{"id":"1b9986c0-6910-4415-80b3-00ee5ac79f52","arxiv_id":"2507.18656","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"ShrinkBox is a backdoor attack that makes object detectors output smaller bounding boxes on triggered images, preserving mAP while tripling distance-estimation error.","lead":"A new backdoor attack, ShrinkBox, teaches a car-detection AI to draw slightly smaller boxes around objects when a hidden trigger is present. This makes a downstream distance estimator believe cars are farther away, potentially delaying collision warnings, while standard accuracy benchmarks look unchanged.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline 4% poisoning ratio conflicts with paper's own finding that mAP difference is negligible only at ≥5%; at 4% the advertised stealth under standard benchmarks is unsupported.","rationale":"The single most load-bearing concern is the internal contradiction between the headline operating point (4% poisoning) and the paper's own stated condition for stealth (≥5% poisoning). The abstract and conclusion bundle '96% ASR', '4% poisoning ratio', and 'mAP remains unaffected' into one claim, but §III-C explicitly says the negligible-mAP-difference hypothesis holds only at ≥5%. At 4%, the paper provides no mAP/AP numbers and, by its own trend, the AP gap is non-negligible. This matters because the attack's novelty is precisely stealth: shrinking boxes while scoring normally on standard benchmarks. If the advertised configuration is detectable by mAP/AP, the central value proposition is weakened. The reader's verdict was already CONDITIONAL, and this concern reinforces that conditionality (the authors should either report the 4% mAP numbers or move the headline to 10-20%). I did not choose the reader's weakest assumption (height-distance calibration) because the empirical DECADE MAE results already demonstrate the intended distance misperception on KITTI, so calibration is an external-validity concern rather than a direct contradiction of the paper's own reported results. The 4%/5% issue is textually verifiable from the manuscript alone, making it more load-bearing for the central claim. Agreement is 'partial' because the reader noted the 4%/5% mAP issue in the rationale but did not make it the weakest assumption.","tokens_in":9842,"tokens_out":6864,"duration_ms":71354,"concrete_test":"Extract from Fig. 6 the AP_clean and AP_pois (and mAP) values for the YOLOv9m model trained at the 4% poisoning ratio. If the difference is larger than the ≤1.5% margin the paper uses to define 'negligible' for the 10-20% ratios, the 4% headline fails the paper's own stealth criterion. Independently, evaluate the 4%-poisoned YOLOv9m on the poisoned validation set using clean ground-truth boxes (not the poisoned annotations) and compare mAP to the clean model; a drop exceeding 1.5% would confirm the contradiction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract and conclusion claim ShrinkBox achieves 96% ASR with 'only a 4% poisoning ratio' while 'mAP remains unaffected' (Abstract; §IV). However, §III-C states: 'our hypothesis that the difference between mAP_clean and mAP_pois is negligible holds only if the poisoning ratio is at least 5%.' At lower ratios, AP_pois is 'much lower' than AP_clean; for YOLOv9m at 1% the gap is 6.8%. No AP/mAP values are reported for the 4% configuration, which is exactly the regime the authors say fails the stealth criterion. Since the attack's central novelty is being undetectable by standard benchmarks at a low poisoning ratio, the headline combination (4% + negligible mAP drop) is not established. This is an internal inconsistency: the paper's own evaluation contradicts its headline. If presented at 10-20% poisoning, the mAP stealth claim may hold, but the 'only 4%' selling point would need to be withdrawn or qualified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ShrinkBox, a backdoor attack on YOLO object detectors used in a camera-only ADAS pipeline. The poisoning strategy shrinks the ground-truth bounding boxes of Car instances by mapping each box height through a learned inverse distance model and projecting the object to a distance 5 m further than the ground truth; a Pokeball patch is overlaid as the trigger. The authors train 54 poisoned and 6 clean YOLOv9/YOLOv10 models on KITTI, introduce an ASR@X metric based on similarity of predicted box heights to poisoned versus clean boxes, and evaluate the