{"id":"bd214d8c-a23b-46eb-9ca0-f7b655504fb5","arxiv_id":"2412.07996","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A tiling and scaling placement plus a borderline false-positive loss reduces true-positive face detections for remote adversarial patches, but standard metrics show it underperforms prior work.","lead":"This paper proposes a remote adversarial patch attack on face detectors that tiles and scales a patch and uses a new 'borderline false positive' loss to hide faces. The reported true-positive reductions are not accompanied by better F-scores or average precision than earlier methods, so the main claim of superior obstruction is not supported.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (9) has the wrong sign for its stated purpose: minimizing L=-Σ b log(1-p) drives detection confidence to zero, not toward borderline false positives.","rationale":"The paper's central claim is that tiling and scaling plus Borderline False Positive Loss achieves superior obstruction of face detectors, specifically by reducing true-positive detections more than prior RAP methods. I read the method and results in good faith: the comparison in Table I does show fewer TPs than Lee et al. on both datasets, and the positional-robustness experiment is at least a plausible demonstration of tiling. However, the central mechanism attributed to the loss is internally inconsistent. The objective in Eq. (9), when minimized, decreases the confidence of borderline detections. The prose in §III-A2 says the opposite. This is not a matter of interpretation: the derivative is positive, so the unique effect of minimizing the term is to push p~_ij to 0. The experimental outcome matches the equation-as-written: proposed FP counts are 7 and 56, essentially no false positives created. The paper's own Discussion section states that the loss was often zero and that a new objective reducing IoU from 1 to 0.6 is needed, which is an explicit admission that the proposed loss did not function as intended. Despite this, the conclusion asserts that the loss successfully disturbed the true-face coordinates. That assertion is the load-bearing step of the paper, and it is unsupported.\n\nI considered whether the more serious concern is the ground-truth definition in §IV-A1 (GT = the target detector's clean detections). That is a genuine limitation for external validity, but it is disclosed, applies equally to all compared methods, and does not by itself invalidate the relative TP comparison. The loss-sign inconsistency is more fundamental because it attacks the identity of the proposed method: either the equation is wrong and the paper cannot be reproduced, or the implementation matches the equation and the method is a different attack than the one claimed. In both cases the novelty attributed to Borderline False Positive Loss is not established. For this reason I agree with the reader's REJECT verdict, though my primary concern differs from the reader's stated weakest assumption. The correct next step is an independent reimplementation of the optimization with both sign variants and an ablation that isolates tiling/scaling from the loss, which would settle whether any TP reduction survives a corrected loss.","tokens_in":9219,"tokens_out":9595,"duration_ms":102208,"concrete_test":"Retrain the proposed patch on CASIA Gait B with the sign-corrected loss that actually increases confidence of borderline detections, e.g. L = -Σ b_ij log(p~_ij), keeping tiling, scaling, α=5.58, and thresholds θ_T=0.6, θ_F=0.3, θ_D=0.5 identical. Recompute Table I. If the corrected loss fails to produce fewer TPs than Lee et al. (2967) on CGB, or produces FP counts far above the reported 7, the reported TP reduction depends on the sign error and the Borderline False Positive Loss mechanism as described is not validated. Also run a control with Eq. (9) as written to confirm it reproduces Table I as a confidence-suppression attack.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section III-A2 describes Borderline False Positive Loss as increasing the confidence of detections whose IoU with ground truth lies between θ_F=0.3 and θ_T=0.6, in order to create false positives near the true face and disturb the true detection coordinates. But Eq. (9) defines L_bfp = -Σ b_ij log(1 - p~_ij). Since ∂/∂p[-log(1-p)] = 1/(1-p) > 0, minimizing this loss drives p~_ij toward 0, suppressing detections rather than raising their confidence. Table I shows the proposed method produces almost no FPs (7 on CGB, 56 on FFP), which is exactly the behavior of the equation as written, not of the stated mechanism. Section V explicitly admits the loss was often 0 and optimization did not progress, and says a different objective is needed to reduce