The paper examines how preprocessing defenses, commonly used to protect edge vision systems, perform on depthwise‑separable CNNs versus residual architectures. Six preprocessing methods were tested against adversarial attacks, revealing that depthwise‑separable models consistently fail to recover from perturbations while residual models show partial recovery. Interestingly, the same preprocessing that hinders clean predictions leaves adversarial predictions largely intact, offering a measurable detection signal, and the study also finds that typical image‑quality metrics do not reliably indicate defense success.
The paper reviews one‑pixel attacks (OPAs), highlighting their extreme adversarial fragility across domains such as medical diagnosis, autonomous driving, biometrics, and quantum communication. It presents a PRISMA‑guided synthesis of studies from 2017 to 2026, offering a unified taxonomy that covers algorithmic foundations, black‑box evolutionary optimization, hybrid and program‑synthesis attacks, defence mechanisms, interpretability tools, and domain‑specific vulnerabilities. The review identifies dominant Differential Evolution strategies, emerging efficiency‑optimized and saliency‑guided methods, and gaps in dataset diversity, transferability, and evaluation standards, while proposing future research directions and a regulatory framework for robustness testing and AI security governance.
By Mirza Niaz Morshed, Md. Masudul Islam, Galib Muhammad Shahriar Himel, Md. Aslam Uddin, Hui Liu, Md. Shafiqul Islam
The paper introduces a unified evaluation framework for assessing the physical adversarial robustness of Vision‑Language Models (VLMs) deployed at the edge. It defines a conditional attack success rate (cASR) metric that counts only images where the model still localizes objects under a gray occluder, and categorizes failures into omission, substitution, and displacement. Benchmarking shows that compact grounding VLMs can be as vulnerable as traditional object detectors, with omission being the only failure visible to downstream systems, while displacement and substitution pose potentially more dangerous risks, especially under distribution shift.
By Eric Liang, Alan Luo, Kaiwen Yuan
RePAIR is a post‑hoc, label‑free defense for semantic segmentation models that counters backdoor attacks by inferring victim‑target relationships from unlabeled images and correcting predictions in feature space and output space. It localizes suspicious pixels by comparing classifier head outputs with internal semantic evidence, applying conservative constraints to avoid harming clean predictions. Experiments demonstrate that RePAIR significantly reduces attack success across various segmentation architectures while largely preserving clean performance.
By Arnold Brosch, Kira Maag
arXiv:2606. 02267v1 Announce Type: new Abstract: The vulnerability of deep neural networks to adversarial examples poses a significant challenge for real-world deployment.
By Nicolas Stalder, Benjamin F. Grewe, Matteo Saponati, Pau Vilimelis Aceituno
arXiv:2602.08136v2 Announce Type: replace-cross
Abstract: Vision-Language Models (VLMs) are now a core part of modern AI. Recent work proposed several visual jailbreak attacks using single/ holistic...
By Md Rafi Ur Rashid, MD Sadik Hossain Shanto, Vishnu Asutosh Dasu, Shagufta Mehnaz
arXiv:2607. 04145v1 Announce Type: new Abstract: Adversarial attacks guide and provide additional training and test data for both adversarial training and adversarial robustness validation, and expose the 'piecewise linearity' of deep learning based models.
By Naman Goyal, Milan Chaudhari
Vision Transformers (ViTs) increasingly rely on input-adaptive inference, such as token pruning and early halting, to meet energy and latency budgets. This survey examines a recent class of adversarial efficiency degradation attacks that target these mechanisms to increase computation without necessarily degrading accuracy.
arXiv:2506. 03933v2 Announce Type: replace-cross Abstract: Vision Language Models (VLMs) have shown remarkable capabilities in multimodal understanding, yet their susceptibility to adversarial perturbations poses a significant threat to their reliability in real-world applications.
By Jia Fu, Yongtao Wu, Yihang Chen, Kunyu Peng, Xiao Zhang, Volkan Cevher, Sepideh Pashami, Anders Holst
arXiv:2608. 07750v1 Announce Type: cross Abstract: Deep Neural Networks (DNNs) have found successful deployment in numerous vision perception systems.
By Cong Chen, Jean-Philippe Monteuuis, Jonathan Petit
arXiv:2607. 07922v1 Announce Type: cross Abstract: Vision Transformers (ViTs) remain vulnerable to localized adversarial attacks, e.
By Giulia Marchiori Pietrosanti, Giulio Rossolini, Giorgio Buttazzo
The paper introduces TRIM, a black‑box defense for backdoor attacks in computer vision models. TRIM identifies and removes malicious trigger regions at inference time using region‑based segmentation, adaptive trigger discovery via inpainting and diffusion, and selective purification, without needing model internals, training data, or clean samples. Experiments on various datasets and trigger types show TRIM reduces attack success rates to as low as 1.16% while maintaining high clean accuracy.
By Ahmed Abdelnaby, Mohamed Elmahallawy