{"id":"61211b5d-94f4-4b86-94c4-1c925e6c2e65","arxiv_id":"2412.02171","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A background-attentive, hardware-aware adversarial training method restores real-time object detection FPS under latency attacks on edge, desktop, and cloud GPUs.","lead":"This paper defends object detectors against latency attacks that flood non-maximum suppression with phantom boxes and stall real-time processing on edge GPUs. It proposes adversarial training that focuses perturbations on background regions and adjusts the defense to the hardware capacity of the GPU.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The robustness evaluation never states whether Daedalus/Phantom Sponge/Overload are re-optimized against each defended model; if the same perturbations are transferred from the undefended baseline, the Table 1 gains may reflect gradient obfuscation rather than true robustness.","rationale":"The reader correctly flags Eq. (4) as algebraically inconsistent with Eq. (3): the printed bound has a minus sign inside the square root and omits the linear term, and alpha/beta are never quantified, so Algorithm 2's hardware-capacity stopping rule cannot be reproduced as written. That is a genuine internal inconsistency and it justifies a CONDITIONAL verdict. I do not, however, think it is the most load-bearing issue. The central advertised result is robust object detection under latency attacks, and that result is established by Table 1, whose attack-generation protocol is underspecified. Robustness evaluations are meaningful only when the attack is optimized against the model being defended; otherwise the defense may simply benefit from obfuscated gradients. Since Section 5.1 never states that attacks are run against each defense, the reader cannot verify whether the 8-10% gain is real. The FPS restoration plots in Fig. 6 and the framework portability results in Table 4 are useful independent evidence that the trained models reduce phantom boxes, so I would not reject the paper; but the core comparison needs an explicit adaptive-attack rerun. My recommended verdict is therefore the same CONDITIONAL verdict the reader reached, i.e., UNCHANGED pending that check.","tokens_in":17756,"tokens_out":7686,"duration_ms":81737,"concrete_test":"Regenerate each latency attack from its published objective (Eq. 2 and Refs. [3,28,35]) with K-step PGD directly against the Underload, MTD, and OOD models, using the same epsilon and per-image budgets, and recompute Table 1. If Underload's robust mAP under these adaptive attacks falls by more than about 10 points or approaches the Standard model's values, the claimed 8-10% robust-accuracy gain is not established. Publish the per-model attack-generation code to allow independent verification.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Underload's central claim is that it 'restores real-time processing' and 'achieves up to 8-10% gain on robust accuracy compared to MTD and OOD.' Both claims rest on the robustness numbers in Table 1. Section 5.1 describes the attacks only by name and hyperparameters; it never states whether each attack is generated against the standard (undefended) model and then evaluated on all defenses, or regenerated against each defended model. This is decision-relevant: Overload and Daedalus use gradient-based PGD, and Phantom Sponge trains a universal perturbation against a specific detector. If the perturbations in Table 1 were optimized for the standard model and simply transferred to MTD/OOD/Underload, then Underload's higher mAP could be due to a changed loss surface that the attack was not optimized against, not to genuine robustness. Adversarial training with an objectness-loss proxy can mask gradients even when a stronger adaptive attack would find phantoms. The paper also does not report attack success rate or perturbation budget per defense, making it impossible to rule out this confound. This is more load-bearing than the Eq. (4) algebra issue identified by the reader: if the robustness comparison is not adaptive, the empirical core of the paper is unsupported; if it is adaptive, the hardware-capacity formula can be corrected without changing the main result.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes Underload, an adversarial training defense against NMS-based latency attacks (Daedalus, Phantom Sponge, Overload) on YOLO-family object detectors. The method uses the objectness loss as a proxy for the attack objective, injects perturbations only into background-attentive regions via a mask, and couples the training stopping criterion to a hardware-capacity bound derived from NMS computation and GPU-CPU transfer costs. The authors report table-level robust-accuracy gains over MTD and OOD across PASCAL-VOC, MS-COCO, and BDD, and latency measurements on Jetson Xavier/Orin NX, 4070Ti Super, and A100 GPUs, including a claimed restoration of real-time processing from 13 FPS to 43 FPS on Jetson Orin NX.","tokens_in":18055,"tokens_out":5413,"duration_ms":50434,"significance":"If the empirical claims survive scrutiny, Underload would be a valuable first defense against a recently identified class of denial-of-service attacks on object detectors, with practical relevance to edge deployments. The paper includes a broad evaluation across three YOLO versions, three datasets, and four