IoU from 1 to 0.6; nevertheless §IV-B and §VI credit the loss with successfully disturbing true-face coordinates. Thus the central claim that Borderline False Positive Loss reduces TP is not supported by the paper's own description or data. If the code follows Eq. (9), the actual method is confidence suppression and the 'borderline false positive' contribution is absent; if the code follows the text, Eq. (9) is erroneous and the reported results are not reproducible from the paper. Either way the load-bearing loss mechanism is unverified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a remote adversarial patch (RAP) attack against face detectors, addressing two challenges: variation in face scale and the two-class nature of face detection. The proposed patch application method tiles a scaled patch across the image so that any crop contains patch pixels, and the proposed Borderline False Positive Loss is intended to raise the confidence of detections whose IoU with a true face is in a borderline interval, thereby creating false positives near the face and disturbing true-positive coordinates. Experiments compare the method with DPatch and Lee et al. on CASIA Gait B and FaceForensics++, using S3FD, MTCNN, and RetinaFace, and the paper reports TP/FP counts, F values, and AP. The paper concludes that the proposed method obstructs face detection more effectively than existing remote adversarial patch methods and exhibits robustness to face scale and position.","tokens_in":9509,"tokens_out":7853,"duration_ms":77061,"significance":"The paper addresses an underexplored and practically motivated problem, and the tiling/scaling patch placement is a plausible way to make a remote patch robust to face scale and position. The manuscript evaluates on two datasets and three face detectors, and it is candid about some limitations, such as the loss often being zero during optimization. However, the central loss mechanism appears to be implemented with the wrong sign, the evaluation uses the attacked detector's own pre-attack outputs as ground truth, and the standard metrics in Table I are substantially worse than the comparison method. These issues mean that the paper's main claims, as written, are not supported.","major_comments":[{"comment":"The Borderline False Positive Loss is defined as L_bfp = -Σ b_ij log(1 - p̃_ij). The prose states that this loss 'increases the confidence value of the inference results' and thereby creates false positives near the true face. However, for a fixed b_ij, the derivative of -log(1-p) with respect to p is 1/(1-p) > 0, so gradient descent on this loss drives p toward 0, not toward higher confidence. This is exactly the opposite of the stated mechanism. Table I is consistent with confidence suppression rather than false-positive creation: the proposed method produces only 7 FPs on CGB and 56 on FFP, far fewer than Lee et al. (38,235 and 26,866). Section V also states that the loss was often 0 and that a different objective is needed to reduce IoU from 1 to 0.6, which undermines the claim in Section IV-B that the Borderline False Positive Loss successfully disturbed true-face coordinates. If the implementation follows Eq. (9), the actual objective is confidence suppression; if it follows the text, Eq. (9) is not the implemented loss and the experiments are not reproducible from the paper.","section":"Section III-A2, Eq. (9)"},{"comment":"The evaluation defines ground truth as the attacked detector's own clean-image detections: the paper states 'GT is the inference result d_i of the image I_i before patch application. Therefore, in the experiment, d_i = g_i.' Consequently, TP/FP/FN are computed with respect to S3FD's pre-attack outputs, not independent face labels. Since the attack only needs to suppress S3FD's own detections, the reported 'obstruction' results do not establish that real faces are hidden; they establish only that S3FD's outputs change. This circularity is load-bearing because the paper's main quantitative argument (fewer TP than other methods) is made entirely in these self-referential terms. A valid evaluation should use an independent face-annotation ground truth, such as a standard benchmark with human-verified bounding boxes, and report detection performance separately for true faces.","section":"Section IV-A1"},{"comment":"Table I shows that the proposed method has substantially higher F and AP (less degradation) than Lee et al. on both datasets: on CGB, F=0.791 vs 0.134 and AP=0.999 vs 0.041; on FFP, F=0.978 vs 0.196 and AP=0.999 vs 0.093. The paper explains that F and AP are insensitive to the quantities of interest, but these are the standard detection metrics, and the comparison as reported indicates that Lee et al. degrades