downstream effect on DECADE distance estimation. The headline claims are a 96% ASR at a 4% poisoning ratio for YOLOv9m, a negligible mAP difference, and more than a 3x increase in MAE on poisoned instances.","tokens_in":10020,"tokens_out":6983,"duration_ms":76014,"significance":"If the central claims held, ShrinkBox would be one of the first backdoor attacks targeting bounding-box geometry rather than object labels or presence, and the empirical sweep is broad: 60 trained models, 6 model scales, 9 poisoning ratios, and 54 poisoned detectors. The proposed ASR@X metric is a reasonable starting point for measuring size-targeting attacks, and the end-to-end evaluation through DECADE demonstrates a plausible safety impact. However, the paper's stealth claim is not tested against any existing backdoor defense or human-inspection protocol, and the headline 4% poisoning ratio is contradicted by the paper's own statement in Section III-C that the mAP difference is negligible only for poisoning ratios of at least 5%. The downstream MAE increase is also by construction, since the poisoning function explicitly shifts distance estimates by 5 m; Fig. 8 validates the end-to-end pipeline rather than discovering an unanticipated effect. With these caveats, the paper is a useful empirical demonstration but currently overclaims the stealth and low-poisoning properties of the attack.","major_comments":[{"comment":"The headline claim of a 96% ASR with only a 4% poisoning ratio while mAP remains unaffected is not supported by the reported evaluation. Section III-C states that the hypothesis of a negligible mAP_clean versus mAP_pois difference 'holds only if the poisoning ratio is at least 5%,' and the paper gives the YOLOv9m 1% ratio AP gap as 6.8%. No AP or mAP values are reported for the 4% condition, which is exactly the regime on which the headline relies. The authors should report the 4% AP/mAP values and show that they satisfy their own stealth criterion, or revise the headline and instead present the 10-20% poisoning ratios that Section III-C actually recommends.","section":"III-C, Abstract, Conclusion"},{"comment":"The stealthiness claim is undermined by the trigger design. The actual poisoning pipeline uses a 'conspicuous Pokeball patch' blended at 100% opacity with a patch height of 40% of the box (Section III-B), whereas the motivational example in Fig. 2 explicitly assumes an invisible trigger for the preliminary study. The assertion that ShrinkBox 'remains undetected in dataset inspections' is not backed by any human-subject study or by evaluation against standard backdoor defenses such as Neural Cleanse, STRIP, or frequency-based detection. As written, the paper demonstrates that the annotation change is subtle, but not that the poisoned images are stealthy.","section":"III-B, Fig. 2"},{"comment":"The ASR metric is defined only over the set P of instances whose predicted boxes match the poisoned boxes with IoU >= 0.6. If the trigger causes the detector to miss an object entirely or to produce a box with IoU below 0.6, that instance is excluded from the denominator of Eq. (4). ASR can therefore be inflated by ignoring detection failures. The authors should evaluate ASR over the full set of poisoned ground-truth instances and report the match rate, or justify why unmatched instances should not count as attack failures.","section":"II-B, Eq. (4)"},{"comment":"The reported more-than-3x MAE increase in downstream distance estimation is a design consequence rather than an independent empirical discovery. The poisoning function deliberately projects each box to a distance d+5 (Section II-A), so an MAE_pois close to the 5 m critical offset in a fully successful attack is expected, as the authors themselves hypothesize in Section II-C. The value of Fig. 8 is in showing that the backdoor transfers through the trained detectors to DECADE; the paper should frame it as validation of the end-to-end pipeline and also report the cases where the learned height-distance calibration (Eq. (1), validation MAE 1.69 m) causes the observed offset to deviate from 5 m.","section":"II-A, II-C, Fig. 8"}],"minor_comments":[{"comment":"The MAE increase is reported inconsistently as 'more than 3x' in the abstract, '3.3x' in Contribution 3, and '3.1x' in the conclusion; these numbers should be reconciled.","section":"Abstract, I-B, IV"},{"comment":"The sentence 'the YOLOv9 t, s, and m achieve ASR scores of 