最近的进步表明，深度神经网络（DNN）容易受到对抗性扰动的影响。因此，有必要使用对抗攻击评估高级DNN的鲁棒性。但是，将使用贴纸作为扰动的传统物理攻击比最近的基于光的物理攻击更容易受到伤害。在这项工作中，我们提出了一种基于投影仪的物理攻击，称为“对抗颜色投影（ADVCP）”，该攻击通过操纵投影光的物理参数来进行对抗攻击。实验显示了我们方法在数字和物理环境中的有效性。实验结果表明，所提出的方法具有出色的攻击传递性，它赋予了Advcp有效的BlackBox攻击。我们向ADVCP提出威胁，威胁到未来的基于视觉的系统和应用程序，并提出一些基于轻型物理攻击的想法。

众所周知，深神经网络（DNN）的性能容易受到微妙的干扰。到目前为止，基于摄像机的身体对抗攻击还没有引起太多关注，但这是物理攻击的空缺。在本文中，我们提出了一种简单有效的基于相机的物理攻击，称为“对抗彩色膜”（ADVCF），该攻击操纵了彩色膜的物理参数以执行攻击。精心设计的实验显示了所提出的方法在数字和物理环境中的有效性。此外，实验结果表明，ADVCF生成的对抗样本在攻击转移性方面具有出色的性能，这可以使ADVCF有效的黑盒攻击。同时，我们通过对抗训练给予对ADVCF的防御指导。最后，我们调查了ADVCF对基于视觉的系统的威胁，并为基于摄像机的物理攻击提出了一些有希望的心态。

尽管已知深度神经网络（DNN）很脆弱，但没有人研究了物理世界中图像对DNNS性能的缩放和缩放的影响。在本文中，我们演示了一种新型的物理对抗攻击技术，称为“对抗变焦镜头（Advzl）”，该技术使用变焦镜头放大了物理世界的图片，欺骗了DNN，而无需更改目标对象的特征。迄今为止，提出的方法是唯一不添加物理对抗扰动攻击DNN的对抗性攻击技术。在数字环境中，我们构建了一个基于Advzl的数据集，以验证相等规模的扩大图像对DNN的拮抗作用。在物理环境中，我们操纵变焦镜头以放大目标对象，并生成对抗样本。实验结果证明了Advzl在数字和物理环境中的有效性。我们进一步分析了提出的数据集与改进的DNN的拮抗作用。另一方面，我们通过对抗训练提供了针对Advzl的防御指南。最后，我们研究了提出的未来自动驾驶和变体攻击思想的威胁可能性，类似于拟议的攻击。

Although Deep Neural Networks (DNNs) have achieved impressive results in computer vision, their exposed vulnerability to adversarial attacks remains a serious concern. A series of works has shown that by adding elaborate perturbations to images, DNNs could have catastrophic degradation in performance metrics. And this phenomenon does not only exist in the digital space but also in the physical space. Therefore, estimating the security of these DNNs-based systems is critical for safely deploying them in the real world, especially for security-critical applications, e.g., autonomous cars, video surveillance, and medical diagnosis. In this paper, we focus on physical adversarial attacks and provide a comprehensive survey of over 150 existing papers. We first clarify the concept of the physical adversarial attack and analyze its characteristics. Then, we define the adversarial medium, essential to perform attacks in the physical world. Next, we present the physical adversarial attack methods in task order: classification, detection, and re-identification, and introduce their performance in solving the trilemma: effectiveness, stealthiness, and robustness. In the end, we discuss the current challenges and potential future directions.

在过去的十年中，深度学习急剧改变了传统的手工艺特征方式，具有强大的功能学习能力，从而极大地改善了传统任务。然而，最近已经证明了深层神经网络容易受到对抗性例子的影响，这种恶意样本由小型设计的噪音制作，误导了DNNs做出错误的决定，同时仍然对人类无法察觉。对抗性示例可以分为数字对抗攻击和物理对抗攻击。数字对抗攻击主要是在实验室环境中进行的，重点是改善对抗性攻击算法的性能。相比之下，物理对抗性攻击集中于攻击物理世界部署的DNN系统，这是由于复杂的物理环境（即亮度，遮挡等），这是一项更具挑战性的任务。尽管数字对抗和物理对抗性示例之间的差异很小，但物理对抗示例具有特定的设计，可以克服复杂的物理环境的效果。在本文中，我们回顾了基于DNN的计算机视觉任务任务中的物理对抗攻击的开发，包括图像识别任务，对象检测任务和语义细分。为了完整的算法演化，我们将简要介绍不涉及身体对抗性攻击的作品。我们首先提出一个分类方案，以总结当前的物理对抗攻击。然后讨论现有的物理对抗攻击的优势和缺点，并专注于用于维持对抗性的技术，当应用于物理环境中时。最后，我们指出要解决的当前身体对抗攻击的问题并提供有前途的研究方向。

