{"id":"21d64c72-e49a-4b0f-b52a-4fe2f9b43db7","arxiv_id":"2607.21243","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"InsCAT adds a contrastive loss that aligns adversarially clothed people with clean people and pushes away from texture-only images, reducing texture false positives from 46.9% to 7.3% while lifting average attack AP to 82.3%.","lead":"A new training method, InsCAT, stops person-detection AI from treating adversarial clothing textures as evidence that a person is present. It keeps detection accuracy high under physical attacks while cutting false alarms on texture-only images from 46.9% to 7.3%.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Texture-FPR gain may reflect overfitting to the SICA negative's exact generation recipe; physical test is too narrow to confirm shortcut suppression generalizes.","rationale":"The reader's weakest assumption—that the texture-only negative faithfully captures the shortcut cue and that pushing features away from it reduces real-world texture-triggered false positives—is exactly the load-bearing point I identify. The paper's own diagnostic metric (texture FPR) is generated by the same compositing procedure as the training negative, creating a risk of circular evaluation. This does not invalidate the empirical results, but it means the central claim of shortcut-resistant learning is not yet established by the rendered-nuScenes and synthetic-negative evidence alone. The physical-world experiment partially mitigates this, but it uses only two textures from the same research group and does not systematically vary the negative-presentation mode. My proposed test would settle whether the low texture FPR reflects a general invariance to adversarial texture as an independent cue or a narrow rejection of the synthetic negative distribution. Since this concern is specific and testable, and the paper is otherwise strong (detailed ablations, multiple detectors, latency analysis, reproducible code), the appropriate verdict remains CONDITIONAL—i.e., UNCHANGED relative to the reader's assessment—pending the additional evaluation.","tokens_in":22185,"tokens_out":4372,"duration_ms":53349,"concrete_test":"Evaluate InsCAT on human-free texture inputs that are out-of-distribution relative to the training negative generation: (1) AdvTexture/AdvPatch printed on a flat card held in natural scenes, (2) full-body adversarial textures applied to a mannequin or clothing on a hanger with no person, and (3) adversarial textures rendered on blank backgrounds without the tiling/cropping/sparse-mask recipe used in Sec. 3.4. If texture FPR remains near 7% across all three, the shortcut suppression generalizes; if FPR rises toward the AT-Mix level (e.g., >30%), the reported 7.3% is an artifact of matching the training negative distribution. A complementary check is to vary the negative-generation procedure during training (e.g., different tiling scales, masks, or natural backgrounds) and confirm that texture-FPR gains persist.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central evidence for shortcut suppression is the texture false-positive rate (FPR) on human-free texture-only inputs (Sec. 4.3.2, Fig. 5), which drops from 46.9% (AT-Mix) to 7.3% (InsCAT). However, the texture-only negative used in the SICA loss (Eq. 11) is generated by the exact same procedure: compositing the current adversarial texture onto a blank background via random scaling, tiling, cropping, and sparse masking (Sec. 3.4). The texture-FPR evaluation uses essentially the same human-free texture-only images. Thus the metric is not independent of the training objective: SICA explicitly pushes adversarial-person features away from this synthetic negative, so low texture FPR may simply mean the detector has learned to reject that specific synthetic input distribution, not that it has ceased using texture as a cue when the texture appears on real persons or in natural contexts. The physical experiments (Sec. 4.6) use only two textures (AdvReal-v5 and AdvSerial-v5), both from the same group that developed the training attack generator (Refs. [20,21]), and the 'handheld texture' cases resemble the training negative. This is the most load-bearing concern because it questions whether InsCAT actually achieves shortcut-resistant representations or merely overfits to the negative-generation pipeline.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper identifies a failure mode in physical adversarial training for person detectors, which it calls the patch texture shortcut: when an optimized clothing texture repeatedly co-occurs with positive person instances, the detector learns to use the texture itself as evidence of person presence. This leads to high attack AP together with false detections on human-free texture-only inputs and poor transfer to unseen textures. The authors propose InsCAT, which combines ROPO (a rendering-amortized online texture optimizer), SICA (an instance-level contrastive alignment that pulls adversarial-person features toward matched clean-person features and pushes them away from texture-only negatives), and an adversarial guard that coordinates the training schedule. The method is evaluated on rendered nuScenes, INRIAPerson, printed garments, and three detector families. The main reported results are an average attack AP of 82.3% on rendered nuScenes (11.1 points above the strongest baseline PAD), a texture false-positive rate reduction from 46.9% (AT-Mix) to 7.3% (InsCAT), and a physical-world F1 of 96.6% with FPR 1.8%.","tokens_in":22573,"tokens_out":6947,"duration_ms":77887,"significance":"If the central claim holds, the paper makes a useful contribution: it provides a concrete diagnosis of