# A color temperature-based high-speed decolorization: an empirical approach
for tone mapping applications

Prasoon Ambalathankandy İD , Yafei Ou İD , and Masayuki Ikebe İD Prasoon
Ambalathankandy and Yafei Ou are with the Research Center For Integrated
Quantum Electronics, Hokkaido University, Sapporo 060-0813, Japan, and also
with the Graduate School of Information Science and Technology, Hokkaido
University, Sapporo 060-0814, Japan.Masayuki Ikebe is with the Research Center
For Integrated Quantum Electronics, Hokkaido University, Sapporo 060-0813,
Japan (e-mail: ikebe@ist.hokudai.ac.jp).

###### Abstract

Grayscale images are fundamental to many image processing applications like
data compression, feature extraction, printing and tone mapping. However, some
image information is lost when converting from color to grayscale. In this
paper, we propose a light-weight and high-speed image decolorization method
based on human perception of color temperatures. Chromatic aberration results
from differential refraction of light depending on its wavelength. It causes
some rays corresponding to cooler colors (like blue, green) to converge before
the warmer colors (like red, orange). This phenomena creates a perception of
warm colors “advancing” toward the eye, while the cool colors to be “receding”
away. In this proposed color to gray conversion model, we implement a weighted
blending function to combine red (perceived warm) and blue (perceived cool)
channel. Our main contribution is threefold: First, we implement a high-speed
color processing method using exact pixel by pixel processing, and we report a
$5.7\times$ speed up when compared to other new algorithms. Second, our
optimal color conversion method produces luminance in images that are
comparable to other state of the art methods which we quantified using the
objective metrics (E-score and C2G-SSIM) and a subjective user study. Third,
we demonstrate that an effective luminance distribution can be achieved using
our algorithm by using global and local tone mapping applications.

###### Index Terms:

Color temperature, chromatic aberration, decolorization, luminance, pre-
processing, RGB, tonemap.

##  I Introduction

Grayscale channels, which reflect image luminance, are used for various
applications such as printing, tone mapping, data compression, and feature
extraction. Thus, obtaining luminance along with human perception has a key
role for decolorization, which converts RGB channels to high-quality gray
ones. For example, High Dynamic Range (HDR) compression is ideally performed
by tone mapping the luminance channel for the lower computational and memory
cost. However, applying well-known luminance channels such as Y of YCbCr or V
of HSV does not guarantee appropriate tone mapping, as these channels do not
reflect human perceptions. Therefore, decolorization has gathered considerable
attention and various sophisticated methods to achieve perceptual
decolorization have recently been proposed. These methods can be classified
into global and local methods. Global methods can define only one conversion
function for all pixels, and most of these methods use all pixels in the image
to determine the function. On the other hand, local ones process the target
from neighboring pixels in the same way as a spatial filter, the function is
different for each pixel. However, both types of methods face the issue of
calculation cost, which comes from optimization iterations or spatial filter
processing.

We have developed a fast decolorization method that reflects the perception of
warm and cool colors which is well known in psychophysics studies[1]. Colors
are arranged according to their wavelengths on the color wheel, the ones with
longest wavelengths are on the right side of the wheel and are known as warm
colors, as they evoke warmth. These hues include shades of red, yellow, and
orange. On the other hand, green, blue and violet which have shorter
wavelengths are placed on the left side of the color wheel, and are perceived
as cool colors. The color of an object in a scene affects our perception of
its apparent depth and this phenomenon has been exploited by many artists.
This optical illusion has been studied by psychologists, and early researchers
explored color-depth relationship. One of the widely accepted theory explains
this phenomenon is due to fact that shorter wavelengths of visible light are
refracted more than longer wavelengths [2]. In other words, an equidistant
source of different wavelengths cannot be focused simultaneously onto our
retina. This phenomena is called as chromatic aberration and we discuss it in
detail in section III-A. In our decolorization method, we combine the idea of
warm/cool colors with the Helmholtz-Kohlrausch effect [3]. On that account, we
make two assumptions, which are: $(i)$ warm colors (mainly including $R$) are
lighter than $Y$ of YCbCr and $(ii)$ mixed colors are darker than the $Y$ or
$L$ of CIE with the same luminance. To satisfy these assumptions, we use a
weighted blending of RGB channels and remap them to warm/cool colors on the
luminance channel. Following are our main contributions:

  * •

We achieve high-speed color mapping by exact pixel-by-pixel processing.

  * •

We obtain luminance comparable to that of optimization-based methods.

  * •

We demonstrate effective luminance distribution by performing objective
evaluations and a subjective user study.

Figure 1: Main concept of our decolorization method: Human perception of warm
and cool colors. Warm colors “advance” toward the eye, while cool colors
“recede”. In this work we are able to accurately reflect the human perception
of color temperatures, whereas this phenomenon is non-existent in conventional
YCbCr color space.

There are many well defined methods to convert any color image to a grayscale
image. An effortless procedure is to assign different weights to color
channels, in order to have the same luminance in the grayscale image as the
original color image. For example, in the MATLAB function rgb2gray, it
converts any RGB values to grayscale ($Gray$) values by forming a weighted sum
of the $R$, $G$, and $B$ components as $Gray=0.2989\times R+0.5870\times
G+0.1140\times B$. This function operates under an assumption that human
visual system is more sensitive to green color. When operating with CIELab and
YUV color spaces, one could directly obtain luminance channel as the grayscale
version of the color image as they consider the luminance and color channel to
be independent. But, such crude approaches will fail to preserve image
contrast as shown in these examples (see Fig. 1 and Fig. 2).

Figure 2: Comparison of luminance components obtained using YCbCr, CIELAB and
our proposed method.

In several real-world image/video processing applications like detail
enhancement, image matching, and segmentation under different illumintion a
1-D grayscale image has to be obtained from its corresponding 3-D color image.
However, mapping the 3-D color information onto a 1-D grayscale image while
retaining the original contrast and fine details is a challenging problem.
Additionally, implementing decolorization algorithms with a reasonable
computational efficiency is pivotal for realising their real-time
applications. Many studies have been carried out to develop novel
decolorization methods. These mapping methods can be categorized into global
[4, 5, 6, 7, 8] and local methods [9, 10, 11, 12]. In local mapping methods,
the same color pixel within an image could be mapped into different grayscale
values depending on its spatial location. Ideally this undesirable as such
output images may be perceived as unnatural. On the other hand, in global
mapping methods same color pixels within an image irrespective of its spatial
location are mapped to same grayscale values. Thus, global methods are more
likely to produce grayscale images that are perceived to appear natural.

In the global methods category, Gooch et al. [4] proposed a global
decolorization algorithm that can be implemented by solving the optimization
problem for all image pixels. Then, Kim et al. [7] aimed at high-speed
processing by simplifying Gooch’s method. Smith et al. [6] used unsharp
masking and the Helmholtz-Kohlrausch effect (H-K effect) model of Nayatani et
al. [3]. Nayatani’s model [3] is merely an experimental model for the effect
of the CIELUV chrominance component for human perception. On the other hand,
the method of Lu et al. [8] is focused on converting a color image into a gray
image with high contrast. The main advantage of these methods is
transformation consistency, i.e., the same color is converted to the same
grayscale. However, speed remains a problem for these methods. Most of the
local methods are aimed at speeding up the method of Lu et al [8]. To enhance
image contrast, Ancuti et al. [10] adopted the strategy of using a Laplacian
filter and Song et al. [12] used a Sobel filter. Although local methods are
effective in terms of contrast emphasis, they are disadvantageous in terms of
tone mapping because conversion consistency is not maintained and it differs
from human perception.

Recently, some machine learning-based techniques have also been proposed for
image decolorization [13, 14, 15, 16, 17]. Cai et al. [14] proposed a method,
that used the perceptual loss function to pretrain VGG-Net [18]. However, it
is difficult to control and many of their output images are far from human
perception additionally, the computational cost are high. Processing an image
of $256\times 256$ size it requires roughly 30 seconds on a single Nvidia
GeForceGTX 1080 GPU. Zhang et al., proposed a CNN framework that combines
local and global image features [17]. However, their network framework do not
account for exposure features [13]. Lin et al.’s method [16] by utilizing a
database of 50 images from the Corel dataset produced 50 grayscale images
using the Color2Gray algorithm [4]. With these 50 input/output image pairs as
training examples for their partial differential equations-based (PDE)learning
system, the learn color2gray mapping. The PDE system produced images of
comparable quality to [4]. However, for an input image of size $n\times n$
their PDE color mapping algorithm’s computational complexity is
$\textit{O}(n^{2})$. Under these circumstances, a high-speed method for
generating grayscale images that accurately captures human perception has not
yet been developed. To make tone maps valid, it is necessary to develop such a
method.

##  II Proposed Method

###  II-A Problem Definition

Luminance components such as $Y$ of YCbCr and CIE $L$ have been used in
various image processing applications; however, they do not accurately reflect
human perception (Fig.1 and Fig. 2). Figure 1 shows how the warm colored
flower (red) advances towards the eye of the observer, while the background
mainly green recedes. Using the luminance channel of the conventional YCbCr
color space this phenomenon is absent. But, in our method we are able to
capture the warmth $R$ (red) component as perceived in human perception.
Figure 2 shows that the $R$ (red) and $B$ (blue) components do not come even
close to the perception in the luminance component of CIELAB. Moreover, mixed
color components such as mud yellow tend to appear dark for people. In this
study, we conceived the idea that RGB weight functions for alpha blending can
reproduce this phenomenon.