Recent studies show that the state-of-the-art deep neural networks (DNNs) are vulnerable to adversarial examples, resulting from small-magnitude perturbations added to the input. Given that that emerging physical systems are using DNNs in safety-critical situations, adversarial examples could mislead these systems and cause dangerous situations. Therefore, understanding adversarial examples in the physical world is an important step towards developing resilient learning algorithms. We propose a general attack algorithm, Robust Physical Perturbations (RP 2 ), to generate robust visual adversarial perturbations under different physical conditions. Using the real-world case of road sign classification, we show that adversarial examples generated using RP 2 achieve high targeted misclassification rates against standard-architecture road sign classifiers in the physical world under various environmental conditions, including viewpoints. Due to the current lack of a standardized testing method, we propose a two-stage evaluation methodology for robust physical adversarial examples consisting of lab and field tests. Using this methodology, we evaluate the efficacy of physical adversarial manipulations on real objects. With a perturbation in the form of only black and white stickers, we attack a real stop sign, causing targeted misclassification in 100% of the images obtained in lab settings, and in 84.8% of the captured video frames obtained on a moving vehicle (field test) for the target classifier.

To assess the vulnerability of deep learning in the physical world, recent works introduce adversarial patches and apply them on different tasks. In this paper, we propose another kind of adversarial patch: the Meaningful Adversarial Sticker, a physically feasible and stealthy attack method by using real stickers existing in our life. Unlike the previous adversarial patches by designing perturbations, our method manipulates the sticker's pasting position and rotation angle on the objects to perform physical attacks. Because the position and rotation angle are less affected by the printing loss and color distortion, adversarial stickers can keep good attacking performance in the physical world. Besides, to make adversarial stickers more practical in real scenes, we conduct attacks in the black-box setting with the limited information rather than the white-box setting with all the details of threat models. To effectively solve for the sticker's parameters, we design the Region based Heuristic Differential Evolution Algorithm, which utilizes the new-found regional aggregation of effective solutions and the adaptive adjustment strategy of the evaluation criteria. Our method is comprehensively verified in the face recognition and then extended to the image retrieval and traffic sign recognition. Extensive experiments show the proposed method is effective and efficient in complex physical conditions and has a good generalization for different tasks.

深度神经网络容易受到来自对抗性投入的攻击，并且最近，特洛伊木马误解或劫持模型的决定。我们通过探索有界抗逆性示例空间和生成的对抗网络内的自然输入空间来揭示有界面的对抗性实例 - 通用自然主义侵害贴片的兴趣类 - 我们呼叫TNT。现在，一个对手可以用一个自然主义的补丁来手臂自己，不太恶意，身体上可实现，高效 - 实现高攻击成功率和普遍性。 TNT是普遍的，因为在场景中的TNT中捕获的任何输入图像都将：i）误导网络（未确定的攻击）;或ii）迫使网络进行恶意决定（有针对性的攻击）。现在，有趣的是，一个对抗性补丁攻击者有可能发挥更大的控制水平 - 选择一个独立，自然的贴片的能力，与被限制为嘈杂的扰动的触发器 - 到目前为止只有可能与特洛伊木马攻击方法有可能干扰模型建设过程，以嵌入风险发现的后门;但是，仍然意识到在物理世界中部署的补丁。通过对大型视觉分类任务的广泛实验，想象成在其整个验证集50,000张图像中进行评估，我们展示了TNT的现实威胁和攻击的稳健性。我们展示了攻击的概括，以创建比现有最先进的方法实现更高攻击成功率的补丁。我们的结果表明，攻击对不同的视觉分类任务（CIFAR-10，GTSRB，PUBFIG）和多个最先进的深神经网络，如WieredEnet50，Inception-V3和VGG-16。

