{"id":"458acd54-9152-4f74-96d0-e99bf6fd65c3","arxiv_id":"2506.23581","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"A composite adversarial training method that combines small-area gradient-guided patches with imperceptible global perturbations improves object detector robustness against both adversarial patches and adversarial texture attacks.","lead":"PBCAT is a training method that makes object detectors resistant to physical attacks such as printed adversarial patches and clothing textures. It combines small-area adversarial patches with imperceptible global noise during training, and reports large robustness gains over prior defenses on person detection.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central 'strong adaptive settings' claim is not substantiated for texture attacks: Sec.","rationale":"The reader's weakest_assumption is that gradient-guided sub-patch selection is what transfers to large-area texture attacks. That is a reasonable secondary concern, but the ablation (Table 3) and top-k experiments (Table A6) give empirical support for the design choice; even if the mechanism is heuristic, the robustness numbers are still what they are. The adaptive-evaluation ambiguity is more load-bearing because it targets the interpretation of every number in Table 1. If texture attacks were not re-optimized against PBCAT, the comparison measures robustness to a fixed attack, not to the adaptive attack class the paper claims. The concern is not an accusation; it is an unstated experimental condition. Sec. 4.1's phrase 'strictly followed their original configurations' and the total silence in Appendix D about texture re-optimization make the static-transfer reading the default. A single clarifying sentence or a rerun would settle it. I therefore keep the reader's CONDITIONAL verdict but for a different reason.","tokens_in":17053,"tokens_out":6637,"duration_ms":74977,"concrete_test":"Re-run AdvTexture and AdvCaT optimization with the victim set to the PBCAT-trained Faster R-CNN (full white-box access; use the original differentiable-renderer pipelines from [16,17] with the defended detector as the loss oracle), and also re-optimize the same attacks against the AdvOD/l∞-AT baseline. Evaluate AP50 with the exact rendering/evaluation protocol of Table 1. If PBCAT retains roughly 60/56 AP50 while baselines stay low, the adaptive claim is confirmed; if PBCAT's AP50 drops substantially (e.g., toward the 30.5 AP50 of AdvOD on AdvTexture), then the reported advantage is an artifact of non-adaptive evaluation. Minimal textual check: state in Sec. 4.1 or Appendix D whether each attack was optimized against the vanilla model, against each defense, or against PBCAT specifically.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline results for person detection (Table 1: 60.2 AP50 against AdvTexture, 56.4 against AdvCaT; abstract's 29.7% improvement) are presented under 'strong adaptive settings' (Sec. 4.2). The load-bearing condition for that claim is that the evaluated texture attacks were actually re-optimized against each defended detector. The manuscript does not document this. Sec. 4.1 says the evaluation settings for AdvPatch/AdvTexture/AdvCaT 'strictly followed their original configurations in the digital world,' and Appendix D.2 describes only how baselines were obtained, not how texture perturbations were generated per defense. On the natural reading, the adversarial textures are the precomputed textures from Hu et al. [16,17], which were optimized against a vanilla detector, and Table 1 is a fixed-transfer evaluation. A fixed texture that is not adapted to PBCAT can be defeated simply because PBCAT was trained on different perturbation structure; this would not support 'significantly improved robustness ... in strong adaptive settings,' and the 29.7% gap over l∞-AT could shrink or vanish under a white-box texture attack optimized against PBCAT. Because the central claim depends on adaptive evaluation, this missing documentation is the most load-bearing concern; it is resolvable by reporting the attack-generation protocol or rerunning the attack.