{"id":"76cc5597-b4cb-485e-a40c-e5e73a3f9684","arxiv_id":"2501.15653","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Pedestrians can lower a detector's confidence by walking through spatial 'blind spots' found from confidence heatmaps, and a location-based threshold can partially counter this.","lead":"This paper shows that street cameras detect people with different confidence depending on where they stand, and uses that to plan walking paths that reduce detection confidence, then proposes a countermeasure that raises confidence in weak spots. It offers a low-cost privacy trick that needs no adversarial clothing or patches.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"L-PET's reported reductions may be in-sample artifacts: heatmaps are built and evaluated on the same 4-hour footage, so held-out temporal evaluation is the decisive missing test.","rationale":"The reader's weakest assumption is exactly the in-sample issue. I agree with that identification. The paper's core observation that location and angle affect detector confidence is well supported by the controlled experiments in Section 3 and the qualitative heatmaps in Figures 3–5. However, the quantitative claims about L-PET and L-BAT depend on the predictive validity of the heatmap for future traversals, which is not tested. The in-sample design makes the reported reductions a lower bound on the true effect (likely near zero if the heatmap is not temporally stable). The fix is straightforward: a temporal split or a physical walk-through test. Because the authors can address this with a re-analysis of existing data, the CONDITIONAL verdict is appropriate. No change to the reader's verdict is needed.","tokens_in":32698,"tokens_out":4212,"duration_ms":38599,"concrete_test":"Split each of the 17 recordings into two non-overlapping halves: use hours 1–2 to build the confidence heatmap (Algorithm 1) and hours 3–4 to evaluate path confidences (or vice versa). Recompute Table 3 for Faster R-CNN and YOLOv3. If the max/average confidence reductions of L-PET over the Manhattan/random baselines are preserved (within, say, 0.02) on the held-out half, the in-sample concern is resolved. If the reductions vanish or shrink by more than half, the technique is not a reliable evasion method. Additionally, report the per-walk detector confidence for a person actually traversing the planned path in the held-out footage, rather than the heatmap pixel average.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that a pedestrian can plan a future traversal with reduced detection confidence using a heatmap built from past footage. The evaluation does not test this. In Section 4.1, Algorithm 1 builds the confidence heatmap from a full 4-hour recording. In Sections 4.2 and 4.3, the same recordings' heatmaps are used to compute the max/avg confidence of L-PET paths and the random/direct baselines. Thus L-PET optimizes, and is scored on, the identical quantity derived from the identical frames. The baselines are not optimized, so a reduction vs. random/direct paths is expected by construction and does not by itself demonstrate an evasion capability. Moreover, the path score is the heatmap's per-pixel average, not the detector's confidence on an actual walking person; a person spans many pixels and the detector's output for their bounding box may not equal the pixel average. The threat model assumes the pedestrian obtains footage (e.g., a live stream) to build a heatmap for a future walk; the paper never evaluates this temporal transfer. The same in-sample issue affects L-BAT's evaluation in Sections 5.2 and 5.3, where the heatmap used for the countermeasure and the evaluation data come from the same 4-hour videos. The magnitude of the claimed reductions (0.09 max, 0.13 avg) is therefore not established for the actual use case.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims that automatic pedestrian detectors exhibit location-dependent blind spots, proposes L-PET, a technique that plans a path through a scene to minimize the maximum and average detection confidence using a per-pixel confidence heatmap, and proposes L-BAT, a countermeasure that reweights detection confidences according to historical per-location averages. The evaluation uses public street-camera footage from three locations and five object detectors, reporting that L-PET reduces max and average path confidence by up to 0.09 and 0.13 for Faster R-CNN, and that L-BAT raises these values while improving the detector's true-positive rate and average true-positive confidence.","tokens_in":32976,"tokens_out":7025,"duration_ms":62970,"significance":"If the claims were validated, the contribution would be notable: it would demonstrate a practical, accessory-free evasion technique that relies only on footage and model inference, plus a countermeasure that is inexpensive to deploy. The paper is well-structured, covers multiple scenes, models, and lighting conditions, and provides clear algorithmic descriptions. However, the evaluation does not test the central temporal-transfer scenario (past footage to plan a future walk), uses a proxy metric rather than the detector's output on an actual walking person, and the countermeasure's reported gains are partly a consequence of its normalization rule. These issues currently prevent the results from supporting the stated conclusions.","major_comments":[{"comment":"The evaluation of L-PET is entirely in-sample: the confidence heatmap used to plan paths is generated from the same 4-hour recordings that are later used to compute the path confidences reported in Table 3. The threat model in Section 2 requires a pedestrian to build a heatmap from previously