面向单目标追踪的对抗攻击技术综述

doi:10.3778/j.issn.1002-8331.2410-0308

摘要/Abstract

摘要： 单目标追踪是计算机视觉中的关键任务之一。随着人工智能技术的发展，基于深度学习的追踪方法已经成为单目标追踪的主流，显著提升了追踪的精度和可用性。然而深度学习方法易受到对抗攻击威胁，攻击者能够诱使深度追踪模型产生错误的追踪结果，严重影响追踪的鲁棒性和安全性。综述了近年来单目标追踪领域对抗性攻击技术的研究进展，揭示了深度学习追踪模型所面临的潜在安全风险，并分析了该领域所面临的挑战和难题。依据攻击方法是否与视频追踪的在线特性相适应，对现有的单目标追踪对抗性攻击技术进行了分类总结，阐述了基本原理、特征以及代表性工作。最后从构建安全可靠的追踪模型和面向实际应用的追踪攻击等视角，对追踪对抗技术的未来发展趋势进行了展望，探讨了当前追踪攻击研究中的关键问题，包括追踪对抗防御、多模态追踪攻击、物理可实现追踪攻击及非合作追踪攻击等，以推动该领域创新与进步。

关键词: 单目标追踪（SOT）, 对抗攻击, 深度学习, 人工智能

Abstract: Single object tracking (SOT) is one of the key tasks in computer vision. With the advancement of artificial intelligence, tracking methods based on deep learning have become the mainstream approach for SOT, significantly improving the performance of tracking systems. However, deep learning methods are vulnerable to adversarial attacks, where attackers induce tracking errors in deep tracking models, severely impacting the precision and robustness of tracking. This paper reviews the development of adversarial attack techniques for SOT in recent years, uncovering the security threats and analyzing the challenges encountered in adversarial attack techniques for SOT. Furthermore, this paper categorizes the existing adversarial attack techniques for SOT based on whether the attack methods align with the online characteristics of video tracking, summarizing their fundamental principles, characteristics, and representative works. Finally, from the perspectives of constructing secure and reliable tracking models and targeting practical applications of tracking attacks, this paper provides an outlook on the future development trends of tracking adversarial technologies. It delves into the pivotal issues in current research on tracking attacks, encompassing tracking adversarial defense, multimodal tracking attacks, physically realizable tracking attacks, and non-cooperative attacks, with the aim of fostering innovation and advancement in this field.

Key words: single object tracking (SOT), adversarial attacks, deep learning, artificial intelligence

陆正之, 黄希宸, 彭勃. 面向单目标追踪的对抗攻击技术综述[J]. 计算机工程与应用, 2025, 61(16): 1-15.

LU Zhengzhi, HUANG Xichen, PENG Bo. Survey of Adversarial Attacks for Single Object Tracking[J]. Computer Engineering and Applications, 2025, 61(16): 1-15.

参考文献

[1] ZHANG Y C, WANG T, LIU K X, et al. Recent advances of single-object tracking methods: a brief survey[J]. Neurocomputing, 2021, 455: 1-11.
[2] 韩瑞泽, 冯伟, 郭青, 等. 视频单目标跟踪研究进展综述[J]. 计算机学报, 2022, 45(9): 1877-1907.
HAN R Z, FENG W, GUO Q, et al. Single object tracking research: a survey[J]. Chinese Journal of Computers, 2022, 45(9): 1877-1907.
[3] LEON F, GAVRILESCU M. A review of tracking, prediction and decision making methods for autonomous driving[J]. arXiv:1909.07707, 2019.
[4] 钟乐海, 李礁, 包晓安, 等. 公共安全智能监控平台关键技术[J]. 兵工自动化, 2021, 40(11): 60-65.
ZHONG L H, LI J, BAO X A, et al. Key technologies of public security intelligent monitoring platform[J]. Ordnance Industry Automation, 2021, 40(11): 60-65.