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PBCAT, an adversarial training (AT) method for object detectors that combines small-area, gradient-guided adversarial patches with imperceptible global l-infinity perturbations, trained efficiently via a FreeAT-style replay scheme. Experiments on Faster R-CNN, FCOS, and DN-DETR are reported against AdvPatch, AdvTexture, AdvCaT, and a masked PGD patch attack, on MS-COCO, Inria, and a synthetic dataset. The central claim is that PBCAT yields significantly improved robustness against physically realizable attacks in 'strong adaptive settings,' with headline AP50 values of 60.2% and 56.4% against AdvTexture and AdvCaT, and a 29.7% improvement over prior defenses against AdvTexture.","tokens_in":17338,"tokens_out":4529,"duration_ms":42680,"significance":"If the adaptive-evaluation claim is substantiated, PBCAT would be a valuable contribution: it is the first unified AT recipe that addresses both adversarial patches and large-area texture attacks for object detection, and it does so at a training cost comparable to standard AT (Appendix C, Table A2). The paper ships code, compares three distinctly different detector architectures, and gives a careful computational-overhead analysis of prior patch-based AT methods (Appendix A). These are real strengths. The main risk is that the evaluation protocol for texture attacks may not actually be adaptive; this is the decisive point for the paper's headline claim. The paper also acknowledges its main limitation (slightly decreased clean accuracy) in the Discussion section.","major_comments":[{"comment":"The adaptive evaluation of AdvTexture and AdvCaT is not documented. Section 4.1 states that the evaluation settings for these attacks 'strictly followed their original configurations in the digital world,' which implies the attacks were not re-optimized against each defended detector. Section 4.2 nevertheless claims white-box adaptive evaluation and 'strong adaptive settings,' and Appendix D.2 describes only how baselines were obtained, not how texture perturbations were generated per defense. If the adversarial textures are the precomputed textures from Hu et al. [16,17] optimized against a vanilla detector, then Table 1 is a fixed-transfer evaluation, and the 29.7% gain over l-infinity AT could shrink or vanish under a texture attack re-optimized against PBCAT. Please document the exact attack-generation protocol (including number of iterations, budget, and whether the detector gradient is used) or rerun the texture attacks in a genuinely white-box adaptive fashion.","section":"Section 4.1, Table 1"},{"comment":"Key hyperparameters—patch scale factor lambda, number of sub-patches N, top-k ratio, and the perturbation intensities alpha, beta, epsilon, and replay parameter r—are selected using ablations on the same attacks (AdvPatch, AdvTexture, AdvCaT) that are later used for the headline evaluation. This introduces a model-selection circularity: the reported gains may overstate robustness because the method was tuned on the evaluation attacks. Please report a hyperparameter-selection protocol (e.g., a separate validation set or a held-out attack) or otherwise demonstrate that the conclusions are robust to the tuning procedure.","section":"Section 4.3.2 and Tables 4-5, D.5"},{"comment":"The central heuristic that sub-patches with the highest average gradient norm identify the most vulnerable regions for adversarial training, and that training on them transfers to unseen large-area texture attacks, is supported only by Table 3, which compares gradient versus random selection on the same attacks used in the final evaluation. No causal mechanism or theoretical justification is provided for why this selection should transfer to texture attacks that cover the whole object. Please provide additional evidence, such as an analysis of the learned masks under texture attacks or an evaluation on a held-out texture attack, to support this load-bearing assumption.","section":"Section 3.3, Table 3"},{"comment":"No error bars or repeated-run statistics are reported anywhere in the experimental section. Given the stochasticity of adversarial training and the small differences in several comparisons (e.g., FCOS AdvCaT 26.0 vs 17.7, DN-DETR AdvTexture 16.8 vs 0.0), the robustness improvements may not be statistically significant. Please report the mean and standard deviation over at least three seeds for the main comparisons and perform a significance test where appropriate.","section":"Tables 1-7"},{"comment":"For the non-AT baselines, the paper says the implementations were 'modified to conduct adaptive attacks,' but it does not specify what modifications were made for each attack type, especially for AdvTexture and AdvCaT. Without knowing whether the same attack budget, number of iterations, and optimization objective were used for each baseline, the comparison in Table 1 may understate the baselines' robustness. Please provide the exact attack configuration used for every baseline, or state which components of the original attack code were changed.","section":"Appendix D.2"}],"minor_comments":[{"comment":"The text says 'the detection performance of Faster R-CNN without defense mechanisms and with BCAT'; this should read 'with PBCAT.'","section":"Section 4.5"},{"comment":"The patch perturbation intensity is listed as beta = 64/255 in the training recipe, while Eq. (2) gives beta = 1 as an example; please clarify the relationship between these values.","section":"Section 4.1"},{"comment":"The hyperparameters for