Adversarial Examples in the Physical World: A Survey

TL;DR

This survey comprehensively examines physical adversarial examples in deep neural networks, analyzing their unique characteristics, sources, and defenses to advance understanding and robustness in real-world applications.

Contribution

It provides a systematic analysis and classification framework for physical adversarial examples based on over 100 studies, addressing a key research gap.

Findings

Manufacturing and re-sampling are primary sources of PAE characteristics.

Developed a comprehensive classification framework for PAEs.

Identified open challenges and future research directions.

Abstract

Deep neural networks (DNNs) have demonstrated high vulnerability to adversarial examples, raising broad security concerns about their applications. Besides the attacks in the digital world, the practical implications of adversarial examples in the physical world present significant challenges and safety concerns. However, current research on physical adversarial examples (PAEs) lacks a comprehensive understanding of their unique characteristics, leading to limited significance and understanding. In this paper, we address this gap by thoroughly examining the characteristics of PAEs within a practical workflow encompassing training, manufacturing, and re-sampling processes. By analyzing the links between physical adversarial attacks, we identify manufacturing and re-sampling as the primary sources of distinct attributes and particularities in PAEs. Leveraging this knowledge, we develop a comprehensive analysis and classification framework for PAEs based on their specific characteristics, covering over 100 studies on physical-world adversarial examples. Furthermore, we investigate defense strategies against PAEs and identify open challenges and opportunities for future research. We aim to provide a fresh, thorough, and systematic understanding of PAEs, thereby promoting the development of robust adversarial learning and its application in open-world scenarios to provide the community with a continuously updated list of physical world adversarial sample resources, including papers, code, \etc, within the proposed framework