A Real-Time Defense Against Object Vanishing Adversarial Patch Attacks for Object Detection in Autonomous Vehicles

Jaden Mu

REVIEW 5 major objections 5 minor 14 references

A Real-Time Defense Against Object Vanishing Adversarial Patch Attacks for Object Detection in Autonomous Vehicles

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A temporal-consistency defense detects and masks object-vanishing patches in real-time driving video.

desk verdict A sensible and novel temporal-consistency defense for object-vanishing patches, but the headline numbers are fitted and the method goes blind if the patch is present before or during the reference-frame warm-up. read the letter →

arxiv 2412.06215 v1 pith:FUAJGY7L submitted 2024-12-09 cs.CV cs.AI

Jaden Mu This is my paper · ORCID

classification cs.CVcs.AI

keywords adversarialpatchobjectdetectionautonomousvehiclestemporalconsistencydefensegradientattributionBDD100Kreal-time

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes ADAV, a defense for object detection in autonomous vehicles aimed specifically at object-vanishing adversarial patches. The paper's central claim is that comparing a detector's output on the current frame with its output on a clean frame from 0.5 seconds earlier reliably reveals when a patch has suppressed detections, and that a second stage can then localize and mask the patch to restore them. ADAV is designed to run in real time: clean frames pass straight through at 56 FPS, while attacked frames are processed at 20 FPS after mask-and-rerun. The paper evaluates on BDD100K driving videos and reports that ADAV outperforms the next-best baseline on adversarial mAP (0.36 vs 0.30) while also keeping clean mAP higher (0.44 vs 0.38) because clean inputs are not altered.

What carries the argument

Temporal consistency is the load-bearing mechanism: the paper defines it as the expectation that the same objects appear in similar locations in frames 0.5 seconds apart, so a large MSE between the detector's output tensors indicates an anomaly. The second mechanism is gradient-based attribution: ADAV computes the gradient of that MSE with respect to the input image using guided backpropagation, yielding a saliency map that should highlight patch pixels. A 20x20 box filter with stride 5 converts the saliency map into region-level suspicion scores, and a dynamic threshold n = median + λ·IQR selects outlier regions to mask. The two-stage design means the expensive attribution and masking run only when the first stage flags an attack, which is why clean frames process at nearly full detector speed.

What would settle it

Apply an object-vanishing patch to every frame of a BDD100K video from the first frame onward and run ADAV: expected result if the claim is correct is that detection recall collapses and adversarial mAP returns to the undefended 0.22 level, because no clean reference exists. Alternatively, remove the 0.5-second clean warm-up and verify that the defense does not flag the attack.

Watch

Extended reading notes

Core claim

The paper's central claim is that a two-stage defense built on temporal consistency can protect an object detector from object-vanishing adversarial patches in an autonomous vehicle. The first stage compares the detector's output on the current frame with its output on a reference frame from 0.5 seconds earlier, computing the mean-squared error; an MSE above a tuned threshold k indicates that a patch has entered the view and suppressed detections. The second stage computes the gradient of that MSE with respect to the input image using guided backpropagation, aggregates gradients with strided 20x20 box filters, and masks pixels whose suspicion score exceeds a dynamic threshold n = median + λ·IQR, then re-runs the detector on the cleaned frame. On BDD100K video, this raises adversarial mAP from 0.22 (undefended) to 0.36 while keeping clean mAP at 0.44, and runs at 56 FPS on clean frames and 20 FPS on attacked frames.

Load-bearing premise

The defense assumes that a clean, unpatched reference frame exists 0.5 seconds before the target frame; if the patch is present from the start, or the vehicle turns sharply or lighting changes abruptly, the temporal-consistency signal is no longer a reliable indicator of an attack.

Editorial extensions

If this is right

A detector paired with ADAV can maintain a clean-frame throughput of 56 FPS, so the defense can run continuously rather than on-demand.
On attacked frames, the defense runs at 20 FPS, still within a plausible real-time budget for a perception pipeline.
Because clean frames skip the localization stage, the defense's clean mAP (0.44) is nearly identical to the undefended detector (0.46), unlike preprocessing defenses that degrade clean inputs.
Large patches (scale >0.8) are detected with 0.95 recall, meaning nearly all full-scale patch attacks are flagged for masking.
The approach applies to any differentiable object detector, not just YOLOv5s, since the consistency and attribution steps only require gradients of the detector output.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The clean-reference assumption implies an adaptive attacker could evade detection by making the patch appear gradually, so the detector output changes slowly and never exceeds the MSE threshold; the paper does not consider this attack.
The 0.5-second reference lag means the defense will flag legitimate scene changes (sharp braking, cut-ins, lighting changes) as anomalies; the dynamic threshold limits false positives, but the trade-off is not characterized on such traffic events.
Because the cleaned output queue is populated with outputs of frames the defense itself cleaned, any missed patch early in a video could poison the reference for later frames; a single false negative could cascade.
The masking step replaces suspected regions with a neutral color, so objects partially covered by a patch are lost; inpainting (which the paper names as future work) would be needed to recover the underlying scene.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core idea here is good and worth taking seriously: use temporal consistency between video frames to detect object-vanishing patches, then localize with gradient-based attribution and mask. That combination is new in the object-detection defense literature, and the two-stage design (skip the expensive masking on clean frames) is a real practical advantage. Running at 56 FPS clean and 20 FPS attacked on a T4 is a legitimate result, and the evaluation on BDD100K with a moving patch model is much closer to the driving context than the usual image-level benchmarks. The author also picked sensible baselines.