GPU classes, and it ships source code, which strengthens reproducibility. However, the central hardware-adaptive capacity formula is algebraically incorrect as written, and the robustness evaluation leaves unclear whether the attacks are adapted to the defended models; both issues must be resolved before the reported gains can be interpreted as genuine robustness.","major_comments":[{"comment":"The closed-form bound in Eq. (4) is not the solution of Eq. (3). Solving α|C|²/S_IoU + β|C|/B < T − T_backbone for |C| yields the positive root |C| < [−β/B + sqrt(β²/B² + 4α(T−T_backbone)/S_IoU)] / (2α/S_IoU). The paper instead prints (S_IoU/(2α))·sqrt(β²/B² − 4α(T−T_backbone)/S_IoU), which has a minus sign inside the square root and omits the linear term. This expression is used verbatim in Eq. (12) and in Algorithm 2 line 1 to compute |C_max|, so the hardware-adaptive stopping rule is based on an incorrect formula. In addition, α and β are never specified, measured, or bounded anywhere in the paper or supplementary, making the capacity threshold not only wrong on its face but also unreproducible.","section":"§3.2, Eq. (4); §4.2, Eq. (12); Algorithm 2"},{"comment":"The robustness evaluation does not state whether Daedalus, Phantom Sponge, and Overload are re-optimized against each defended model or are generated once against the standard model and then transferred. All three attacks are gradient-based (PGD or universal perturbation training), so if the same perturbations are transferred from the undefended baseline, the higher mAP values for Underload could reflect gradient obfuscation or a changed loss surface rather than genuine robustness. The paper also does not report attack success rates or perturbation budgets per defense. Please specify the exact evaluation protocol, and provide an additional adaptive-attack evaluation (e.g., running Overload-style PGD on the objectness loss of the Underload model) to establish whether the reported gains persist.","section":"§5.1, §5.2, Table 1"},{"comment":"Property 3 states that the box count E[fθ(x+δ_M)]_box is monotonically increasing in the mask size r_x·r_y, and this monotonicity is used to justify the while-loop termination in Algorithm 2. No proof or direct empirical verification is given. The direction of monotonicity is also ambiguous from the text: Section 4.2 says larger masks \"reduce the amount of perturbations injected,\" whereas Section 5.4 equates mask size with \"unprotected area\" and reports that box number increases with mask size. Please either prove the property from the attack/defense definitions or provide a direct measurement with error bars, and clarify the mask semantics consistently.","section":"§4.2, Property 3"}],"minor_comments":[{"comment":"The header column \"ODD\" appears to be a typo for \"OOD\" used in the text; please unify the notation.","section":"Table 1"},{"comment":"The weight ρ in the Phantom Sponge term is introduced without definition or default value; please state its value or reference the exact setting from [28].","section":"Eq. (2)"},{"comment":"The algorithm uses \"T_basenet\" in line 1 while Eq. (4) uses \"T_backbone\"; please use consistent notation.","section":"Algorithm 2, Eq. (4)"},{"comment":"The text says hyperparameters follow [28] with λ1=1, λ3=0, but λ2 is never mentioned; please clarify the full attack hyperparameter tuple.","section":"§5.1"},{"comment":"The paper claims experiments are repeated 5 times (Supplementary C), but Table 1 reports no standard deviations or confidence intervals; please add variance estimates or state that the table shows means and that variances were small.","section":"§5.2"}],"recommendation":"major_revision","confidential_remarks":"The paper's central contribution is potentially publishable, but the current manuscript is not. The Eq. (4) error is straightforward to fix by substituting the correct quadratic solution and calibrating α and β; however, the more serious issue is the ambiguous attack evaluation protocol. The reader's stress-test concern about transferred attacks is well-founded and is the single largest threat to the validity of the robustness claims. I would ask for an adaptive-attack evaluation in the revision before considering acceptance. The reader's circularity concern (that the robust-accuracy gains are obtained by fitting the target metric) is not well supported—the training uses external attack losses and the mask ratio seems tuned on validation, which is a mild selection issue but not a circularity in the derivation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Underload is worth a serious look: it is the first defense targeted at latency attacks on the NMS module of edge object detectors, and the experiments are broad—three YOLO generations, four GPU classes, ONNX/TensorRT, and public code. The new pieces are background-masked adversarial training on the objectness loss plus a hardware-aware mask schedule; the system-level finding that the NMS bottleneck is compute-bound on Jetsons but memory-bound on desktop/cloud GPUs is a genuine measurement contribution. The flaws are localized but real. Eq. (4) does not follow from Eq. (3); solving the quadratic gives a different bound, and alpha/beta are unreported, so the hardware-adaptive stopping rule is not reproducible as written. Property 3's monotonicity is asserted without