obtained footage and use it for a future traversal, but no held-out temporal split is reported. As a result, the claimed reductions (e.g., 0.09 max and 0.13 average for Faster R-CNN) may be inflated by optimizing and scoring on the same data, and the central claim that a pedestrian can use past footage to plan an effective future path is not established.","section":"Sections 4.2-4.3, Algorithm 1"},{"comment":"The path score is the per-pixel average of the confidence heatmap, not the actual output of the detector on a person traversing the path. A pedestrian is detected as a bounding box covering many pixels, and the detector's confidence for that box may differ substantially from the mean of pixel-level heatmap values. Moreover, pixels with no historical detections (Hd=0 in Algorithm 1) are undefined in the heatmap, and the path optimizer may route through them even though they are not evidence of a detector blind spot; they may simply be areas where pedestrians rarely walk. The paper does not validate L-PET by having a person walk planned paths and measuring the detector's confidence or detection rate, so the claimed evasion capability is not directly demonstrated.","section":"Section 4.3, Algorithm 1"},{"comment":"The location-based 'blind spots' are computed from pedestrian traffic footage, where each pixel's confidence is averaged only over bounding boxes that cover it. Low-confidence regions therefore conflate weak detector performance with sparse pedestrian presence or static occlusion. For example, a path that crosses a road lane with no pedestrian traffic would trivially have low heatmap confidence but would not demonstrate that the detector is weak there. The paper should control for pedestrian density (e.g., by using the detection heatmap as a mask or constraining paths to walkable, pedestrian-accessible areas) to support the claim that the effect is due to detector vulnerability rather than data availability.","section":"Section 3.3, Insight 6"},{"comment":"L-BAT's update rule divides each detection confidence by the historical average confidence at that location (Algorithm 3, line 9). This is a location-dependent normalization that, by construction, raises confidences in low-average regions and lowers them in high-average regions, making the heatmap more uniform. The reported increases in L-PET path confidence (Table 4) therefore follow in part from the normalization itself. Similarly, in Section 5.3, the Faster R-CNN AUC is unchanged (0.89 before and after L-BAT in Table 5a), so the reported TPR and average TP confidence improvements are threshold effects caused by rescaling scores, not improvements in ranking quality. The evaluation also builds the heatmap and measures TPR/FPR on the same footage, so the temporal-transfer limitation applies here as well.","section":"Section 5.2, Algorithm 3"}],"minor_comments":[{"comment":"The division Hc(i,j) <- Hc(i,j)/Hd(i,j) appears inside the outer loop over bounding boxes in the pseudocode; if executed there, it would normalize partial sums and corrupt subsequent accumulation. The division should occur once after all bounding boxes have been processed; please clarify the control flow.","section":"Algorithm 1, line 9"},{"comment":"The text states that Table 3 presents results for five object detectors, but Table 3 lists only four; the DiffusionDet results are in the appendix (Table 7). Please adjust the cross-reference.","section":"Section 4.3 / Table 3"},{"comment":"The evaluation constructs ground-truth positive samples by running an SSD detector and selecting one accepted person box per frame; this couples the ground truth to a particular detector, which may bias the TPR/FPR results. Please state whether any manual verification was performed, and discuss the potential bias.","section":"Section 5.3.1"},{"comment":"The threshold used to compute TPR and FPR is not stated; the results depend on the chosen threshold, and the unchanged AUC for Faster R-CNN suggests the ranking is not improved. Please report the threshold and include ROC curves or threshold-independent statistics.","section":"Section 5.3.2"},{"comment":"The claimed reductions 'up to 0.09 and 0.13' refer to averages over all scenes, but individual rows in Table 3 show reductions as large as 0.23 (max) and 0.19 (average). Please make clear whether the headline numbers are means across all settings and provide error bars or ranges.","section":"Abstract and Section 4.3"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses an interesting problem and the multi-scene, multi-detector scope is commendable, but the current evaluation is in-sample and uses a proxy metric rather than actual detector output for walking pedestrians. I believe the work is fixable with a held-out temporal split, a walkability constraint, and either a physical or realistic synthetic walking evaluation; I encourage the editor to request major revision rather than reject."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The controlled experiments are the strongest part: across five detectors, three public scenes, and controlled lighting, the paper shows that a pedestrian's distance, angle, height relative to the camera, and ambient light shift detection confidence by meaningful amounts. That part is credible and worth reading. The problem is that the two headline techniques are not evaluated the way they are claimed.