Pith. sign in

REVIEW 3 major objections 5 minor 50 references

Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Background-attentive adversarial training keeps YOLO detectors real-time under latency attacks.

desk verdict First specialized defense against latency attacks on NMS; the core result is plausible, but the adaptation protocol and a wrong formula need fixing. read the letter →

arxiv 2412.02171 v2 pith:2LWHWKUY submitted 2024-12-03 cs.CV cs.CR

Tianyi Wang , Zichen Wang , Cong Wang , Yuanchao Shu , Ruilong Deng , Peng Cheng , Jiming Chen (Zhejiang University , Hangzhou
show 1 more author
China)
This is my paper · ORCID
classification cs.CVcs.CR
keywords latencyattacksobjectdetectionadversarialtrainingnon-maximumsuppressionobjectnesslosshardware-adaptivedefenseedgedevicesreal-time
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Latency attacks on object detectors flood the hand-crafted non-maximum suppression (NMS) stage with phantom bounding boxes, pushing inference time past real-time deadlines and risking cascading failures in downstream systems. This paper introduces Underload, an adversarial training defense that targets the same loss the attacks exploit. The authors argue that the objectness loss correlates strongly with the latency-attack objective, making it the right surrogate for attack generation during training, and that background regions are the vulnerable areas where phantom objects first appear. The training method injects perturbations only into background regions through a shrinking mask, and stops once the detector's candidate-box count falls below a hardware-derived capacity bound. On Jetson Orin NX the method restores throughput from 13 to 43 FPS, and it improves robust accuracy by 8-10 points over prior MTD and OOD defenses with a milder clean-accuracy drop.

What carries the argument

The load-bearing machinery is the pairing of the objectness loss as a training-time proxy and a shrinking background mask. Property 1 asserts that gradients of the objectness loss and of the latency-attack loss are highly correlated (cosine similarity 0.875-0.95), justifying the proxy. Property 2 asserts the background boundary margin is smaller than the object boundary margin, so background regions are where phantoms appear first. Property 3 asserts the candidate-box count increases monotonically with mask size, which licenses the iterative mask-shrinking loop in Algorithm 2. The stopping rule is the hardware-capacity bound of Eq. (4), connecting the candidate-box count |C| to the NMS time model of Eq. (3) via measured IoU processing speed SIoU, PCIe bandwidth B, and backbone time Tbackbone.

What would settle it

Measure NMS execution time as a function of candidate-box count on a Jetson Orin NX, solve Eq. (3) for the box count that exactly meets a 33.3 ms total-budget deadline, and compare it with the value given by Eq. (4); the two formulas are not algebraically equivalent, as Eq. (4) omits the linear term and has the opposite sign inside the square root, so a direct latency measurement would reveal the discrepancy.

Watch

Extended reading notes

Core claim

The paper's central claim is that a hardware-adaptive, background-attentive adversarial training scheme can defend against latency attacks on YOLO-family detectors without removing or replacing the NMS module. The defense uses the objectness loss as a proxy for the adversarial objectives of Daedalus, Phantom Sponge, and Overload, and uses a binary mask to focus inner-loop perturbations on background regions, leveraging the empirical finding that phantoms are generated there with smaller perturbations. The algorithm shrinks the mask iteratively, re-training until the expected number of candidate boxes stays below a capacity threshold derived from the device's measured IoU processing speed, PCIe bandwidth, and backbone latency. The reported result is restoration of real-time processing from 13 FPS to 43 FPS on Jetson Orin NX, with consistently higher robust mAP50 than MTD and OOD across VOC, COCO, and BDD.

Load-bearing premise

The algorithm's stopping rule depends on Eq. (4) being a correct solution of the NMS time model in Eq. (3), with the scaling factors α and β properly quantified; if that capacity bound is wrong or uncalibrated, the mask-shrinking loop may stop at the wrong point.