###  II-B Luminance mapping using red and blue weighting function

Figure 3: (a) Remodeling of luminance space based on our two weighting
functions one each for warm and cool colors. Here, luminance is defined as the
Euclidean distance of warm/cool color. (b) Decolorization of a color chart
illustrating our method’s effectiveness in generating brighter shades of gray
for warm colors.

We considered the idea of color mapping by combining the warm/cool color and
the Helmholtz-Kohlrausch [3]. Psychophysical studies find that, warm and cool
colors impact our visual perception of the objects that we see. For example,
the red color associated with fire/sun advances toward the eye, creates an
illusion of heat and therefore perceived as warmth and comforting. On the
other hand, cool colors have reverse effects of warm colors. Receding from the
eye of the observer, cool colors reminds of the earthy objects, like meadows
and oceans. These hues often are perceived as cool and refreshing [1][19]. In
our decolorization method, we developed two weighting functions as shown in
Fig 3. One function for remapping warm colors and the other for remapping cool
colors. In our method, actual luminance is defined as the Euclidean distance
of weighted warm/cool luminance including the $W$ (white) channel. Essential
luminance is given by

$L_{WHITE}=\sqrt{\frac{R^{2}+G^{2}+B^{2}}{3}}$ (1) $L_{B}=B$ (2)
$L_{G,R}=\sqrt{\beta_{R}R^{2}+(1-\beta_{R})G^{2}},\;(0.5<\beta_{R}<1)$ (3)

As we know, $L_{WHITE}:W$ is the Euclidean distance of $RGB$ channels; $L_{B}$
is the $B$ channel as it is. The warm color function is also defined as the
Euclidean distance by $\beta_{R}$ weighted $R$ and $G$(green) vectors. The
$\beta_{R}$ determines the bias of $R$ components in the replacement; when the
$\beta_{R}$ becomes higher, more $R$ components than $G$ components are rated.
The remappings made by the blending function using the $R$ and $B$ ratio of
$RGB$ values are given by

$L_{WARM}=\frac{R}{R+G+B}\cdot L_{G,R}+\left(1-\frac{R}{R+G+B}\right)\cdot
L_{WHITE}$ (4) $L_{COOL}=\left(1-\frac{B}{R+G+B}\right)\cdot
L_{B}+\frac{B}{R+G+B}\cdot L_{WHITE}$ (5)

Figure 4: Impact of $\beta_{R}$ and $\beta_{k}$ on output luminance value.
(top) $\beta_{k}$ set to 0.8 and for changing $\beta_{R}$ we move from
$G_{max}$ to $R_{max}$. (middle) $\beta_{R}$ set to 0.55 and for changing
$\beta_{k}$ we move from $B_{max}$ to $R_{max}$. (bottom) $\beta_{R}$ set to
0.55 and for changing $\beta_{k}$ we move from $B_{max}$ to $G_{max}$ Figure
5: Color to gray conversion comparison with other decolorization methods.

In the $L_{WARM}$, using $R$ weighting, we can map $\frac{G}{R}$ to $low/high$
luminance separately. In Inverse $B$ weighting, pure $B$ components are
assigned to low luminance in the $L_{COOL}$ . Since both functions are blended
with $L_{WHITE}$, bright orange/yellow and sky blue, which include high white
components, are mapped to higher luminance. Finally, we obtain the luminance
channel $L$, which is given by

$L=\sqrt{\beta_{k}L^{2}_{WARM}+(1-\beta_{k})L^{2}_{COOL}}\;(0.5<\beta_{k}<1)$
(6)

In this study, we mainly used warm-color weighting luminance in experiments
and set the $\beta_{k}$ higher. We set two parameters relating to color
component emphasis as follows: $(\beta_{R}=0.55;\beta_{k}=0.8)$, and from Fig
4 it can be easily understood how $\beta_{R}$ and $\beta_{k}$ can bias the
resulting luminance values.

###  II-C Evaluation of our algorithm implementation

When evaluating our method, we focused on the following points:

  * •

Visual comparison with other decolorization methods

  * •

Compare their processing speeds.

The evaluations demonstrated that our method does reflect human perception
better than or equal to other optimized methods (see perceptual test). It
delivers high-speed processing, and is a useful tool for many image processing
applications. Figure 5 shows a comparison between our proposed method and
other decolorization methods, and the subjective evaluation is shown in Fig.
6. For this comparison we have used images from Cadik’s dataset [20]. In Fig.
5 first and second columns from the left are original images and images
obtained with our method respectively. The images in the third column from the
left were obtained with the $L$ component of the CIELAB color space, which is
a reversible model reflecting human visual characteristics. The images in the
fourth to sixth columns were obtained from global decolorization methods,
which means only one conversion function is applied to each pixel. For
example, in these methods, optimization techniques referring to whole pixels
are applied to luminance conversion without regard to the brightness perceived
by human perception. The images in the far right column were obtained with a
local method that refers to pixel values in the local patch of the image for
contrast enhancement.

Figure 6: Subjective visual test survey and mean opinion score Figure 7:
Effects of decolorization techniques on tone mapped images that are generated
using Shan et al.’s tone mapping operator [21].

In the $L$ component of the CIELAB color space, the base luminance is $Y$ in
the YCbCr color space; the luminance is also mapped along with the color order
of $Y$. In the image (third column, fourth row), since the luminance of all
colors are the same in $Y$, output values are also the same in the CIELAB
color space. However, we can perceive the contrast in this image. Thus, an
appropriate conversion is required; our method can generate the perceived
contrast in this image. Gooch et al. [4] obtained the highest average C2G-SSIM
score but clearly a step artifact occurs in the gradation image (fourth
column, second row). Kim et al. [7] proposed an improved version of Gooch’s
method that achieves high-speed optimization and reflects the Helmholtz-
Kohlrausch [3]. In this method, since a weighting function is applied for
expanding luminance distribution of whole pixel colors in the image along with
chrominance, its conversion becomes different in each image. Thus, over-
enhancement is observed in the images (fifth column, first row) and (fifth
column, fourth row). The output images of our method are similar to those of
Smith et al. [6]. Their method also uses the Helmholtz-Kohlrausch, but it also
requires a lot of processing time for post-unsharp-mask filtering. In Lu et
al. [8], their method does not reflect human perception; they try generating
high contrast images for mask images that are input to an edge-preserving
filter such as a guided filter.

TABLE I: Run-time comparison table with other decolorization algorithms. Algorithm |  Processing time |  Image size W$\times$H |  CPU Clock Speed |  Optimization |  Process |  Normalized Time⋆
---|---|---|---|---|---|---
Gooch et al. [4] |  25.7s |  200$\times$200 |  -GPU- |  ✓ |  Global |  N/A
Kim et al. [7] |  102ms |  320$\times$240 |  2.66GHz |  ✓ |  Global |  1.30$\mu$s
Smith et al. [6] |  6.7s |  570$\times$593 |  3.0GHz |  $\times$ |  Global+Local |  22.02$\mu$s
Lu et al. [8] |  800ms |  600$\times$600 |  3.80GHz |  ✓ |  Global Contrast |  3.12$\mu$s
Song et al. [12] |  40ms |  320$\times$240 |  N/A |  $\times$ |  Local Contrast |  N/A
Ancuti et al. [10] |  100ms |  800$\times$600 |  2.5GHz |  $\times$ |  Local Contrast |  0.19$\mu$s
L of CIE Lab |  25.57ms |  800$\times$600 |  2.7GHz |  $\times$ |  Global |  0.053$\mu$s
Ours low res |  16.71ms |  800$\times$600 |  2.7GHz |  $\times$ |  Global |  0.034$\mu$s
Ours high res |  202.05ms |  3008$\times$2008 |  2.7GHz |  $\times$ |  Global |  0.033$\mu$s

For our perceptual evaluation we conducted a user study with two objectives:

  * •

Evaluate the decolorization process by measuring accuracy and preference [20,
22].

  * •

Assess the effectiveness of our decolorization method as an image pre-
processing tool for tone mapping application.

Our study group of 15 students (9 males, 6 females, average age = 23) were
shown twelve sets of images (refer Figs. 5 and 7 ). They were asked to
evaluate Fig. 5 and assign points to these images, on a scale of 1 (low) to 5
(high) for accuracy and preference. For our first evaluation, to measure the
accuracy they compared the original color images to their decolorized output
image. For the preference measurements, the user group compared the
decolorized images only, i.e., without the corresponding color image. In our
next user study we measured the naturalness and overall quality of the tone
mapped images. For tone mapping we chose a MATLAB algorithm of Shan et al.
[21] as they can tonemap standard images and it can be performed by simple
parameter settings. Color tone mapped images for the same set shown in Fig. 7
were evaluated for naturalness and perceptual quality, i.e., the users rated 5
for images that were perceived as natural and observed minimal artifacts. In
our test setup we used a Microsoft Surface Pro 7 set to its native resolutions
and the lighting of the test room was slightly dim. The compiled response of
the volunteers are presented in Fig. 6.

Table I lists the processing speed of various methods, our proposed
implementation and the CIELAB were implemented in C++; these codes were
executed on an Intel Core i5-5257U (2.70GHz) CPU without any multicore,
multithread or SIMD operations. The results confirmed that our method had the
fastest runtime among the methods compared. It is worth noticing that it
exceeded CIELAB in runtime; this indicates it also has advantages in total
calculation cost including post-processing. Its computational complexity is
only $\textit{O}(1)$ because it performs exact pixel by pixel processing,
referring only to the RGB value at each pixel. Among other methods, the one
developed by Gooch et al. was reported to have $\textit{O}(n^{4})$
computational complexity. Using $\textit{O}(1)$ spatial filtering it is
possible to develop $\textit{O}(1)$ local methods [10, 12], but the filter
calculations required would degrade their run-time in comparison to our
decolorization method. The proposed color to gray technique has demonstrated
faster run-time than local methods by maintaining global coherence, which
means the conversions were the same in all pixels.