\n\nL-PET is a clean idea: build a confidence heatmap from footage, then find a path that minimizes the maximum heatmap value, using a minimax Dijkstra. But in Sections 4.2 and 4.3 the heatmap is built from the full four-hour recording and then scored on the same recording. The baselines are random or shortest-distance paths that are not optimized, so it is expected that L-PET scores lower. There is no held-out footage, no temporal split, and no test of whether a heatmap from one day predicts confidence on another day. The threat model assumes a pedestrian can obtain footage before walking the path, so that temporal transfer is the actual use case. The numbers in Table 3 (up to 0.23 max confidence drop) are therefore in-sample artifacts until shown otherwise.\n\nL-BAT has a deeper issue. Algorithm 3 divides each detection confidence by the historical average confidence at that bounding box's pixels. If the detector's confidence at a location is roughly the same as its historical average, the new confidence becomes near one by construction. So the reported increases in L-PET path confidence and TP confidence are largely forced by the update rule. The paper honestly reports the accompanying FPR increase (0.19 to 0.24 on Faster R-CNN), but the benefit of L-BAT over a simpler location-specific threshold is not demonstrated.\n\nThe title overstates things. L-PET's average max path confidence for Faster R-CNN is still 0.71, well above typical detection thresholds, so 'evade detection' is not supported. What is supported is a modest shift in confidence, and only on heatmaps, not on actual walking pedestrians.\n\nNet: the underlying phenomenon is real and the path-planning idea is worth discussing, but the quantitative claims need held-out evaluation and a real-world traversal test. I would send this to a serious referee, expecting major revision.","headline":"Real phenomenon, but the evasion and countermeasure results are in-sample and partly built into the update rule, so the headline numbers are not yet established.","tokens_in":33512,"tokens_out":3315,"would_cite":false,"duration_ms":30918,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A privacy-concerned pedestrian can reduce detection confidence by walking through the scene's blind spots, with no adversarial accessories.","keywords":["privacy-enhancing technology","pedestrian detection evasion","object detector confidence","blind spots","confidence heatmap","surveillance camera privacy","bottleneck path planning","location-based adaptive threshold"],"falsifier":"Re-run the evaluation with the confidence heatmap built from the first half of each recording and L-PET paths evaluated on the second half (or on a different day's recording of the same scene); if the max/average confidence reductions collapse toward zero, the location-based vulnerability is an artifact of evaluating on the very footage used to build the map.","tokens_in":32507,"feed_emoji":"🚶","tokens_out":6886,"duration_ms":51127,"temperature":0.7,"pith_summary":"This paper argues that a privacy-concerned pedestrian can evade a street video camera's automatic pedestrian detector without wearing adversarial patches or carrying special accessories, simply by choosing where to walk. The authors show that detector confidence varies with a person's distance, angle, and height relative to the camera, as well as with ambient light, so that a static scene contains spatial 'blind spots' where the detector is systematically less confident. They build a per-pixel confidence heatmap from several hours of footage and route a path through the lowest-confidence areas, lowering the maximum and average detection confidence along the path compared with direct or random routes. They also propose a countermeasure that raises confidence in those blind spots, shrinking the advantage of such path planning while improving the detector's true-positive rate. If the claim holds, it would mean that surveillance footage can be dodged without any physical adversarial tool, and that camera operators can partially defend against this merely by adjusting detection thresholds per location.","feed_headline":"Blind spots let pedestrians dodge street cameras without gadgets","feed_subtitle":"New path-finding cuts detector confidence by up to 0.13; a countermeasure restores it.","key_machinery":"The central object is the confidence heatmap: for each pixel, the average confidence of all 'person' bounding boxes that cover that pixel, computed from frames sampled every two seconds from a four-hour recording. It converts the continuous scene into a grid where every pixel carries a detection-confidence weight. The path-finding step is a modified Dijkstra algorithm (a bottleneck shortest path) that, instead of minimizing total cost, minimizes the maximum node confidence that must be crossed to go from start to end, so the pedestrian always stays in the weakest-detection regions. The countermeasure L-BAT reweights a detection's confidence by the local heatmap average, $c_{\\text{new}} = \\min(1, c_{bb} / \\bar{H}_c)$, which raises confidence in blind spots.","core_discovery":"Automatic pedestrian detectors trained on curated datasets carry an inherent weakness: their confidence in detecting a person depends on where that person appears in the scene. The paper demonstrates this with five detector architectures (Faster R-CNN, YOLOv3, SSD, DiffusionDet, RTMDet) across three real-world locations, measuring how distance, angle, camera height, and lighting shift detection confidence from 1.0 down to about 0.55. In a fixed scene these variations form stable 'blind spots' of low confidence, which the paper exploits with L-PET: a confidence heatmap is built by averaging the detector's person-box confidences per pixel over hours of footage, the scene is turned into a pixel graph, and a modified Dijkstra search finds the path whose highest-confidence crossing is as low as possible. On Faster R-CNN this lowers the maximum path confidence by up to 0.09 