Editorial extensions

If this is right

  • YOLOv3, YOLOv5, and YOLOv8 detectors can maintain 30 FPS real-time operation under Daedalus, Phantom Sponge, and Overload attacks on Jetson Orin NX, with 13-23 ms inference times.
  • The defense transfers across PyTorch, ONNX, and TensorRT implementations, so edge and cloud deployments can be protected without altering the NMS dependency.
  • Underload achieves a more favorable clean-accuracy versus robust-accuracy trade-off than MTD and OOD, with roughly 4% clean mAP drop versus 15-17% for the baselines on YOLOv5s with VOC.
  • Anchor-free detectors such as YOLOv8, which encode objectness within classification, still benefit, indicating the objectness proxy generalizes across the YOLO family.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The background-attention principle suggests a wider design rule: defenses against attacks that exploit post-processing bottlenecks should concentrate adversarial training on the spatial regions the attack actually recruits, not uniformly across the image.
  • The hardware-adaptive stopping scheme could be transplanted to other latency-sensitive perception pipelines, using a measured latency-versus-load curve as the training stop rule.
  • A deployment-grade version of Underload could replace the analytic capacity formula with a directly measured box-count threshold per target device, which would be a testable engineering variant of the paper's idea.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper proposes Underload, an adversarial training defense against NMS-based latency attacks (Daedalus, Phantom Sponge, Overload) on YOLO-family object detectors. The method uses the objectness loss as a proxy for the attack objective, injects perturbations only into background-attentive regions via a mask, and couples the training stopping criterion to a hardware-capacity bound derived from NMS computation and GPU-CPU transfer costs. The authors report table-level robust-accuracy gains over MTD and OOD across PASCAL-VOC, MS-COCO, and BDD, and latency measurements on Jetson Xavier/Orin NX, 4070Ti Super, and A100 GPUs, including a claimed restoration of real-time processing from 13 FPS to 43 FPS on Jetson Orin NX.

Significance. If the empirical claims survive scrutiny, Underload would be a valuable first defense against a recently identified class of denial-of-service attacks on object detectors, with practical relevance to edge deployments. The paper includes a broad evaluation across three YOLO versions, three datasets, and four GPU classes, and it ships source code, which strengthens reproducibility. However, the central hardware-adaptive capacity formula is algebraically incorrect as written, and the robustness evaluation leaves unclear whether the attacks are adapted to the defended models; both issues must be resolved before the reported gains can be interpreted as genuine robustness.

major comments (3)
  1. [§3.2, Eq. (4); §4.2, Eq. (12); Algorithm 2] The closed-form bound in Eq. (4) is not the solution of Eq. (3). Solving α|C|²/S_IoU + β|C|/B < T − T_backbone for |C| yields the positive root |C| < [−β/B + sqrt(β²/B² + 4α(T−T_backbone)/S_IoU)] / (2α/S_IoU). The paper instead prints (S_IoU/(2α))·sqrt(β²/B² − 4α(T−T_backbone)/S_IoU), which has a minus sign inside the square root and omits the linear term. This expression is used verbatim in Eq. (12) and in Algorithm 2 line 1 to compute |C_max|, so the hardware-adaptive stopping rule is based on an incorrect formula. In addition, α and β are never specified, measured, or bounded anywhere in the paper or supplementary, making the capacity threshold not only wrong on its face but also unreproducible.
  2. [§5.1, §5.2, Table 1] The robustness evaluation does not state whether Daedalus, Phantom Sponge, and Overload are re-optimized against each defended model or are generated once against the standard model and then transferred. All three attacks are gradient-based (PGD or universal perturbation training), so if the same perturbations are transferred from the undefended baseline, the higher mAP values for Underload could reflect gradient obfuscation or a changed loss surface rather than genuine robustness. The paper also does not report attack success rates or perturbation budgets per defense. Please specify the exact evaluation protocol, and provide an additional adaptive-attack evaluation (e.g., running Overload-style PGD on the objectness loss of the Underload model) to establish whether the reported gains persist.
  3. [§4.2, Property 3] Property 3 states that the box count E[fθ(x+δ_M)]_box is monotonically increasing in the mask size r_x·r_y, and this monotonicity is used to justify the while-loop termination in Algorithm 2. No proof or direct empirical verification is given. The direction of monotonicity is also ambiguous from the text: Section 4.2 says larger masks "reduce the amount of perturbations injected," whereas Section 5.4 equates mask size with "unprotected area" and reports that box number increases with mask size. Please either prove the property from the attack/defense definitions or provide a direct measurement with error bars, and clarify the mask semantics consistently.
minor comments (5)
  1. [Table 1] The header column "ODD" appears to be a typo for "OOD" used in the text; please unify the notation.
  2. [Eq. (2)] The weight ρ in the Phantom Sponge term is introduced without definition or default value; please state its value or reference the exact setting from [28].
  3. [Algorithm 2, Eq. (4)] The algorithm uses "T_basenet" in line 1 while Eq. (4) uses "T_backbone"; please use consistent notation.
  4. [§5.1] The text says hyperparameters follow [28] with λ1=1, λ3=0, but λ2 is never mentioned; please clarify the full attack hyperparameter tuple.
  5. [§5.2] The paper claims experiments are repeated 5 times (Supplementary C), but Table 1 reports no standard deviations or confidence intervals; please add variance estimates or state that the table shows means and that variances were small.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: robustness and FPS claims are measured post-training against external attacks and baselines; the Eq. (4) algebra issue and adaptive-attack ambiguity are correctness risks, not circular derivation.