FCOS and DN-DETR (alpha = 4/255, beta = 32/255, lambda = 0.2) differ from the main recipe (alpha = 8/255, beta = 64/255, lambda = sqrt(2)/5) without justification; please explain or move this detail to an appendix.","section":"Section 4.4"},{"comment":"The caption says 'PGDPatch was optimized on MS-COCO' but does not specify whether the patch is optimized per image, per object, or globally; please clarify the optimization procedure.","section":"Figure 3 caption"},{"comment":"The name 'AdvCAT' should be 'AdvCaT' to match the rest of the paper.","section":"Section 4.5"}],"recommendation":"major_revision","confidential_remarks":"The reader's conditional verdict is appropriate. The missing documentation of the adaptive attack protocol for AdvTexture and AdvCaT is a substantive, load-bearing issue rather than a presentation issue. If the authors can show that these attacks were genuinely re-optimized against each defended model (PBCAT in particular), the paper's claims become plausible. The hyperparameter-tuning circularity is also significant and should be addressed, but it is less severe than the adaptive-attack issue. The paper's strengths—mult-architecture evaluation, training efficiency, and released code—make it worth a major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nPunchline: PBCAT is a sensible recipe—composite patch plus l-infinity perturbations for adversarial training of object detectors—and the transfer numbers are real. But the paper's central claim of robustness under 'strong adaptive settings' is not actually documented for the texture attacks. The text says the evaluation 'strictly followed their original configurations' and that they rendered persons wearing outfits 'optimized by AdvTexture and AdvCaT'—both point to the precomputed textures from Hu et al., not to textures re-optimized against each defended detector. If that's right, Table 1 is a fixed-transfer evaluation, not a white-box adaptive one, and the 29.7% improvement over l-infinity AT could shrink or vanish under an adaptive texture attack. The authors do not describe the attack-generation protocol per defense, so the claim outruns the evidence.\n\nWhat is actually new and good: the idea of combining small-area gradient-guided patches with imperceptible global noise in one AT scheme for object detection is new, and the gradient-based sub-patch selection is a cheap way to find vulnerable locations, extending earlier patch-AT work from classification to detection. The paper trains three architectures (Faster R-CNN, FCOS, DN-DETR), includes ablations, and ships code. The robustness against precomputed attacks and transfer attacks is credible and practically useful—physical attackers often use fixed textures.\n\nWhere the soft spots are, in order: (1) the adaptive-evaluation gap above is load-bearing and should be fixed with either a true adaptive attack or a corrected claim; (2) hyperparameters (patch size, sub-patch count, top-k) were chosen via ablations on the same AdvTexture/AdvCaT attacks used for final evaluation, so part of the gain is selection, not method; (3) no error bars or multiple seeds; (4) the method depends on an adversarially pre-trained backbone, which limits scope, though the authors acknowledge it.\n\nWho it's for: researchers working on empirical defenses against physical adversarial attacks on object detectors. It's a useful empirical study, but the headline claim needs verification. I'd send it to review with the condition that the authors either run adaptive texture attacks or explicitly mark the numbers as transfer-based and soften the adaptive talk.\n\nBest,","headline":"Sensible composite AT recipe, credible transfer results, but the 'strong adaptive settings' claim for texture attacks is not supported by the described evaluation.","tokens_in":17862,"tokens_out":3405,"would_cite":true,"duration_ms":31736,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"One adversarial training recipe defeats both patch and texture attacks","keywords":["adversarial training","physically realizable attacks","adversarial patches","adversarial textures","object detection","person detection","gradient-guided patch selection","robustness"],"falsifier":"Train PBCAT with random sub-patch selection at the same mask area and evaluate on an unseen texture attack; if the random-selected model matches the gradient-selected model, the gradient-guided mask is not carrying the reported robustness, and the same conclusion would follow from an adaptive texture attacker that concentrates its energy on the discarded half of each patch.","tokens_in":16845,"feed_emoji":"🛡️","tokens_out":11047,"duration_ms":101459,"temperature":0.7,"pith_summary":"Object detectors used in autonomous driving and surveillance can be hidden by printed patches or by adversarial clothing textures. This paper argues