81.5%, 88.3%, and 91.9% respectively at only a 2% poisoning ratio for instance' contains an awkward dangling phrase 'for instance' that should be rewritten.","section":"III-D"},{"comment":"The caption says 'on clean (top) and poisoned (right) bounding boxes,' but the surrounding text describes a left/right column layout; the caption should be aligned with the actual figure layout.","section":"Fig. 2 caption"},{"comment":"The phrase 'we restrict our poisoning to the only instances that are partially obstructed, having an obstruction value of ≤ 1.0' is imprecise, because occlusion value 1.0 in KITTI denotes partly occluded but the filter also includes fully visible objects; please clarify the occlusion filter.","section":"III-B"},{"comment":"The sentence 'a higher error from DECADE is guaranteed to cause traffic accidents' is too strong; a higher error makes collisions more likely, but it is not a guarantee in every scenario.","section":"I"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of a security-oriented machine-learning venue and the empirical sweep is a strength. The main concern for the editor is that the paper's marketing of the 4% poisoning ratio conflicts with its own evaluation, and the stealth claim is not tested against actual backdoor defenses. These issues are fixable with additional experiments or careful rescoping, so the paper should not be rejected outright, but it needs substantial revision before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"ShrinkBox is worth a serious look. The novel idea is real: instead of hiding objects or changing their labels, the backdoor shrinks the ground-truth bounding box so that the detector, on seeing the trigger, predicts a smaller box that makes the object look farther away. That is a new attack class for object detection, and the dynamic height-based poisoning strategy built on an inverse distance model is sensible. The empirical sweep is also serious: 60 trained models across six YOLO variants and nine poisoning ratios, with mAP, ASR, and downstream distance-error numbers reported. The demonstration that DECADE's MAE rises to about 5m when the attack succeeds is consistent with the attack design, and the proposed ASR metric is a reasonable way to measure box-shrinking attacks.\n\nThe soft spots are real but manageable. The biggest one: the abstract and conclusion claim a 4% poisoning ratio achieves 96% ASR \"while mAP remains unaffected,\" but Section III-C says the mAP difference is negligible only when the poisoning ratio is at least 5%. At 4%, the paper itself predicts a non-negligible AP drop. No mAP or AP numbers are reported for the 4% configuration, so the headline stealth claim is unsupported as stated. The authors actually recommend 10-20% poisoning, where the attack still works well, so the fix is to qualify or withdraw the \"only 4%\" selling point.\n\nA related framing issue: the poisoning ratios are computed over a filtered subset (14,800 instances) rather than the full 35,450-instance training set. A \"4%\" ratio over that subset is roughly 1.7% of all instances, which is less impressive than it sounds. The paper should make this explicit.\n\nOther concerns are minor. There are no error bars, no code or data release, and no evaluation against actual backdoor detection methods (e.g., Neural Cleanse, STRIP). The claim that ShrinkBox evades standard benchmarks is tested only via mAP, which is not a defense. That is a common gap in this literature, but worth flagging.\n\nThe downstream MAE increase is partly by construction, since the poisoned boxes are deliberately projected to a distance 5m farther. That doesn't make the result invalid; it just means the paper demonstrates the pipeline works end-to-end rather than discovering a new phenomenon.