full rationale

The paper's central claims (robust mAP under Daedalus, Phantom Sponge, and Overload, and restored FPS on heterogeneous GPUs) are measured after adversarial training rather than obtained by fitting the reported quantities. The training objective in Eqs. (10)-(13) combines an objectness-loss inner maximization, which is empirically correlated with the latency-attack loss in Fig. 4, with a binary background mask and a hardware-capacity stopping rule. The reported accuracy and FPS numbers are outputs of this training and evaluation pipeline, not inputs used to define the method's parameters. The only same-author citations, e.g., [39] for the background boundary-margin definition and [29]/[20] for system-level motivation, are definitions or motivational context; they are not load-bearing because Property 2 is independently validated in Fig. 5 and the defense's effectiveness is measured against external attacks and external baselines (MTD and OOD). The algebraic error in Eq. (4), which is not the correct solution of Eq. (3), and the absence of an explicit statement of whether attacks were re-optimized against each defended model in Sec. 5.1 are substantive correctness and evaluation-validity concerns, but they do not make any reported result equal by construction to a fitted parameter or a self-citation. Under the stated circularity criteria, no derivation step reduces to its own inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests on an NMS latency model with two unreported scaling factors, an empirically asserted correlation between objectness loss and attack objective, an empirical background-vs-object margin inequality, an unproved monotonicity property, and an algebraically incorrect quadratic root. No new physical entities are introduced.

free parameters (3)
  • alpha (NMS quadratic scaling factor) = not reported
    Appears in Eq. (3)-(4) as a scaling factor for the quadratic NMS term; no value or fitting method is given.
  • beta (linear data-transfer scaling factor) = not reported
    Appears in Eq. (3)-(4) as a scaling factor for the linear CPU-GPU transfer term; no value or fitting method is given.
  • Mask/object ratio = 0.9
    Selected on the PASCAL-VOC ablation in Sec. 5.4 (Fig. 7) as the peak robust-accuracy point and then used for the main results; no separate validation split is described.
assumptions (5)
  • domain assumption NMS execution time model: Tnms = a|C|^2 for |C|>N_t and Tnms = alpha|C|^2/S_IoU + beta|C|/B in general
    Used in Eq. (1)-(3); quadratic complexity comes from Overload [3], and the two-term extension with PCIe bandwidth and IoU processing speed is justified only by profiling, with no derivation or fitted constants shown.
  • domain assumption Property 1: perturbations generated from Lobj correlate with perturbations from the latency attack objective Ladv
    Empirically supported in Sec. 4.1, Fig. 4 on PASCAL-VOC; not proven and not shown for all attack variants or for YOLOv8's embedded objectness.
  • domain assumption Property 2: background boundary margin is smaller than object boundary margin
    Empirically supported in Sec. 4.1, Fig. 5; used to justify background-attentive masking.
  • ad hoc to paper Property 3: box count E[f_theta(x+delta_M)]_box is monotonically increasing in mask size r_x * r_y
    Stated as a property in Sec. 4.2 with no formal proof; it drives the mask-reduction schedule in Algorithm 2.
  • standard math The algebraic step from Eq. (3) to Eq. (4)
    Presented as a derivation, but the printed Eq. (4) does not solve Eq. (3); the paper's hardware capacity bound depends on this step.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices." pith.science (2026). https://pith.science/paper/2LWHWKUY