that one training recipe, PBCAT, can defend a single detector against both types of physically realizable attack. PBCAT trains on a composite perturbation: a small patch inside each object's bounding box, narrowed to the half of its sub-patches with the largest average gradient norms, plus an imperceptible whole-image noise within a tiny $\\ell^\\infty$ budget. The claimed payoff is person-detection AP50 of 60.2% under AdvTexture and 56.4% under AdvCaT in adaptive white-box tests, with a 29.7 percentage-point gain over prior defenses on AdvTexture and training cost close to standard adversarial training.","feed_headline":"One adversarial training recipe defeats both patch and texture attacks","feed_subtitle":"Person-detection AP50 jumps from 30.5% to 60.2% under AdvTexture after PBCAT training.","key_machinery":"The load-bearing object is the binary mask $M$ that determines where the large visible patch perturbation is applied. $M$ is built by partitioning a randomly placed patch into $n^2$ sub-patches, computing the average gradient norm of each from a single backward pass, and setting to one only the top 50%. The training perturbation is $\\delta = \\mathrm{Apply}(\\delta_p \\odot M, x) + \\delta_g$, where $\\delta_p$ is a patch perturbation with intensity $\\beta$ and $\\delta_g$ is a global perturbation with $\\|\\delta_g\\|_\\infty \\le 4/255$. The mask concentrates the strong perturbation on a small, gradient-selected vulnerable area, and the global term covers the entire image at imperceptible strength; this combination is what the paper credits both for preventing training collapse with large-area attacks and for transferring to unseen texture attacks.","core_discovery":"On the paper's own terms, the central claim is that adversarial training against physically realizable attacks on object detectors fails when it uses only one perturbation scale, and succeeds when it mixes a small, gradient-selected patch perturbation with an imperceptible global perturbation. For each bounding box, a patch is placed at a random location, split into $n\\times n$ sub-patches, and reduced by a binary mask to the top half by average gradient norm; then an $\\ell^\\infty$-bounded global noise is added over the whole image. PBCAT updates both perturbations with replayed gradients in a single backward pass, using an adversarially pre-trained backbone, so the additional training cost is modest. The paper claims that this composite recipe makes a Faster R-CNN reach 60.2% AP50 against AdvTexture and 56.4% against AdvCaT, beats $\\ell^\\infty$-adversarial-training baselines as well as patch-specific defenses under adaptive attacks, and transfers to FCOS and DN-DETR.","pith_inferences":["An adaptive attacker that inverts the gradient rule and focuses on the discarded half of each patch would test whether the reported texture robustness comes from the selection mechanism or from the global noise; this attack is not run in the paper.","Because PBCAT depends on an adversarially pre-trained backbone, extending it to detectors without such backbones requires first training those backbones, a direction the paper notes is needed for YOLO-series detectors.","The clean-accuracy cost is acknowledged but not mapped; sweeping the patch scale, global budget, and mask ratio would characterize the robustness-accuracy frontier the authors leave open."],"forward_implications":["A single PBCAT-trained detector can replace separate defenses for patches and textures, since it maintains high AP50 under AdvPatch, AdvTexture, and AdvCaT in adaptive evaluations.","Against AdvTexture, the reported AP50 gain is 29.7 percentage points over the best $\\ell^\\infty$-AT baseline, indicating that large-area texture attacks are not out of reach for adversarial training.","The training cost stays comparable to standard adversarial training because the inner maximization reuses gradients from parameter updates; PBCAT trained Faster R-CNN in about 44 hours versus 34 hours for the $\\ell^\\infty$-AT baseline.","The recipe transfers across architectures: PBCAT improves robustness for the one-stage FCOS and the transformer-based DN-DETR, not just Faster R-CNN.","Transfer-based and black-box patch attacks lose most of their effectiveness against PBCAT models in the reported numbers."],"supporting_citations":[{"why":"Defines AdvTexture, the tileable clothing-texture attack that provides the main large-area threat and evaluation pipeline.","marker":"[16]"},{"why":"Defines AdvCaT and the synthetic dataset used for evaluating clothing-texture robustness.","marker":"[17]"},{"why":"Defines AdvPatch, the printed-patch attack used to evaluate patch robustness on the Inria dataset.","marker":"[45]"},{"why":"Supplies the adversarially pre-trained backbone, training recipe, and $\\ell^\\infty$-AT baseline that PBCAT extends and compares