overall detection quality much more aggressively. The proposed method's competitive advantage rests entirely on the TP count under the self-referential ground truth. Without an independent evaluation, the claim of superior obstruction is not established.","section":"Section IV-B, Table I"},{"comment":"The hyperparameters α = 5.58, θ_T = 0.6, and θ_F = 0.3 are reported as 'determined from empirical results' without a validation protocol. If these values were selected based on the same test sets used in Tables I and II, the performance comparisons are not independent. The authors should report a proper training/validation split or an ablation over these parameters, especially because the scaling parameter α directly affects the central claim of scale robustness.","section":"Section IV-A3"}],"minor_comments":[{"comment":"The notation for the loss is inconsistent: Eq. (9) and the surrounding text use 'L_bf pc' with an extra 'c', while elsewhere it is 'Borderline False Positive Loss' or 'L_bfp'. Please unify the notation.","section":"Section III-A2"},{"comment":"The construction of the coordinate-uniform dataset excludes images for which S3FD produced no inference result before patch application. This selection bias should be discussed, since it removes the hardest cases from the positional-robustness evaluation.","section":"Section IV-C"},{"comment":"The manuscript contains numerous typographical and formatting errors, including 'Furtermore' in Section III and missing spaces in the abstract. A careful proofread is needed.","section":"General"}],"recommendation":"reject","confidential_remarks":"The two load-bearing problems—Eq. (9) implementing the opposite of the stated objective and the self-referential ground truth—mean that the paper's central claim is not supported by the evidence presented. Correcting the loss and re-evaluating with independent ground truth would constitute a substantially new study rather than a routine revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper's central loss function appears to have the wrong sign, and the evaluation defines ground truth as the attacked detector's own clean-image outputs. That combination makes the headline claim hard to trust.\n\nWhat's actually new: tiling a remote patch so any crop of the image contains patch pixels is a sensible idea for face detectors, where small faces are common. Scaling the patch to match the face area is a natural extension of DPatch and Lee et al., but I don't think anyone had done exactly this combination for face detection. The positional-robustness experiment (shifting faces and plotting FN heatmaps) is a decent way to show tiling distributes the obstruction effect across the image, and I'd credit that.\n\nThe soft spots are load-bearing. Equation (9) defines L = -Σ b log(1-p). Minimizing that drives p toward 0, which suppresses detection confidence. The prose says the loss is meant to increase confidence of borderline detections to create false positives. That's the opposite. The authors' own Section V notes the loss often stayed 0 and optimization stalled, which is exactly what you'd expect from an objective that penalizes high confidence. The data agree: Table I shows the proposed method produces almost no false positives (7 on CGB, 56 on FFP) compared to Lee et al. (38k and 27k). So the \"borderline false positive\" mechanism is either not implemented as written or not working as claimed.\n\nThe evaluation's ground truth is also self-referential. Section IV-A1 sets the GT to the detector's pre-patch detections, so \"TP reduction\" measures suppression of S3FD's own outputs, not whether real faces are hidden. If S3FD is accurate on these images, that's defensible, but the paper doesn't validate it, and the hyperparameters (alpha, theta_T, theta_F) were tuned on the same evaluation setup. That makes the reported numbers look overfit. There is no code and the results appear to come from single runs, so reproducibility is weak.\n\nThe tiling idea and the heatmap are worth a look for someone working on adversarial patches for privacy. But the main contribution—the loss function—is mis-specified or at least unverified, and the evaluation doesn't support the stronger claims. I would not send this to peer review in its current form. The authors should fix the loss, describe what they actually optimized, validate against human-annotated ground truth, and release code. As written, it's a reject.","headline":"The border-line false positive loss is mis-specified (Eq. 9 drives confidence down, not up), and the evaluation's ground-truth self-reference makes the headline TP-reduction claim unreliable; only the tiling idea stands up.","tokens_in":758,"tokens_out":1408,"would_cite":false,"duration_ms":57800,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A