Embodied Laser Attack:Leveraging Scene Priors to Achieve Agent-based Robust Non-contact Attacks

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-31 15:12:30

Abstract: As physical adversarial attacks become extensively applied in unearthing the potential risk of security-critical scenarios, especially in dynamic scenarios, their vulnerability to environmental variations has also been brought to light. The non-robust nature of physical adversarial attack methods brings less-than-stable performance consequently.
  Although methods such as Expectation over Transformation (EOT) have enhanced the robustness of traditional contact attacks like adversarial patches, they fall short in practicality and concealment within dynamic environments such as traffic scenarios. Meanwhile, non-contact laser attacks, while offering enhanced adaptability, face constraints due to a limited optimization space for their attributes, rendering EOT less effective. This limitation underscores the necessity for developing a new strategy to augment the robustness of such practices. To address these issues, this paper introduces the Embodied Laser Attack (ELA), a novel framework that leverages the embodied intelligence paradigm of Perception-Decision-Control to dynamically tailor non-contact laser attacks. For the perception module, given the challenge of simulating the victim's view by full-image transformation, ELA has innovatively developed a local perspective transformation network, based on the intrinsic prior knowledge of traffic scenes and enables effective and efficient estimation. For the decision and control module, ELA trains an attack agent with data-driven reinforcement learning instead of adopting time-consuming heuristic algorithms, making it capable of instantaneously determining a valid attack strategy with the perceived information by well-designed rewards, which is then conducted by a controllable laser emitter. Experimentally, we apply our framework to diverse traffic scenarios both in the digital and physical world, verifying the effectiveness of our method under dynamic successive scenes.

