN ob-ject detector","volume-title":"European Conf on Machine Learning and Knowledge Discovery in Databases","author":"Chen","year":"2019"},{"key":"ref17","first-page":"12536","article-title":"DSGN: deep stereo geometry network for 3D object detection","volume-title":"Proc IEEE\/CVF Conf on Computer Vision and Pattern Recognition","author":"Chen","year":"2020"},{"key":"ref18","first-page":"15127","article-title":"Towards practi-cal certifiable patch defense with vision transformer","volume-title":"Proc IEEE\/CVF Conf on Computer Vision and Pat-tern Recognition","author":"Chen","year":"2022"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19839-7_30"},{"key":"ref20","article-title":"Certified de-fenses for adversarial patches","volume-title":"8th Int Conf on Learning Representations","author":"Chiang","year":"2020"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/iv51971.2022.9827222"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/spw50608.2020.00025"},{"key":"ref23","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc 37th Int Conf on Machine Learning","author":"Croce","year":"2020"},{"key":"ref24","article-title":"Understanding and improving en-semble adversarial defense","volume-title":"37 th Int Conf on Neural Information Processing Systems","author":"Deng","year":"2023"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/j.dcan.2020.04.007"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/tits.2023.3259322"},{"key":"ref27","article-title":"An image is worth 16\u00d7 16 words: transformers for image recognition at scale","volume-title":"9th Int Conf on Learning Representations","author":"Dosovitskiy","year":"2020"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr42600.2020.00108"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr46437.2021.01580"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_5"},{"key":"ref31","first-page":"1","article-title":"Physical adversarial examples for object detectors","volume-title":"Proc 12th USENIX Workshop on Offensive Technologies","author":"Eykholt","year":"2018a"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2018.00175"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr42600.2020.00683"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2023.3288426"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/iccv.2019.00494"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19775-8_24"},{"key":"ref37","author":"Guesmi","year":"2022","journal-title":"Adversarial attack on radar-based environment perception systems"},{"key":"ref38","first-page":"1903","article-title":"Security anal-ysis of camera- LiDAR fusion against black-box attacks on autonomous vehicles","volume-title":"31st USENIX Security Symp","author":"Hallyburton","year":"2022"},{"key":"ref39","first-page":"836","article-title":"A unified anomaly detection methodology for lane-following of autonomous driving systems","volume-title":"IEEE Int Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking","author":"Han","year":"2021"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3548171"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/spw54247.2022.9833890"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/cvprw.2018.00210"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/iccv51070.2023.00428"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/iccv48922.2021.00775"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01295"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr42600.2020.00080"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3591870"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301962"},{"key":"ref49","author":"Ji","year":"2021","journal-title":"Adversarial YOLO: defense human detection patch attacks via detecting adversarial patches"},{"key":"ref50","author":"Jia","year":"2022","journal-title":"Fooling the eyes of autonomous vehicles: robust physical adversarial examples against traffic sign recognition systems"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/icra46639.2022.9812411"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/tits.2021.3054625"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr42600.2020.01426"},{"key":"ref54","first-page":"399","article-title":"Effects of multipath reception on GPS positioning performance","volume-title":"Proc ELMAR","author":"Kos","year":"2010"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/aipr50011.2020.9425267"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6473833"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/irc.2019.00023"},{"key":"ref58","article-title":"(De)Randomized smoothing for certifiable defense against patch attacks","volume-title":"Proc 34th Int Conf on Neural Information Processing Systems","author":"Levine","year":"2020"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2019.00783"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/iccv48922.2021.00780"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01455"},{"key":"ref62","first-page":"1865","article-title":"SLAP: improving physical adversarial examples with short-lived adversarial perturbations","author":"Lovisotto","year":"2021","journal-title":"30th USENIX Security Symp"},{"key":"ref63","author":"Lu","year":"2017","journal-title":"Adversarial examples that fool detectors"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3485133"},{"key":"ref65","first-page":"317","article-title":"GhostImage: remote perception attacks against camera-based image classification systems","author":"Man","year":"2020","journal-title":"23rd Int Symp on Research in Attacks, Intrusions and Defenses"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ijcnn55064.2022.9892612"},{"key":"ref67","article-title":"Efficient certified defenses against patch attacks on image classifiers","volume-title":"9th Int Conf on Learning Representations","author":"Metzen","year":"2021"},{"key":"ref68","author":"Metzen","year":"2021","journal-title":"Meta adversarial training against universal patches"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/msp.2020.2985363"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2017.17"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr46437.2021.00738"},{"key":"ref72","author":"Patel","year":"2020","journal-title":"Bait