{"id":"dd7a4363-ec4d-4dae-bbe3-6f6ab8a2f5df","arxiv_id":"2412.06215","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"ADAV uses temporal consistency between video frames to detect and mask object-vanishing adversarial patches in real time.","lead":"This paper introduces ADAV, a two-stage defense that checks whether an object detector's outputs are consistent between video frames and, if not, masks the adversarial patch it localizes with gradient attribution. It reports higher adversarial robustness than baseline defenses on BDD100K driving videos while keeping clean frames nearly unchanged.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The defense assumes a clean reference frame 0.5 s before each target; if the patch is present from initialization or before the queue is filled, temporal consistency never breaks and the defense is blind to the attack.","rationale":"After reading the paper in good faith, I find the temporal-consistency idea is coherent and the two-stage pipeline is a sensible way to keep clean latency. The reader's weakest assumption (clean reference) is indeed the single most load-bearing point, and I agree with the conditional verdict; no move to reject is warranted because the authors explicitly state the assumption and their evaluation demonstrates a specific regime (patch insertion after 1-10 s). However, the title and abstract claim a general defense against object-vanishing patches. A persistent patch from initialization is a realistic attack and is untested. The concrete test above would either validate the defense in that regime or reveal that the central claim must be scoped to patches that appear after a clean warm-up, reinforcing the reader's conditional verdict rather than changing it.","tokens_in":6794,"tokens_out":4992,"duration_ms":51914,"concrete_test":"Construct 100 BDD100K videos with a 200x200 adversarial patch (same training/eval setup) applied from frame 0, both at a fixed position/scale and with the random-walk motion used in Sec. 4.4, so the patch is never absent from the reference frames. Run ADAV unmodified and measure attack detection rate and adversarial mAP@IoU=50. If detection precision/recall drops near chance and adversarial mAP approaches 0.22, the temporal-consistency defense does not generalize to persistent patches; if performance remains high, the assumption is not load-bearing.","verdict_should_be":"UNCHANGED","load_bearing_attack":"ADAV's detection stage (Sec. 3.2) compares the target frame's YOLO output against a reference frame 0.5 s earlier, and the queue is initialized from the first 0.5 s of video, which is 'assumed to be clean'. The entire attack-detection signal is a rise in output MSE. If an object-vanishing patch is present in the very first frames—e.g., printed on a sign or vehicle already in view, or activated during the 0.5 s warm-up—the reference and target outputs are both suppressed, so the MSE remains near the clean level and no patch is flagged. The evaluation (Sec. 4.4) inserts patches at a random time between 1 and 10 s, so it never exercises this persistent-attack regime. Because detection is the gate for localization and masking, ADAV's adversarial mAP would collapse toward the 'No Defense' 0.22 in exactly the scenario its threat model claims to cover. This is not merely a tuning issue; it is a structural limitation of the temporal-consistency signal.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ADAV, a two-stage defense against object-vanishing adversarial patch attacks on object detection in driving video. Stage 1 detects an attack by comparing YOLOv5s outputs for the current frame against a reference frame from 0.5 s earlier, using the MSE between output tensors and a threshold k. When the MSE exceeds k, Stage 2 computes guided-backpropagation gradients of that MSE with respect to the input, downsamples the saliency map into 20x20 regions with a stride of 5, thresholds suspicious regions using a dynamic threshold n = x-tilde + lambda*Q, masks those pixels, and reruns the detector. Clean outputs are stored in a queue so that the reference is always clean. Experiments are run on 100 BDD100K videos, converted into 100 synthetic adversarial videos by inserting a universal patch at a random time between 1 and 10 s; the paper reports attack detection rate, mAP@IoU=50 for clean and adversarial inputs, and FPS on a T4 GPU, comparing against LGS, JPEG compression, and Universal Defense Frames.","tokens_in":7045,"tokens_out":4809,"duration_ms":53663,"significance":"The conceptual mechanism is well motivated for AV perception: temporal consistency is a natural signal for patch-induced vanishing attacks, and the two-stage design sensibly keeps latency low on clean frames while concentrating computation on