remote adversarial patch built from tiled, scaled copies and a borderline false positive loss can suppress true-positive face detections more effectively than existing remote patch attacks.","keywords":["remote adversarial patch","face detection","adversarial patch attack","patch tiling","patch scaling","false positive loss","privacy protection"],"falsifier":"Label a held-out set of face images with human-verified bounding boxes and rerun the CGB and FFP experiments using those boxes as ground truth; if the tiled patch no longer reduces true positives below the baseline methods, the claimed obstruction is an artifact of self-grounding.","tokens_in":8976,"feed_emoji":"🕶️","tokens_out":5928,"duration_ms":54777,"temperature":0.7,"pith_summary":"This paper aims to establish that a remote adversarial patch can obstruct face detection even though faces appear at many scales and face detection has only two classes to choose between. The proposed attack tiles a repeatedly scaled patch across the whole image, so any cropped region contains part of the patch, and it trains the patch with a Borderline False Positive Loss that rewards detections hovering just outside the true-face boundary. In experiments with the S3FD face detector, the method produced fewer true-positive detections than two existing remote patch attacks on both CASIA Gait B and FaceForensics++. If the claim holds, the method is a usable privacy tool: it can keep faces from being detected at capture or publication time without modifying the face itself.","feed_headline":"Tiled adversarial patch hides faces from detectors at any position","feed_subtitle":"Scaling and tiling make a remote patch suppress true face detections on small and large faces alike.","key_machinery":"The argument is carried by three mechanisms. Tiling ($T$) repeats a scaled patch $P^S$ periodically across the image as $P^T[x,y]=P^S[x \\bmod w_{P^S},\\ y \\bmod h_{P^S}]$, so every feature-extraction window sees patch pixels regardless of face position. Scaling ($S$) resizes the patch so its area is $\\alpha$ times the area of the largest ground-truth face, matching attack strength to face scale. The Borderline False Positive Loss $L_{bfp}=-\\sum_j b_{ij}\\log(1-\\tilde{p}_{ij})$ selects detections whose maximum IoU with a true face lies between thresholds $\\theta_T=0.6$ and $\\theta_F=0.3$ and raises their confidence, turning true-positive detections into false positives near the face boundary. This combination is what lets a two-class detector be attacked without redirecting the face class to a background class.","core_discovery":"The paper's central claim is that the combination of tiling, scaling, and the Borderline False Positive Loss gives a remote adversarial patch a stronger face-detection obstruction effect than prior remote patch methods. On the CGB test set, true positives dropped to 1,967 with the proposed patch, versus 2,977 for DPatch and 2,967 for the Lee et al. patch; on FFP, they dropped to 3,227 versus 3,305 and 3,287. The authors further claim that the tiling process removes the position constraint: false negatives spread across the whole image instead of concentrating near the patch's fixed origin, and patches trained on the large-face FFP dataset still suppress true positives on the small-face CGB dataset. In the authors' words, the loss \"can successfully disturb the coordinate of the true face.\"","pith_inferences":["Because ground truth is the detector's own pre-patch output, the natural next test is to score the same patches against human-labeled face boxes; that would tell whether the TP drop reflects hiding real faces or merely suppressing the detector's self-consistent boxes.","The tiling grid is a global periodic pattern, so a practical deployment would need to consider how conspicuous or filterable such a patch is; the paper does not address patch stealth.","The borderline false positive idea likely transfers to other binary detectors, such as person-presence or deepfake classifiers, where class redirection is also impossible and boundary-confusing detections are the only lever.","A direct extension would be to combine the borderline loss with a term that encourages false positives more aggressively, since the paper notes that the loss often stayed at zero early in optimization."],"forward_implications":["A single tiled patch can suppress true-positive face detections across positions, so the attacker does not need to know where the face will appear in the frame.","Scaling relative to the largest face makes the attack effective across face-size distributions; patches learned on large-face FFP still keep CGB true positives below 2,000.","Because the patch