proof. The decisive question is whether Table 1's attacks were regenerated for each defended model or transferred from the undefended baseline. The paper never says. If they are transferred, the robust-accuracy gains could be gradient obfuscation; if fully adaptive, the main claim stands and the formula fix is minor. This must be clarified before acceptance. Mask-ratio and attack-budget tuning on the test sets is a mild selection issue but not fatal. The citation pattern is honest, and the robustness numbers are not fitted to the target metric. I would send this to peer review. The contribution is practical and the evaluation gap is answerable. A reviewer should ask for the adaptive-attack protocol, corrected capacity formula, and parameter reporting.","headline":"First specialized defense against latency attacks on NMS; the core result is plausible, but the adaptation protocol and a wrong formula need fixing.","tokens_in":689,"tokens_out":1068,"would_cite":true,"duration_ms":30570,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Background-attentive adversarial training keeps YOLO detectors real-time under latency attacks.","keywords":["latency attacks","object detection","adversarial training","non-maximum suppression","objectness loss","hardware-adaptive defense","edge devices","real-time object detection"],"falsifier":"Measure NMS execution time as a function of candidate-box count on a Jetson Orin NX, solve Eq. (3) for the box count that exactly meets a 33.3 ms total-budget deadline, and compare it with the value given by Eq. (4); the two formulas are not algebraically equivalent, as Eq. (4) omits the linear term and has the opposite sign inside the square root, so a direct latency measurement would reveal the discrepancy.","tokens_in":17549,"feed_emoji":"🛡️","tokens_out":7085,"duration_ms":61175,"temperature":0.7,"pith_summary":"Latency attacks on object detectors flood the hand-crafted non-maximum suppression (NMS) stage with phantom bounding boxes, pushing inference time past real-time deadlines and risking cascading failures in downstream systems. This paper introduces Underload, an adversarial training defense that targets the same loss the attacks exploit. The authors argue that the objectness loss correlates strongly with the latency-attack objective, making it the right surrogate for attack generation during training, and that background regions are the vulnerable areas where phantom objects first appear. The training method injects perturbations only into background regions through a shrinking mask, and stops once the detector's candidate-box count falls below a hardware-derived capacity bound. On Jetson Orin NX the method restores throughput from 13 to 43 FPS, and it improves robust accuracy by 8-10 points over prior MTD and OOD defenses with a milder clean-accuracy drop.","feed_headline":"Defense restores real-time object detection under latency attacks","feed_subtitle":"Background-attentive training lifts throughput from 13 to 43 FPS on Jetson Orin NX, targeting the NMS bottleneck.","key_machinery":"The load-bearing machinery is the pairing of the objectness loss as a training-time proxy and a shrinking background mask. Property 1 asserts that gradients of the objectness loss and of the latency-attack loss are highly correlated (cosine similarity 0.875-0.95), justifying the proxy. Property 2 asserts the background boundary margin is smaller than the object boundary margin, so background regions are where phantoms appear first. Property 3 asserts the candidate-box count increases monotonically with mask size, which licenses the iterative mask-shrinking loop in Algorithm 2. The stopping rule is the hardware-capacity bound of Eq. (4), connecting the candidate-box count |C| to the NMS time model of Eq. (3) via measured IoU processing speed SIoU, PCIe bandwidth B, and backbone time Tbackbone.","core_discovery":"The paper's central claim is that a hardware-adaptive, background-attentive adversarial training scheme can defend against latency attacks on YOLO-family detectors without removing or replacing the NMS module. The defense uses the objectness loss as a proxy for the adversarial objectives of Daedalus, Phantom Sponge, and Overload, and uses a binary mask to focus inner-loop perturbations on background regions, leveraging the empirical finding that phantoms are generated there with smaller perturbations. The algorithm shrinks the mask iteratively, re-training until the expected number of candidate boxes stays below a capacity threshold derived from the device's measured IoU processing speed, PCIe bandwidth, and backbone latency. The reported result is restoration of real-time processing from 13 FPS to 43 FPS on Jetson Orin NX, with consistently higher robust mAP50 than MTD and OOD across VOC, COCO, and BDD.","pith_inferences":["The background-attention principle suggests a wider design rule: defenses against attacks that exploit post-processing bottlenecks should concentrate adversarial training on the spatial regions the attack actually recruits, not uniformly across the image.","The hardware-adaptive stopping scheme could be transplanted to other latency-sensitive perception pipelines, using a measured latency-versus-load curve as the training stop rule.","A deployment-grade version of Underload could replace the analytic capacity formula with a directly