\n\nOverall: the attack concept is novel, the implementation is careful, and the paper is honest enough to state the 5% poisoning condition internally. The abstract needs revision, and the evaluation would benefit from more transparency. This deserves a serious referee and likely acceptance after moderate revision.","headline":"ShrinkBox is a credible new backdoor that shrinks bounding boxes rather than flipping labels; the core result holds up, but the advertised 4% poisoning ratio conflicts with the paper's own stealth criterion.","tokens_in":10592,"tokens_out":2118,"would_cite":false,"duration_ms":27133,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ShrinkBox backdoor makes ADAS overestimate car distances by 5 meters","keywords":["backdoor attack","object detection","collision avoidance","distance estimation","ADAS","YOLO","KITTI","bounding box poisoning"],"falsifier":"On each poisoned validation instance, compute the actual projected distance shift by feeding the shrunken poisoned box heights through the fitted curve and comparing $d_{\\mathrm{proj}}$ with the ground-truth distance; if the median shift is not about 5 m across the poisoned set, the poisoning strategy does not produce the claimed distance misperception. Alternatively, reproduce the YOLOv9m 50% poisoning run and check whether DECADE's MAE on poisoned samples is near the reported 5.5 m, since a perfect infection should give at least 5 m.","tokens_in":9615,"feed_emoji":"🚗","tokens_out":6270,"duration_ms":58890,"temperature":0.7,"pith_summary":"ShrinkBox is a backdoor attack that targets the size of predicted bounding boxes rather than their labels or existence. By shrinking a car's ground-truth box in a small fraction of training images and overlaying a trigger patch, the poisoned detector learns to output smaller boxes on triggered inputs, which makes a bounding-box-based distance estimator like DECADE read the car as farther away than it is. The paper demonstrates this on YOLOv9m trained on KITTI, reporting a 96% attack success rate at just a 4% poisoning ratio, with mAP essentially unchanged. On poisoned samples, DECADE's mean absolute error grows from 1.67 m to 5.51 m, which is enough to delay or suppress collision warnings. The intended effect is to show that a backdoored camera-only ADAS can fail dangerously while still scoring normally on standard object-detection benchmarks.","feed_headline":"ShrinkBox backdoor makes ADAS overestimate car distances by 5 meters","feed_subtitle":"Poisoning 4% of training data raises distance-estimation error by more than 3x without hurting mAP.","key_machinery":"The load-bearing mechanism is the learned inverse height-distance curve $d = k/h + c$ (with learnable $k>0$ and $c\\ge 0$), which converts a desired distance shift of $+5$ m into a concrete shrink factor for each bounding box. Because the curve is fit to filtered KITTI Car boxes in the 10-60 m range, it provides a dynamic, per-instance poisoning rule instead of a fixed reduction, keeping the annotation changes subtle while still biasing perceived distance. The matching procedure joins predicted boxes to poisoned and clean boxes at IoU 0.6, and the indicator in the ASR definition decides success by comparing predicted height against the poisoned height relative to the clean height.","core_discovery":"On the paper's own terms, ShrinkBox is the first backdoor attack on object detection that manipulates only the dimensions of the bounding box. The attacker fits the inverse relation $d = k/h + c$ between box height and distance on filtered KITTI Car annotations, then for each poisoned instance shrinks the box to the height that this curve maps to a distance 5 m farther than the ground truth, preserving width proportionally, and pastes a Pokeball patch at the object's center as the trigger. The infected detector behaves normally on clean images but emits shrunken boxes on triggered images, so the downstream detection-wise distance estimator, DECADE, systematically overestimates the object's distance by roughly the intended offset. The authors introduce a similarity-threshold-based Attack Success Rate to measure this because mAP cannot; across six YOLOv9 and YOLOv10 variants, higher-capacity models are more susceptible, and at recommended poisoning ratios the distance MAE on poisoned samples reaches about 5 m.","pith_inferences":["The same shrink-to-shift mechanism could bias other geometric downstream tasks, such as lateral position or size-based speed estimation, by targeting width instead of height.","The attack's portability depends on the calibration curve; a detector trained on one camera may not produce the intended distance shift on another, which suggests defensive calibration checks could catch it.","A testable defense direction raised by this work is to monitor the agreement between predicted box sizes and an independent geometric model of the scene, since poisoned boxes systematically violate that relationship.","Selectively poisoning other classes, such as pedestrians or cyclists, could create similar misunderstandings with possibly different