[Paper Review] A Survey on Physical Adversarial Attack in Computer Vision

Donghua Wang, Wen Yao+3 more|arXiv (Cornell University)|Sep 28, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This survey provides a comprehensive, up-to-date analysis of physical adversarial attacks in computer vision, categorizing 95 studies (2016–2023) into a novel five-stage taxonomy: victim model selection, problem modeling, optimization, deployment, and evaluation. It identifies key challenges in robustness under real-world conditions and proposes future research directions for more effective and reproducible physical attacks.

ABSTRACT

Over the past decade, deep learning has revolutionized conventional tasks that rely on hand-craft feature extraction with its strong feature learning capability, leading to substantial enhancements in traditional tasks. However, deep neural networks (DNNs) have been demonstrated to be vulnerable to adversarial examples crafted by malicious tiny noise, which is imperceptible to human observers but can make DNNs output the wrong result. Existing adversarial attacks can be categorized into digital and physical adversarial attacks. The former is designed to pursue strong attack performance in lab environments while hardly remaining effective when applied to the physical world. In contrast, the latter focus on developing physical deployable attacks, thus exhibiting more robustness in complex physical environmental conditions. Recently, with the increasing deployment of the DNN-based system in the real world, strengthening the robustness of these systems is an emergency, while exploring physical adversarial attacks exhaustively is the precondition. To this end, this paper reviews the evolution of physical adversarial attacks against DNN-based computer vision tasks, expecting to provide beneficial information for developing stronger physical adversarial attacks. Specifically, we first proposed a taxonomy to categorize the current physical adversarial attacks and grouped them. Then, we discuss the existing physical attacks and focus on the technique for improving the robustness of physical attacks under complex physical environmental conditions. Finally, we discuss the issues of the current physical adversarial attacks to be solved and give promising directions.

Motivation & Objective

• To address the growing need for robust physical adversarial attacks as DNNs are increasingly deployed in real-world systems.
• To provide a systematic taxonomy of physical adversarial attacks across image recognition, object detection, and other tasks.
• To identify critical gaps in evaluation, including lack of standardized benchmarks and dynamic testing criteria.
• To explore the potential dual-use of adversarial examples for improving model robustness and stability in complex environments.

Proposed method

• Proposed a five-stage taxonomy: victim model, problem modeling, optimization, deployment, and evaluation of physical attacks.
• Reviewed 95 recent physical adversarial attack papers from 2016 to July 2023 using keyword-based and reference-based literature collection.
• Categorized attacks by task (image recognition, object detection, others) and analyzed techniques for enhancing robustness under physical conditions.
• Evaluated existing attack methods across datasets and deployment scenarios, highlighting inconsistencies in evaluation protocols.
• Proposed the use of simulation environments (e.g., Carla, AirSim) to standardize and reproduce physical attack testing under controlled conditions.
• Identified the need for uniform physical test criteria, including dynamic settings, environmental factors, and resolution constraints.

Experimental results

Research questions

• RQ1 How can physical adversarial attacks be systematically categorized across the attack pipeline?
• RQ2 What are the key technical challenges in ensuring physical robustness of adversarial examples under real-world environmental variations?
• RQ3 Why is reproducibility of physical adversarial attacks currently limited, and how can simulation-based testing improve it?
• RQ4 To what extent do transferability and robustness in digital attacks translate to physical-world effectiveness?
• RQ5 What are the potential positive applications of adversarial perturbations beyond exploitation, such as model robustness enhancement?

Key findings

• The number of physical adversarial attack papers has grown significantly, with 95 studies reviewed from 2016 to 2023, indicating increasing research interest.
• Most physical attacks are focused on image recognition and object detection, while semantic segmentation and tracking remain underexplored.
• Current evaluation practices lack standardization, with inconsistent datasets and insufficient description of environmental conditions.
• Stationary physical testing fails to capture dynamic real-world scenarios where object motion and changing lighting affect attack success.
• Simulation platforms like Carla and AirSim offer a promising path toward reproducible, controlled evaluation of physical attacks.
• There is a strong potential for using adversarial examples as training data to improve model robustness in complex, real-world environments.