Figure 8: Comparison of six color to gray methods based on the E-score.

###  II-D Experimental results

In our experiments, we utilized the color250 dataset which comprises of 250
natural and synthetic color images [22]. To quantitatively evaluate our
decolorization algorithm we choose two objective metrics: E-score and C2G-SSIM
by Ma et al [23]. E-score is a joint measure proposed by Lu et al., a harmonic
mean which is computed by combining two metrics: Color Contrast Preserving
Ratio (CCPR), and Color Content Fidelity Ratio (CCFR) [22]. The CCPR is useful
in maintaining the color contrast in decolorization images which is
perceivable to humans. Specifically, when the color difference is smaller than
a certain threshold value, it becomes undetectable to humans. Furthermore,
CCFR estimates if the decolorization image is accurate in terms of structures
when compared to the original color image. C2G-SSIM is new color to gray
objective evaluation metric based on the Structural Similarity (SSIM) index
quality metric [24]. The C2G-SSIM generates quality map and has good
correlation with HVS subjective preference. Table II presents the average
E-score and C2G-SSIM for the color 250 dataset in comparison with other
decolorization methods.

Figure 9: Comparison of six color to gray methods based on the C2G-SSIM score. Figure 10: Chromatic aberration which results from differential refraction of light depending on its wavelength, it causes some rays (green) to converge before other (red). This results in a perception of red “advancing” toward the eye, while green to be “receding”. Figure 11: Global tone mapping performed in three different luminance spaces: Our’s, Y of YCbCr and V of HSV TABLE II: Comparison of six color to gray methods based on average objective metrics for 250 images. | Decolorization | CCFR | CCPR | E-score | C2G-SSIM
---|---|---|---|---|---
(a) |  Lu et al. [22] | 0.9922 | 0.9645 | 0.9781 | 0.8900
(b) |  Nafchi et al. [25] | 0.9880 | 0.9555 | 0.9710 | 0.8900
(c) |  Grundland et al [5] | 0.9811 | 0.9584 | 0.9747 | 0.8749
(d) |  Smith et al. [6] | 0.9880 | 0.9555 | 0.9710 | 0.9062
(e) |  Gooch et al. [4] | 0.9839 | 0.9545 | 0.9714 | 0.8935
(f) | Ours | 0.9890 | 0.9576 | 0.9728 | 0.9018

In our experiment we computed the average CCPR for the 250 images in the
dataset by varying $\tau$ from 1 to 15 [22]. As can be seen from Fig. 8, our
algorithm’s performance is reasonable and practicable when compared to other
color to gray algorithms. Figure 9 shows the average C2G-SSIM score for the
six decolorization methods. According to the plot in Fig. 8, Lu et al.’s
method shows best performance based on the E-score, however, our method
delivers high average C2G-SSIM measure which is better correlated to human
perception [25].

##  III Characteristics of visualization of our algorithm

###  III-A Color temperature and chromatic aberration

From Snell’s law we know that the refraction of light is dependent on its
wavelength. As the frequency of light increases, its refractive index becomes
larger, causing more refraction of the shorter wavelengths. Therefore, when an
image is captured through a lens, all colors do not focus at the same
distance, and these imperfections are known as chromatic aberration. In
cameras this imperfection is removed by using a combination of second
achromatic lens which is made of different material(glass) than the first
lens. This second lens would reverse the color dispersion caused by the first
lens. The human eye, also employs a lens and does exhibit this phenomena as
shown in Fig. 10. From this figure we can observe that red light forms the
image farthest from the lens as it has the smallest refractive index. Colors
with higher index of refraction would ideally bend more thereby forming images
closer to the lens. Therefore, it would be impossible to focus on all colors
simultaneously, resulting in “somewhat fuzzy” images that are not in focus.
Colors that are closer to red end of the electromagnetic spectrum are said to
be warm colors and are perceived as closer to the observer [26, 27]. Colors
that are around the blue end are said to be cooler colors and are perceived to
be receding away from the observer. This phenomenon has been exploited by
traditional artists to add depth information in artwork [28], display devices
[29], and 3D imagery [30].

Figure 12: Application: (a) Ideal image processing pipeline (tone mapping) (b)
Color boosted by local tone mapping and corresponding grayscale image. (c)
Demonstration example for easy control features using our decolorization
algorithm. TM1: background boost TM2: background suppression

###  III-B Tone mapping application

The color to grayscale conversion is a dimensionality reduction problem whose
significance has been underestimated. Usually the tone mapping is performed on
the grayscale image because of the lower computational and memory
requirements, when compared to tone mapping on the RGB channels. In this
section we will discuss global and local tone mapping application using the
proposed decolorization algorithm and demonstrate its effectiveness.

####  III-B1 Global tone mapping

We discuss our decolorization method’s applicability for post-processing tasks
such as tone mapping. Conventional methods have not shown such applicability
because of their long run-time; thus, the use of $Y$ of YCbCr or $V$ of HSV
for tone mapping is popular today. We evaluated our method’s output of global
tone mapping because it has the ability to adequately remap colors to $1-D$
luminance. Thus, even using global tone mapping confirms the effectiveness of
our method. Figure 11 shows tone mapped results using $Y$, $V$, or our
luminance channel. In the fish image, using $Y$, the fish color became the
same as the background and could not be controlled separately, because the
weight of $R$ is small in the YCbCr color channel. Our method was able to
separate fish color from background in the same way as human perception and
directly mapped the color of the background to dark. In the sky and snow
scene, the global tone curve for contrast enhancement is a centered sigmoid
curve, in which highlight/shadow clippings occur naturally. Since HSV color
space treats primary colors and whites the same way, colors of sky and snow
were mapped to luminance that was too light. Thus, the sigmoid function
degraded the contrast of the outputted image. YCbCr treats $B$ as too low
luminance; the sky became too dark. We confirmed that our method generates
well-balanced images maintaining the contrast and the colors.

####  III-B2 Local tone mapping

Local histogram equalization based local tone mapping converts target pixels
by using tone curves constructed from local cumulative histograms. Smoothed
local histogram equalization (LHE) are also used as a smoothed LH filter [31].
The Apical’s (ARM®) Iridix algorithm [32], which is based on smoothed LHE are
used by a range of camera makers, including Nikon, Olympus and Sony. For our
local tonemap application we selected smoothed LHE-based function as they are
very suitable for practical real-time applications, in Fig. 12(a) we show an
ideal pipeline for such a system. We implemented the local tonemap application
similar to one presented by Ambalathankandy et al. [33], as their
implementation has a linear $\textit{O}(1)$ computational complexity and
produces output images with fine quality as shown in Fig. 12(b, c). The total
computational time including our proposed decolorization and the local tonemap
operation was only $14.7\mu s$ per pixel (normalized time<EMAIL_ADDRESS>CPU). This
time utilization is $20\times$ less than Lu et al.’s work [8]. Additionally,
using our decolorization method has an advantage, which is to individually
control the back/foreground as shown in Fig. 12(c).

###  III-C Limitation of our method

In our decolorization method, pure green is likely to be mapped to a dark
luminance value. Light green will also be mapped to a lesser dark luminance
part as shown in Fig. 4. Therefore, certain scenes are likely to be perceived
as unnatural. For example: (a) Vegetables (e.g. leafy greens like cabbage) (b)
Green meadows under bright sky. (c) Bright green neon lights. However, in Fig.
13 we perceive them as natural. We postulate the following as the possible
reasons: (i) There are rarely any pure bright green (like G255) scene in
nature. (ii) In our color space, green color with white components follow
Eq.(1) by weighting function. Therefore, the color keeps a balance among other
color channels. (iii) Vegetation scenery with dark green are well perceived as
healthy plants.

Figure 13: Examples to demonstrate limitation of our decolorization method
when mapping bright green/neon color.

##  IV Conclusion

In this paper, we present a color temperature-based RGB to gray conversion
model by taking in to account the chromatic aberration phenomena. This anomaly
results from differential refraction of light depending on its wavelength, it
causes some of the rays (cool colors) to converge before others (warm colors).
This results in a perception of warmer colors “advancing” towards the eye,
while the cooler ones to be “receding”. Essentially, since decolorization is
expected to have a key role in the pre-processing of tone mapping or edge
preserving filters, low calculation cost and fast operation for the processing
are required. To address this requirement, we have developed a high-speed
$\textit{O}(1)$ decolorization method that is based on color temperature-based
perception. It refers to RGB values in one pixel and performs weighted
blending of the Euclidean distances of warm/cool color vectors. This simple
conversion outputs a gray channel that is comparable to the conventional
optimization methods using iterations. When our method is applied to tone
mapping, it achieves better results than one could be obtained with YCbCr/HSV
color space.

##  V Acknowledgments

We would like to sincerely thank Cadik et al., Lu et al. for making available
their datasets, and other authors for sharing their source codes.