and the average by up to 0.13 compared with direct and random paths. The companion countermeasure, L-BAT, divides each detection's confidence by the average heatmap confidence of the pixels it covers, raising the confidence of detections in weak areas and thereby forcing a would-be evader back toward more expensive attack methods.","pith_inferences":["Because heatmaps are built and evaluated on the same recordings, the reported reductions are upper bounds; a held-out evaluation would likely show smaller but still nonzero gains.","The same training-distribution mismatch that creates blind spots for pedestrians should create analogous location-dependent blind spots for other detection tasks, such as vehicle detection for autonomous driving, making the L-PET/L-BAT pattern portable.","An adaptive attacker could treat the heatmap as an online map that must be kept fresh, while a defender could periodically re-estimate the heatmap to close newly exploited blind spots.","If the technique transfers across cameras of the same scene, a pedestrian could precompute paths from one vantage and use them under another, though the paper's own limitation notes that heatmaps do not transfer across lighting or detectors."],"forward_implications":["L-PET lowers the maximum and average detection confidence along a path for all five detector architectures, with the largest reductions on Faster R-CNN (0.09 max, 0.13 average).","The effect holds across three global locations (Shibuya, Broadway, Castro Street) and across times of day, including night footage.","L-BAT raises the max/average confidence of L-PET paths by 0.09 and 0.05 on Faster R-CNN, and improves the detector's TPR and average true-positive confidence at the cost of a higher false-positive rate.","A pedestrian needs no white-box access to the target model, no adversarial accessories, and no physical modification of the scene, only footage of the scene and knowledge of the detector.","The countermeasure is not plug-and-play across lighting conditions or model architectures: heatmaps are specific to the location, time of day, and detector."],"supporting_citations":[{"why":"Supplies the primary detector (Faster R-CNN) whose confidence heatmaps and paths are evaluated.","marker":"[12]"},{"why":"One of the five detector architectures tested for location-dependent confidence.","marker":"[13]"},{"why":"One of the five detector architectures tested for location-dependent confidence.","marker":"[14]"},{"why":"One of the five detector architectures tested for location-dependent confidence.","marker":"[15]"},{"why":"One of the five detector architectures tested for location-dependent confidence.","marker":"[16]"},{"why":"The shortest-path algorithm that L-PET modifies to minimize maximum node confidence.","marker":"[37]"},{"why":"Baseline evasion via adversarial mask that L-PET aims to replace with a no-accessory approach.","marker":"[4]"},{"why":"Baseline evasion via adversarial hat that L-PET aims to replace with a no-accessory approach.","marker":"[6]"},{"why":"Baseline person-detector evasion via adversarial patches that L-PET contrasts with.","marker":"[9]"}],"fun_headline_variants":["Blind spots in AI cameras let pedestrians vanish from view","Pedestrian detectors have blind spots that let you dodge them","Walking the blind spots: evade street cameras with no gear","AI's own blind spots hand pedestrians a stealth path","Street camera blind spots enable gadget-free evasion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The heatmap built from a four-hour recording is assumed to predict detection confidence for paths evaluated on that same recording and for future traversals, yet the paper does not hold out separate footage for heatmap building versus path evaluation, so the reported reductions may be inflated by in-sample fitting.","fun_headline_variants_meta":{"raw":{"variants":["Blind spots in AI cameras let pedestrians vanish from view","Pedestrian detectors have blind spots that let you dodge them","Walking the blind spots: evade street cameras with no gear","AI's own blind spots hand pedestrians a stealth path","Street camera blind spots enable gadget-free evasion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000294,"raw_usage":{"total_tokens":1780,"prompt_tokens":1085,"completion_tokens":695,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":701,"completion_tokens_details":{"reasoning_tokens":617}},"tokens_in":701,"tokens_out":695,"duration_ms":6176,"temperature":1.0,"reasoning_tokens":617,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T14:03:58.962851+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the evaluation with the confidence heatmap built from the first half of each recording and L-PET paths evaluated on the second half (or on a different day's recording of the same scene); if the max/average confidence reductions collapse toward zero, the location-based vulnerability is an artifact of evaluating on the very footage used to build the map.","supporting_citations":[{"cited_title":"A note on two problems in connexion with graphs,","cited_arxiv_id":null,"evidence_quote":"The shortest-path algorithm that L-PET modifies to minimize maximum node confidence."},{"cited_title":"Adversarial mask: Real-world universal adversarial attack on face recognition models,","cited_arxiv_id":null,"evidence_quote":"Baseline evasion via adversarial mask that L-PET aims to replace with a no-accessory approach."},{"cited_title":"Fooling automated surveillance cameras: adversarial patches to attack person detection,","cited_arxiv_id":null,"evidence_quote":"Baseline person-detector evasion via adversarial patches that L-PET contrasts with."}],"review_version":1}