Main paper: 
 introduction: 
 In many vision-critical applications [2, 27, 30] , the perception system heavily relies on deep neural networks (DNNs) to sense and analyze external information, and the security of these intelligent systems is vital. However, since Kurakin et al. [15] propose achievable physical adversarial samples, the increasing diversity of practical attacks [6, 14, 20, 34, 35, 39] have posed a significant threat to the real-life DNNs' deployment, which deserves further exploration to pave the way for enhanced reliability. Notably, their performances are unstable, which can be easily affected by various real-world factors, especially the changes in the target's viewpoint, distances, etc. that often occur in dynamic continuous processes such as traffic scenarios. Thus, an urgent need exists to enhance the practical attacks' robustness when faced with such possible variations in the real world to obtain consistently stable performance.To enhance the robustness of attack methods faced with dynamic variations, Expectation over Transformation (EOT), introduced by Athalye et al. [1] , plays a crucial role, particularly in optimizing contact attacks like adversarial patches. These patches, while robust and universally applicable due to EOT optimization, suffer from a lack of concealment and practical challenges associated with their physical placement in the real world. Conversely, non-contact optical attacks, leveraging light manipulations, i.e. manipulating the slope, width, and wavelength of a laser, provide greater stealth and are easier to deploy with no need for manual attachment. However, the limited variability in light parameters makes it difficult for EOT to effectively develop a universal strategy that can adapt to changing conditions with a simple style.Given the inherent challenges of enhancing such attacks in dynamic scenarios, this paper aims to focus on non-contact attacks that are harder to boost performance and explores a new method from the perspective of active adaptation. Specifically, We introduce a dynamic, robust laser attack framework, the "Embodied Laser Attack (ELA)", applied here within a traffic scenario as a case study. The ELA framework leverages the core concepts of embodied intelligence-"Perception-Decision-Control"-to dynamically adjust a highly manipulable laser medium, crafting optimal real-time attack strategies based on current perceived states. This method represents a departure from traditional static, offline enhancements such as EOT, focusing instead on active adaptation to enhance the robustness of non-contact attacks. A visual comparison between EOT and our ELA method is illustrated in Figure 1 .However, to implement this idea, there exist two challenges: (1) Perception Transformation for Victim's Perspective. In practical scenarios, acquiring information from the victim is challenging, while data from a third-party sensor is more obtainable, meanwhile posing a necessity of transforming data from the attacker's view to the victim's. Moreover, unlike static attacks focusing on a singular scene, dynamic scenarios present both the attack target and surrounding environment as ever-changing, requiring the real-time and precise acquisition of target information. Therefore, our first challenge is to efficiently and rapidly utilize such accessible data to establish real-time inference between the two perspectives, on which attack strategies depend. (2) Dynamic Decision with Flexible Control. For the decision and control (DC) stage, we need to interactively learn from the dynamic scenario and achieve a rapid response with a flexible way to conduct as well. Existing non-contact optical attacks in traffic scenarios often fail to provide instantaneity and efficiency due to their reliance on query-based algorithms that are time-consuming. So, how to utilize perceived information to construct and launch instantaneous attacks is our second challenge.To address the above issues, firstly, we innovatively utilize the intrinsic geometric priors of traffic scenes, which significantly reduce the computational cost associated with traditional full-image perspective transformation technologies. Specifically, a few-layer Multilayer Perceptron (MLP) is utilized to construct the Perspective Transformation Network (PTN), which could enable a real-time and efficient estimation of the target's distorted states in the victim's view from the attacker's accessible imaging. Secondly, we propose agent-based decision-making and manipulate the laser (shooting angles, wavelength, etc) -a flexible and controllable medium to implement in the physical world for the DC module, which trains an attack agent with reinforcement learning, capable of instantaneously determining a valid strategy based on the perceived status estimation during the attack phase. Besides, we carefully design the reward function to further guarantee the immediacy of attacks and the laser's physical properties. Main contributions are as follows:• We propose the first dynamic robust non-contact attack framework called ELA, which utilizes the paradigm of embodied intelligence: Perception-Decision-Control to dynamically and timely adjust a manipulable laser towards valid attack strategies according to current situations, rather than statically enhancing a fixed physical adversarial example's robustness in an off-line manner like EOT ahead of time.Transformation Network (PTN) is proposed to enable rapid simulation of object variations relying on the intrinsic geometric priors of traffic scenes; An adversarial laser decisionmaking agent is designed to facilitate real-time valid strategies for dynamic successive processes. • We evaluate our method on the sign recognition task in traffic scenarios based on data collected from the CARLA simulator and the real world. Experimental results demonstrate the effectiveness of our framework for different categories and complex scenes, including various viewpoints, distances, etc. 
related works 2.1 robust physical adversarial attacks: 