Adversarial patch is an important form of real-world adversarial attack that brings serious risks to the robustness of deep neural networks. Previous methods generate adversarial patches by either optimizing their perturbation values while fixing the pasting position or manipulating the position while fixing the patch's content. This reveals that the positions and perturbations are both important to the adversarial attack. For that, in this paper, we propose a novel method to simultaneously optimize the position and perturbation for an adversarial patch, and thus obtain a high attack success rate in the black-box setting. Technically, we regard the patch's position, the pre-designed hyper-parameters to determine the patch's perturbations as the variables, and utilize the reinforcement learning framework to simultaneously solve for the optimal solution based on the rewards obtained from the target model with a small number of queries. Extensive experiments are conducted on the Face Recognition (FR) task, and results on four representative FR models show that our method can significantly improve the attack success rate and query efficiency. Besides, experiments on the commercial FR service and physical environments confirm its practical application value. We also extend our method to the traffic sign recognition task to verify its generalization ability.

Recent studies reveal that deep neural network (DNN) based object detectors are vulnerable to adversarial attacks in the form of adding the perturbation to the images, leading to the wrong output of object detectors. Most current existing works focus on generating perturbed images, also called adversarial examples, to fool object detectors. Though the generated adversarial examples themselves can remain a certain naturalness, most of them can still be easily observed by human eyes, which limits their further application in the real world. To alleviate this problem, we propose a differential evolution based dual adversarial camouflage (DE_DAC) method, composed of two stages to fool human eyes and object detectors simultaneously. Specifically, we try to obtain the camouflage texture, which can be rendered over the surface of the object. In the first stage, we optimize the global texture to minimize the discrepancy between the rendered object and the scene images, making human eyes difficult to distinguish. In the second stage, we design three loss functions to optimize the local texture, making object detectors ineffective. In addition, we introduce the differential evolution algorithm to search for the near-optimal areas of the object to attack, improving the adversarial performance under certain attack area limitations. Besides, we also study the performance of adaptive DE_DAC, which can be adapted to the environment. Experiments show that our proposed method could obtain a good trade-off between the fooling human eyes and object detectors under multiple specific scenes and objects.

基于深度学习的图像识别系统已广泛部署在当今世界的移动设备上。然而，在最近的研究中，深入学习模型被证明易受对抗的例子。一种逆势例的一个变种，称为对抗性补丁，由于其强烈的攻击能力而引起了研究人员的注意。虽然对抗性补丁实现了高攻击成功率，但由于补丁和原始图像之间的视觉不一致，它们很容易被检测到。此外，它通常需要对文献中的对抗斑块产生的大量数据，这是计算昂贵且耗时的。为了解决这些挑战，我们提出一种方法来产生具有一个单一图像的不起眼的对抗性斑块。在我们的方法中，我们首先通过利用多尺度发生器和鉴别器来决定基于受害者模型的感知敏感性的补丁位置，然后以粗糙的方式产生对抗性斑块。鼓励修补程序与具有对抗性训练的背景图像一致，同时保留强烈的攻击能力。我们的方法显示了白盒设置中的强烈攻击能力以及通过对具有不同架构和培训方法的各种型号的广泛实验，通过广泛的实验进行黑盒设置的优异转移性。与其他对抗贴片相比，我们的对抗斑块具有最大忽略的风险，并且可以避免人类观察，这是由显着性图和用户评估结果的插图支持的人类观察。最后，我们表明我们的对抗性补丁可以应用于物理世界。

物体检测中的物理对抗攻击引起了越来越受到关注。然而，最先前的作品专注于通过生成单独的对抗贴片来隐藏来自探测器的物体，该贴片仅覆盖车辆表面的平面部分并且无法在物理场景中攻击多视图，长距离和部分封闭的探测器对象。为了弥合数字攻击与物理攻击之间的差距，我们利用完整的3D车辆表面来提出坚固的全面覆盖伪装攻击（FCA）到愚弄探测器。具体来说，我们首先尝试在整个车辆表面上渲染非平面伪装纹理。为了模仿现实世界的环境条件，我们将引入转换功能，将渲染的伪装车辆转移到照片现实场景中。最后，我们设计了一个有效的损失功能，以优化伪装纹理。实验表明，全面覆盖伪装攻击不仅可以在各种测试用例下优于最先进的方法，而且还可以推广到不同的环境，车辆和物体探测器。 FCA的代码可用于：https://idrl-lab.github.io/full-coverage-camouflage -Adversarial-Attack/。