shortcut learning in physical adversarial training and a training mechanism that explicitly targets texture-based decision cues while preserving clean accuracy and direct-inference latency. The paper's strengths include a clean ablation isolating the SICA objective (Table 5), evaluation on several independently generated attack textures, cross-architecture validation, and a training-efficiency analysis of ROPO. The code is promised publicly. The main risk is that the central shortcut-resistance metric (texture FPR) is generated by the same synthetic procedure used to create the SICA negatives, so the reported reduction may reflect specialization to that input distribution rather than general shortcut suppression. This concern, together with the partially confounded clean-rendered comparison and the narrow physical evaluation, prevents immediate acceptance.","major_comments":[{"comment":"The central evidence for shortcut suppression is the texture FPR on human-free texture-only images (Fig. 5). These images are constructed by the same five-step procedure used for the SICA negative x_neg(p*) in Sec. 3.4: random scaling, tiling, cropping, sparse masking, and compositing onto a blank background. SICA explicitly optimizes the adversarial embedding to be dissimilar from this exact synthetic distribution. A low FPR on this recipe therefore does not establish that the detector has ceased using texture as a cue when texture appears on persons or in natural scenes; it may only have learned to reject the specific 'blank background + sparse mosaic' input class. The held-out textures in Fig. 5 vary texture appearance but not the composition recipe, so they do not break this correlation. The physical 'handheld texture' condition resembles the same blank-background negative. Please ad","section":"§3.4, §4.3.2, Eq. (11)"},{"comment":"The headline 11.1-point gain over PAD is not a like-for-like training comparison. InsCAT is fine-tuned on rendered nuScenes composites (404 CAMFRONT backgrounds) and on COCO with rendered adversarial instances, whereas PAD and the other purification baselines use the same frozen pretrained detector without any rendered-domain training. This explains the large clean-rendered improvement (96.0 vs 80.6) and likely contributes to the attack-AP margin. The internal AT-Mix baseline, matched in rendering exposure and training schedule, is the correct adversarial-training comparator; its gap to InsCAT is much smaller (78.1 vs 82.3 AP in Sec. 4.3.2, or 0.802 vs 0.773 AP50 in Table 5). Please report like-for-like adversarial-training baselines (AT-Mix, plus PBCAT on YOLOv5n if feasible) with error bars, and qualify the PAD comparison as an inference-only comparison.","section":"§4.1, §4.2.1, Table 1"},{"comment":"The physical validation uses one subject and two garments (AdvReal-v5 and AdvSerial-v5), both produced by the same group that developed the training attack optimizer (Refs. [20,21]); ROPO's 3D branch is explicitly built on [20]. The 'handheld texture' condition also resembles the blank-background negative used in training. This setup is too narrow to support the claim that FPR suppression generalizes to independently generated physical textures. Please add more subjects, garments, and environments, ideally with textures produced by an independent source, and report failure cases and per-sequence variability.","section":"§4.6, Table 9"},{"comment":"The main cross-attack and physical tables report single runs without error bars or significance tests. Table 7 shows run-to-run standard deviations around 0.01–0.03 for INRIAPerson AP50 and 0.03 for nuScenes AP50, which suggests that some of the reported differences could be within noise. Please report mean±std over at least three seeds for the central comparisons, and state whether the 11.1-point margin over PAD and the FPR reduction are statistically significant.","section":"§4.2, Tables 1–3, 8"}],"minor_comments":[{"comment":"The final phrase 'decision cu' appears to be missing the letter 'e'—should read 'decision cue'.","section":"Abstract"},{"comment":"Clarify that the same reference bounding box is used to define the RoI on the blank negative canvas. Currently the reader has to infer this from Fig. 3 and the phrase 'the bounding box is used only to determine the spatial extent.'","section":"§3.4"},{"comment":"Define the texture-FPR metric precisely: how are detections counted on human-free images, what IoU threshold is used, and are all detections treated as false positives regardless of class confidence?","section":"§4.3.2"},{"comment":"The checkmark notation in the component columns needs a small legend; it is currently not self-explanatory that a checkmark means the component is enabled.","section":"Table 5"},{"comment":"The caption should state what the solid and dashed curves represent for each garment condition and how the per-distance confidence values were aggregated over the five videos.","section":"Fig. 7"},{"comment":"State explicitly which of the reported baselines were retrained (L∞-AT, PBCAT, AT-Mix) and which were used frozen; the current text mentions this for purification methods but not for all adversarial-training baselines.","section":"§4.1"}],"recommendation":"major_revision","confidential_remarks":"The paper has a valuable core idea and the ablations are informative, but the key shortcut metric needs to be shown to generalize beyond the exact synthetic negative-generation recipe used in training. The rendered-domain comparison with PAD is confounded by additional fine-tuning on rendered data; the internal AT-Mix control is the appropriate baseline and should be foregrounded. The physical experiment is too narrow to support the general