This paper presents a novel universal perturbation method for generating
robust multi-view adversarial examples in 3D object recognition. Unlike
conventional attacks limited to single views, our approach operates on multiple
2D images, offering a practical and scalable solution for enhancing model
scalability and robustness. This generalizable method bridges the gap between
2D perturbations and 3D-like attack capabilities, making it suitable for
real-world applications.
Existing adversarial attacks may become ineffective when images undergo
transformations like changes in lighting, camera position, or natural
deformations. We address this challenge by crafting a single universal noise
perturbation applicable to various object views. Experiments on diverse
rendered 3D objects demonstrate the effectiveness of our approach. The
universal perturbation successfully identified a single adversarial noise for
each given set of 3D object renders from multiple poses and viewpoints.
Compared to single-view attacks, our universal attacks lower classification
confidence across multiple viewing angles, especially at low noise levels. A
sample implementation is made available at
this https URL

本研究提出了一种新颖的通用干扰方法，用于生成 3D 物体识别中的强健的多视角对抗样本。与仅限于单个视角的传统攻击不同，我们的方法在多个 2D 图像上操作，为增强模型的可扩展性和鲁棒性提供实用且可扩展的解决方案。这种通用方法将 2D 干扰和类似 3D 攻击能力之间的差距缩小，适用于实际应用。

一种噪音统治一切：具有通用扰动的多视角对抗攻击

One Noise to Rule Them All: Multi-View Adversarial Attacks with  Universal Perturbation

Previous studies have shown the vulnerability of vision transformers to
adversarial patches, but these studies all rely on a critical assumption: the
attack patches must be perfectly aligned with the patches used for linear
projection in vision transformers. Due to this stringent requirement, deploying
adversarial patches for vision transformers in the physical world becomes
impractical, unlike their effectiveness on CNNs. This paper proposes a novel
method for generating an adversarial patch (G-Patch) that overcomes the
alignment constraint, allowing the patch to launch a targeted attack at any
position within the field of view. Specifically, instead of directly optimizing
the patch using gradients, we employ a GAN-like structure to generate the
adversarial patch. Our experiments show the effectiveness of the adversarial
patch in achieving universal attacks on vision transformers, both in digital
and physical-world scenarios. Additionally, further analysis reveals that the
generated adversarial patch exhibits robustness to brightness restriction,
color transfer, and random noise. Real-world attack experiments validate the
effectiveness of the G-Patch to launch robust attacks even under some very
challenging conditions.

通过使用类似 GAN 的结构，本文提出了一种新的方法生成对抗补丁，该补丁克服了与视觉 Transformer 进行线性投影的贴片完美对齐的约束，使得该补丁能够在视野内的任何位置发动定向攻击，并且无论是在数字环境还是在真实世界的情况下都表现出普遍攻击的有效性。

随机位置对抗性修复在视觉转换器中的应用

Random Position Adversarial Patch for Vision Transformers

Machine learning models are known to be vulnerable to adversarial attacks,
namely perturbations of the data that lead to wrong predictions despite being
imperceptible. However, the existence of "universal" attacks (i.e., unique
perturbations that transfer across different data points) has only been
demonstrated for images to date. Part of the reason lies in the lack of a
common domain, for geometric data such as graphs, meshes, and point clouds,
where a universal perturbation can be defined. In this paper, we offer a change
in perspective and demonstrate the existence of universal attacks for geometric
data (shapes). We introduce a computational procedure that operates entirely in
the spectral domain, where the attacks take the form of small perturbations to
short eigenvalue sequences; the resulting geometry is then synthesized via
shape-from-spectrum recovery. Our attacks are universal, in that they transfer
across different shapes, different representations (meshes and point clouds),
and generalize to previously unseen data.

本文提出了一种在几何数据中实现通用攻击的计算程序，攻击采用短特征向量值的小扰动，在光谱域中操作，通用于不同形状，网格和点云的不同表示，并且可以泛化到以前从未见过的数据。

可变形形状的通用频谱对抗攻击

Universal Spectral Adversarial Attacks for Deformable Shapes

We study the problem of learning classifiers robust to universal adversarial
perturbations. While prior work approaches this problem via robust
optimization, adversarial training, or input transformation, we instead phrase
it as a two-player zero-sum game. In this new formulation, both players
simultaneously play the same game, where one player chooses a classifier that
minimizes a classification loss whilst the other player creates an adversarial
perturbation that increases the same loss when applied to every sample in the
training set. By observing that performing a classification (respectively
creating adversarial samples) is the best response to the other player, we
propose a novel extension of a game-theoretic algorithm, namely fictitious
play, to the domain of training robust classifiers. Finally, we empirically
show the robustness and versatility of our approach in two defence scenarios
where universal attacks are performed on several image classification datasets
-- CIFAR10, CIFAR100 and ImageNet.

构建针对普遍对抗性扰动所鲁棒的分类器的零和博弈训练方法，可在多个图像分类数据集上保证分类器的鲁棒性和多用途性。