 Considering that physical attacks [4, 5, 9, 22] are vulnerable to changeable environmental conditions, several works have been proposed to ensure the robustness of attack methods in the real world. Among them, EOT [1] is a classic technique utilized in the majority of existing physical attacks, which applies various random transformations, such as scaling, rotation, and blurring, to a single sample, thereby improving the universality of adversarial examples across environmental variations. In addition, there also exist some other works, like Robust Physical Perturbations (RP2) [9] However, these robustness enhancement techniques, predominantly designed for contact attacks, tend to be less effective when applied to non-contact adversarial attacks such as those involving lasers or other remote manipulation methods. Non-contact attacks typically use mediums like lasers, which are inherently homogenous compared to textured patches, making techniques like EOT difficult to find a unified attack strategy within such a limited parameter space for optimization. Therefore, despite non-contact attacks' flexibility and concealment, their robustness is often poor. To bridge this gap, our work shifts focus towards enhancing the robustness of non-contact adversarial attacks through an active adaptation framework rather than static enhancement like EOT.It should be noted that most robust physical attack methods need to be manually attached to the target, which is not always practical, and it is difficult to adapt to other situations once implemented, thus causing limitations in traffic scenarios. To address this issue, some achievable non-contact attacks in the physical world are designed with adversarial light as an easy-to-control medium, such as [12, 18] using a projector to attack recognition tasks with a designed texture projection, and [8, 11, 38] conducting attacks with geometric light on the whole image to mislead traffic sign recognition. In our method, we also utilize light due to its flexibility, specifically adding a laser beam on the traffic sign to promise being wholly captured by the lens, which is easy to conduct.Notably, we find that most light attacks adopt real-time optimization using evolutionary algorithms like Genetic algorithm (GA) [11] and Particle Swarm Optimization algorithm (PSO) [29, 40] , or greedy algorithm [8, 16] , which will lead to uncontrollable performance and time costs and hinder those applications in dynamic scenarios. Unlike those methods, we attempt to design a different optimization method with reinforcement learning, ensuring its attack performance and speed simultaneously. 
methodology: 
 In this section, we introduce our proposed Embodied Laser Attack (ELA) based on the safety-critical task: traffic sign recognition. The whole framework is presented in Figure 2 .The inherent challenge in non-contactly attacking traffic sign recognition tasks lies in dynamic scenarios. The variability and unpredictability of real-world conditions range from changes in alterations in the vehicle's speed to the angle of view, which demand an adaptive attack method that can consistently fool the recognition systems under such fluctuating circumstances.To address the identified challenge, we propose a novel attack framework ELA, which effectively integrates the paradigm of embodied intelligence: perception-decision-control. Specifically, our ELA is first meticulously designed to enable the active perception of real-time, precise data. This process involves a critical perspective transformation T that could transform the attacker view o 𝑡 𝑎 observed by a third-party sensor into the victim view o 𝑡 𝑣 . Then, we combine o 𝑡 𝑣 with light parameters 𝒍 𝑡 𝜃 into the state s 𝑡 to an agent developed within a reinforcement learning paradigm, enabling it to make an instantaneous decision a 𝑡 corresponding to each state s 𝑡 . Additionally, the chosen medium for this agent's interaction with the environment is laser beam, selected for its inherent controllability, and the action space of the agent is represented by the laser's several attributes.Based on the above, the objective of optimization within our ELA framework can be succinctly summarized as follows:EQUATIONwithy 𝑡 = 𝑓 (A (s 𝑡 , a 𝑡 )) , s 𝑡 = {(T (o 𝑡 𝑎 ; 𝜙 T ), 𝒍 𝑡 𝜃 }, a 𝑡 ∼ 𝜋 (•|s 𝑡 ; Θ),where I(•) signifies an indicator function that equals 1 when y 𝑡 ≠ y 𝑡 , 𝜙 T and Θ respectively represent parameters for the perspective transformation T and the decision-making policy 𝜋. s 𝑡 is the actual state with an estimation of the victim's perspective from T as well as 𝒍 𝑡 𝜃 . A (•) represents an operation that performs the laser attack strategy determined by a 𝑡 , which is chosen by 𝜋 according to current state s 𝑡 , to generate the final adversarial image for recognition through the classifier 𝑓 . In the following sections, we will detail the core designs in the perception module and the DC module. Typically, in the actual attack scenarios, directly accessing data from the victim's perspective is impractical. To address this, we propose a third-party perception module (shown in Figure 3 ), grounded in the concept that acquiring third-party scene data via an externally placed sensor is more feasible. However, it's obvious that the data acquired from such a third-party standpoint does not align with the imaging observed from the victim.To address the inherent imaging inconsistencies at different viewpoints, traditional approaches often rely on multi-view imagery for new viewpoint synthesis, which suffers from high time costs and loss of actual precision. Given that traffic sign recognition in real scenarios involves critical region localization before classification, slight position deviations in generated viewpoint information may hinder the attack performances drastically. Compared to such fullimage perspective simulations, we propose a local transformation method by leveraging traffic-specific shape priors, significantly enhancing accuracy and efficiency in perspective estimation.. Traffic scenarios possess unique prior knowledge, inherently existent in both the thirdparty attacker and the victim's perspective, such as geometric shapes. For instance, vehicles in the scene from the attacker's view can be represented by rectangles, while traffic signs in the scene from the victim's view often adhere to fixed shapes as well, such as circles or octagons. For traffic sign recognition, what is essential is merely the portion of the victim's viewpoint containing the traffic sign. Therefore, we can abstract complex scenes from pixel representations to representations based on shape priors.For the scene o 𝑡 𝑎 under the attacker view, as demonstrated in Figure 3 , we can represent o 𝑡 𝑎 into the minimal bounding box wrapping tightly around