1 INTRODUCTION

2 BACKGROUND

3 RELATED WORK

4 THREAT MODEL
4.1 The attack surface of deep learning models
4.2 Adversarial goal
4.3 Adversarial capabilities and knowledge

5 ADVERSARIAL ATTACKS FOR 2D DEEP LEARNING MODELS
5.1 Catalog of 2D adversarial attacks
5.2 White-box adversarial attack for 2D deep learning models
5.3 Black-box adversarial attack for 2D deep learning models
5.4 The safety impact of physical-realizable 2D adversarial attacks

6 ADVERSARIAL ATTACKS FOR 3D DEEP LEARNING MODELS
6.1 The difference between 3D and 2D adversarial attacks
6.2 Catalog of 3D adversarial attacks
6.3 3D adversarial attacks in the digital world
6.4 The safety impact of physical-realizable 3D adversarial attacks

7 FUTURE DIRECTIONS AND CHALLENGES
7.1 Improving the transfer ability of adversarial examples
7.2 Towards semantic perturbation
7.3 Making adversarial examples physically achievable
7.4 Designing efficient 3D black-box adversarial attacks
7.5 Evaluating the robustness of newly proposed models
7.6 Evaluating the safety of novel CV applications
7.7 Breaking newly proposed defenses

8 CONCLUSION