The problems are real but localized. Section 3.5 tunes k and lambda by grid search on the same 100 videos used to produce Table 2. That makes the reported 0.36 adversarial mAP a fitted number, not an unbiased performance estimate. No error bars, no multiple seeds, no train/validation split within the evaluation set. So the numerical advantage over LGS should be read as "best case after tuning," not as a head-to-head comparison.

The more structural issue is the clean-reference assumption. ADAV initializes its 0.5-second queue from the first frames of the video, described in Section 3.2 as "assumed to be clean." If a patch is already present when the queue fills, or appears during that warm-up, the detector's outputs are suppressed on both the reference and target frames, the MSE stays near the clean level, and the first stage never fires. The evaluation inserts patches at 1-10 seconds, so it never exercises this regime. That is not a tweakable parameter; it is a blind spot in the threat model. The author acknowledges the assumption in the text but does not quantify how much performance collapses when the patch is persistent from frame zero.

A related soft spot is the absence of adaptive attacks. A patch optimizer that knows the temporal-consistency signal could aim for low output MSE between frames, and the paper does not test that. Also, no code or seeds are provided, which limits reproducibility.

On balance, the paper is a solid first step, clearly written, and the central mechanism is plausible. The evaluation just needs to be rebuilt around a proper parameter selection protocol and an explicit persistent-patch scenario. I would send this to peer review rather than desk-reject, but with the expectation of major revision, not minor cleanup.

Referee Report

5 major / 5 minor

Summary. The paper proposes ADAV, a two-stage defense against object-vanishing adversarial patch attacks on object detection in driving video. Stage 1 detects an attack by comparing YOLOv5s outputs for the current frame against a reference frame from 0.5 s earlier, using the MSE between output tensors and a threshold k. When the MSE exceeds k, Stage 2 computes guided-backpropagation gradients of that MSE with respect to the input, downsamples the saliency map into 20x20 regions with a stride of 5, thresholds suspicious regions using a dynamic threshold n = x-tilde + lambda*Q, masks those pixels, and reruns the detector. Clean outputs are stored in a queue so that the reference is always clean. Experiments are run on 100 BDD100K videos, converted into 100 synthetic adversarial videos by inserting a universal patch at a random time between 1 and 10 s; the paper reports attack detection rate, mAP@IoU=50 for clean and adversarial inputs, and FPS on a T4 GPU, comparing against LGS, JPEG compression, and Universal Defense Frames.

Significance. The conceptual mechanism is well motivated for AV perception: temporal consistency is a natural signal for patch-induced vanishing attacks, and the two-stage design sensibly keeps latency low on clean frames while concentrating computation on suspected attacked frames. The paper also targets a practically relevant setup with a real driving dataset and a trainable detector. However, the current evidence does not establish the claimed performance. The headline numbers in Table 2 are obtained with k and lambda selected by grid search on the same evaluation videos used to report those numbers, there is no uncertainty quantification, the defense is tested against a single non-adaptive patch, and the reference-frame assumption is not stress-tested. The core idea is worth further development, but the evaluation as it stands is not publication-ready.

major comments (5)