@misc{pith2026241202171,
  author       = {Pith},
  title        = {Pith review of: Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2LWHWKUY}},
  note         = {Machine review of arXiv:2412.02171}
}
abstract

Object detection is a fundamental enabler for many real-time downstream applications such as autonomous driving, augmented reality and supply chain management. However, the algorithmic backbone of neural networks is brittle to imperceptible perturbations in the system inputs, which were generally known as misclassifying attacks. By targeting the real-time processing capability, a new class of latency attacks are reported recently. They exploit new attack surfaces in object detectors by creating a computational bottleneck in the post-processing module, that leads to cascading failure and puts the real-time downstream tasks at risks. In this work, we take an initial attempt to defend against this attack via background-attentive adversarial training that is also cognizant of the underlying hardware capabilities. We first draw system-level connections between latency attack and hardware capacity across heterogeneous GPU devices. Based on the particular adversarial behaviors, we utilize objectness loss as a proxy and build background attention into the adversarial training pipeline, and achieve a reasonable balance between clean and robust accuracy. The extensive experiments demonstrate the defense effectiveness of restoring real-time processing capability from $13$ FPS to $43$ FPS on Jetson Orin NX, with a better trade-off between the clean and robust accuracy.

Figures

Figures reproduced from arXiv: 2412.02171 by the authors.

Figure 1
Figure 1. Visualization of latency attacks [28] generating an over￾whelming number of “phantom objects” and the effectiveness of our defense. bedded NVIDIA Jetson boards. However, in the shadow of these tremendous successes, a new threat called latency attack lurks to impair the real-time processing capability of object detectors [3, 21, 30, 35], which employ hand-crafted Non-Maximum Suppression (NMS) to eliminate duplicate o… view at source ↗
Figure 2
Figure 2. Interactions between GPU-CPU in the NMS. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. System effects of latency attacks. a) # objects vs. NMS [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Adversarial relations between Ladv in [3] and Lobj. a) Pearson coefficient and cosine similarity between the two losses over the PGD iterations; b) Distribution of the cosine similarity for different images in PASCAL-VOC between (Ladv, Lobj) vs. (Ladv, Lcls).The former…
Figure 6
Figure 6. Figure 6: Execution time (ms) across heterogeneous GPUs under [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Ablation study of mask size for clean accuracy and ro [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Validating the background and object semantics by [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Visualization of the entire NMS process: a) original image; 2) pre-processed results with all the prediction boxes; 3) box filtering [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: DETR and RT-DETR inference time evaluation on dif [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Visualization of the training process of YOLOv5s on the PASCAL-VOC dataset. [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]
Figure 12
Figure 12. Figure 12: Precision/Recall curves among different AT methods. [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 38 canonical work pages

  1. [1]

    Under- standing robustness of transformers for image classification

    Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and Andreas Veit. Under- standing robustness of transformers for image classification. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10231–10241, 2021. 1

    work page 2021

  2. [2]

    End-to- end object detection with transformers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to- end object detection with transformers. In European confer- ence on computer vision, pages 213–229. Springer, 2020. 2, 1

    work page 2020

  3. [3]

    Overload: Latency attacks on object detection for edge devices

    Erh-Chung Chen, Pin-Yu Chen, I Chung, Che-Rung Lee, et al. Overload: Latency attacks on object detection for edge devices. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24716– 24725, 2024. 1, 2, 3, 5, 6, 7

    work page 2024

  4. [4]

    Nmtsloth: understanding and testing efficiency degra- dation of neural machine translation systems

    Simin Chen, Cong Liu, Mirazul Haque, Zihe Song, and Wei Yang. Nmtsloth: understanding and testing efficiency degra- dation of neural machine translation systems. In Proceed- ings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 1148–1160, 2022. 3, 1

    work page 2022

  5. [5]