and switch: online training data poisoning of autonomous driving systems"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101826"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.3390\/app9050909"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/dsn-w50199.2020.00016"},{"key":"ref76","first-page":"1","article-title":"Evaluating effectiveness of adversarial examples on state of art license plate recognition models","volume-title":"IEEE Int Conf on Intelligence and Security Informatics","author":"Rana","year":"2020"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/iccv.2019.00636"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2023.3314512"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1177\/0278364920917446"},{"key":"ref80","first-page":"3309","article-title":"Dirty road can attack: security of deep learning based automated lane centering under physical-world attack","volume-title":"Proc 30th USENIX Security Symp","author":"Sato","year":"2021"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/iccv51070.2023.00927"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3398394"},{"key":"ref83","author":"Sitawarin","year":"2018","journal-title":"Rogue signs: deceiving traffic sign recognition with malicious ads and logos"},{"key":"ref84","first-page":"877","article-title":"Towards robust LiDAR-based perception in autonomous driving: general black-box adversarial sensor attack and counter-measures","author":"Sun","year":"2020","journal-title":"29th USENIX Security Symp"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01487"},{"key":"ref86","author":"Szegedy","year":"2014","journal-title":"Intriguing properties of neural networks"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/cvprw.2019.00012"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr42600.2020.01373"},{"key":"ref89","first-page":"1013","article-title":"Exploring adversarial robustness of multi-sensor perception systems in self driving","volume-title":"Proc 5th Conf on Robot Learning","author":"Tu","year":"2022"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i2.20141"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr46437.2021.00846"},{"key":"ref92","author":"Wei","year":"2022","journal-title":"Physical adversarial attack meets computer vision: a decade survey"},{"key":"ref93","author":"Wei","year":"2022","journal-title":"Visually adversarial attacks and defenses in the physical world: a survey"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/iccv51070.2023.00410"},{"key":"ref95","article-title":"Defending against physically realizable attacks on image classification","volume-title":"8th Int Conf on Learning Representations","author":"Wu","year":"2020a"},{"key":"ref96","author":"Wu","year":"2020b","journal-title":"Physical adversarial attack on vehicle detector in the CARLA simulator"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58548-8_1"},{"key":"ref98","article-title":"SafeBench: a bench-marking platform for safety evaluation of autonomous vehicles","volume-title":"Proc 36th Int Conf on Neural Information Processing Systems","author":"Xu","year":"2022"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.14722\/autosec.2021.23032"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2020.102694"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/access.2020.3027372"},{"key":"ref103","author":"Yang","year":"2020","journal-title":"Finding physical adversarial examples for autonomous driving with fast and differentiable image compositing"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453106"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/jiot.2020.3034899"},{"key":"ref106","article-title":"Certified defences against adversarial patch attacks on semantic segmentation","volume-title":"11th Int Conf on Learning Representations","author":"Yatsura","year":"2023"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/lra.2023.3280813"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.00592"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19812-0_38"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2018.00747"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/jiot.2021.3099164"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01473"},{"key":"ref113","article-title":"CAMOU: learning physical vehicle camouflages to adversarially attack detectors in the wild","volume-title":"7th Int Conf on Learning Representations","author":"Zhang","year":"2019"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01491"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i4.16477"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01296"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52729.2023.02069"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr46437.2021.01498"}],"container-title":["Frontiers of Information Technology & Electronic Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1631\/FITEE.2300867.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1631\/FITEE.2300867\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1631\/FITEE.2300867.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T06:37:17Z","timestamp":1771655837000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1631\/FITEE.2300867"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4]]},"references-count":118,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,4]]}},"alternative-id":["2050"],"URL":"https:\/\/doi.org\/10.1631\/fitee.2300867","relation":{},"ISSN":["2095-9184","2095-9230"],"issn-type":[{"value":"2095-9184","type":"print"},{"value":"2095-9230","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4]]},"assertion":[{"value":"25 December 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 April 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 May 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"Yahong HAN is a corresponding expert of\n                      Frontiers of Information Technology\n                      &\n                      Electronic Engineering\n                      , and he was not involved with the peer review process of this paper. All the authors declare that they have no conflict of interest.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}