## References

  * [1] J. L. Morton, _Color logic_. Colorcom, 1998.
  * [2] J. M. SUNDET, “Effects of colour on perceived depth: review of experiments and evalutaion of theories,” _Scandinavian Journal of Psychology_ , vol. 19, no. 1, pp. 133–143, 1978.
  * [3] Y. Nayatani, “Simple estimation methods for the helmholtz kohlrausch effect,” _Color Research & Application_, vol. 22, no. 6, pp. 385–401, 1997.
  * [4] A. A. Gooch, S. C. Olsen, J. Tumblin, and B. Gooch, “Color2gray: salience-preserving color removal,” _ACM Transactions on Graphics (TOG)_ , vol. 24, no. 3, pp. 634–639, 2005.
  * [5] M. Grundland and N. A. Dodgson, “Decolorize: Fast, contrast enhancing, color to grayscale conversion,” _Pattern Recognition_ , vol. 40, no. 11, pp. 2891–2896, 2007.
  * [6] K. Smith, P.-E. Landes, J. Thollot, and K. Myszkowski, “Apparent greyscale: A simple and fast conversion to perceptually accurate images and video,” in _Computer Graphics Forum_ , vol. 27, no. 2, pp. 193–200. Wiley Online Library, 2008.
  * [7] Y. Kim, C. Jang, J. Demouth, and S. Lee, “Robust color-to-gray via nonlinear global mapping,” _ACM Transactions on Graphics (TOG)_ , vol. 28, no. 5, p. 161, 2009.
  * [8] C. Lu, L. Xu, and J. Jia, “Contrast preserving decolorization,” in _Computational Photography (ICCP), 2012 IEEE International Conference on_ , pp. 1–7. IEEE, 2012.
  * [9] C. O. Ancuti, C. Ancuti, C. Hermans, and P. Bekaert, “Image and video decolorization by fusion,” in _Asian Conference on Computer Vision_ , pp. 79–92. Springer, 2010.
  * [10] C. Ancuti and C. O. Ancuti, “Laplacian-guided image decolorization,” in _Image Processing (ICIP), 2016 IEEE International Conference on_ , pp. 4107–4111. IEEE, 2016.
  * [11] Q. Liu, P. X. Liu, W. Xie, Y. Wang, and D. Liang, “Gcsdecolor: gradient correlation similarity for efficient contrast preserving decolorization,” _IEEE Transactions on Image Processing_ , vol. 24, no. 9, pp. 2889–2904, 2015\.
  * [12] Y. Song and L. Gong, “O (1) contrast preserving decolorization using linear local mapping,” in _Wireless Communications & Signal Processing (WCSP), 2016 8th International Conference on_, pp. 1–6. IEEE, 2016.
  * [13] S. Liu and X. Zhang, “Image decolorization combining local features and exposure features,” _IEEE Transactions on Multimedia_ , 2019.
  * [14] B. Cai, X. Xu, and X. Xing, “Perception preserving decolorization,” in _2018 25th IEEE International Conference on Image Processing (ICIP)_ , pp. 2810–2814. IEEE, 2018.
  * [15] X. Hou, J. Duan, and G. Qiu, “Deep feature consistent deep image transformations: Downscaling, decolorization and hdr tone mapping,” _arXiv preprint arXiv:1707.09482_ , 2017.
  * [16] Z. Lin, W. Zhang, and X. Tang, “Learning partial differential equations for computer vision,” _Peking Univ., Chin. Univ. of Hong Kong_ , 2008.
  * [17] X. Zhang and S. Liu, “Contrast preserving image decolorization combining global features and local semantic features,” _The Visual Computer_ , vol. 34, no. 6-8, pp. 1099–1108, 2018.
  * [18] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition. 2014,” _arXiv preprint arXiv:1409.1556_ , 2018\.
  * [19] L.-C. Ou, M. R. Luo, A. Woodcock, and A. Wright, “A study of colour emotion and colour preference. part i: Colour emotions for single colours,” _Color Research & Application_, vol. 29, no. 3, pp. 232–240, 2004.
  * [20] M. Ĉadík, “Perceptual evaluation of color-to-grayscale image conversions,” in _Computer Graphics Forum_ , vol. 27, no. 7, pp. 1745–1754. Wiley Online Library, 2008\.
  * [21] Q. Shan, J. Jia, and M. S. Brown, “Globally optimized linear windowed tone mapping,” _IEEE transactions on visualization and computer graphics_ , vol. 16, no. 4, pp. 663–675, 2009.
  * [22] C. Lu, L. Xu, and J. Jia, “Contrast preserving decolorization with perception-based quality metrics,” _International journal of computer vision_ , vol. 110, no. 2, pp. 222–239, 2014.
  * [23] K. Ma, T. Zhao, K. Zeng, and Z. Wang, “Objective quality assessment for color-to-gray image conversion,” _IEEE Transactions on Image Processing_ , vol. 24, no. 12, pp. 4673–4685, 2015.
  * [24] Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: from error visibility to structural similarity,” _IEEE transactions on image processing_ , vol. 13, no. 4, pp. 600–612, 2004.
  * [25] H. Z. Nafchi, A. Shahkolaei, R. Hedjam, and M. Cheriet, “Corrc2g: Color to gray conversion by correlation,” _IEEE Signal Processing Letters_ , vol. 24, no. 11, pp. 1651–1655, 2017.
  * [26] S. Niemeyer, “Ec88-423 color expression in the home,” 1988.
  * [27] C. L. Eastlake, _Goethe’s Theory of Colours_. BoD–Books on Demand, 2020.
  * [28] V. A. Nguyen, I. P. Howard, and R. S. Allison, “Detection of the depth order of defocused images,” _Vision Research_ , vol. 45, no. 8, pp. 1003–1011, 2005.
  * [29] L. F. Hodges and D. F. McAllister, “Chromostereoscopic crt-based display,” in _Three-Dimensional Imaging and Remote Sensing Imaging_ , vol. 902, pp. 37–45. International Society for Optics and Photonics, 1988.
  * [30] J. Hong, H. Lee, D. Park, and C. Kim, “Depth perception enhancement based on chromostereopsis in a 3d display,” _Journal of Information Display_ , vol. 13, no. 3, pp. 101–106, 2012.
  * [31] M. Kass and J. Solomon, “Smoothed local histogram filters,” _ACM Transactions on Graphics (TOG)_ , vol. 29, no. 4, p. 100, 2010.
  * [32] V. Chesnokov, “Image enhancement methods and apparatus therefor,” Nov. 27 2007, uS Patent 7,302,110.
  * [33] P. Ambalathankandy, M. Ikebe, T. Yoshida, T. Shimada, S. Takamaeda, M. Motomura, and T. Asai, “An adaptive global and local tone mapping algorithm implemented on fpga,” _IEEE Transactions on Circuits and Systems for Video Technology_ , 2019.


promotion space for present physical attacks to compromise these off-the-shelf
applications.

###  7.4. Designing efficient 3D black-box adversarial attacks

Only a few works (Cao et al., 2019b; Sun et al., 2020; Wicker and Kwiatkowska,
2019) explored the 3D black-box adversarial attacks, while most used very
primitive or heuristic algorithms like random sampling, greedy search, and
evolution algorithm. Many techniques like priors-transferring and boundary
estimation have been exploited for 2D black-box attacks. Migrating these
skills to 3D data may foster more efficient algorithms with fewer queries. For
example, recently, 3DHacker (Tao et al., 2023) used boundary estimation to
improve the query efficiency of hard-label attacks.

###  7.5. Evaluating the robustness of newly proposed models

Novel 2D and 3D computer vision models’ robustness, e.g., Transformer (Vaswani
et al., 2017) and Point Transformer (Zhao et al., 2021a) , still need to be
studies. Additionally, likelihood-based generative models have emerged, like
the diffusion model (Ho et al., 2020), which can produce high-quality images.
Some pilot studies have already evaluated their robustness (Zhuang et al.,
2023). But these works are very rudimentary, and there is a lot of room for
improvement. Moreover, the diffusion model is also helpful to improve the
performance of generative-model-based attacks, such as unrestricted semantic
attacks. However, how to backward its gradients to improve attack efficiency
and how to disentangle its latent noises to control image attributes better
still needs further research.

###  7.6. Evaluating the safety of novel CV applications

An increasing number of novel computer vision applications have incorporated
deep learning, such as medical image processing, rain and fog removal, and
pedestrian detection. The security requirements and potential attack surfaces
of these emerging tasks vary a lot. Consequently, designing adversarial
attacks for these novel tasks necessitates special considerations. For
example, Schmalfuss et al. proposed an adversarial weather attack for motion
estimation (Schmalfuss et al., 2023) that simulates weather effects by
utilizing adversarially optimized particles.

###  7.7. Breaking newly proposed defenses

Many adversarial attacks are proposed specifically targeting certain defense
mechanisms, such as the C&W attack to break the defensive distillation, the
BPDA attack to break gradient shattering, and the BlindSpot attack to break
the adversarial training. With the development of this race of adversarial
machine learning, an increasing number of novel defenses are proposed, such as
provable defenses and adversarial purification (Nie et al., 2022). It is still
unknown whether these defense mechanisms can be defeated by stronger
adversarial attacks.

##  8\. Conclusion

In this survey, we comprehensively review the recent progress of adversarial
attacks that damage the robustness and safety of deep learning models in
computer vision tasks. In contrast to previous works, we summarize the
adversarial attacks for 3D computer vision for the first time. Moreover, we
extend the connotation of adversarial examples to imperceptible and semantic
perturbations. For semantic perturbations, we systematically summarize the
latest methods, including local and global spatial transformation, color space
distortion, and attribution modification. What’s more, we investigate the
physically realizable adversarial attacks towards safety-critical missions
like self-driving vehicles and face recognition. In the end, we give some
understanding of improving the transferability of AEs, making the AEs
physically achievable, boosting the 3D black-box attack’s efficiency,
evaluating the robustness of emerging models, and designing adversarial
attacks for novel applications and defenses.