[5] BUDIHARTO W, ANDREAS V, SUROSO J S, et al. Development of tank-based military robot and object tracker[C]//Proceedings of the 2019 4th Asia-Pacific Conference on Intelligent Robot Systems. Piscataway: IEEE, 2019: 221-224.
[6] CHAN Y T, HU A G C, PLANT J B. A Kalman filter based tracking scheme with input estimation[J]. IEEE Transactions on Aerospace and Electronic Systems, 1979, 15(2): 237-244.
[7] MALIK N A, DRACOS T, PAPANTONIOU D A. Particle tracking velocimetry in three-dimensional flows[J]. Experiments in Fluids, 1993, 15(4): 279-294.
[8] 肖军, 朱世鹏, 黄杭, 等. 基于光流法的运动目标检测与跟踪算法[J]. 东北大学学报 (自然科学版), 2016, 37(6): 770-774.
XIAO J, ZHU S P, HUANG H, et al. Object detecting and tracking algorithm based on optical flow[J]. Journal of Northeastern University (Natural Science), 2016, 37(6): 770-774.
[9] HENRIQUES J F, CASEIRO R, MARTINS P, et al. High-speed tracking with kernelized correlation filters[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2015, 37(3): 583-596.
[10] KUMAR A, VOHRA R, JAIN R, et al. Correlation filter based single object tracking: a review[J]. Information Fusion, 2024, 112: 102562.
[11] 张刚, 郭琦. 基于深度学习的目标追踪方法综述[J]. 长江信息通信, 2023, 36(10): 17-21.
ZHANG G, GUO Q. Survey on target tracking methods based on deep learning[J]. Changjiang Information & Communications, 2023, 36(10): 17-21.
[12] AKHTAR N, MIAN A, KARDAN N, et al. Advances in adversarial attacks and defenses in computer vision: a survey[J]. IEEE Access, 2021, 9: 155161-155196.
[13] 纪守领, 杜天宇, 邓水光, 等. 深度学习模型鲁棒性研究综述[J]. 计算机学报, 2022, 45(1): 190-206.
JI S L, DU T Y, DENG S G, et al. Robustness certification research on deep learning models: a survey[J]. Chinese Journal of Computers, 2022, 45(1): 190-206.
[14] LU Z Z, WANG H, CHANG Z Y, et al. Hard no-box adversarial attack on skeleton-based human action recognition with skeleton-motion-informed gradient[C]//Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2023: 4574-4583.
[15] GOODFELLOW I J, SHLENS J, SZEGEDY C. Explaining and harnessing adversarial examples[C]//Proceedings of the 2015 International Conference on Learning Representations, 2015.
[16] ZHANG Y, TI?O P, LEONARDIS A, et al. A survey on neural network interpretability[J]. IEEE Transactions on Emerging Topics in Computational Intelligence, 2021, 5(5): 726-742.
[17] GILPIN L H, BAU D, YUAN B Z, et al. Explaining explanations: an overview of interpretability of machine learning[C]//Proceedings of the 2018 IEEE 5th International Conference on Data Science and Advanced Analytics. Piscataway: IEEE, 2018: 80-89.
[18] LIANG S Y, WEI X X, YAO S Y, et al. Efficient adversarial attacks for visual object tracking[C]//Proceedings of the 16th European Conference on Computer Vision. Cham: Springer, 2020: 34-50.
[19] GUO Q, XIE X F, JUEFEI-XU F, et al. SPARK: spatial-aware online incremental attack against visual tracking[C]//Proceedings of the 16th European Conference on Computer Vision. Cham: Springer, 2020: 202-219.
[20] CHEN X S, YAN X Y, ZHENG F, et al. One-shot adversarial attacks on visual tracking with dual attention[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 10173-10182.