is remote, it can be applied as a background overlay before image publication or capture, leaving the face region itself untouched.","The method transfers across detectors in the tested settings: MTCNN, S3FD, and RetinaFace all show the same dataset-swap tendency.","The low false-positive count relative to the Lee et al. method indicates that the loss function can be refined to generate more false positives while preserving true-positive suppression."],"supporting_citations":[{"why":"Defines the remote adversarial patch and the property of remote attackability that this paper adopts.","marker":"[2]"},{"why":"Supplies DPatch, the position-independent patch baseline that the proposed method is compared against.","marker":"[3]"},{"why":"Supplies Lee and Kolter's loss-maximizing patch method, the other baseline for obstruction comparison.","marker":"[4]"},{"why":"Provides the CASIA Gait B dataset used for small-face training and testing.","marker":"[9]"},{"why":"Provides the FaceForensics++ dataset used for large-face training and testing.","marker":"[10]"},{"why":"Supplies the NI-FGSM optimizer used to learn the patch.","marker":"[12]"},{"why":"MTCNN, one of the three face detectors used in the transferability experiment.","marker":"[13]"},{"why":"S3FD, the target face detector used for the main evaluation and also used to generate ground-truth detections.","marker":"[14]"},{"why":"RetinaFace, the third detector used in the transferability experiment.","marker":"[15]"}],"fun_headline_variants":["Tiled patches hide faces from detectors at any scale or position","Scaling and tiling strengthen remote patches against face detectors","New patch design blocks face detection from afar","Tiling and scaling make remote patches block face detectors","Face detectors evaded by tiled, scaled adversarial patches"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evaluation treats the attacked detector's own clean-image detections as ground truth, so the reported true-positive counts measure whether the patch suppresses the detector's own outputs; if those clean-image outputs are inaccurate face labels, the obstruction numbers do not directly tell whether real faces were hidden.","fun_headline_variants_meta":{"raw":{"variants":["Tiled patches hide faces from detectors at any scale or position","Scaling and tiling strengthen remote patches against face detectors","New patch design blocks face detection from afar","Tiling and scaling make remote patches block face detectors","Face detectors evaded by tiled, scaled adversarial patches"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00074,"raw_usage":{"total_tokens":3264,"prompt_tokens":866,"completion_tokens":2398,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":482,"completion_tokens_details":{"reasoning_tokens":2320}},"tokens_in":482,"tokens_out":2398,"duration_ms":17527,"temperature":1.0,"reasoning_tokens":2320,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:19:54.005313+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Label a held-out set of face images with human-verified bounding boxes and rerun the CGB and FFP experiments using those boxes as ground truth; if the tiled patch no longer reduces true positives below the baseline methods, the claimed obstruction is an artifact of self-grounding.","supporting_citations":[{"cited_title":"Ipatch: A remote adversarial patch,","cited_arxiv_id":null,"evidence_quote":"Defines the remote adversarial patch and the property of remote attackability that this paper adopts."},{"cited_title":"Robust view trans- formation model for gait recognition,","cited_arxiv_id":null,"evidence_quote":"Provides the CASIA Gait B dataset used for small-face training and testing."},{"cited_title":"FaceForensics++: Learning to detect manipulated facial images,","cited_arxiv_id":null,"evidence_quote":"Provides the FaceForensics++ dataset used for large-face training and testing."},{"cited_title":"Nesterov accelerated gradient and scale invariance for adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the NI-FGSM optimizer used to learn the patch."},{"cited_title":"Joint face detection and align- ment using multitask cascaded convolutional networks,","cited_arxiv_id":null,"evidence_quote":"MTCNN, one of the three face detectors used in the transferability experiment."},{"cited_title":"S3FD: Single shot scale-invariant face detector,","cited_arxiv_id":null,"evidence_quote":"S3FD, the target face detector used for the main evaluation and also used to generate ground-truth detections."},{"cited_title":"Retinaface: Single-shot multi-level face localisation in the wild,","cited_arxiv_id":null,"evidence_quote":"RetinaFace, the third detector used in the transferability experiment."}],"review_version":1}