    Dif- fusiondet: Diffusion model for object detection

    Shoufa Chen, Peize Sun, Yibing Song, and Ping Luo. Dif- fusiondet: Diffusion model for object detection. In Proceed- ings of the IEEE/CVF international conference on computer vision, pages 19830–19843, 2023. 2

    2023

  6. [6]

    Adversarial objectness gradient attacks in real- time object detection systems

    Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Adversarial objectness gradient attacks in real- time object detection systems. In 2020 Second IEEE Inter- national Conference on Trust, Privacy and Security in Intel- ligent Systems and Applications (TPS-ISA) , pages 263–272. IEEE, 2020. 1

    work page 2020

  7. [7]

    Dynamic detr: End-to-end object detection with dynamic attention

    Xiyang Dai, Yinpeng Chen, Jianwei Yang, Pengchuan Zhang, Lu Yuan, and Lei Zhang. Dynamic detr: End-to-end object detection with dynamic attention. In Proceedings of the IEEE/CVF international conference on computer vision, pages 2988–2997, 2021. 2

    work page 2021

  8. [8]

    The pascal visual object classes challenge: A retrospective

    Mark Everingham, SM Ali Eslami, Luc Van Gool, Christo- pher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes challenge: A retrospective. In- ternational journal of computer vision, 111:98–136, 2015. 6

    work page 2015

Show all 50 references
  1. [9]

    Rich feature hierarchies for accurate object detection and semantic segmentation

    Ross Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Rich feature hierarchies for accurate object detection and semantic segmentation. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 580–587, 2014. 1, 2

    2014

  2. [10]

    Ilfo: Adversarial attack on adaptive neural networks

    Mirazul Haque, Anki Chauhan, Cong Liu, and Wei Yang. Ilfo: Adversarial attack on adaptive neural networks. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14264–14273, 2020. 3, 1

    2020

  3. [11]

    α-iou: A family of power intersection over union losses for bounding box regression

    Jiabo He, Sarah Erfani, Xingjun Ma, James Bailey, Ying Chi, and Xian-Sheng Hua. α-iou: A family of power intersection over union losses for bounding box regression. Advances in Neural Information Processing Systems, 34:20230–20242,

  4. [12]

    Learning non-maximum suppression

    Jan Hosang, Rodrigo Benenson, and Bernt Schiele. Learning non-maximum suppression. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 4507–4515, 2017. 1

    2017

  5. [13]

    Adversarial attack and defense of yolo detectors in autonomous driving scenarios

    Jung Im Choi and Qing Tian. Adversarial attack and defense of yolo detectors in autonomous driving scenarios. In 2022 IEEE Intelligent Vehicles Symposium (IV), pages 1011–1017. IEEE, 2022. 2, 7, 1

    2022

  6. [14]

    Distill- ing robust and non-robust features in adversarial examples by information bottleneck

    Junho Kim, Byung-Kwan Lee, and Yong Man Ro. Distill- ing robust and non-robust features in adversarial examples by information bottleneck. Advances in Neural Information Processing Systems, 34:17148–17159, 2021. 2, 5

    2021

  7. [15]

    Robust adversarial perturbation on deep proposal-based models

    Yuezun Li, Daniel Tian, Ming-Ching Chang, Xiao Bian, and Siwei Lyu. Robust adversarial perturbation on deep proposal-based models. arXiv preprint arXiv:1809.05962 ,

    arXiv

  8. [16]

    Aide: An automatic data engine for object detection in autonomous driving

    Mingfu Liang, Jong-Chyi Su, Samuel Schulter, Sparsh Garg, Shiyu Zhao, Ying Wu, and Manmohan Chandraker. Aide: An automatic data engine for object detection in autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 14695...

    2024

  9. [17]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceeding...

    2014

  10. [18]

    Ssd: Single shot multibox detector

    Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part I 14, p...