the vehicle's contour in the imaging, a rectangle whose shape depends on the vehicle's location and rotation. This representation captures the scene's essence by focusing on the geometric stability of vehicles, a persistent element in traffic scenarios. Mathematically, o 𝑡 𝑎 could be formulated as follows:EQUATIONwhere x 𝑡 min , y 𝑡 min denotes the coordinates of the top-left vertex, and x 𝑡 max , y 𝑡 max represents the coordinates of the bottom-right vertex of the minimal bounding rectangle at time t.For the scene o 𝑡 𝑣 under the victim view, it can similarly be characterized using the constant presence of the traffic sign. Specifically, with distinct shapes such as circular or octagonal, we can represent each using the coordinate of its center position along with a geometric parameter set 𝜼 𝑡 𝑔𝑒𝑜 . Thus, o 𝑡 𝑣 can be expressed as:EQUATIONwhere (x 𝑡 center , y 𝑡 center ) denotes the coordinate of the sign's center at time t, and 𝜼 𝑔𝑒𝑜 can be further reduced to its geometric shape in the victim's view, for example, a circle sign 30's 𝜼 𝑡 𝑔𝑒𝑜 consists of the respective lengths 𝑎, 𝑏 of an ellipse's long and short axes as well as the angle Δ of deflection to characterize the distorted circle, i.e. EQUATIONwhere 𝜙 T represents the learnable parameters of PTN.Regarding the training of this network, once the state o 𝑡 𝑣 is obtained, we employ geometric knowledge to further locate the traffic sign. Taking a circular sign 30 as an example, we define the sign's religion based on the sign's geometric parameters 𝜼 𝑡 𝑔𝑒𝑜 = [𝑎, 𝑏, Δ]. This process allows us to generate a mask that precisely indicates the traffic sign's region. For example, the creation of a mask M for the sign area, based on the geometric parameters 𝜼 𝑡 𝑔𝑒𝑜 , can be formalized as follows:EQUATIONwhere (𝑖, 𝑗) represents the coordinates of pixel in the mask M. Then, upon obtaining the predicted mask M, it can be compared with the ground truth mask on a pixel-by-pixel basis to calculate the Mean Squared Error (MSE) loss. This computed loss is then utilized to iteratively update the PTN. The loss function is as follows:EQUATIONwhere 𝑁 , 𝐾 denote the number of rows and columns in the mask matrix, M(𝑖, 𝑗) is the value of the predicted mask at pixel (𝑖, 𝑗), and M GT (𝑖, 𝑗) is the value of the ground truth mask at the same pixel.As the PTN converges through the training process, it becomes good at transforming perspectives from the attacker's to the victim's viewpoint across various scenes. This capability is derived from the PTN's focus on inferring the location mask without the need to consider the specific content within the scene, where the simulation of the target sign generally aligns with the actual distortion state of the target. Therefore, during the whole moving process, PTN can generalize the attacker's perspective information shift to the victim's viewpoint.After estimating the scenario o 𝑡 𝑣 from the victim's perspective, there remains a need for an instantaneous attack method. Consequently, we have developed a novel agent-based attack framework, which is particularly well-suited to autonomous and timely decisions in dynamic scenarios. Detailed explanations will follow. 𝜃 of the laser beam to be applied in the scene, we can characterize the state s 𝑡 at this time as follows:EQUATIONwhere k 𝑡 , 𝝎 𝑡 , 𝝀 𝑡 denote the slope, width, and wavelength of the laser beam at time t, respectively. Given our selection of the laser beam as the control medium, the action space A of the agent A is defined by the parameters 𝒍 𝜃 of the light encoded within the state representation. Mathematically, the action space A can be characterized as follows:EQUATIONwhere the range 𝝀 min = 400 nm ∼ 𝝀 max = 700 nm encompasses all the colors that the human eye can perceive. Next, we will discuss how to train policy network 𝜋.To ensure the adaptability of the adversarial laser beam across consecutive time frames, and different driving environments, our training dataset is collected from various driving scenes and pre-processed into distinct, continuous five-frame segments. The agent is trained on these segments via random sampling to enhance its ability to generalize across dynamically changing scenarios. Then, given the continuous nature of the light parameter space, and to enable more effective exploration and adaptation, our optimization framework employs the Proximal Policy Optimization (PPO) algorithm, as detailed in [21] . This method leverages a modified objective function that facilitates stable and effective policy updates by utilizing the probability ratio and advantage estimates. The training objective of PPO is designed to minimize the expected cost, formalized as:EQUATIONwhere Θ denotes the parameters of the policy 𝜋. The term r 𝑡 (Θ) = 𝜋 (a 𝑡 |s 𝑡 ;Θ) 𝜋 (a 𝑡 |s 𝑡 ;Θ 𝑜𝑙𝑑 ) represents the probability ratio, comparing the likelihood of selecting action a 𝑡 under the current policy with that under the previous policy. 𝐴 𝑡,𝜏 denotes the advantage function at time 𝑡 within the training segment 𝜏, measuring the relative benefit of the chosen action over the expected value of all possible actions in that state. 𝜖 is a critical hyperparameter that controls the clipping range, ensuring that updates are appropriately scaled to prevent destabilizing the learning process or stalling improvements.Because the relationship between the advantage function 𝐴 𝑡 and the reward function R in PPO is well-understood and straightforward, here we directly introduce the design of reward functions. Specifically, we first design a reward 𝑅 attack for the efficiency of the attack and its time cost. It should be noted that since direct interaction with the victim model is impractical, we utilize ensemble surrogate models 𝐹 1,••• ,𝑛 to evaluate the effectiveness of our strategies. The formulation of 𝑅 attack is represented as follows:EQUATIONwhere r 𝑠 is the reward for a successful attack. 𝐹 𝑖 represents the confidence score from the 𝑖-th model in the ensemble. 𝑐 𝑖 is the scaling factor for the 𝑖-th model's contribution to the penalty. 