愚弄深度神经网络（DNN）与黑匣子优化已成为一种流行的对抗攻击方式，因为DNN的结构先验知识始终是未知的。尽管如此，最近的黑匣子对抗性攻击可能会努力平衡其在解决高分辨率图像中产生的对抗性示例（AES）的攻击能力和视觉质量。在本文中，我们基于大规模的多目标进化优化，提出了一种关注引导的黑盒逆势攻击，称为LMOA。通过考虑图像的空间语义信息，我们首先利用注意图来确定扰动像素。而不是攻击整个图像，减少了具有注意机制的扰动像素可以有助于避免维度的臭名臭氧，从而提高攻击性能。其次，采用大规模的多目标进化算法在突出区域中遍历降低的像素。从其特征中受益，所产生的AES有可能在人类视力不可知的同时愚弄目标DNN。广泛的实验结果已经验证了所提出的LMOA在ImageNet数据集中的有效性。更重要的是，与现有的黑匣子对抗性攻击相比，产生具有更好的视觉质量的高分辨率AE更具竞争力。

Video classification systems are vulnerable to adversarial attacks, which can create severe security problems in video verification. Current black-box attacks need a large number of queries to succeed, resulting in high computational overhead in the process of attack. On the other hand, attacks with restricted perturbations are ineffective against defenses such as denoising or adversarial training. In this paper, we focus on unrestricted perturbations and propose StyleFool, a black-box video adversarial attack via style transfer to fool the video classification system. StyleFool first utilizes color theme proximity to select the best style image, which helps avoid unnatural details in the stylized videos. Meanwhile, the target class confidence is additionally considered in targeted attacks to influence the output distribution of the classifier by moving the stylized video closer to or even across the decision boundary. A gradient-free method is then employed to further optimize the adversarial perturbations. We carry out extensive experiments to evaluate StyleFool on two standard datasets, UCF-101 and HMDB-51. The experimental results demonstrate that StyleFool outperforms the state-of-the-art adversarial attacks in terms of both the number of queries and the robustness against existing defenses. Moreover, 50% of the stylized videos in untargeted attacks do not need any query since they can already fool the video classification model. Furthermore, we evaluate the indistinguishability through a user study to show that the adversarial samples of StyleFool look imperceptible to human eyes, despite unrestricted perturbations.

深度学习大大提高了单眼深度估计（MDE）的性能，这是完全基于视觉的自主驾驶（AD）系统（例如特斯拉和丰田）的关键组成部分。在这项工作中，我们对基于学习的MDE产生了攻击。特别是，我们使用基于优化的方法系统地生成隐形的物理对象贴片来攻击深度估计。我们通过面向对象的对抗设计，敏感的区域定位和自然风格的伪装来平衡攻击的隐身和有效性。使用现实世界的驾驶场景，我们评估了对并发MDE模型的攻击和AD的代表下游任务（即3D对象检测）。实验结果表明，我们的方法可以为不同的目标对象和模型生成隐形，有效和健壮的对抗贴片，并在物体检测中以1/1/的斑点检测到超过6米的平均深度估计误差和93％的攻击成功率（ASR）车辆后部9个。具有实际车辆的三个不同驾驶路线上的现场测试表明，在连续视频帧中，我们导致超过6米的平均深度估计误差，并将对象检测率从90.70％降低到5.16％。

Adversarial attacks on thermal infrared imaging expose the risk of related applications. Estimating the security of these systems is essential for safely deploying them in the real world. In many cases, realizing the attacks in the physical space requires elaborate special perturbations. These solutions are often \emph{impractical} and \emph{attention-grabbing}. To address the need for a physically practical and stealthy adversarial attack, we introduce \textsc{HotCold} Block, a novel physical attack for infrared detectors that hide persons utilizing the wearable Warming Paste and Cooling Paste. By attaching these readily available temperature-controlled materials to the body, \textsc{HotCold} Block evades human eyes efficiently. Moreover, unlike existing methods that build adversarial patches with complex texture and structure features, \textsc{HotCold} Block utilizes an SSP-oriented adversarial optimization algorithm that enables attacks with pure color blocks and explores the influence of size, shape, and position on attack performance. Extensive experimental results in both digital and physical environments demonstrate the performance of our proposed \textsc{HotCold} Block. \emph{Code is available: \textcolor{magenta}{https://github.com/weihui1308/HOTCOLDBlock}}.