    2016

  11. [19]

    Decoupled weight decay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017. 7

    2017 arXiv

  12. [20]

    Multi-View Do- main Adaptive Object Detection in Surveillance Cameras

    Yan Lu, Zhun Zhong, and Yuanchao Shu. Multi-View Do- main Adaptive Object Detection in Surveillance Cameras. In AAAI Conference on Artificial Intelligence (AAAI), 2023. 1

    2023

  13. [21]

    Slowtrack: Increasing the latency of camera-based percep- tion in autonomous driving using adversarial examples

    Chen Ma, Ningfei Wang, Qi Alfred Chen, and Chao Shen. Slowtrack: Increasing the latency of camera-based percep- tion in autonomous driving using adversarial examples. In Proceedings of the AAAI Conference on Artificial Intelli- gence, pages 4062–4070, 2024. 1, 2, 3

    2024

  14. [22]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. 4, 7

    2017 arXiv

  15. [23]

    Efficient non- maximum suppression

    Alexander Neubeck and Luc Van Gool. Efficient non- maximum suppression. In 18th international conference on pattern recognition (ICPR’06), pages 850–855. IEEE, 2006. 2

    2006

  16. [24]

    Yolov3: An incremental improvement

    Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018. 2, 6, 1 9

    2018 arXiv

  17. [25]

    You only look once: Unified, real-time object de- tection

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object de- tection. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 779–788, 2016. 1, 2

    2016

  18. [26]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. IEEE transactions on pattern analysis and machine intelligence, 39(6):1137–1149, 2016. 1, 2

    2016

  19. [27]

    Generalized in- tersection over union: A metric and a loss for bounding box regression

    Hamid Rezatofighi, Nathan Tsoi, JunYoung Gwak, Amir Sadeghian, Ian Reid, and Silvio Savarese. Generalized in- tersection over union: A metric and a loss for bounding box regression. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 658–666,

  20. [28]

    Phantom sponges: Exploiting non- maximum suppression to attack deep object detectors

    Avishag Shapira, Alon Zolfi, Luca Demetrio, Battista Big- gio, and Asaf Shabtai. Phantom sponges: Exploiting non- maximum suppression to attack deep object detectors. In Proceedings of the IEEE/CVF Winter Conference on Appli- cations of Computer Vision, pages 4571–4580, 2023. ...

    2023

  21. [29]

    Flexible High-resolution Object Detection on Edge Devices with Tunable Latency

    Jiang Shiqi, Lin Zhiqi, Li Yuanchun, Shu Yuanchao, and Liu Yunxin. Flexible High-resolution Object Detection on Edge Devices with Tunable Latency. In ACM International Con- ference on Mobile Computing and Networking (MobiCom) ,

  22. [30]

    Sponge examples: Energy-latency attacks on neural networks

    Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Paper- not, Robert Mullins, and Ross Anderson. Sponge examples: Energy-latency attacks on neural networks. In 2021 IEEE European symposium on security and privacy (EuroS&P) , pages 212–231. IEEE, 2021. 1, 3

    2021

  23. [31]

    Wise- iou: bounding box regression loss with dynamic focusing mechanism

    Zanjia Tong, Yuhang Chen, Zewei Xu, and Rong Yu. Wise- iou: bounding box regression loss with dynamic focusing mechanism. arXiv preprint arXiv:2301.10051, 2023. 2

    2023 arXiv

  24. [32]

    default hyp in yolo

    Ultralytics. default hyp in yolo. https://github.com/ ultralytics/yolov5/tree/master/data/hyps, 2022. Accessed: 2024-7-16. 7

    2022

  25. [33]

    Ultralytics. Yolov5. https://github.com/ultralytics/yolov5,

  26. [34]

    Ultralytics. Yolov8. https : / / github. com / ultralytics / ultralytics, 2024. Accessed: 2024-7-16. 1, 2, 5, 6, 7

    2024

  27. [35]

    Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples

    Derui Wang, Chaoran Li, Sheng Wen, Qing-Long Han, Surya Nepal, Xiangyu Zhang, and Yang Xiang. Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples. IEEE Transactions on Cybernetics, 52 (8):7427–7440, 2021. 1, 2, 3, 6, 7

    2021

  28. [36]

    Generalized uav object detec- tion via frequency domain disentanglement

    Kunyu Wang, Xueyang Fu, Yukun Huang, Chengzhi Cao, Gege Shi, and Zheng-Jun Zha. Generalized uav object detec- tion via frequency domain disentanglement. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1064–1073, 2023. 1