suspected attacked frames. The paper also targets a practically relevant setup with a real driving dataset and a trainable detector. However, the current evidence does not establish the claimed performance. The headline numbers in Table 2 are obtained with k and lambda selected by grid search on the same evaluation videos used to report those numbers, there is no uncertainty quantification, the defense is tested against a single non-adaptive patch, and the reference-frame assumption is not stress-tested. The core idea is worth further development, but the evaluation as it stands is not publication-ready.","major_comments":[{"comment":"The reported mAP values are in-sample fits rather than independent predictions. The grid search in Section 3.5 selects k and lambda by maximizing mAP on the same 100 adversarial and 100 clean videos whose results are then presented in Table 2. This makes the headline 0.36 adversarial / 0.44 clean mAP optimistically biased, and it also disadvantages baselines whose parameters were not tuned on the same set. The paper needs a separate validation split or nested cross-validation for parameter selection, final numbers reported on a held-out test set, and the same tuning protocol applied to LGS, JPEG compression, and Universal Defense Frames.","section":"Section 3.5 / Table 2"},{"comment":"The temporal-consistency signal is structurally blind to attacks present before or during reference initialization. The queue is initialized from the first 0.5 s of video, which Section 3.2 explicitly 'assumed to be clean,' and detection is triggered only by an output-MSE increase relative to that reference. If an object-vanishing patch is present from the first frame, or becomes active during the warm-up period, both reference and target outputs are suppressed and the MSE can remain near the clean level, so Stage 1 will not flag the frame. The evaluation inserts patches at a random time between 1 and 10 s, so this persistent-attack regime is never exercised. Please evaluate attacks that start before or during the warm-up, and if the defense cannot handle them, state that threat-model restriction explicitly rather than claiming coverage of object-vanishing patch attacks generally.","section":"Section 3.2 / Section 4.4"},{"comment":"The defense is evaluated against a single universal patch trained by the method of [7], with no attacker awareness of ADAV. An adaptive attacker could optimize a patch that keeps the detector output close to the reference-frame output, for example by attacking each frame after initialization or by designing the patch so that the output MSE does not spike when the patch enters the field of view. Such an attack would bypass Stage 1 entirely. A defense paper in this area should include at least one adaptive white-box attack that is aware of the temporal-consistency check, and should specify the assumed attacker knowledge model. Without that, the claim that ADAV 'defends against object vanishing patch attacks' is under-supported.","section":"Section 4.4 / Section 4.7"},{"comment":"No uncertainty quantification is provided. The differences in Table 2, such as adversarial mAP 0.36 for ADAV versus 0.30 for LGS, are point estimates from a single 200-video evaluation set with one patch training run and one grid-search run; there are no confidence intervals, multiple patch seeds, or significance tests. Given the randomness in patch placement, patch scale, and patch training, the claim in Section 4.8 that ADAV 'significantly outperforms' LGS is not statistically supported. Please report bootstrap intervals, multiple independent evaluation runs, or a significance test.","section":"Section 4.7 / Section 4.8"},{"comment":"The detection-rate table and the defense-performance table are not measuring the same regime. Table 1 reports accuracy, precision, and recall only for patches of scale larger than 0.8, where Table 1 shows recall 0.95; for smaller patches recall is 0.52. Table 2, however, reports adversarial mAP averaged over all scales. This can hide the fact that small patches are often missed, and it can also make the defense look better than it is if smaller patches are also weaker attacks. Please stratify adversarial mAP by patch scale and explicitly report what range of scales contributes to the aggregate mAP.","section":"Section 4.6 / Section 4.7"}],"minor_comments":[{"comment":"There are many formatting artifacts, including 'ADA V', 'A Vs', and 'T able' in place of 'ADAV', 'AVs', and 'Table'; these should be corrected before resubmission.","section":"Throughout"},{"comment":"The tuning objective in Section 3.5 is not a well-defined scalarization: a and b are the maxima of adversarial and clean mAP over the grid, but these maxima may be achieved at different