𝛼 is a penalty factor for the number of steps 𝑁 steps , which encourages the development of more efficient strategies. Besides, to generate a valid light with the principle of keeping the disturbance as little as possible, we need to limit the area covered by the light, which mainly depends on its width, and the wavelength should also be proper or it cannot be captured by the victim's sensor. Based on the above requirements, we design another reward R appear for the natural appearance of lights: (11) where r 𝜔 represents a predefined reward value for the beam width. When the beam width, denoted as 𝝎, is less than a threshold 𝝎 0 , a reward of (𝝎 0 -𝝎)r 𝜔 is granted. Conversely, if the beam width exceeds this threshold, it results in a penalty. Similarly, r 𝜆 follows a comparable mechanism. 𝝀 min and 𝝀 max could be set by 400 and 700 as the range borders, and I is the signum function.R appear = (𝝎 0 -𝝎) • r 𝜔 + I[(𝝀 -𝝀 min ) • (𝝀 max -𝝀)] • 𝒓 𝜆 ,Finally, those rewards work together as a comprehensive evaluation to train our agent 𝐴 with guidance:EQUATIONwhere 𝛾 1 and 𝛾 2 are the weights that adjust the importance. Then, utilizing the trained policy network 𝜋, we can sample action a 𝑡 from 𝜋, to adjust the laser beam parameters 𝒍 𝑡 𝜃 for generating adversarial examples A (s 𝑡 , a 𝑡 ) at time t during inference. Additionally, during the inference process, aside from the initial state s 0 where random light parameters are used, the light parameters for subsequent frames are derived by using the parameters from the previous frame as the initial parameters for inference. Compared with [8, 16, 29, 40] treating separate frames equally and randomly, our agent could cope with the whole consecutive process through interaction and learning, making effective use of scenarios and empirical information, and our attack phase is more efficient. 
experiments 4.1 settings: 
 Simulation of Physical Implementation: Due to the inherent risks and complexities of implementing ELA in the real world, we conduct most validations within the near-realistic environment of the CARLA Simulator [7] with reference to other physical attacks in autonomous driving scenarios [3, 24, 25, [31] [32] [33] 36] . CARLA is an autonomous driving simulator, owning 3D maps with realistic buildings, traffic signs, dynamic vehicles, diverse weather, and manually placable RGB sensors, which is just right for our needs. Specifically, to consider the variety of scenes, we choose three maps with different settings in CARLA: a small village embedded in mountains with a special infinite highway, a town with skyscrapers, residential buildings and an ocean promenade, as well as a small rural area with a river and several bridges. Such selections naturally cover various environmental conditions in terms of sunlight, fog, etc. with four different sign settings by default: Sign "30", Sign "60", Sign "90" and Sign "Stop" since the traffic requirements for these scenarios are diverse. Then we record several aligned video pairs (a total of 3200 frames) for each category as training data. For the data obtained from the fixed sensor, we annotate signs at the pixel level, and for data from the victim's view, we annotate the vehicle at the box level. Besides, each category uses frames of an extra video pair shot for a whole driving route (each 100 frames) as the test data. We carry out attacks in CARLA and record videos of the corresponding attack status of signs, and then evaluate the classification results after attacks in an off-line way. Victim Models: For the DC module, our ensemble surrogate models contain some commonly used kinds including ResNet50 [10] , Inception-v3 [26] , EfficientNet [28] , and we select another three main classifiers to test: ResNet101 [10] , DenseNet121 [13] and GoogLeNet-V3 [26] . We first train in GTSRB [23] with officially pre-trained weights, and then finetune the models by our own video frames, which achieves 100% precision on clean test samples. Metrics: We choose a commonly used metric to indicate the overall performance: Attack Successful Rate (ASR). Specifically, ASR shows the attack performance as a ratio of successfully misclassified samples in the test set. In our paper, we record a video about the attack and compute the corresponding ASR for the video's frames. Other Implementations: For the part of active perception, we directly apply our trained weights with the best performances to the perspective transformation work during attacks. For the agent training, we set 𝑒𝑝𝑜𝑐ℎ as 100 with sampling operations.To show the accuracy of our first-perspective inference, we utilize a common metric in the field of computer vision to conduct an assessment: Intersection over Union (IOU). Specifically, we train PTN and make predictions on test datasets of the four categories, and then calculate the average IOU as their overall performances, which here doesn't merely represent the overlap degree of two areas in 2D images, but the effect after many variations involving rotation, distortion, and scaling, etc. The results of each category are shown in Tab 1, where we can see that all are above 90%, showing our method's validity. To be clearer, we also give visualized examples of the perception results of two kinds of signs with different shapes: Sign "60" and Sign "Stop" in Fig 4 . We can find that the predicted region of the target sign is basically the same as the real imaging situation, which demonstrates the accuracy of our perception module and lays the foundation for effective decision-making on the current state in the next stage. To demonstrate the effect and rapidity of our decision and control module, we also compare the attack performance with two opensource light attack methods: Adversarial Laser Beam (AdvLB) [8] and Adversarial Laser Spot (AdvLS) [11] . It's clear that they are faced with different application situations: first, the former two methods are black-box static methods designed to search parameters for one scene with no time limit, optimizing through random search and retaining better solutions in an off-line manner, while our method is trained ahead for the whole process to promise realtime and changeable attacks; secondly, their light could appear anywhere on the whole image, while ours is limited by the sign's area. To ensure fairness, we restrict their rays to be only added to the sign area as ours, then we calculate ASR and average time cost (Time) for comparison. Since the above methods use a fixed way to attack, we just calculate the optimization period as a time value, and for our method, we record the time costs of each attack and use the mean of the set as the final result. Here we take attacks on Inception-V3 as an example. The results are shown in Tab 2, where we find that our approach is generally