measured box-count threshold per target device, which would be a testable engineering variant of the paper's idea."],"forward_implications":["YOLOv3, YOLOv5, and YOLOv8 detectors can maintain 30 FPS real-time operation under Daedalus, Phantom Sponge, and Overload attacks on Jetson Orin NX, with 13-23 ms inference times.","The defense transfers across PyTorch, ONNX, and TensorRT implementations, so edge and cloud deployments can be protected without altering the NMS dependency.","Underload achieves a more favorable clean-accuracy versus robust-accuracy trade-off than MTD and OOD, with roughly 4% clean mAP drop versus 15-17% for the baselines on YOLOv5s with VOC.","Anchor-free detectors such as YOLOv8, which encode objectness within classification, still benefit, indicating the objectness proxy generalizes across the YOLO family."],"supporting_citations":[{"why":"Overload: the latency-attack formulation and the quadratic NMS time model the defense is built against.","marker":"[3]"},{"why":"Phantom Sponge: the auxiliary-box and IoU losses that define the attack objective and the evaluation threat model.","marker":"[28]"},{"why":"Daedalus: the pioneering NMS-targeting attack and its adversarial losses, used as one of the evaluation attacks.","marker":"[35]"},{"why":"Madry et al.: the min-max adversarial training framework that Underload extends with background attention and hardware capacity.","marker":"[22]"},{"why":"Kim et al.: the robust/non-robust feature distinction that motivates focusing adversarial training on background regions.","marker":"[14]"},{"why":"MTD: the multi-task domain defense baseline that Underload compares against.","marker":"[43]"},{"why":"OOD: the objectness-oriented defense baseline, compared to measure clean and robust accuracy.","marker":"[13]"},{"why":"YOLOv5: the detector architecture on which the main experiments and loss decomposition (Lcls, LCIoU, Lobj) are based.","marker":"[33]"}],"fun_headline_variants":["Defense restores real-time FPS 13 to 43 on Jetson Orin NX","Background-attentive training thwarts latency attacks, triples FPS","New defense restores real-time detection on edge from 13 to 43 FPS","Hardware-adaptive training beats latency attacks on Jetson Orin NX"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The algorithm's stopping rule depends on Eq. (4) being a correct solution of the NMS time model in Eq. (3), with the scaling factors α and β properly quantified; if that capacity bound is wrong or uncalibrated, the mask-shrinking loop may stop at the wrong point.","fun_headline_variants_meta":{"raw":{"variants":["Defense restores real-time FPS 13 to 43 on Jetson Orin NX","Background-attentive training thwarts latency attacks, triples FPS","New defense restores real-time detection on edge from 13 to 43 FPS","Hardware-adaptive training beats latency attacks on Jetson Orin NX"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001363,"raw_usage":{"total_tokens":5533,"prompt_tokens":953,"completion_tokens":4580,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":569,"completion_tokens_details":{"reasoning_tokens":4491}},"tokens_in":569,"tokens_out":4580,"duration_ms":31151,"temperature":1.0,"reasoning_tokens":4491,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T23:45:53.059827+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure NMS execution time as a function of candidate-box count on a Jetson Orin NX, solve Eq. (3) for the box count that exactly meets a 33.3 ms total-budget deadline, and compare it with the value given by Eq. (4); the two formulas are not algebraically equivalent, as Eq. (4) omits the linear term and has the opposite sign inside the square root, so a direct latency measurement would reveal the discrepancy.","supporting_citations":[{"cited_title":"Overload: Latency attacks on object detection for edge devices","cited_arxiv_id":null,"evidence_quote":"Overload: the latency-attack formulation and the quadratic NMS time model the defense is built against."},{"cited_title":"Phantom sponges: Exploiting non- maximum suppression to attack deep object detectors","cited_arxiv_id":null,"evidence_quote":"Phantom Sponge: the auxiliary-box and IoU losses that define the attack objective and the evaluation threat model."},{"cited_title":"Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples","cited_arxiv_id":null,"evidence_quote":"Daedalus: the pioneering NMS-targeting attack and its adversarial losses, used as one of the evaluation attacks."},{"cited_title":"Distill- ing robust and non-robust features in adversarial examples by information bottleneck","cited_arxiv_id":null,"evidence_quote":"Kim et al.: the robust/non-robust feature distinction that motivates focusing adversarial training on background regions."},{"cited_title":"Towards adversarially ro- bust object detection","cited_arxiv_id":null,"evidence_quote":"MTD: the multi-task domain defense baseline that Underload compares against."},{"cited_title":"Adversarial attack and defense of yolo detectors in autonomous driving scenarios","cited_arxiv_id":null,"evidence_quote":"OOD: the objectness-oriented defense baseline, compared to measure clean and robust accuracy."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"YOLOv5: the detector architecture on which the main experiments and loss decomposition (Lcls, LCIoU, Lobj) are based."}],"review_version":1}