## References

  * (1)
  * Agarwal et al. (2020) Akshay Agarwal, Mayank Vatsa, Richa Singh, and Nalini K Ratha. 2020.  Noise is inside me! generating adversarial perturbations with noise derived from natural filters. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops_. 774–775.
  * Al-Dujaili and O’Reilly (2019) Abdullah Al-Dujaili and Una-May O’Reilly. 2019.  There are no bit parts for sign bits in black-box attacks.  _arXiv preprint arXiv:1902.06894_ (2019).
  * Alaifari et al. (2018) Rima Alaifari, Giovanni S Alberti, and Tandri Gauksson. 2018\.  ADef: an Iterative Algorithm to Construct Adversarial Deformations. In _International Conference on Learning Representations_.
  * Andriushchenko et al. (2020) Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. 2020.  Square attack: a query-efficient black-box adversarial attack via random search. In _European Conference on Computer Vision_. Springer, 484–501.
  * Athalye et al. (2018a) Anish Athalye, Nicholas Carlini, and David Wagner. 2018a.  Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In _International conference on machine learning_. PMLR, 274–283.
  * Athalye et al. (2018b) Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. 2018b.  Synthesizing robust adversarial examples. In _International conference on machine learning_. PMLR, 284–293.
  * Aydin et al. (2021) Ayberk Aydin, Deniz Sen, Berat Tuna Karli, Oguz Hanoglu, and Alptekin Temizel. 2021.  Imperceptible Adversarial Examples by Spatial Chroma-Shift. In _Proceedings of the 1st International Workshop on Adversarial Learning for Multimedia_. 8–14.
  * Baluja and Fischer (2018) Shumeet Baluja and Ian Fischer. 2018.  Learning to attack: Adversarial transformation networks. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 32.
  * Bhagoji et al. (2018) Arjun Nitin Bhagoji, Warren He, Bo Li, and Dawn Song. 2018.  Practical black-box attacks on deep neural networks using efficient query mechanisms. In _Proceedings of the European Conference on Computer Vision (ECCV)_. 154–169.
  * Bhattad et al. (2019) Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and DA Forsyth. 2019.  Unrestricted Adversarial Examples via Semantic Manipulation. In _International Conference on Learning Representations_.
  * Brendel et al. (2017) Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2017\.  Decision-based adversarial attacks: Reliable attacks against black-box machine learning models.  _arXiv preprint arXiv:1712.04248_ (2017).
  * Brown et al. (2017) Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. 2017.  Adversarial patch.  _arXiv preprint arXiv:1712.09665_ (2017).
  * Brunner et al. (2019) Thomas Brunner, Frederik Diehl, Michael Truong Le, and Alois Knoll. 2019.  Guessing smart: Biased sampling for efficient black-box adversarial attacks. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 4958–4966.
  * Byun et al. (2022) Junyoung Byun, Seungju Cho, Myung-Joon Kwon, Hee-Seon Kim, and Changick Kim. 2022.  Improving the Transferability of Targeted Adversarial Examples through Object-Based Diverse Input. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15244–15253.
  * Cao et al. (2019a) Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. 2019a.  Adversarial sensor attack on lidar-based perception in autonomous driving. In _Proceedings of the 2019 ACM SIGSAC conference on computer and communications security_. 2267–2281.
  * Cao et al. (2019b) Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, and Bo Li. 2019b.  Adversarial objects against lidar-based autonomous driving systems.  _arXiv preprint arXiv:1907.05418_ (2019).
  * Carlini and Wagner (2017) Nicholas Carlini and David Wagner. 2017.  Towards evaluating the robustness of neural networks. In _2017 ieee symposium on security and privacy (sp)_. Ieee, 39–57.
  * Chen and Huang (2021) Chang Chen and Teng Huang. 2021.  Camdar-adv: generating adversarial patches on 3D object.  _International Journal of Intelligent Systems_ 36, 3 (2021), 1441–1453.
  * Chen and Gu (2020) Jinghui Chen and Quanquan Gu. 2020.  Rays: A ray searching method for hard-label adversarial attack. In _Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_. 1739–1747.
  * Chen et al. (2020) Jianbo Chen, Michael I Jordan, and Martin J Wainwright. 2020\.  Hopskipjumpattack: A query-efficient decision-based attack. In _2020 ieee symposium on security and privacy (sp)_. IEEE, 1277–1294.
  * Chen et al. (2018b) Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. 2018b.  Ead: elastic-net attacks to deep neural networks via adversarial examples. In _Proceedings of the AAAI conference on artificial intelligence_ , Vol. 32.
  * Chen et al. (2017) Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017.  Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In _Proceedings of the 10th ACM workshop on artificial intelligence and security_. 15–26.
  * Chen et al. (2018a) Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. 2018a.  Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In _Joint European Conference on Machine Learning and Knowledge Discovery in Databases_. Springer, 52–68.
  * Chen et al. (2023) Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. 2023\.  Content-based Unrestricted Adversarial Attack.  _arXiv preprint arXiv:2305.10665_ (2023).
  * Cheng et al. (2020) Minhao Cheng, Simranjit Singh, Patrick H Chen, Pin-Yu Chen, Sijia Liu, and Cho-Jui Hsieh. 2020\.  Sign-OPT: A Query-Efficient Hard-label Adversarial Attack. In _International Conference on Learning Representations_.
  * Cheng et al. (2019b) Minhao Cheng, Huan Zhang, Cho-Jui Hsieh, Thong Le, Pin-Yu Chen, and Jinfeng Yi. 2019b.  Query-efficient hard-label black-box attack: An optimization-based approach. In _International Conference on Learning Representations_. International Conference on Learning Representations, ICLR.
  * Cheng et al. (2019a) Shuyu Cheng, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. 2019a.  Improving black-box adversarial attacks with a transfer-based prior.  _Advances in neural information processing systems_ 32 (2019).
  * Croce et al. (2022) Francesco Croce, Maksym Andriushchenko, Naman D Singh, Nicolas Flammarion, and Matthias Hein. 2022\.  Sparse-rs: a versatile framework for query-efficient sparse black-box adversarial attacks. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 36. 6437–6445.
  * Croce and Hein (2019) Francesco Croce and Matthias Hein. 2019.  Sparse and Imperceivable Adversarial Attacks. In _2019 IEEE/CVF International Conference on Computer Vision (ICCV)_. 4723–4731.  https://doi.org/10.1109/ICCV.2019.00482
  * Dong et al. (2020) Xiaoyi Dong, Dongdong Chen, Jianmin Bao, Chuan Qin, Lu Yuan, Weiming Zhang, Nenghai Yu, and Dong Chen. 2020\.  GreedyFool: Distortion-aware sparse adversarial attack.  _Advances in Neural Information Processing Systems_ 33 (2020), 11226–11236.
  * Dong et al. (2018) Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018.  Boosting adversarial attacks with momentum. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 9185–9193.
  * Dong et al. (2019) Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. 2019\.  Evading defenses to transferable adversarial examples by translation-invariant attacks. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 4312–4321.
  * Duan et al. (2020) Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A. K. Qin, and Yun Yang. 2020\.  Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_.
  * Engstrom et al. (2018) Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. 2018.  A rotation and a translation suffice: Fooling cnns with simple transformations.  (2018).
  * Eykholt et al. (2018) Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018.  Robust physical-world attacks on deep learning visual classification. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 1625–1634.
  * Fawzi and Frossard (2015) Alhussein Fawzi and Pascal Frossard. 2015.  Manitest: Are classifiers really invariant?. In _British Machine Vision Conference (BMVC)_.
  * Ganeshan et al. (2019) Aditya Ganeshan, Vivek BS, and R Venkatesh Babu. 2019\.  Fda: Feature disruptive attack. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 8069–8079.
  * Geirhos et al. (2018) Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. 2018.  ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness.  _arXiv preprint arXiv:1811.12231_ (2018).
  * Gilmer et al. (2018) Justin Gilmer, Ryan P Adams, Ian Goodfellow, David Andersen, and George E Dahl. 2018.  Motivating the rules of the game for adversarial example research.  _arXiv preprint arXiv:1807.06732_ (2018).
  * Gnanasambandam et al. (2021) Abhiram Gnanasambandam, Alex M Sherman, and Stanley H Chan. 2021\.  Optical adversarial attack. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 92–101.
  * Goodfellow et al. (2014) Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014\.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ (2014).
  * Guo et al. (2019a) Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. 2019a.  Simple black-box adversarial attacks. In _International Conference on Machine Learning_. PMLR, 2484–2493.
  * Guo et al. (2021) Meng-Hao Guo, Jun-Xiong Cai, Zheng-Ning Liu, Tai-Jiang Mu, Ralph R Martin, and Shi-Min Hu. 2021\.  Pct: Point cloud transformer.  _Computational Visual Media_ 7, 2 (2021), 187–199.
  * Guo et al. (2019b) Yiwen Guo, Ziang Yan, and Changshui Zhang. 2019b.  Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks.  _Advances in Neural Information Processing Systems_ 32 (2019).
  * Hamdi et al. (2020) Abdullah Hamdi, Sara Rojas, Ali Thabet, and Bernard Ghanem. 2020.  Advpc: Transferable adversarial perturbations on 3d point clouds. In _European Conference on Computer Vision_. Springer, 241–257.
  * He et al. (2018) Warren He, Bo Li, and Dawn Song. 2018.  Decision boundary analysis of adversarial examples. In _International Conference on Learning Representations_.