in a good position, achieving the best ASR of up to 76% with the highest speed since our agent has learned before, although in some cases the ASR is not particularly high. Since we just use a common light beam without complex texture and attack once, we believe such results are acceptable for this simple pattern. Among them, possessing the same attack form as ours, AdvLB's performance especially highlights the superiority of our attack decision-making, proving that our light attack's significant superiority depends on the decision process, rather than the light design itself which is not our main innovation. Besides, it is worth emphasizing that all methods experience a training phase interaction and cannot receive feedback on the classification information during the one-step attack phase, which is in line with the real application in physical scenarios and means a more challenging attack level.To conduct systemic verification for our ELA, we have done a comparative experiment with EOT to show the effects of the two different robust attack methods. Considering that EOT and ELA have quite different detail settings, we apply both to our scenario with well-thought-out condition settings for relatively objective verification, and here we both choose to attack three unseen classifiers: ResNet101, DenseNet121, and GoogleNet-V3 to test the transferability of the two methods, simulating real implementation conditions. For EOT, we allow it to use part of the whole training data (1/10) with random variations like random cropping, rotating, blurring,etc, and also choose a laser beam as the attack form. For ours, we remain in the same setting. The results of the four categories against three classifiers are shown in Tab 3, where we can see that our ASR is far higher than Advlb's results, roughly reflecting the effective cooperation between our perception module and the decision module.Obviously, for physical attacks like ray attacks, although they have been improved by the enhancement method EOT, it is still difficult to work for all samples with a unified style like using a complex noise-based patch in the digital world. At this point, our approach is better suited to solve this scenario, which can make changeable decisions with rapid speed, as represented in Fig 5 . Convergence Discussions: As an optimization method based on reinforcement learning, it is necessary to explore its convergence to prove its training validity from a quantitative perspective. Therefore, we count the rewards and attack time during the training process and then use line charts to reflect the training trend. classifiers is huge, where some agent attacks have relatively worse performance with a gap of almost 30% than the optimal one, our performance is still significantly better than theirs. Such results fully prove that our agent-based decision module can effectively learn and take attack strategies suitable for different situations, and can make timely decisions within the specified time. Verification in the Physical World: Although we are not at liberty to achieve real-vehicle verification, we still attempt to simulate such a process and validate our method under the approximation of the real-world conditions. In fact, the perspective transformation relations fitted by the perception module are not easily disturbed by other factors in the real world and are sufficiently verifiable in the digital world. Thus, we focus on mimicking a vehicle's real movement. Imitating the real driving situation, one person is asked to stand at a fixed position against the side holding a stop sign, while another person moves forward with a shooting camera, obtaining a video from a pseudo-vehicle imaging perspective. The visual examples of partial frames are listed in the first row of Fig. 7 . It is clear that the sign is scaling and shifted with slight deformation during the successive process, which is consistent with real scenarios. We shoot for 7 seconds at twenty frames a second (total 140 frames) within an indoor scene and perform our attack on this video, which finally obtains an average ASR of 31.3% on the three classifiers, the result suggests that the external environment has a certain impact on the performance but it's not particularly significant compared with digital results. We also consider it acceptable since the sign "STOP" has unique discriminatory characteristics and is more difficult to attack than most categories. The attack results of partial frames are listed in the second row of Fig. 7 , where we can find that the multi-frame training strategy brings part of the similarity to light patterns across frames. Statistical Insights on Attack Results: We consider that each category has its own representative characteristics as well as a corresponding misleading tendency, so we discuss the effect of our ELA attack from a macro point of view, globally analyzing the statistical results of the false determinations triggered by the attack and revealing potential risk warning insights. Specifically, we count the frequencies of labels that are incorrectly predicted after successful attacks and attempt to find out such rules with the results in Tab 5, where we can observe that a speed limit sign "30" with an adversarial light can be mostly mistaken for sign "70" or less frequent "60" with higher restrictions, and the action-determining sign "Stop" could also be vulnerable to be misled as others. Based on this, we can easily recognize what weak points the embodied agents tend to dig out for each category, and then future work could focus more on the top frequent labels to ensure reliability.  
conclusion: 
 In this paper, we proposed a dynamic robust laser attack framework combined with embodied intelligence: ELA, which contained three stages: perception, decision and control to achieve the attack. For the perception stage, a PTN was designed to infer key local information in the victim's view without direct interaction with its sensor.For the decision and control stage, an attack decision-making agent was designed and trained with reinforcement learning, which could timely generate proper strategies according to scene variations and then implement them flexibly. This is a new paradigm to enhance the robustness of contactless attacks better suitable to real-world successive scenarios, which may pave a new path for enhancing the robustness of physical attacks.  
 