parameter settings, and the absolute-difference terms are not normalized, so clean or adversarial performance can dominate the objective depending on the range of each metric. A normalized Pareto scalarization or a reported trade-off curve would be clearer.","section":"Section 3.5"},{"comment":"The choices of the 20x20 box-filter size, the stride of 5, and the masking color are stated but not justified empirically; a sensitivity analysis of these components would help establish that the localization stage is not brittle.","section":"Section 3.3"},{"comment":"The paper reports only the final mAP of the trained YOLOv5s detector; please provide the training and validation curves, image size, batch size, NMS configuration, and the exact confidence threshold used, since these affect all subsequent measurements.","section":"Section 4.2"},{"comment":"Precision and recall are reported without the underlying confusion-matrix counts; giving the number of true positives, false positives, and false negatives would make the detection-rate results more interpretable.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"The core temporal-consistency idea is interesting and the two-stage latency design is sensible, but the current evaluation is not yet convincing: parameter selection on the test set, absent uncertainty quantification, and the untested persistent-attack and adaptive-attack regimes are load-bearing gaps. I would be willing to review a revised version that reruns the evaluation with a proper validation split, adds the missing threat-model experiments, and reports statistical variability. The manuscript also needs a careful editorial pass to fix the pervasive formatting artifacts."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is good and worth taking seriously: use temporal consistency between video frames to detect object-vanishing patches, then localize with gradient-based attribution and mask. That combination is new in the object-detection defense literature, and the two-stage design (skip the expensive masking on clean frames) is a real practical advantage. Running at 56 FPS clean and 20 FPS attacked on a T4 is a legitimate result, and the evaluation on BDD100K with a moving patch model is much closer to the driving context than the usual image-level benchmarks. The author also picked sensible baselines.\n\nThe problems are real but localized. Section 3.5 tunes k and lambda by grid search on the same 100 videos used to produce Table 2. That makes the reported 0.36 adversarial mAP a fitted number, not an unbiased performance estimate. No error bars, no multiple seeds, no train/validation split within the evaluation set. So the numerical advantage over LGS should be read as \"best case after tuning,\" not as a head-to-head comparison.\n\nThe more structural issue is the clean-reference assumption. ADAV initializes its 0.5-second queue from the first frames of the video, described in Section 3.2 as \"assumed to be clean.\" If a patch is already present when the queue fills, or appears during that warm-up, the detector's outputs are suppressed on both the reference and target frames, the MSE stays near the clean level, and the first stage never fires. The evaluation inserts patches at 1-10 seconds, so it never exercises this regime. That is not a tweakable parameter; it is a blind spot in the threat model. The author acknowledges the assumption in the text but does not quantify how much performance collapses when the patch is persistent from frame zero.\n\nA related soft spot is the absence of adaptive attacks. A patch optimizer that knows the temporal-consistency signal could aim for low output MSE between frames, and the paper does not test that. Also, no code or seeds are provided, which limits reproducibility.\n\nOn balance, the paper is a solid first step, clearly written, and the central mechanism is plausible. The evaluation just needs to be rebuilt around a proper parameter selection protocol and an explicit persistent-patch scenario. I would send this to peer review rather than desk-reject, but with the expectation of major revision, not minor cleanup.","headline":"A sensible and novel temporal-consistency defense for object-vanishing patches, but the headline numbers are fitted and the method goes blind if the patch is present before or during the reference-frame warm-up.","tokens_in":7516,"tokens_out":1539,"would_cite":false,"duration_ms":17062,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A temporal-consistency defense detects and masks object-vanishing patches in real-time driving video.","keywords":["adversarial patch","object detection","autonomous vehicles","temporal consistency","defense","gradient attribution","BDD100K","real-time defense"],"falsifier":"Apply