[21] VINYALS O, BLUNDELL C, LILLICRAP T, et al. Matching networks for one shot learning[C]//Advances in Neural Information Processing Systems 29, 2016: 3637-3645.
[22] NAM H, HAN B. Learning multi-domain convolutional neural networks for visual tracking[C]//Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2016: 4293-4302.
[23] NAM H, BAEK M, HAN B. Modeling and propagating CNNs in a tree structure for visual tracking[J]. arXiv:1608. 07242, 2016.
[24] LI H X, LI Y, PORIKLI F. DeepTrack: learning discriminative feature representations online for robust visual tracking[J]. IEEE Transactions on Image Processing, 2016, 25(4): 1834-1848.
[25] BERTINETTO L, VALMADRE J, HENRIQUES J F, et al. Fully-convolutional Siamese networks for object tracking[C]//Proceedings of the 14th European Conference on Computer Vision. Cham: Springer, 2016: 850-865.
[26] LI B, WU W, WANG Q, et al. SiamRPN++: evolution of Siamese visual tracking with very deep networks[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2019: 4277-4286.
[27] ZHU Z, WANG Q, LI B, et al. Distractor-aware Siamese networks for visual object tracking[C]//Proceedings of the 15th European Conference on Computer Vision. Cham: Springer, 2018: 103-119.
[28] DANELLJAN M, BHAT G, KHAN F S, et al. ATOM: accurate tracking by overlap maximization[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2019: 4655-4664.
[29] BHAT G, DANELLJAN M, VAN GOOL L, et al. Learning discriminative model prediction for tracking[C]//Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2019: 6181-6190.
[30] DANELLJAN M, VAN GOOL L, TIMOFTE R. Probabilistic regression for visual tracking[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 7181-7190.
[31] CHEN X, YAN B, ZHU J W, et al. Transformer tracking[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2021: 8122-8131.
[32] YAN B, PENG H W, FU J L, et al. Learning spatio-temporal transformer for visual tracking[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2021: 10428-10437.
[33] MA F, SHOU M Z, ZHU L C, et al. Unified transformer tracker for object tracking[C]//Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2022: 8771-8780.
[34] GUO D Y, SHAO Y Y, CUI Y, et al. Graph attention tracking[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2021: 9538-9547.
[35] KIM H I, PARK R H. Residual LSTM attention network for object tracking[J]. IEEE Signal Processing Letters, 2018, 25(7): 1029-1033.
[36] YUN S, CHOI J, YOO Y, et al. Action-decision networks for visual tracking with deep reinforcement learning[C]//Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2017: 1349-1358.
[37] LU Z Z, YANG G A, LIU D Y, et al. Selective part-based correlation filter tracking algorithm with reinforcement learning[J]. IET Image Processing, 2022, 16(4): 1208-1226.
[38] MELEKHOV I, KANNALA J, RAHTU E. Siamese network features for image matching[C]//Proceedings of the 2016 23rd International Conference on Pattern Recognition. Piscataway: IEEE, 2016: 378-383.
[39] HAN K, WANG Y H, CHEN H T, et al. A survey on vision transformer[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023, 45(1): 87-110.
[40] THYS S, VAN RANST W, GOEDEME T. Fooling automated surveillance cameras: adversarial patches to attack person detection[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. Piscataway: IEEE, 2019: 49-55.
[41] MORRIS J X, LIFLAND E, YOO J Y, et al. TextAttack: a framework for adversarial attacks, data augmentation, and adversarial training in NLP[J]. arXiv:2005.05909, 2020.
[42] CHEN X S, FU C M, ZHENG F, et al. A unified multi-scenario attacking network for visual object tracking[J]. Proceedings of the AAAI Conference on Artificial Intelligence, 2021, 35(2): 1097-1104.
[43] BEWLEY A, GE Z Y, OTT L, et al. Simple online and realtime tracking[C]//Proceedings of the 2016 IEEE International Conference on Image Processing. Piscataway: IEEE, 2016: 3464-3468.