基于深的神经网络（DNNS）基于合成孔径雷达（SAR）自动靶标识别（ATR）系统已显示出非常容易受到故意设计但几乎无法察觉的对抗扰动的影响，但是当添加到靶向物体中时，DNN推断可能会偏差。在将DNN应用于高级SAR ATR应用时，这会导致严重的安全问题。因此，增强DNN的对抗性鲁棒性对于对现代现实世界中的SAR ATR系统实施DNN至关重要。本文旨在构建更健壮的DNN基于DNN的SAR ATR模型，探讨了SAR成像过程的领域知识，并提出了一种新型的散射模型引导的对抗攻击（SMGAA）算法，该算法可以以电磁散射响应的形式产生对抗性扰动（称为对抗散射器） ）。提出的SMGAA由两个部分组成：1）参数散射模型和相应的成像方法以及2）基于自定义的基于梯度的优化算法。首先，我们介绍了有效的归因散射中心模型（ASCM）和一种通用成像方法，以描述SAR成像过程中典型几何结构的散射行为。通过进一步制定几种策略来考虑SAR目标图像的领域知识并放松贪婪的搜索程序，建议的方法不需要经过审慎的态度，但是可以有效地找到有效的ASCM参数来欺骗SAR分类器并促进SAR分类器并促进强大的模型训练。对MSTAR数据集的全面评估表明，SMGAA产生的对抗散射器对SAR处理链中的扰动和转换比当前研究的攻击更为强大，并且有效地构建了针对恶意散射器的防御模型。

由于缺乏对AI模型的安全性和鲁棒性的信任，近年来，深度学习模型（尤其是针对安全至关重要的系统）中的对抗性攻击正在越来越受到关注。然而，更原始的对抗性攻击可能是身体上不可行的，或者需要一些难以访问的资源，例如训练数据，这激发了斑块攻击的出现。在这项调查中，我们提供了全面的概述，以涵盖现有的对抗贴片攻击技术，旨在帮助感兴趣的研究人员迅速赶上该领域的进展。我们还讨论了针对对抗贴片的检测和防御措施的现有技术，旨在帮助社区更好地了解该领域及其在现实世界中的应用。

深度学习技术的发展极大地促进了自动语音识别（ASR）技术的性能提高，该技术证明了在许多任务中与人类听力相当的能力。语音接口正变得越来越广泛地用作许多应用程序和智能设备的输入。但是，现有的研究表明，DNN很容易受到轻微干扰的干扰，并且会出现错误的识别，这对于由声音控制的智能语音应用非常危险。

随着对深神经网络（DNN）模型的越来越关注，对于此类模型，攻击也即将发生。例如，攻击者可以以特定方式仔细构建图像（也称为对抗性示例），以误导DNN模型以输出不正确的分类结果。同样，提出了许多努力来检测和减轻对抗性例子，通常是针对某些专门的攻击。在本文中，我们提出了一种基于数字水印的新型方法，以生成图像对抗性示例以愚弄DNN模型。具体而言，Watermark图像的部分主要特征几乎被视而不见地嵌入到主机图像中，旨在篡改和损坏DNN模型的识别能力。我们设计了一种有效的机制来选择主机图像和水印图像，并利用改进的离散小波变换（DWT）的拼布水印算法，并使用一组有效的超参数将数字水印从水印图像数据集嵌入到原始图像中，以生成图像对抗性示例。实验结果表明，对COFAR-10数据集的攻击成功率平均达到95.47％，最高为98.71％。此外，我们的方案能够有效地生成大量的对抗示例，具体地，平均完成了1.17秒，以完成CIFAR-10数据集上每个图像的攻击。此外，我们设计了一个基线实验，它使用高斯噪声作为水印图像数据集生成的水印图像，该数据集也显示了我们方案的有效性。同样，我们还提出了基于修改的离散余弦变换（DCT）的拼布水印算法。为了确保可重复性和可重复性，可以在GitHub上获得源代码。