an object-vanishing patch to every frame of a BDD100K video from the first frame onward and run ADAV: expected result if the claim is correct is that detection recall collapses and adversarial mAP returns to the undefended 0.22 level, because no clean reference exists. Alternatively, remove the 0.5-second clean warm-up and verify that the defense does not flag the attack.","tokens_in":6611,"feed_emoji":"🚗","tokens_out":7078,"duration_ms":60699,"temperature":0.7,"pith_summary":"This paper proposes ADAV, a defense for object detection in autonomous vehicles aimed specifically at object-vanishing adversarial patches. The paper's central claim is that comparing a detector's output on the current frame with its output on a clean frame from 0.5 seconds earlier reliably reveals when a patch has suppressed detections, and that a second stage can then localize and mask the patch to restore them. ADAV is designed to run in real time: clean frames pass straight through at 56 FPS, while attacked frames are processed at 20 FPS after mask-and-rerun. The paper evaluates on BDD100K driving videos and reports that ADAV outperforms the next-best baseline on adversarial mAP (0.36 vs 0.30) while also keeping clean mAP higher (0.44 vs 0.38) because clean inputs are not altered.","feed_headline":"Two-stage defense catches vanishing-object patch attacks at 56 FPS","feed_subtitle":"ADAV compares each frame to a clean frame from 0.5s earlier to flag and mask adversarial patches on driving video.","key_machinery":"Temporal consistency is the load-bearing mechanism: the paper defines it as the expectation that the same objects appear in similar locations in frames 0.5 seconds apart, so a large MSE between the detector's output tensors indicates an anomaly. The second mechanism is gradient-based attribution: ADAV computes the gradient of that MSE with respect to the input image using guided backpropagation, yielding a saliency map that should highlight patch pixels. A 20x20 box filter with stride 5 converts the saliency map into region-level suspicion scores, and a dynamic threshold n = median + λ·IQR selects outlier regions to mask. The two-stage design means the expensive attribution and masking run only when the first stage flags an attack, which is why clean frames process at nearly full detector speed.","core_discovery":"The paper's central claim is that a two-stage defense built on temporal consistency can protect an object detector from object-vanishing adversarial patches in an autonomous vehicle. The first stage compares the detector's output on the current frame with its output on a reference frame from 0.5 seconds earlier, computing the mean-squared error; an MSE above a tuned threshold k indicates that a patch has entered the view and suppressed detections. The second stage computes the gradient of that MSE with respect to the input image using guided backpropagation, aggregates gradients with strided 20x20 box filters, and masks pixels whose suspicion score exceeds a dynamic threshold n = median + λ·IQR, then re-runs the detector on the cleaned frame. On BDD100K video, this raises adversarial mAP from 0.22 (undefended) to 0.36 while keeping clean mAP at 0.44, and runs at 56 FPS on clean frames and 20 FPS on attacked frames.","pith_inferences":["The clean-reference assumption implies an adaptive attacker could evade detection by making the patch appear gradually, so the detector output changes slowly and never exceeds the MSE threshold; the paper does not consider this attack.","The 0.5-second reference lag means the defense will flag legitimate scene changes (sharp braking, cut-ins, lighting changes) as anomalies; the dynamic threshold limits false positives, but the trade-off is not characterized on such traffic events.","Because the cleaned output queue is populated with outputs of frames the defense itself cleaned, any missed patch early in a video could poison the reference for later frames; a single false negative could cascade.","The masking step replaces suspected regions with a neutral color, so objects partially covered by a patch are lost; inpainting (which the paper names as future work) would be needed to recover the underlying scene."],"forward_implications":["A detector paired with ADAV can maintain a clean-frame throughput of 56 FPS, so the defense can run continuously rather than on-demand.","On attacked frames, the defense runs at 20 FPS, still within a plausible real-time budget for a perception pipeline.","Because clean frames skip the localization stage, the defense's clean mAP (0.44) is nearly identical to the undefended detector (0.46), unlike preprocessing defenses that degrade clean inputs.","Large patches (scale >0.8) are detected with 0.95 recall, meaning nearly all full-scale