{"id":"710a0f7f-0a77-4959-9520-27e5330053f1","arxiv_id":"1906.11897","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"A physical patch suppresses all object detections by YOLOv3 even for distant objects without overlapping them.","lead":"This paper shows a physical adversarial patch can make YOLOv3 miss every object in a scene no matter where the patch is placed. Smart readers might care because it reveals a flexible way to fool real-world vision systems without altering the objects themselves.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Physical transfer of digitally optimized patch to real-world printing/lighting not shown","rationale":"Reader correctly flagged the digital-to-physical gap as the weakest link; full text would be needed only to check whether later sections contain the missing transfer experiments. The non-local suppression mechanism itself is plausible in digital space but is not the load-bearing step for the stated physical result.","tokens_in":1638,"tokens_out":294,"duration_ms":10170,"concrete_test":"Print the final patch from the paper's optimization, photograph it at 3 distances (0.5 m, 2 m, 5 m) under indoor/outdoor lighting with objects at varying distances from the patch; measure YOLOv3 recall on the resulting images versus clean baseline. If recall does not drop below 10 % for non-overlapping objects, the physical claim fails.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that a patch optimized in digital space (presumably via gradient descent on YOLOv3 loss) produces a printable pattern whose effect survives camera capture, perspective distortion, illumination variation, and distance. The abstract asserts a physical attack with non-local suppression but supplies no quantitative transfer results, no mention of color calibration, no real-photo success rates, and no comparison of digital vs. physical mAP drop. Without this, the physical-attack conclusion does not follow from the digital optimization step.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript demonstrates an adversarial patch attack on object detectors (notably YOLOv3) in which a digitally optimized patch, when placed anywhere in the scene, suppresses detection of virtually all objects—even those distant from the patch—without requiring overlap with the targets. The work claims this effect transfers to the physical world after printing and real-world capture, supported by a video demonstration.","tokens_in":1720,"tokens_out":441,"duration_ms":19961,"significance":"If the physical transfer holds with quantitative validation, the result would be significant because it enables non-local physical attacks on detection systems that require no modification of the objects themselves. This opens new attack surfaces for applications such as surveillance and autonomous vehicles. The provided video demo is a strength that aids reproducibility of the claimed effect.","major_comments":[{"comment":"Abstract and §4 (Physical Experiments): The central claim of a successful physical attack is asserted, yet no quantitative metrics are supplied—e.g., no success rates, mAP drops, or tables comparing digital vs. physical performance under controlled variations in lighting, angle, distance, or camera model. This directly undermines the transfer from digital optimization to physical realization.","section":"Abstract and §4"},{"comment":"§3 (Patch Optimization): The non-local suppression effect is presented as a key novelty, but the manuscript provides no ablation or analysis (e.g., via attention maps or feature visualizations) showing the mechanism by which a localized patch affects distant objects; without this, the generality of the attack remains unclear.","section":"§3"}],"minor_comments":[{"comment":"Figure captions and the video link should explicitly state the camera model, printing method, and environmental conditions used in the physical tests to allow replication.","section":null},{"comment":"The related-work section should include a direct quantitative comparison table against prior physical patch attacks (e.g., those requiring object overlap) to clarify the advance.","section":"§2"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for their thoughtful review and constructive comments regarding the physical validation and mechanistic analysis of our adversarial patch attack. We provide point-by-point responses below.","responses":[{"response":"We agree that quantitative metrics would provide stronger evidence for the physical transfer. The current manuscript supports the physical claim primarily through the video demonstration. In the revised manuscript, we will include quantitative evaluations, such as detection suppression rates in physical settings, to address this concern. We will also discuss the limitations in controlling all variables like camera models.","revision_made":"yes","referee_comment":"[Abstract and §4] Abstract and §4 (Physical Experiments): The central claim of a successful physical attack is asserted, yet no quantitative metrics are supplied—e.g., no success rates, mAP drops, or tables comparing digital vs. physical performance under controlled variations in lighting, angle, distance, or camera model. This directly undermines the transfer from digital optimization to physical realization."},{"response":"The non-local effect is highlighted as a novel aspect, but we recognize the value of providing analysis to explain the underlying mechanism. We will add visualizations, such as feature maps or attention analysis, in the revised version to demonstrate how the patch influences distant objects and to support the generality of the attack.","revision_made":"yes","referee_comment":"[§3] §3 (Patch Optimization): The non-local suppression effect is presented as a key novelty, but the manuscript provides no ablation or analysis (e.g., via attention maps or feature visualizations) showing the mechanism by which a localized patch affects distant objects; without this, the generality of the attack remains unclear."