[44] NAKKA K K, SALZMANN M. Universal, transferable adversarial perturbations for visual object trackers[C]//Proceedings of the 17th European Conference on Computer Vision. Cham: Springer, 2022: 413-429.
[45] WU Y, LIM J, YANG M H. Online object tracking: a benchmark[C]//Proceedings of the 2013 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2013: 2411-2418.
[46] KRISTAN M, MATAS J, LEONARDIS A, et al. The ninth visual object tracking VOT2021 challenge results[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision Workshops. Piscataway: IEEE, 2021: 2711-2738.
[47] FAN H, LIN L T, YANG F, et al. LaSOT: a high-quality benchmark for large-scale single object tracking[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2019: 5369-5378.
[48] WU W B, SU Y X, CHEN X X, et al. Boosting the transferability of adversarial samples via attention[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 1158-1167.
[49] WANG X S, ZHANG Z L, ZHANG J P. Structure invariant transformation for better adversarial transferability[C]//Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2023: 4584-4596.
[50] WANG K Y, HE X R, WANG W X, et al. Boosting adversarial transferability by block shuffle and rotation[C]//Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2024: 24336-24346.
[51] CHEN P-Y, ZHANG H, SHARMA Y, et al. ZOO: zeroth order optimization based black-box attacks to deep neural networks without training substitute models[C]//Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. New York: ACM, 2017: 15-26.
[52] CARLINI N, WAGNER D. Towards evaluating the robustness of neural networks[C]//Proceedings of the 2017 IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2017: 39-57.
[53] PENG B W, PENG B, XIA J Y, et al. Towards assessing the synthetic-to-measured adversarial vulnerability of SAR ATR[J]. ISPRS Journal of Photogrammetry and Remote Sensing, 2024, 214: 119-134.
[54] WANG L, YOON K J. PSAT-GAN: efficient adversarial attacks against holistic scene understanding[J]. IEEE Transactions on Image Processing, 2021, 30: 7541-7553.
[55] WU W B, SU Y X, LYU M R, et al. Improving the transferability of adversarial samples with adversarial transformations[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2021: 9020-9029.
[56] WAN X S, LIU W, NIU C Y, et al. Black-box universal adversarial attack for DNN-based models of SAR automatic target recognition[J]. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing, 2024, 17: 8673-8696.
[57] WANG T, YING Z J, LI Q M, et al. Boost adversarial transferability by uniform scale and mix mask method[J]. arXiv: 2311. 12051, 2023.
[58] FAN J X, YAN Q, LI M H, et al. A survey on data poisoning attacks and defenses[C]//Proceedings of the 2022 7th IEEE International Conference on Data Science in Cyberspace. Piscataway: IEEE, 2022: 48-55.
[59] LI Y M, JIANG Y, LI Z F, et al. Backdoor learning: a survey[J]. IEEE Transactions on Neural Networks and Learning Systems, 2024, 35(1): 5-22.
[60] ILYAS A, ENGSTROM L, ATHALYE A, et al. Black-box adversarial attacks with limited queries and information[C]//Proceedings of the 35th International Conference on Machine Learning, 2018: 2137-2146.
[61] XIE C H, ZHANG Z S, ZHOU Y Y, et al. Improving transferability of adversarial examples with input diversity[C]//Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2019: 2725-2734.
[62] ATHALYE A, ENGSTROM L, ILYAS A, et al. Synthesizing robust adversarial examples[C]//Proceedings of the 35th International Conference on Machine Learning, 2018: 284-293.
[63] WEI X X, PU B Z, LU J F, et al. Visually adversarial attacks and defenses in the physical world: a survey[J]. arXiv:2211. 01671, 2022.
[64] ZHANG C N, BENZ P, LIN C G, et al. A survey on universal adversarial attack[C]//Proceedings of the 30th International Joint Conference on Artificial Intelligence, 2021: 4687-4694.