    2023

  29. [37]

    Balance, imbalance, and rebalance: Under- standing robust overfitting from a minimax game perspec- tive

    Yifei Wang, Liangchen Li, Jiansheng Yang, Zhouchen Lin, and Yisen Wang. Balance, imbalance, and rebalance: Under- standing robust overfitting from a minimax game perspec- tive. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. 5

    2023

  30. [38]

    Adversar- ial weight perturbation helps robust generalization

    Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversar- ial weight perturbation helps robust generalization. In Ad- vances in Neural Information Processing Systems , pages 2958–2969. Curran Associates, Inc., 2020. 5

    2020

  31. [39]

    You see what i want you to see: Exploring targeted black-box transferability attack for hash-based image retrieval systems

    Yanru Xiao and Cong Wang. You see what i want you to see: Exploring targeted black-box transferability attack for hash-based image retrieval systems. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1934–1943, 2021. 5

    1934

  32. [40]

    Adversarial examples for se- mantic segmentation and object detection

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for se- mantic segmentation and object detection. In Proceedings of the IEEE international conference on computer vision, pages 1369–1378, 2017. 4

    2017

  33. [41]

    Adc: Adversarial attacks against object detection that evade context consistency checks

    Mingjun Yin, Shasha Li, Chengyu Song, M Salman Asif, Amit K Roy-Chowdhury, and Srikanth V Krishnamurthy. Adc: Adversarial attacks against object detection that evade context consistency checks. InProceedings of the IEEE/CVF winter conference on applications of computer vision,...

    2022

  34. [42]

    Bdd100k: A diverse driving dataset for heterogeneous multitask learning

    Fisher Yu, Haofeng Chen, Xin Wang, Wenqi Xian, Yingying Chen, Fangchen Liu, Vashisht Madhavan, and Trevor Dar- rell. Bdd100k: A diverse driving dataset for heterogeneous multitask learning. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition ...

    2020

  35. [43]

    Towards adversarially ro- bust object detection

    Haichao Zhang and Jianyu Wang. Towards adversarially ro- bust object detection. In Proceedings of the IEEE/CVF In- ternational Conference on Computer Vision, pages 421–430,

  36. [44]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Ma- chine Learning, ICML 2019, 9-15 June 2019, Long Beac...

    2019

  37. [45]

    Dynamic r-cnn: Towards high quality object detection via dynamic training

    Hongkai Zhang, Hong Chang, Bingpeng Ma, Naiyan Wang, and Xilin Chen. Dynamic r-cnn: Towards high quality object detection via dynamic training. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23– 28, 2020, Proceedings, Part XV 16, pages 260–275. Springer,

    2020

  38. [46]

    Detrs beat yolos on real-time object detection

    Yian Zhao, Wenyu Lv, Shangliang Xu, Jinman Wei, Guanzhong Wang, Qingqing Dang, Yi Liu, and Jie Chen. Detrs beat yolos on real-time object detection. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16965–16974, 2024. 2, 1

    2024

  39. [47]

    Enhancing ge- ometric factors in model learning and inference for object detection and instance segmentation

    Zhaohui Zheng, Ping Wang, Dongwei Ren, Wei Liu, Rong- guang Ye, Qinghua Hu, and Wangmeng Zuo. Enhancing ge- ometric factors in model learning and inference for object detection and instance segmentation. IEEE transactions on cybernetics, 52(8):8574–8586, 2021. 2

    2021

  40. [48]

    Deformable detr: Deformable trans- formers for end-to-end object detection

    Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable detr: Deformable trans- formers for end-to-end object detection. arXiv preprint arXiv:2010.04159, 2020. 2

    2010 arXiv

  41. [49]

    Object detection in 20 years: A survey.Proceed- ings of the IEEE, 111(3):257–276, 2023

    Zhengxia Zou, Keyan Chen, Zhenwei Shi, Yuhong Guo, and Jieping Ye. Object detection in 20 years: A survey.Proceed- ings of the IEEE, 111(3):257–276, 2023. 2 10 Can’t Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices S...

    2023

  42. [2022]

    1, 2, 4, 6

    Accessed: 2024-4-26. 1, 2, 4, 6

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.