patch attacks are flagged for masking.","The approach applies to any differentiable object detector, not just YOLOv5s, since the consistency and attribution steps only require gradients of the detector output."],"supporting_citations":[{"why":"YOLOv5s is the base object detector, providing the differentiable one-stage architecture and the raw output tensor used for consistency and gradient computation.","marker":"[3]"},{"why":"Supplies the patch-training objective (maximize YOLO confidence loss) used to generate the object-vanishing patches that ADAV defends against.","marker":"[7]"},{"why":"Guided backpropagation, the attribution method ADAV uses to localize patch pixels from the MSE gradient.","marker":"[9]"},{"why":"BDD100K driving dataset used for training the detector, generating patches, and evaluating defense performance.","marker":"[13]"},{"why":"Local Gradient Smoothing is the strongest preprocessing baseline that ADAV is compared against and outperforms.","marker":"[6]"},{"why":"Universal Defense Frames is a preprocessing baseline included in the mAP and latency comparison.","marker":"[14]"},{"why":"JPEG-compression defense is another preprocessing baseline in the latency and mAP comparison.","marker":"[2]"},{"why":"Vanilla gradient saliency maps provide the underlying attribution method that the paper extends to the MSE between frames.","marker":"[8]"}],"fun_headline_variants":["Vanishing-object patch defense runs at 56 FPS","ADAV: real-time guard against vanishing-object attacks","Frame-to-frame consistency halts adversarial patches","Self-driving vision: two-stage patch defense","Temporal checks neutralize vanishing patches"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes that a clean, unpatched reference frame exists 0.5 seconds before the target frame; if the patch is present from the start, or the vehicle turns sharply or lighting changes abruptly, the temporal-consistency signal is no longer a reliable indicator of an attack.","fun_headline_variants_meta":{"raw":{"variants":["Vanishing-object patch defense runs at 56 FPS","ADAV: real-time guard against vanishing-object attacks","Frame-to-frame consistency halts adversarial patches","Self-driving vision: two-stage patch defense","Temporal checks neutralize vanishing patches"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000361,"raw_usage":{"total_tokens":1975,"prompt_tokens":993,"completion_tokens":982,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":609,"completion_tokens_details":{"reasoning_tokens":913}},"tokens_in":609,"tokens_out":982,"duration_ms":10433,"temperature":1.0,"reasoning_tokens":913,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T19:53:02.469946+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Apply an object-vanishing patch to every frame of a BDD100K video from the first frame onward and run ADAV: expected result if the claim is correct is that detection recall collapses and adversarial mAP returns to the undefended 0.22 level, because no clean reference exists. Alternatively, remove the 0.5-second clean warm-up and verify that the defense does not flag the attack.","supporting_citations":[{"cited_title":"In: 3rd International Conference on Electrical, Computer, Communica- tions and Mechatronics Engineering (ICECCME 2022) (2022)","cited_arxiv_id":null,"evidence_quote":"Supplies the patch-training objective (maximize YOLO confidence loss) used to generate the object-vanishing patches that ADAV defends against."},{"cited_title":"In: 3rd International Conference on Learning Representations (ICLR 2015) (2015)","cited_arxiv_id":null,"evidence_quote":"Guided backpropagation, the attribution method ADAV uses to localize patch pixels from the MSE gradient."},{"cited_title":"In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR) 2020 (2020)","cited_arxiv_id":null,"evidence_quote":"BDD100K driving dataset used for training the detector, generating patches, and evaluating defense performance."},{"cited_title":"In: 2019 IEEE Winter Conference on Applications of Computer Vision (W ACV) (2019)","cited_arxiv_id":null,"evidence_quote":"Local Gradient Smoothing is the strongest preprocessing baseline that ADAV is compared against and outperforms."},{"cited_title":"In: ACM Trans- actions on Multimedia Computing, Communications, and Applications (2023) 12 Jaden Mu jaden.mu@gmail.com","cited_arxiv_id":null,"evidence_quote":"JPEG-compression defense is another preprocessing baseline in the latency and mAP comparison."},{"cited_title":"In: Workshop at Inter- national Conference on Learning Representations (2014)","cited_arxiv_id":null,"evidence_quote":"Vanilla gradient saliency maps provide the underlying attribution method that the paper extends to the MSE between frames."}],"review_version":1}