{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/robust-physical-world-attacks-on-deep","title":"Robust Physical-World Attacks on Deep Learning Models","arxiv_id":"1707.08945","date":"2017-07-27","proceeding":null,"authors":["Kevin Eykholt","Ivan Evtimov","Earlence Fernandes","Bo Li","Amir Rahmati","Chaowei Xiao","Atul Prakash","Tadayoshi Kohno","Dawn Song"],"abstract":"Recent studies show that the state-of-the-art deep neural networks (DNNs) are\nvulnerable to adversarial examples, resulting from small-magnitude\nperturbations added to the input. Given that that emerging physical systems are\nusing DNNs in safety-critical situations, adversarial examples could mislead\nthese systems and cause dangerous situations.Therefore, understanding\nadversarial examples in the physical world is an important step towards\ndeveloping resilient learning algorithms. We propose a general attack\nalgorithm,Robust Physical Perturbations (RP2), to generate robust visual\nadversarial perturbations under different physical conditions. Using the\nreal-world case of road sign classification, we show that adversarial examples\ngenerated using RP2 achieve high targeted misclassification rates against\nstandard-architecture road sign classifiers in the physical world under various\nenvironmental conditions, including viewpoints. Due to the current lack of a\nstandardized testing method, we propose a two-stage evaluation methodology for\nrobust physical adversarial examples consisting of lab and field tests. Using\nthis methodology, we evaluate the efficacy of physical adversarial\nmanipulations on real objects. Witha perturbation in the form of only black and\nwhite stickers,we attack a real stop sign, causing targeted misclassification\nin 100% of the images obtained in lab settings, and in 84.8%of the captured\nvideo frames obtained on a moving vehicle(field test) for the target\nclassifier.","url_abs":"http://arxiv.org/abs/1707.08945v5","url_pdf":"http://arxiv.org/pdf/1707.08945v5.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"robust-physical-world-attacks-on-deep","repo_url":"https://github.com/evtimovi/robust_physical_perturbations","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"deep-learning","task_name":"Deep Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1707.08945","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}