}],"tokens_in":1230,"tokens_out":367,"duration_ms":44714,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The central new point is that a single adversarial patch can be placed anywhere in the scene and still cause the detector to miss every object, even ones far from the patch. This differs from earlier physical attacks that needed the patch to overlap or sit near the targets. The authors frame this as opening attacks that leave the actual objects untouched, which is a reasonable distinction from the cited prior work on patches for object detection.","headline":"The paper claims a non-overlapping physical patch that globally suppresses YOLOv3 detections, but supplies no numbers or transfer evidence to back the physical part.","tokens_in":2181,"tokens_out":159,"would_cite":false,"duration_ms":16069,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":{"model":"grok-4.3","evidence":[],"headline":"Adversarial patch optimization for YOLO suppression has no overlap with RS forcing chain","alignment":"orthogonal","rationale":"Paper's machinery is standard PGD + EoT maximization of detection loss (Eq. 2) on YOLOv3 grid cells; no J-cost, phi-ladder, 8-tick periodicity, or distinction-derived structures appear. Domain (cs.CV adversarial robustness) lies outside RS theorems on reality_from_one_distinction, AbsoluteFloorClosure, Cost.FunctionalEquation, etc.","tokens_in":44346,"confidence":"high","tokens_out":127,"duration_ms":5430,"cache_read_input_tokens":38528,"cache_creation_input_tokens":0},"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"An adversarial patch placed anywhere in an image can cause an object detector to miss every object in the scene.","keywords":["adversarial patch","object detection","physical attack","YOLOv3","global suppression","universal attack"],"falsifier":"Print the optimized patch, place it in a real scene containing visible objects, photograph the scene, and run the detector on the photo; continued detection of the objects would show the claim does not hold.","tokens_in":2531,"feed_emoji":"⚠️","tokens_out":607,"duration_ms":26022,"temperature":0.7,"pith_summary":"The paper shows that a single adversarial patch, when placed at any location, can make the YOLOv3 detector fail to report virtually all objects present, including those distant from the patch. Earlier physical attacks required the patch to overlap or sit near the targets being hidden. The new method needs no alteration to the objects themselves. A reader should care because it identifies a way to disrupt detection systems without touching the things they are meant to find.","feed_headline":"Patch anywhere makes detector miss every object in scene","feed_subtitle":"YOLOv3 fails on all targets even far from the patch, without needing to alter objects","key_machinery":"The adversarial patch optimized to produce global suppression of object detections regardless of its position in the image.","core_discovery":"We demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene.","pith_inferences":["The result suggests detectors may depend on global image statistics that a localized patch can override.","Similar patches could be tested on other detectors to determine whether the suppression effect is architecture-specific.","One could explore whether retraining with such patches improves robustness without harming normal accuracy."],"forward_implications":["Object detectors can be attacked without any change to the objects being detected.","A single patch can affect detections across the entire image rather than only locally.","Physical attacks become possible in scenes where modifying the objects themselves is impractical.","Detection systems must now defend against location-independent suppression effects."],"fun_headline_variants":["Adversarial patch suppresses all detections from anywhere","Patch anywhere causes YOLOv3 to miss every object","Physical patch defeats object detector without overlap","Anywhere patch erases all detections in the scene","Distant adversarial patch hides every object from YOLOv3"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"A patch optimized in digital simulation will still suppress detections after it is printed and photographed under real lighting, angles, and distances.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial patch suppresses all detections from anywhere","Patch anywhere causes YOLOv3 to miss every object","Physical patch defeats object detector without overlap","Anywhere patch erases all detections in the scene","Distant adversarial patch hides every object from YOLOv3"]},"model":"grok-4.3","cost_usd":0.008537,"raw_usage":{"total_tokens":3831,"prompt_tokens":617,"num_sources_used":0,"completion_tokens":72,"cost_in_usd_ticks":85374500,"prompt_tokens_details":{"text_tokens":617,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":3142,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":617,"tokens_out":72,"duration_ms":34286,"temperature":1.0,"reasoning_tokens":3142,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-25T19:57:40.227283+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Print the optimized patch, place it in a real scene containing visible objects, photograph the scene, and run the detector on the photo; continued detection of the objects would show the claim does not hold.","supporting_citations":[],"review_version":1}