safety consequences."],"forward_implications":["A backdoored camera-only ADAS can systematically overestimate distances on triggered inputs while passing standard benchmarks, so collision warnings can be delayed or suppressed.","Larger object detectors are more susceptible: at a 2% poisoning ratio, YOLOv9t/s/m reach 81.5%, 88.3%, and 91.9% ASR respectively, and a 4% ratio suffices for 96% ASR in YOLOv9m.","Because mAP and AP stay within roughly 1.5% of clean values at 10-20% poisoning, benchmark-based evaluation alone cannot reveal the infection.","At the recommended 10-20% poisoning ratios, most infected variants push DECADE's mean absolute error on poisoned samples to about 5 m, matching the attack's critical offset."],"supporting_citations":[{"why":"Provides the DECADE detection-wise distance estimator that the attack's downstream disruption is evaluated on.","marker":"[11]"},{"why":"Supplies the KITTI dataset, the training/validation images and annotations used for poisoning and evaluation.","marker":"[19]"},{"why":"Provides the training/validation split and the height-based distance estimation model that motivates the inverse relation.","marker":"[20]"},{"why":"Supplies the YOLOv9m (Ultralytics YOLO) detector that is the primary victim model.","marker":"[18]"},{"why":"Defines the taxonomy of backdoor attacks on object detection (OGA, ODA, RMA, GMA) that ShrinkBox is contrasted with.","marker":"[16]"},{"why":"Describes the YOLOv9 architecture that the attacked YOLOv9 models are built on.","marker":"[6]"}],"fun_headline_variants":["ShrinkBox backdoor shrinks boxes, ADAS sees cars 5m farther","4% poisoned data makes ADAS overestimate distances 3x","Backdoor attack: tiny box shrink blinds collision avoidance","ShrinkBox: subtle box shrink backdoor disrupts ADAS warnings"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's effect rests on the fitted curve $d = k/h + c$ being accurate for the cars being attacked; if the height-to-distance calibration is off for an object, camera, or vehicle type, the shrunk box will not correspond to the intended 5 m farther distance.","fun_headline_variants_meta":{"raw":{"variants":["ShrinkBox backdoor shrinks boxes, ADAS sees cars 5m farther","4% poisoned data makes ADAS overestimate distances 3x","Backdoor attack: tiny box shrink blinds collision avoidance","ShrinkBox: subtle box shrink backdoor disrupts ADAS warnings"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000192,"raw_usage":{"total_tokens":1413,"prompt_tokens":1075,"completion_tokens":338,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":691,"completion_tokens_details":{"reasoning_tokens":261}},"tokens_in":691,"tokens_out":338,"duration_ms":3886,"temperature":1.0,"reasoning_tokens":261,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T14:59:16.594696+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"On each poisoned validation instance, compute the actual projected distance shift by feeding the shrunken poisoned box heights through the fitted curve and comparing $d_{\\mathrm{proj}}$ with the ground-truth distance; if the median shift is not about 5 m across the poisoned set, the poisoning strategy does not produce the claimed distance misperception. Alternatively, reproduce the YOLOv9m 50% poisoning run and check whether DECADE's MAE on poisoned samples is near the reported 5.5 m, since a perfect infection should give at least 5 m.","supporting_citations":[{"cited_title":"Decade: Towards designing efficient-yet-accurate distance estimation modules for collision avoidance in mobile advanced driver assistance systems,","cited_arxiv_id":null,"evidence_quote":"Provides the DECADE detection-wise distance estimator that the attack's downstream disruption is evaluated on."},{"cited_title":"Dist-yolo: fast object detection with distance estimation,","cited_arxiv_id":null,"evidence_quote":"Provides the training/validation split and the height-based distance estimation model that motivates the inverse relation."},{"cited_title":"Baddet: Backdoor attacks on object detection,","cited_arxiv_id":null,"evidence_quote":"Defines the taxonomy of backdoor attacks on object detection (OGA, ODA, RMA, GMA) that ShrinkBox is contrasted with."},{"cited_title":"Yolov9: Learning what you want to learn using programmable gradient information,","cited_arxiv_id":null,"evidence_quote":"Describes the YOLOv9 architecture that the attacked YOLOv9 models are built on."}],"review_version":1}