physical-realizability claim. With additional independent generalization tests, training-matched comparisons, and error bars, the paper could become acceptable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper for two things: it names a real failure mode—adversarial training against physical textures can teach the detector to use the texture itself as person evidence—and it ships a defense, InsCAT, that looks well-engineered and is tested across three detector families, eight attack textures, and a small physical study. The texture-FPR diagnostic is genuinely useful: AT-Mix gets 46.9% FPR on human-free texture inputs while InsCAT drops to 7.3%, and the physical results (F1 96.6%, FPR 1.8%) support the story. The contrastive instance-level alignment (SICA), the amortized online patch optimizer (ROPO), and the validation-driven guard are sensibly combined, and the ablations actually show that Push without Guard hurts separation, which is the kind of detail that suggests the authors understand their own method. The rendered nuScenes gain (82.3 vs 71.2 average attack AP over PAD) is large, though part of the clean-AP improvement comes from fine-tuning on the rendered domain, and the main tables have no error bars or significance tests. The sensitivity study does report means and stds for the key hyperparameters, which is better than most, but the headline comparisons are single runs. The weakest spot—and the stress-test note is right to push on it—is that the texture-FPR evaluation uses essentially the same human-free texture-only images that the SICA loss is trained against. The negative generation recipe (random scale, tile, crop, sparse mask, blank background) is nearly identical on both sides, so a low texture FPR may mean the detector has learned to reject that specific synthetic input distribution rather than that it has stopped using texture cues on real persons. That said, the external evidence partially rescues the claim: texture FPR is low across eight textures, including six not used in training, and the t-SNE and Grad-CAM results show cleaner feature separation and attention on body regions. The physical study is too narrow (one subject, two garments, both from the same group that built the training attack generator) to establish generality on its own, but it is consistent with the digital results. The self-citation concern is real but not damning: AdvReal and AdvSerial are two of the eight evaluation textures, and both come from the authors' own group, which reduces independence; still, the other six textures carry the argument. On balance, the central claim is defensible, the method is novel and reproducible in spirit (code is promised), and the failure mode it addresses is important for anyone working on physical adversarial robustness. Who should read this: people building defenses for pedestrian detection, and anyone evaluating adversarial training under shortcut learning. It deserves a serious referee—the experimental protocol needs tightening (error bars, independent physical evaluation) but the core idea is worth engaging. I would cite it if I were working in this area, and I'd bring it to a reading group; the texture-FPR diagnostic alone is worth discussing. My recommendation: send it to peer review, with the expectation of major revisions on evaluation independence and statistical rigor.","headline":"A solid empirical paper that diagnoses a real texture-shortcut failure in physical adversarial training and offers a plausible fix; the main caveat is that the central shortcut metric is built from the same negative-generation recipe used in training, so independence is weaker than claimed.","tokens_in":23039,"tokens_out":800,"would_cite":true,"duration_ms":11581,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Contrastive adversarial training prevents detectors from using attack texture as independent person evidence, cutting texture-only false positives from 46.9% to 7.3%.","keywords":["adversarial training","physically realizable attack","person detection","shortcut learning","contrastive learning","adversarial texture","object detection","texture false positive"],"falsifier":"After training, generate a new adversarial texture by optimizing against the InsCAT detector itself, composite it onto a blank background, and measure person-confidence detections on that human-free image: if the model fires confidently on the new texture alone (texture FPR well above the reported 7.3% and close to or above the undefended rate), the claim that InsCAT suppresses the texture shortcut rather than memorizing the eight evaluation textures would be refuted.","tokens_in":22092,"feed_emoji":"🛡️","tokens_out":7085,"duration_ms":80760,"temperature":0.7,"pith_summary":"Standard adversarial training against physically realizable attacks can teach a detector the wrong cue: an optimized texture that repeatedly appears on positive person instances becomes evidence for 'person' on its own, so the model fires on human-free texture and fails to transfer to new attack patterns. The paper establishes this 'patch texture shortcut' with a diagnosis metric (texture false-positive rate on human-free inputs) and instance-level feature similarity. It then proposes InsCAT, an instance-level contrastive adversarial training framework whose SICA loss pulls the adversarially textured person's features toward its matched clean-clothing features and pushes them away from a texture-only negative. On rendered driving scenes, InsCAT reaches 82.3% average attack AP, 11.1 points above the strongest baseline, while cutting texture FPR from 46.9% (AT-Mix) to 7.3% and keeping clean AP high. The practical stake is that a detector can report high adversarial