  * He et al. (2022a) Yingzhe He, Guozhu Meng, Kai Chen, Xingbo Hu, and Jinwen He. 2022a.  Towards Security Threats of Deep Learning Systems: A Survey.  _IEEE Transactions on Software Engineering_ 48, 5 (2022), 1743–1770.
  * He et al. (2022b) Ziwen He, Wei Wang, Jing Dong, and Tieniu Tan. 2022b.  Transferable Sparse Adversarial Attack. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 14963–14972.
  * Ho et al. (2020) Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020.  Denoising diffusion probabilistic models.  _Advances in neural information processing systems_ 33 (2020), 6840–6851.
  * Hosseini and Poovendran (2018) Hossein Hosseini and Radha Poovendran. 2018.  Semantic adversarial examples. In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops_. 1614–1619.
  * Hu et al. (2021) Yu-Chih-Tuan Hu, Bo-Han Kung, Daniel Stanley Tan, Jun-Cheng Chen, Kai-Lung Hua, and Wen-Huang Cheng. 2021.  Naturalistic physical adversarial patch for object detectors. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 7848–7857.
  * Hua et al. (2018) Binh-Son Hua, Minh-Khoi Tran, and Sai-Kit Yeung. 2018\.  Pointwise convolutional neural networks. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 984–993.
  * Huang et al. (2022) Qidong Huang, Xiaoyi Dong, Dongdong Chen, Hang Zhou, Weiming Zhang, and Nenghai Yu. 2022\.  Shape-invariant 3D Adversarial Point Clouds. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15335–15344.
  * Huang et al. (2019) Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. 2019\.  Enhancing adversarial example transferability with an intermediate level attack. In _Proceedings of the IEEE/CVF international conference on computer vision_. 4733–4742.
  * Ilyas et al. (2018b) Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018b.  Black-box adversarial attacks with limited queries and information. In _International Conference on Machine Learning_. PMLR, 2137–2146.
  * Ilyas et al. (2018a) Andrew Ilyas, Logan Engstrom, and Aleksander Madry. 2018a.  Prior Convictions: Black-box Adversarial Attacks with Bandits and Priors. In _International Conference on Learning Representations_.
  * Ilyas et al. (2019) Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019.  Adversarial examples are not bugs, they are features.  _Advances in neural information processing systems_ 32 (2019).
  * Ji et al. (2021) Xiaoyu Ji, Yushi Cheng, Yuepeng Zhang, Kai Wang, Chen Yan, Wenyuan Xu, and Kevin Fu. 2021.  Poltergeist: Acoustic adversarial machine learning against cameras and computer vision. In _2021 IEEE Symposium on Security and Privacy (SP)_. IEEE, 160–175.
  * Jia et al. (2022) Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chunhua Shen, Xiaokang Yang, and Chao Ma. 2022.  Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition.  _Advances in Neural Information Processing Systems_ 35 (2022), 34136–34147.
  * Joshi et al. (2019) Ameya Joshi, Amitangshu Mukherjee, Soumik Sarkar, and Chinmay Hegde. 2019.  Semantic adversarial attacks: Parametric transformations that fool deep classifiers. In _Proceedings of the IEEE/CVF international conference on computer vision_. 4773–4783.
  * Kanbak et al. (2018) Can Kanbak, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. 2018\.  Geometric robustness of deep networks: analysis and improvement. In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_. 4441–4449.
  * Kato et al. (2018) Hiroharu Kato, Yoshitaka Ushiku, and Tatsuya Harada. 2018\.  Neural 3d mesh renderer. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 3907–3916.
  * Khrulkov and Oseledets (2018) Valentin Khrulkov and Ivan Oseledets. 2018.  Art of singular vectors and universal adversarial perturbations. In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_. 8562–8570.
  * Kim et al. (2021) Jaeyeon Kim, Binh-Son Hua, Thanh Nguyen, and Sai-Kit Yeung. 2021\.  Minimal adversarial examples for deep learning on 3d point clouds. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 7797–7806.
  * Kurakin et al. (2018) Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. 2018\.  Adversarial examples in the physical world.  In _Artificial intelligence safety and security_. Chapman and Hall/CRC, 99–112.
  * Kurita et al. (2020) Keita Kurita, Paul Michel, and Graham Neubig. 2020\.  Weight Poisoning Attacks on Pretrained Models. In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_. Association for Computational Linguistics, 2793–2806.
  * Laidlaw and Feizi (2019) Cassidy Laidlaw and Soheil Feizi. 2019.  Functional adversarial attacks.  _Advances in neural information processing systems_ 32 (2019).
  * Li et al. (2020) Maosen Li, Cheng Deng, Tengjiao Li, Junchi Yan, Xinbo Gao, and Heng Huang. 2020\.  Towards transferable targeted attack. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_. 641–649.
  * Li et al. (2021) Xiaodan Li, Jinfeng Li, Yuefeng Chen, Shaokai Ye, Yuan He, Shuhui Wang, Hang Su, and Hui Xue. 2021\.  Qair: Practical query-efficient black-box attacks for image retrieval. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 3330–3339.
  * Li et al. (2019) Yandong Li, Lijun Li, Liqiang Wang, Tong Zhang, and Boqing Gong. 2019.  Nattack: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks. In _International Conference on Machine Learning_. PMLR, 3866–3876.
  * Li et al. (2023) Yanjie Li, Yiquan Li, Xuelong Dai, Songtao Guo, and Bin Xiao. 2023.  Physical-World Optical Adversarial Attacks on 3D Face Recognition. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_. 24699–24708.
  * Lin et al. (2019) Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. 2019.  Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks. In _International Conference on Learning Representations_.
  * Liu et al. (2020a) Aishan Liu, Jiakai Wang, Xianglong Liu, Bowen Cao, Chongzhi Zhang, and Hang Yu. 2020a.  Bias-based universal adversarial patch attack for automatic check-out. In _European conference on computer vision_. Springer, 395–410.
  * Liu et al. (2022) Binbin Liu, Jinlai Zhang, and Jihong Zhu. 2022.  Boosting 3D Adversarial Attacks with Attacking On Frequency.  _IEEE Access_ 10 (2022), 50974–50984.
  * Liu and Hu (2022) Daizong Liu and Wei Hu. 2022.  Imperceptible Transfer Attack and Defense on 3D Point Cloud Classification.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ (2022), 1–18.
  * Liu et al. (2019) Daniel Liu, Ronald Yu, and Hao Su. 2019.  Extending adversarial attacks and defenses to deep 3d point cloud classifiers. In _2019 IEEE International Conference on Image Processing (ICIP)_. IEEE, 2279–2283.
  * Liu et al. (2020c) Daniel Liu, Ronald Yu, and Hao Su. 2020c.  Adversarial shape perturbations on 3d point clouds. In _European Conference on Computer Vision_. Springer, 88–104.
  * Liu et al. (2018) Qiang Liu, Pan Li, Wentao Zhao, Wei Cai, Shui Yu, and Victor CM Leung. 2018\.  A survey on security threats and defensive techniques of machine learning: A data driven view.  _IEEE access_ 6 (2018), 12103–12117.
  * Liu et al. (2020b) Ximeng Liu, Lehui Xie, Yaopeng Wang, Jian Zou, Jinbo Xiong, Zuobin Ying, and Athanasios V Vasilakos. 2020b.  Privacy and security issues in deep learning: A survey.  _IEEE Access_ 9 (2020), 4566–4593.
  * Liu et al. (2016) Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2016\.  Delving into Transferable Adversarial Examples and Black-box Attacks. In _International Conference on Learning Representations_.
  * Luo et al. (2018) Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu. 2018\.  Towards imperceptible and robust adversarial example attacks against neural networks. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 32.
  * Luo et al. (2022) Cheng Luo, Qinliang Lin, Weicheng Xie, Bizhu Wu, Jinheng Xie, and Linlin Shen. 2022\.  Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15315–15324.
  * Ma et al. (2021) Chen Ma, Xiangyu Guo, Li Chen, Jun-Hai Yong, and Yisen Wang. 2021.  Finding optimal tangent points for reducing distortions of hard-label attacks.  _Advances in Neural Information Processing Systems_ 34 (2021), 19288–19300.
  * Ma et al. (2020) Chengcheng Ma, Weiliang Meng, Baoyuan Wu, Shibiao Xu, and Xiaopeng Zhang. 2020.  Efficient joint gradient based attack against sor defense for 3d point cloud classification. In _Proceedings of the 28th ACM International Conference on Multimedia_. 1819–1827.
  * Machado et al. (2021) Gabriel Resende Machado, Eugênio Silva, and Ronaldo Ribeiro Goldschmidt. 2021.  Adversarial machine learning in image classification: a survey toward the defender’s perspective.  _ACM Computing Surveys (CSUR)_ 55, 1 (2021), 1–38.
  * Madry et al. (2017) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017\.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ (2017).
  * Maho et al. (2021) Thibault Maho, Teddy Furon, and Erwan Le Merrer. 2021\.  Surfree: a fast surrogate-free black-box attack. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 10430–10439.
  * Miller et al. (2020) David J Miller, Zhen Xiang, and George Kesidis. 2020\.  Adversarial learning targeting deep neural network classification: A comprehensive review of defenses against attacks.  _Proc. IEEE_ 108, 3 (2020), 402–433.
  * Modas et al. (2019) Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. 2019.  Sparsefool: a few pixels make a big difference. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_. 9087–9096.
  * Moon et al. (2019) Seungyong Moon, Gaon An, and Hyun Oh Song. 2019.  Parsimonious black-box adversarial attacks via efficient combinatorial optimization. In _International Conference on Machine Learning_. PMLR, 4636–4645.
  * Moosavi-Dezfooli et al. (2017) Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017.  Universal adversarial perturbations. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 1765–1773.