[65] YAN X Y, CHEN X S, JIANG Y, et al. Hijacking tracker: a powerful adversarial attack on visual tracking[C]//Proceedings of the 2020 IEEE International Conference on Acoustics, Speech and Signal Processing. Piscataway: IEEE, 2020: 2897-2901.
[66] JIA S, MA C, SONG Y B, et al. Robust tracking against adversarial attacks[C]//Proceedings of the 16th European Conference on Computer Vision. Cham: Springer, 2020: 69-84.
[67] JIA S, SONG Y B, MA C, et al. IoU attack: towards temporally coherent black-box adversarial attack for visual object tracking[C]//Proceedings of the 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2021: 6705-6714.
[68] 姚睿, 朱享彬, 周勇, 等. 基于重要特征的视觉目标跟踪可迁移黑盒攻击方法[J]. 电子学报, 2023, 51(4): 826-834.
YAO R, ZHU X B, ZHOU Y, et al. Transferable black box attack on visual object tracking based on important features[J]. Acta Electronica Sinica, 2023, 51(4): 826-834.
[69] YAN B, WANG D, LU H C, et al. Cooling-shrinking attack: blinding the tracker with imperceptible noises[C]//Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2020: 987-996.
[70] 程旭, 王莹莹, 张年杰, 等. 基于空间感知的多级损失目标跟踪对抗攻击方法[J]. 通信学报, 2021, 42(11): 242-254.
CHENG X, WANG Y Y, ZHANG N J, et al. Multi?level loss object tracking adversarial attack method based on spatial perception[J]. Journal on Communications, 2021, 42(11): 242-254.
[71] SUTTAPAK W, ZHANG J F, ZHANG L Q. Diminishing-feature attack: the adversarial infiltration on visual tracking[J]. Neurocomputing, 2022, 509: 21-33.
[72] PANG H B, MA R Q, LIU C M, et al. An efficient method to fool and enhance object tracking with adversarial perturbations[J]. Neural Computing and Applications, 2023, 35(15): 10821-10836.
[73] FU C H, LI S H, YUAN X N, et al. Ad2Attack: adaptive adversarial attack on real-time UAV tracking[C]//Proceedings of the 2022 International Conference on Robotics and Automation. Piscataway: IEEE, 2022: 5893-5899.
[74] YIN X Y, RUAN W J, FIELDSEND J. DIMBA: discretely masked black-box attack in single object tracking[J]. Machine Learning, 2024, 113(4): 1705-1723.
[75] ZHOU Z, SUN Y H, SUN Q S, et al. Only once attack: fooling the tracker with adversarial template[J]. IEEE Transactions on Circuits and Systems for Video Technology, 2023, 33(7): 3173-3184.
[76] WIYATNO R, XU A Q. Physical adversarial textures that fool visual object tracking[C]//Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2019: 4821-4830.
[77] DING L, WANG Y W, YUAN K W, et al. Towards universal physical attacks on single object tracking[J]. Proceedings of the AAAI Conference on Artificial Intelligence, 2021, 35(2): 1236-1245.
[78] LI Z B, SHI Y Y, GAO J, et al. A simple and strong baseline for universal targeted attacks on Siamese visual tracking[J]. IEEE Transactions on Circuits and Systems for Video Technology, 2022, 32(6): 3880-3894.
[79] LIU S A, CHEN Z Y, LI W, et al. Efficient universal shuffle attack for visual object tracking[C]//Proceedings of the 2022 IEEE International Conference on Acoustics, Speech and Signal Processing. Piscataway: IEEE, 2022: 2739-2743.
[80] LI Y M, ZHONG H X, MA X J, et al. Few-shot backdoor attacks on visual object tracking[J]. arXiv:2201.13178, 2022.
[81] GUO Q, CHENG Z Y, JUEFEI-XU F, et al. Learning to adversarially blur visual object tracking[C]//Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2021: 10819-10828.