 Appendix:  


Decision: The paper got three positive scores and one negative score, and the average score is above the borderline. I would like to accept this paper.

Reviews: review: paper_summary: paper_summary: This paper proposes the first dynamic robust non-contact attack framework, which utilizes the paradigm of embodied intelligence: Perception-Decision-Control to dynamically and timely adjust a manipulable laser towards valid attack strategies according to current situations.

A novel Perspective Transformation Network(PTN) is proposed to enable rapid simulation of object variations relying on the intrinsic geometric priors of traffic scenes; An adversarial laser decision making agent is designed to facilitate real-time valid strategies for dynamic successive processes.
strength_weakness: strength_weakness: This paper proposes the first dynamic robust non-contact attack framework, which is a novel work in traffic scenes. Especially, the dynamic application demonstrated in the supplementary video, is much different from the previous works  AdvLB and AdvLS,
The performance of the proposed method is much greater compared with the similar existing works AdvLB and AdvLS.
limitations: limitations: The authors use many long sentences with adverbial and subordinate clauses, making it a little hard to read.
x^𝑡_{min}, y^𝑡_{min} should be (x^𝑡_{min}, y^𝑡_{min}), the same as x^𝑡_{max}, y^𝑡_{miax}.
The authors focus on the colors that human eyes can clearly perceived, ranging from 𝝀_{min}=400nm∼𝝀_{max}=700. But in the implementation scenario, the images/videos are taken by the cameras, is the range of colors still appropriate?
In the experiments, the sample dataset is not versatile, with only the signs “30”, “60”, “90”, and “stop”. 
Besides, the scenario of the physical implementation is not suitable enough for the traffic, while the digital simulation is a traffic situation.
paper_summary: paper_summary: This paper introduces the Embodied Laser Attack (ELA) framework, addressing the limitations of traditional physical adversarial attacks in dynamic scenarios like traffic situations. ELA utilizes embodied intelligence to dynamically tailor non-contact laser attacks, enhancing robustness through scene priors, reinforcement learning, and controllable laser emissions. The framework demonstrates effectiveness in various traffic scenarios, offering active adaptation for improved attack performance compared to static methods. The authors discuss challenges in victim perspective modeling and decision-making, highlighting ELA's innovative approach to enhancing non-contact adversarial attacks.
strength_weakness: strength_weakness: This paper presents a novel Embodied Laser Attack (ELA) framework that addresses the challenge of enhancing the robustness of non-contact adversarial attacks in dynamic scenarios like traffic situations. The strength of this paper lies in its innovative approach of leveraging embodied intelligence to dynamically tailor laser attacks, incorporating perception, decision-making, and control modules for real-time adaptation. By introducing ELA as an active adaptation method compared to traditional static methods like Expectation over Transformation (EOT), the paper showcases a shift toward flexible and efficient adversarial attacks in dynamic environments. Through rigorous experiments in both digital and physical environments, the paper demonstrates the effectiveness of ELA in various traffic scenarios, highlighting its potential to significantly contribute to the field of physical adversarial attacks. The systematic verification comparing ELA with EOT further reinforces the paper's strength in providing a comprehensive evaluation of the proposed framework.
limitations: limitations: This paper has the following limitations:
1. The authors claim that their ELA attack could leverage the embodied intelligence paradigm of perception-decision-control. However, the ELA method only attacks the perception module of the autopilot system. The relationship between ELA and embodied intelligence is unclear. Although the authors design the decision-control module, it is more like an optimizing strategy rather than attacking the control system in the embodied intelligence system. The authors should emphasize the relationship between ELA and the embodied intelligence paradigm.
2. The authors claim that ELA could make real-time decisions according to scenario changes in a dynamic manner. In Table 2, the authors claim the time cost is around 0.2s, which could attack the realistic system. However, the details of the time cost are unclear. Does it cover the whole perception-decision-control paradigm? If so, it would be better if the authors provided more details of the hardware, e.g., the processor number of CPU and GPU.
3. Although ELA, AdvLB, and AdvLS have proved their effectiveness on image classifiers, most of the real-world autonomous systems are based on object detectors. To inspire future research on laser attacks, the authors could provide some attempts on the detectors such as YOLO and Faster-RCNN.
paper_summary: paper_summary: The paper presents a novel framework for conducting non-contact adversarial attacks in dynamic environments such as traffic scenarios. This framework, referred to as Embodied Laser Attack (ELA), integrates the embodied intelligence paradigm, combining perception, decision, and control processes to adaptively generate adversarial attacks using a controllable laser system. It utilizes a data-driven reinforcement learning approach for dynamic decision-making, enabling the system to react instantaneously to changes in the environment. The paper demonstrates the effectiveness of this approach through extensive experiments in simulated traffic scenarios, highlighting the potential for real-world applications.
strength_weakness: strength_weakness: 1. The paper introduces a groundbreaking approach by integrating the embodied intelligence framework, which effectively combines perception, decision-making, and control into a cohesive system for non-contact adversarial attacks. 
 