  * Moosavi-Dezfooli et al. (2016) Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016\.  Deepfool: a simple and accurate method to fool deep neural networks. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 2574–2582.
  * Mopuri et al. (2018a) Konda Reddy Mopuri, Aditya Ganeshan, and R Venkatesh Babu. 2018a.  Generalizable data-free objective for crafting universal adversarial perturbations.  _IEEE transactions on pattern analysis and machine intelligence_ 41, 10 (2018), 2452–2465.
  * Mopuri et al. (2018b) Konda Reddy Mopuri, Utkarsh Ojha, Utsav Garg, and R Venkatesh Babu. 2018b.  Nag: Network for adversary generation. In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_. 742–751.
  * Narodytska and Kasiviswanathan (2017) Nina Narodytska and Shiva Prasad Kasiviswanathan. 2017\.  Simple Black-Box Adversarial Attacks on Deep Neural Networks.. In _CVPR Workshops_ , Vol. 2. 2.
  * Nguyen et al. (2020) Dinh-Luan Nguyen, Sunpreet S Arora, Yuhang Wu, and Hao Yang. 2020.  Adversarial light projection attacks on face recognition systems: A feasibility study. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops_. 814–815.
  * Nie et al. (2022) Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022\.  Diffusion models for adversarial purification.  _arXiv preprint arXiv:2205.07460_ (2022).
  * Osadchy et al. (2017) Margarita Osadchy, Julio Hernandez-Castro, Stuart Gibson, Orr Dunkelman, and Daniel Pérez-Cabo. 2017\.  No Bot Expects the DeepCAPTCHA! Introducing Immutable Adversarial Examples, With Applications to CAPTCHA Generation.  _IEEE Transactions on Information Forensics and Security_ 12, 11 (2017), 2640–2653.
  * Papernot et al. (2016a) Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016a.  Transferability in machine learning: from phenomena to black-box attacks using adversarial samples.  _arXiv preprint arXiv:1605.07277_ (2016).
  * Papernot et al. (2017) Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. 2017\.  Practical black-box attacks against machine learning. In _Proceedings of the 2017 ACM on Asia conference on computer and communications security_. 506–519.
  * Papernot et al. (2016b) Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. 2016b.  The limitations of deep learning in adversarial settings. In _2016 IEEE European symposium on security and privacy (EuroS &P)_. IEEE, 372–387.
  * Papernot et al. (2018) Nicolas Papernot, Patrick McDaniel, Arunesh Sinha, and Michael P Wellman. 2018.  Sok: Security and privacy in machine learning. In _2018 IEEE European Symposium on Security and Privacy (EuroS &P)_. IEEE, 399–414.
  * Papernot et al. (2016c) Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. 2016c.  Distillation as a defense to adversarial perturbations against deep neural networks. In _2016 IEEE symposium on security and privacy (SP)_. IEEE, 582–597.
  * Poursaeed et al. (2018) Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. 2018.  Generative adversarial perturbations. In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_. 4422–4431.
  * Qi et al. (2017) Charles R Qi, Hao Su, Kaichun Mo, and Leonidas J Guibas. 2017\.  Pointnet: Deep learning on point sets for 3d classification and segmentation. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 652–660.
  * Qiu et al. (2020) Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li. 2020\.  Semanticadv: Generating adversarial examples via attribute-conditioned image editing. In _European Conference on Computer Vision_. Springer, 19–37.
  * Rahmati et al. (2020) Ali Rahmati, Seyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Huaiyu Dai. 2020.  Geoda: a geometric framework for black-box adversarial attacks. In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_. 8446–8455.
  * Rakin et al. (2021) Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. 2021\.  T-bfa: Targeted bit-flip adversarial weight attack.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ (2021).
  * Reza et al. (2023) Md Farhamdur Reza, Ali Rahmati, Tianfu Wu, and Huaiyu Dai. 2023\.  CGBA: Curvature-aware Geometric Black-box Attack.  _arXiv preprint arXiv:2308.03163_ (2023).
  * Rony et al. (2019) Jérôme Rony, Luiz G Hafemann, Luiz S Oliveira, Ismail Ben Ayed, Robert Sabourin, and Eric Granger. 2019.  Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 4322–4330.
  * Salem et al. (2020) Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. 2020.  $\\{$Updates-Leak$\\}$: Data Set Inference and Reconstruction Attacks in Online Learning. In _29th USENIX security symposium (USENIX Security 20)_. 1291–1308.
  * Sato et al. (2021) Takami Sato, Junjie Shen, Ningfei Wang, Yunhan Jia, Xue Lin, and Qi Alfred Chen. 2021\.  Dirty road can attack: Security of deep learning based automated lane centering under $\\{$Physical-World$\\}$ attack. In _30th USENIX Security Symposium (USENIX Security 21)_. 3309–3326.
  * Sayles et al. (2021) Athena Sayles, Ashish Hooda, Mohit Gupta, Rahul Chatterjee, and Earlence Fernandes. 2021.  Invisible perturbations: Physical adversarial examples exploiting the rolling shutter effect. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 14666–14675.
  * Schmalfuss et al. (2023) Jenny Schmalfuss, Lukas Mehl, and Andrés Bruhn. 2023\.  Distracting Downpour: Adversarial Weather Attacks for Motion Estimation.  _arXiv preprint arXiv:2305.06716_ (2023).
  * Serban et al. (2020) Alex Serban, Erik Poll, and Joost Visser. 2020.  Adversarial examples on object recognition: A comprehensive survey.  _ACM Computing Surveys (CSUR)_ 53, 3 (2020), 1–38.
  * Shamsabadi et al. (2020a) Ali Shahin Shamsabadi, Changjae Oh, and Andrea Cavallaro. 2020a.  EdgeFool: an adversarial image enhancement filter. In _ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_. IEEE, 1898–1902.
  * Shamsabadi et al. (2021) Ali Shahin Shamsabadi, Changjae Oh, and Andrea Cavallaro. 2021\.  Semantically adversarial learnable filters.  _IEEE Transactions on Image Processing_ 30 (2021), 8075–8087.
  * Shamsabadi et al. (2020b) Ali Shahin Shamsabadi, Ricardo Sanchez-Matilla, and Andrea Cavallaro. 2020b.  Colorfool: Semantic adversarial colorization. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 1151–1160.
  * Sharif et al. (2016) Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. 2016.  Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In _Proceedings of the 2016 acm sigsac conference on computer and communications security_. 1528–1540.
  * Sharif et al. (2019) Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. 2019.  A general framework for adversarial examples with objectives.  _ACM Transactions on Privacy and Security (TOPS)_ 22, 3 (2019), 1–30.
  * Shen et al. (2021) Meng Shen, Hao Yu, Liehuang Zhu, Ke Xu, Qi Li, and Jiankun Hu. 2021.  Effective and robust physical-world attacks on deep learning face recognition systems.  _IEEE Transactions on Information Forensics and Security_ 16 (2021), 4063–4077.
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017.  Membership inference attacks against machine learning models. In _2017 IEEE symposium on security and privacy (SP)_. IEEE, 3–18.
  * Shukla et al. (2021) Satya Narayan Shukla, Anit Kumar Sahu, Devin Willmott, and Zico Kolter. 2021.  Simple and efficient hard label black-box adversarial attacks in low query budget regimes. In _Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining_. 1461–1469.
  * Song et al. (2018) Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. 2018\.  Constructing unrestricted adversarial examples with generative models.  _Advances in Neural Information Processing Systems_ 31 (2018).
  * Su et al. (2019) Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. 2019.  One pixel attack for fooling deep neural networks.  _IEEE Transactions on Evolutionary Computation_ 23, 5 (2019), 828–841.
  * Sun et al. (2020) Jiachen Sun, Yulong Cao, Qi Alfred Chen, and Z Morley Mao. 2020\.  Towards robust $\\{$LiDAR-based$\\}$ perception in autonomous driving: General black-box adversarial sensor attack and countermeasures. In _29th USENIX Security Symposium (USENIX Security 20)_. 877–894.
  * Suryanto et al. (2022) Naufal Suryanto, Yongsu Kim, Hyoeun Kang, Harashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. 2022.  DTA: Physical Camouflage Attacks using Differentiable Transformation Network. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15305–15314.
  * Szegedy et al. (2013) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013\.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_ (2013).
  * Tao et al. (2023) Yunbo Tao, Daizong Liu, Pan Zhou, Yulai Xie, Wei Du, and Wei Hu. 2023.  3DHacker: Spectrum-based Decision Boundary Generation for Hard-label 3D Point Cloud Attack.  _arXiv preprint arXiv:2308.07546_ (2023).
  * Tramèr et al. (2017a) Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017a.  Ensemble adversarial training: Attacks and defenses.  _arXiv preprint arXiv:1705.07204_ (2017).
  * Tramèr et al. (2017b) Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017b.  The space of transferable adversarial examples.  _arXiv preprint arXiv:1704.03453_ (2017).
  * Tsai et al. (2020) Tzungyu Tsai, Kaichen Yang, Tsung-Yi Ho, and Yier Jin. 2020\.  Robust adversarial objects against deep learning models. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 34. 954–962.
  * Tu et al. (2019) Chun-Chen Tu, Paishun Ting, Pin-Yu Chen, Sijia Liu, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh, and Shin-Ming Cheng. 2019\.  Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 33. 742–749.
  * Tu et al. (2020) James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. 2020\.  Physically realizable adversarial examples for lidar object detection. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 13716–13725.
  * Vaswani et al. (2017) Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017.  Attention is all you need.  _Advances in neural information processing systems_ 30 (2017).
