{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/shadows-can-be-dangerous-stealthy-and","title":"Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenon","arxiv_id":"2203.03818","date":"2022-03-08","proceeding":"CVPR 2022 1","authors":["Yiqi Zhong","Xianming Liu","Deming Zhai","Junjun Jiang","Xiangyang Ji"],"abstract":"Estimating the risk level of adversarial examples is essential for safely deploying machine learning models in the real world. One popular approach for physical-world attacks is to adopt the \"sticker-pasting\" strategy, which however suffers from some limitations, including difficulties in access to the target or printing by valid colors. A new type of non-invasive attacks emerged recently, which attempt to cast perturbation onto the target by optics based tools, such as laser beam and projector. However, the added optical patterns are artificial but not natural. Thus, they are still conspicuous and attention-grabbed, and can be easily noticed by humans. In this paper, we study a new type of optical adversarial examples, in which the perturbations are generated by a very common natural phenomenon, shadow, to achieve naturalistic and stealthy physical-world adversarial attack under the black-box setting. We extensively evaluate the effectiveness of this new attack on both simulated and real-world environments. Experimental results on traffic sign recognition demonstrate that our algorithm can generate adversarial examples effectively, reaching 98.23% and 90.47% success rates on LISA and GTSRB test sets respectively, while continuously misleading a moving camera over 95% of the time in real-world scenarios. We also offer discussions about the limitations and the defense mechanism of this attack.","url_abs":"https://arxiv.org/abs/2203.03818v3","url_pdf":"https://arxiv.org/pdf/2203.03818v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"shadows-can-be-dangerous-stealthy-and","repo_url":"https://github.com/hncszyq/ShadowAttack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"traffic-sign-recognition","task_name":"Traffic Sign Recognition"},{"task_slug":null,"task_name":"valid"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2203.03818","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2203.03818"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/hncszyq/ShadowAttack","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":8},"by_repo_kind":{"official":{"samples":8,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ec98f8f12abafdf5","entry":"cal_angle","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"schedule_attack.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/schedule_attack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ec98f8f12abafdf5"}},{"code_sha256_prefix":"dcf76eaf2f50e8e6","entry":"cal_delta","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"schedule_attack.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/schedule_attack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dcf76eaf2f50e8e6"}},{"code_sha256_prefix":"abac5e96acc4f012","entry":"gen_extra_data","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"gtsrb.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/gtsrb.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"abac5e96acc4f012"}},{"code_sha256_prefix":"f28d4cce5caf9fe2","entry":"load_gtsrb","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"utils.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f28d4cce5caf9fe2"}},{"code_sha256_prefix":"a4b5ac6c784d663e","entry":"load_lisa","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"utils.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a4b5ac6c784d663e"}},{"code_sha256_prefix":"ab977c63868abbdc","entry":"pre_process_image","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"gtsrb.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/gtsrb.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ab977c63868abbdc"}},{"code_sha256_prefix":"60edf4a9e18d112a","entry":"test_single_image","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"lisa.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/lisa.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"60edf4a9e18d112a"}},{"code_sha256_prefix":"4a028dbff86b13d5","entry":"transform_image","repo":"hncszyq/ShadowAttack","repo_kind":"official","path":"gtsrb.py","file_url":"https://github.com/hncszyq/ShadowAttack/blob/HEAD/gtsrb.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4a028dbff86b13d5"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}