[82] HELD D, THRUN S, SAVARESE S. Learning to track at 100 FPS with deep regression networks[C]//Proceedings of the 14th European Conference on Computer Vision. Cham: Springer, 2016: 749-765.
[83] ZHOU M, WANG L, NIU Z X, et al. Adversarial attack and defense in deep ranking[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024, 46(8): 5306-5324.
[84] WEI X X, HUANG Y, SUN Y T, et al. Unified adversarial patch for visible-infrared cross-modal attacks in the physical world[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024, 46(4): 2348-2363.
[85] XIE T X, HAN H, SHAN S G, et al. Natural adversarial mask for face identity protection in physical world[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025, 47(3): 2089-2106.
[86] SUN G X, ALPCAN T, RUBINSTEIN B I P, et al. To act or not to act: an adversarial game for securing vehicle platoons[J]. IEEE Transactions on Information Forensics and Security, 2023, 19: 163-177.
[87] CHEN Y Z, TANG Y Q, XIAO Y, et al. Satellite video single object tracking: a systematic review and an oriented object tracking benchmark[J]. ISPRS Journal of Photogrammetry and Remote Sensing, 2024, 210: 212-240.
[88] YANG J W, PAN Z X, WANG Z M, et al. SiamMDM: an adaptive fusion network with dynamic template for real-time satellite video single object tracking[J]. IEEE Transactions on Geoscience and Remote Sensing, 2023, 61: 5608619.
[89] BAI T, LUO J Q, ZHAO J, et al. Recent advances in adversarial training for adversarial robustness[J]. arXiv:2102. 01356, 2021.
[90] SOLL M, HINZ T, MAGG S, et al. Evaluating defensive distillation for defending text processing neural networks against adversarial example[C]//Proceedings of the 28th International Conference on Artificial Neural Networks. Cham: Springer, 2019: 685-696.
[91] HAMEED M Z, GY?RGY A, GüNDüZ D. The best defense is a good offense: adversarial attacks to avoid modulation detection[J]. IEEE Transactions on Information Forensics and Security, 2020, 16: 1074-1087.
[92] LI Z H, CUI Y B, LIN Y, et al. MMF-track: multi-modal multi-level fusion for 3D single object tracking[J]. IEEE Transactions on Intelligent Vehicles, 2024, 9(1): 1817-1829.
[93] ZHU H, ZHANG P P, XUE L, et al. Multi-modal understanding and generation for object tracking[J]. IEEE Transactions on Circuits and Systems for Video Technology, 2025, 35(5): 4384-4396.
[94] WANG X, SUN Z J, CHEHRI A, et al. Deep learning and multi-modal fusion for real-time multi-object tracking: algorithms, challenges, datasets, and comparative study[J]. Information Fusion, 2024, 105: 102247.
[95] LU D, WANG Z Q, WANG T, et al. Set-level guidance attack: boosting adversarial transferability of vision-language pre-training models[C]//Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2023: 102-111.
[96] WEI X X, HUANG Y, SUN Y T, et al. Unified adversarial patch for cross-modal attacks in the physical world[C]//Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2023: 4422-4431.
[97] ZHANG Z, YUAN X, ZHU L, et al. BadCM: invisible backdoor attack against cross-modal learning[J]. IEEE Transactions on Image Processing, 2024, 33: 2558-2571.
[98] HINGUN N, SITAWARIN C, LI J, et al. REAP: a large-scale realistic adversarial patch benchmark[C]//Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision. Piscataway: IEEE, 2023: 4617-4628.
[99] WEI H, TANG H, JIA X M, et al. Physical adversarial attack meets computer vision: a decade survey[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024, 46(12): 9797-9817.
[100] NAYAK G K, KHATRI I, RAWAL R, et al. Data-free defense of black box models against adversarial attacks[C]//Proceedings of the 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. Piscataway: IEEE, 2024: 254-263.