  * Wang et al. (2022a) Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. 2022a.  Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 36. 2414–2422.
  * Wang et al. (2021b) Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. 2021b.  Dual attention suppression attack: Generate adversarial camouflage in physical world. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 8565–8574.
  * Wang and He (2021) Xiaosen Wang and Kun He. 2021.  Enhancing the transferability of adversarial attacks through variance tuning. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 1924–1933.
  * Wang et al. (2022b) Xiaosen Wang, Zeliang Zhang, Kangheng Tong, Dihong Gong, Kun He, Zhifeng Li, and Wei Liu. 2022b.  Triangle attack: A query-efficient decision-based adversarial attack. In _European Conference on Computer Vision_. Springer, 156–174.
  * Wang et al. (2019) Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E Sarma, Michael M Bronstein, and Justin M Solomon. 2019.  Dynamic graph cnn for learning on point clouds.  _Acm Transactions On Graphics (tog)_ 38, 5 (2019), 1–12.
  * Wang et al. (2021c) Yajie Wang, Shangbo Wu, Wenyi Jiang, Shengang Hao, Yu-an Tan, and Quanxin Zhang. 2021c.  Demiguise attack: Crafting invisible semantic adversarial perturbations with perceptual similarity.  _arXiv preprint arXiv:2107.01396_ (2021).
  * Wang et al. (2021a) Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. 2021a.  Feature importance-aware transferable adversarial attacks. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 7639–7648.
  * Wei et al. (2022) Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. 2022\.  Cross-Modal Transferable Adversarial Attacks from Images to Videos. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15064–15073.
  * Wen et al. (2020) Yuxin Wen, Jiehong Lin, Ke Chen, CL Philip Chen, and Kui Jia. 2020.  Geometry-aware generation of adversarial point clouds.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ (2020).
  * Wicker and Kwiatkowska (2019) Matthew Wicker and Marta Kwiatkowska. 2019.  Robustness of 3d deep learning in an adversarial setting. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 11767–11775.
  * Wong et al. (2019) Eric Wong, Frank Schmidt, and Zico Kolter. 2019.  Wasserstein adversarial examples via projected sinkhorn iterations. In _International Conference on Machine Learning_. PMLR, 6808–6817.
  * Wu et al. (2018) Lei Wu, Zhanxing Zhu, Cheng Tai, et al. 2018\.  Understanding and enhancing the transferability of adversarial examples.  _arXiv preprint arXiv:1802.09707_ (2018).
  * Wu et al. (2021) Weibin Wu, Yuxin Su, Michael R Lyu, and Irwin King. 2021\.  Improving the transferability of adversarial samples with adversarial transformations. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 9024–9033.
  * Xiao et al. (2018a) Chaowei Xiao, Bo Li, Jun Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. 2018a.  Generating adversarial examples with adversarial networks. In _27th International Joint Conference on Artificial Intelligence, IJCAI 2018_. International Joint Conferences on Artificial Intelligence, 3905–3911.
  * Xiao et al. (2019) Chaowei Xiao, Dawei Yang, Bo Li, Jia Deng, and Mingyan Liu. 2019.  Meshadv: Adversarial meshes for visual recognition. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 6898–6907.
  * Xiao et al. (2018b) Chaowei Xiao, Jun Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. 2018b.  Spatially transformed adversarial examples. In _6th International Conference on Learning Representations, ICLR 2018_.
  * Xiao et al. (2021) Zihao Xiao, Xianfeng Gao, Chilin Fu, Yinpeng Dong, Wei Gao, Xiaolu Zhang, Jun Zhou, and Jun Zhu. 2021\.  Improving transferability of adversarial patches on face recognition with generative models. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 11845–11854.
  * Xie et al. (2017) Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. 2017\.  Adversarial examples for semantic segmentation and object detection. In _Proceedings of the IEEE international conference on computer vision_. 1369–1378.
  * Xie et al. (2019) Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. 2019.  Improving transferability of adversarial examples with input diversity. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 2730–2739.
  * Yang et al. (2020) Jiancheng Yang, Yangzhou Jiang, Xiaoyang Huang, Bingbing Ni, and Chenglong Zhao. 2020.  Learning black-box attackers with transferable priors and query feedback.  _Advances in Neural Information Processing Systems_ 33 (2020), 12288–12299.
  * Yin et al. (2021) Bangjie Yin, Wenxuan Wang, Taiping Yao, Junfeng Guo, Zelun Kong, Shouhong Ding, Jilin Li, and Cong Liu. 2021\.  Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognition.  _International Joint Conferences on Artificial Intelligence (IJCAI)_ (2021).
  * Yu et al. (2022) Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. 2022.  Availability attacks create shortcuts. In _Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_. 2367–2376.
  * Zeng et al. (2019) Xiaohui Zeng, Chenxi Liu, Yu-Siang Wang, Weichao Qiu, Lingxi Xie, Yu-Wing Tai, Chi-Keung Tang, and Alan L Yuille. 2019\.  Adversarial attacks beyond the image space. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 4302–4311.
  * Zhang et al. (2020b) Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In So Kweon. 2020b.  Understanding adversarial examples from the mutual influence of images and perturbations. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 14521–14530.
  * Zhang et al. (2021) Chaoning Zhang, Philipp Benz, Adil Karjauv, and In So Kweon. 2021\.  Universal adversarial perturbations through the lens of deep steganography: Towards a fourier perspective. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 35. 3296–3304.
  * Zhang et al. (2020a) Hanwei Zhang, Yannis Avrithis, Teddy Furon, and Laurent Amsaleg. 2020a.  Smooth adversarial examples.  _EURASIP Journal on Information Security_ 2020, 1 (2020), 1–12.
  * Zhang et al. (2018a) Huan Zhang, Hongge Chen, Zhao Song, Duane Boning, Inderjit S Dhillon, and Cho-Jui Hsieh. 2018a.  The Limitations of Adversarial Training and the Blind-Spot Attack. In _International Conference on Learning Representations_.
  * Zhang et al. (2022b) Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. 2022b.  Improving Adversarial Transferability via Neuron Attribution-Based Attacks. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 14993–15002.
  * Zhang et al. (2022a) Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, Qi Alfred Chen, and Z Morley Mao. 2022a.  On adversarial robustness of trajectory prediction for autonomous vehicles. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 15159–15168.
  * Zhang et al. (2016) Richard Zhang, Phillip Isola, and Alexei A Efros. 2016\.  Colorful image colorization. In _European conference on computer vision_. Springer, 649–666.
  * Zhang et al. (2018b) Yang Zhang, Hassan Foroosh, Philip David, and Boqing Gong. 2018b.  CAMOU: Learning physical vehicle camouflages to adversarially attack detectors in the wild. In _International Conference on Learning Representations_.
  * Zhao et al. (2021a) Hengshuang Zhao, Li Jiang, Jiaya Jia, Philip HS Torr, and Vladlen Koltun. 2021a.  Point transformer. In _Proceedings of the IEEE/CVF international conference on computer vision_. 16259–16268.
  * Zhao et al. (2019) He Zhao, Trung Le, Paul Montague, Olivier De Vel, Tamas Abraham, and Dinh Phung. 2019\.  Perturbations are not enough: Generating adversarial examples with spatial distortions.  _arXiv preprint arXiv:1910.01329_ (2019).
  * Zhao et al. (2020b) Yue Zhao, Yuwei Wu, Caihua Chen, and Andrew Lim. 2020b.  On isometry robustness of deep 3d point cloud models under adversarial attacks. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 1201–1210.
  * Zhao et al. (2018) Zhengli Zhao, Dheeru Dua, and Sameer Singh. 2018.  Generating Natural Adversarial Examples. In _International Conference on Learning Representations_.
  * Zhao et al. (2020a) Zhengyu Zhao, Zhuoran Liu, and Martha Larson. 2020a.  Towards large yet imperceptible adversarial image perturbations with perceptual color distance. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 1039–1048.
  * Zhao et al. (2021b) Zhengyu Zhao, Zhuoran Liu, and Martha Larson. 2021b.  On success and simplicity: A second look at transferable targeted attacks.  _Advances in Neural Information Processing Systems_ 34 (2021), 6115–6128.
  * Zheng et al. (2019a) Tianhang Zheng, Changyou Chen, and Kui Ren. 2019a.  Distributionally adversarial attack. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 33. 2253–2260.
  * Zheng et al. (2019b) Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. 2019b.  Pointcloud saliency maps. In _Proceedings of the IEEE/CVF International Conference on Computer Vision_. 1598–1606.
  * Zhou et al. (2020) Hang Zhou, Dongdong Chen, Jing Liao, Kejiang Chen, Xiaoyi Dong, Kunlin Liu, Weiming Zhang, Gang Hua, and Nenghai Yu. 2020.  Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 10356–10365.
  * Zhou et al. (2018) Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xiangqi Huang, Xiang Gan, and Yong Yang. 2018.  Transferable adversarial perturbations. In _Proceedings of the European Conference on Computer Vision (ECCV)_. 452–467.
  * Zhuang et al. (2023) Haomin Zhuang, Yihua Zhang, and Sijia Liu. 2023.  A pilot study of query-free adversarial attack against stable diffusion. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 2384–2391.
  * Zou et al. (2020) Junhua Zou, Zhisong Pan, Junyang Qiu, Xin Liu, Ting Rui, and Wei Li. 2020\.  Improving the transferability of adversarial examples with resized-diverse-inputs, diversity-ensemble and region fitting. In _European Conference on Computer Vision_. Springer, 563–579.