against.","marker":"[29]"},{"why":"Provides the FreeAT gradient-replay scheme that makes PBCAT's training cost comparable to standard training.","marker":"[41]"},{"why":"Formulates the PGD inner-maximization and adversarial-training objective that PBCAT adapts to patches.","marker":"[33]"},{"why":"Earlier patch-based adversarial training that searches for optimal patch locations; PBCAT's gradient selection addresses its prohibitive cost for object detection.","marker":"[36]"},{"why":"Earlier patch-based adversarial training against physically realizable attacks on classifiers, whose location-choice approach PBCAT replaces.","marker":"[50]"},{"why":"Establishes adaptive attacks as the evaluation standard under which non-adversarial-training defenses are assessed and found lacking.","marker":"[2]"}],"fun_headline_variants":["Training with patch and global noise defeats physical attacks","PBCAT: one adversarial training recipe vs patches and textures","Mix patch and global perturbations to harden object detectors","Adversarial training combo boosts AP50 by 29.7% under AdvTexture","AP50 jumps to 60.2% under AdvTexture with PBCAT"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the sub-patches with the largest average gradient norm are the regions whose perturbation best teaches the detector to resist physical attacks, and that hardening these small regions transfers to large-area texture attacks that were not seen in training.","fun_headline_variants_meta":{"raw":{"variants":["Training with patch and global noise defeats physical attacks","PBCAT: one adversarial training recipe vs patches and textures","Mix patch and global perturbations to harden object detectors","Adversarial training combo boosts AP50 by 29.7% under AdvTexture","AP50 jumps to 60.2% under AdvTexture with PBCAT"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000592,"raw_usage":{"total_tokens":2805,"prompt_tokens":1003,"completion_tokens":1802,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":619,"completion_tokens_details":{"reasoning_tokens":1712}},"tokens_in":619,"tokens_out":1802,"duration_ms":12824,"temperature":1.0,"reasoning_tokens":1712,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T21:36:58.701554+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train PBCAT with random sub-patch selection at the same mask area and evaluate on an unseen texture attack; if the random-selected model matches the gradient-selected model, the gradient-guided mask is not carrying the reported robustness, and the same conclusion would follow from an adaptive texture attacker that concentrates its energy on the discarded half of each patch.","supporting_citations":[{"cited_title":"Adversarial texture for fooling per- son detectors in the physical world","cited_arxiv_id":null,"evidence_quote":"Defines AdvTexture, the tileable clothing-texture attack that provides the main large-area threat and evaluation pipeline."},{"cited_title":"Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling","cited_arxiv_id":null,"evidence_quote":"Defines AdvCaT and the synthetic dataset used for evaluating clothing-texture robustness."},{"cited_title":"Fool- ing automated surveillance cameras: Adversarial patches to attack person detection","cited_arxiv_id":null,"evidence_quote":"Defines AdvPatch, the printed-patch attack used to evaluate patch robustness on the Inria dataset."},{"cited_title":"On the importance of backbone to the adversarial robustness of object detectors","cited_arxiv_id":null,"evidence_quote":"Supplies the adversarially pre-trained backbone, training recipe, and $\\ell^\\infty$-AT baseline that PBCAT extends and compares against."},{"cited_title":"Dickerson, Christoph Studer, Larry S","cited_arxiv_id":null,"evidence_quote":"Provides the FreeAT gradient-replay scheme that makes PBCAT's training cost comparable to standard training."},{"cited_title":"Towards deep learning models resistant to adversarial attacks","cited_arxiv_id":null,"evidence_quote":"Formulates the PGD inner-maximization and adversarial-training objective that PBCAT adapts to patches."},{"cited_title":"Adversarial training against location-optimized adversarial patches","cited_arxiv_id":null,"evidence_quote":"Earlier patch-based adversarial training that searches for optimal patch locations; PBCAT's gradient selection addresses its prohibitive cost for object detection."},{"cited_title":"Defend- ing against physically realizable attacks on image classifica- tion","cited_arxiv_id":null,"evidence_quote":"Earlier patch-based adversarial training against physically realizable attacks on classifiers, whose location-choice approach PBCAT replaces."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes adaptive attacks as the evaluation standard under which non-adversarial-training defenses are assessed and found lacking."}],"review_version":1}