2. By leveraging intrinsic geometric priors specific to traffic scenarios, the proposed Embodied Laser Attack (ELA) method significantly reduces the computational complexity typically associated with perspective transformations. 
 
3. The framework employs a reinforcement learning algorithm to train an attack agent that can make real-time decisions based on the perceived state of the environment. This method stands out for its ability to generate effective and immediate adversarial actions, a critical feature for scenarios where attack opportunities might be fleeting and highly context-dependent.
limitations: limitations: 1. The paper primarily compares its ELA methodology with EOT, which is not specifically tailored for the specified application context of non-contact adversarial attacks.

2. were trained and implemented. This omission makes it difficult to ascertain the fairness and relevance of the comparisons made. 

3. No ablation studies are provieded involving parameters such as $\gamma_1$ and $\gamma_2$, which are crucial for understanding the contribution of different components of the reward function.
paper_summary: paper_summary: The paper presents a novel embodied laser attack method that combines perception, decision-making, and control modules to achieve efficient and robust non-contact physical attacks in dynamic scenes. This study not only enhances the practicality and concealment of physical adversarial attacks but also provides new ideas for future research on physical attacks.
strength_weakness: strength_weakness: - The paper proposes an innovative non-contact laser attack framework (ELA), which combines the Perception-Decision-Control paradigm of embodied intelligence, demonstrating enhanced robustness of laser attacks in dynamic scenarios.

- The effectiveness of the ELA framework is validated through experiments in the CARLA simulator, with performance comparisons against different methods under dynamic scenarios.

-  The paper includes detailed comparisons with existing methods (such as EOT), highlighting the higher attack success rate and real-time performance of ELA in dynamic continuous scenarios.
limitations: limitations: - Although the framework has been validated in a simulator, there is limited verification in real physical environments. The paper only conducts preliminary simulations and lacks discussion on complex situations that might arise in real-world applications. This affects the reliability and applicability of the method in practical scenarios.

-  While the advantages of ELA are showcased, there is insufficient discussion on its limitations. For instance, how does the method perform under different weather and lighting conditions? Is it still effective with more diverse traffic signs and more complex road environments?

-  The method has a high dependency on training data and models, but the paper does not provide detailed explanations on how different data and models impact attack effectiveness. Do different traffic scenarios, camera positions, and vehicle speeds significantly affect the attack performance?

- The paper focuses entirely on vision-related topics rather than covering multimedia aspects.