AP while still failing on texture-only inputs, and InsCAT shows a training-side fix that removes that gap without a preprocessing stage.","feed_headline":"Contrastive training cuts texture false alarms from 47% to 7%","feed_subtitle":"An instance-level contrastive loss stops detectors from using attack patterns as person evidence, lifting adversarial AP by 11 points.","key_machinery":"SICA (Structure-Invariant Contrastive Alignment) — an instance-level contrastive loss on ground-truth-aligned RoI features that pulls the adversarial person representation toward its matched clean representation and pushes it away from a texture-only negative. Around it, ROPO (Rendering-Amortised Online Patch Optimisation) maintains a single global adversarial texture through cheap 2D/3D optimizations and a render buffer so the attack signal stays online and training remains affordable, and an adversarial guard coordinates clean, adversarial, and contrastive loss weights to prevent robustness forgetting. The machinery's job is to control not just the strength of the adversarial signal during","core_discovery":"The paper's central claim is that the main failure mode of adversarial training against physically realizable person attacks is not weak detection under attack but the evidence the detector learns: repeated co-occurrence of an optimized adversarial texture with positive person labels makes the detector treat the texture pattern itself as an independent decision cue. This 'patch texture shortcut' produces confident person predictions on human-free texture inputs and weak cross-attack generalization, even when attack AP looks strong. The discovery is that this shortcut can be suppressed by instance-level contrastive regulation. InsCAT enforces, per person instance, a triplet relationship: the","pith_inferences":["If the texture shortcut is a general label-coupling phenomenon, the same contrastive-triplet recipe should transfer to other physically realizable attacks where an object-specific pattern is repeatedly paired with positive labels, such as printed patterns on vehicles or signs.","The texture-only negative could be made harder by compositing the texture onto a non-target object (e.g., a mannequin or background surface) rather than a blank canvas; the paper's blank-background choice likely underestimates the shortcut's persistence.","A concrete prediction from the paper's distance analysis: InsCAT's benefit should vanish beyond roughly 15 m, where apparent scale—not texture—limits detection; this suggests scale-aware instance alignment as the next lever.","Because SICA operates on mid-level RoI features, it could be coupled with adaptive attacks that optimize texture to mimic clean-person features; whether the margin δ=0.35 in Eq. (11) holds under such attacks is an open question."],"forward_implications":["Attack AP alone can mask a texture shortcut; reporting texture FPR on human-free inputs and instance-level feature similarity should accompany AP in physical adversarial robustness evaluation.","Instance-level contrastive alignment transfers across detector families (one-stage, two-stage, Transformer) with direct inference and no preprocessing latency.","A single online-optimized texture with a render buffer makes physical adversarial training computationally practical, by amortizing the differentiable rendering cost.","Robustness to unseen attack textures improves more from constraining what the detector learns than from broadening the training attack distribution alone.","Detectors trained this way keep near-clean performance (e.g., 96.0 clean AP on rendered scenes) while resisting eight independently generated textures."],"fun_headline_variants":["Detectors learn texture shortcuts; InsCAT stops the false alarms","Adversarial training's hidden flaw: texture becomes person evidence","Instance-level contrastive loss kills the texture shortcut","Texture-only inputs fool detectors; contrastive fix drops FPR to 7%","Beyond attack AP: why detectors learn the wrong thing and how to fix"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The texture-only negative—the current adversarial pattern composited onto a blank background with no human pixels—faithfully isolates the shortcut cue, so pushing adversarial person features away from it does not discard person-relevant information.","fun_headline_variants_meta":{"raw":{"variants":["Detectors learn texture shortcuts; InsCAT stops the false alarms","Adversarial training's hidden flaw: texture becomes person evidence","Instance-level contrastive loss kills the texture shortcut","Texture-only inputs fool detectors; contrastive fix drops FPR to 7%","Beyond attack AP: why detectors learn the wrong thing and how to fix"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.0002,"raw_usage":{"total_tokens":1234,"prompt_tokens":790,"completion_tokens":444,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":534,"completion_tokens_details":{"reasoning_tokens":355}},"tokens_in":534,"tokens_out":444,"duration_ms":4961,"temperature":1.0,"reasoning_tokens":355,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T08:02:14.688447+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"After training, generate a new adversarial texture by optimizing against the InsCAT detector itself, composite it onto a blank background, and measure person-confidence detections on that human-free image: if the model fires confidently on the new texture alone (texture FPR well above the reported 7.3% and close to or above the undefended rate), the claim that InsCAT suppresses the texture shortcut rather than memorizing the eight evaluation textures would be refuted.","supporting_citations":[],"review_version":1}