[Section 3.5 / Table 2] The reported mAP values are in-sample fits rather than independent predictions. The grid search in Section 3.5 selects k and lambda by maximizing mAP on the same 100 adversarial and 100 clean videos whose results are then presented in Table 2. This makes the headline 0.36 adversarial / 0.44 clean mAP optimistically biased, and it also disadvantages baselines whose parameters were not tuned on the same set. The paper needs a separate validation split or nested cross-validation for parameter selection, final numbers reported on a held-out test set, and the same tuning protocol applied to LGS, JPEG compression, and Universal Defense Frames.
[Section 3.2 / Section 4.4] The temporal-consistency signal is structurally blind to attacks present before or during reference initialization. The queue is initialized from the first 0.5 s of video, which Section 3.2 explicitly 'assumed to be clean,' and detection is triggered only by an output-MSE increase relative to that reference. If an object-vanishing patch is present from the first frame, or becomes active during the warm-up period, both reference and target outputs are suppressed and the MSE can remain near the clean level, so Stage 1 will not flag the frame. The evaluation inserts patches at a random time between 1 and 10 s, so this persistent-attack regime is never exercised. Please evaluate attacks that start before or during the warm-up, and if the defense cannot handle them, state that threat-model restriction explicitly rather than claiming coverage of object-vanishing patch attacks generally.
[Section 4.4 / Section 4.7] The defense is evaluated against a single universal patch trained by the method of [7], with no attacker awareness of ADAV. An adaptive attacker could optimize a patch that keeps the detector output close to the reference-frame output, for example by attacking each frame after initialization or by designing the patch so that the output MSE does not spike when the patch enters the field of view. Such an attack would bypass Stage 1 entirely. A defense paper in this area should include at least one adaptive white-box attack that is aware of the temporal-consistency check, and should specify the assumed attacker knowledge model. Without that, the claim that ADAV 'defends against object vanishing patch attacks' is under-supported.
[Section 4.7 / Section 4.8] No uncertainty quantification is provided. The differences in Table 2, such as adversarial mAP 0.36 for ADAV versus 0.30 for LGS, are point estimates from a single 200-video evaluation set with one patch training run and one grid-search run; there are no confidence intervals, multiple patch seeds, or significance tests. Given the randomness in patch placement, patch scale, and patch training, the claim in Section 4.8 that ADAV 'significantly outperforms' LGS is not statistically supported. Please report bootstrap intervals, multiple independent evaluation runs, or a significance test.
[Section 4.6 / Section 4.7] The detection-rate table and the defense-performance table are not measuring the same regime. Table 1 reports accuracy, precision, and recall only for patches of scale larger than 0.8, where Table 1 shows recall 0.95; for smaller patches recall is 0.52. Table 2, however, reports adversarial mAP averaged over all scales. This can hide the fact that small patches are often missed, and it can also make the defense look better than it is if smaller patches are also weaker attacks. Please stratify adversarial mAP by patch scale and explicitly report what range of scales contributes to the aggregate mAP.

minor comments (5)

[Throughout] There are many formatting artifacts, including 'ADA V', 'A Vs', and 'T able' in place of 'ADAV', 'AVs', and 'Table'; these should be corrected before resubmission.
[Section 3.5] The tuning objective in Section 3.5 is not a well-defined scalarization: a and b are the maxima of adversarial and clean mAP over the grid, but these maxima may be achieved at different parameter settings, and the absolute-difference terms are not normalized, so clean or adversarial performance can dominate the objective depending on the range of each metric. A normalized Pareto scalarization or a reported trade-off curve would be clearer.
[Section 3.3] The choices of the 20x20 box-filter size, the stride of 5, and the masking color are stated but not justified empirically; a sensitivity analysis of these components would help establish that the localization stage is not brittle.
[Section 4.2] The paper reports only the final mAP of the trained YOLOv5s detector; please provide the training and validation curves, image size, batch size, NMS configuration, and the exact confidence threshold used, since these affect all subsequent measurements.
[Table 1] Precision and recall are reported without the underlying confusion-matrix counts; giving the number of true positives, false positives, and false negatives would make the detection-rate results more interpretable.

Circularity Check

1 steps flagged · score 7.0 of 10

Reported ADAV performance is not an independent prediction: k and lambda are selected by grid search on the same evaluation set later reported in Table 2.

fitted input called prediction [Section 3.5 (Parameter Tuning); Section 4.5 (Evaluation Dataset); Section 4.7, Table 2]
"a = max k,λ [mAP (πk,λ(xadv))]; b = max k,λ [mAP (πk,λ(xclean))]; koptimal, λoptimal = arg min k,λ [(a − mAP (πk,λ(xadv))) + (b − mAP (πk,λ(xclean)))] We find koptimal and λoptimal with a grid search. ... A evaluation set was created by randomly selecting 100 videos from the BDD100K dataset. ... The results of this evaluation are in Table 2."

The grid search chooses k and λ to maximize mAP on x_adv and x_clean, and the paper then reports ADAV's adversarial and clean mAP in Table 2 on the same evaluation set described in Section 4.5, with no held-out validation split. Thus the headline result (ADAV 0.36 adversarial mAP, 0.44 clean mAP, outperforming LGS) is the optimized training objective evaluated on the very data used to select the thresholds, not a prediction on unseen data. The dynamic localization threshold n = x̃ + λQ also uses the same fitted λ, so the masking stage inherits the same leakage. This is fitted input called prediction: the advertised 'high performance' is forced by construction to be at least as good as the best grid point on that exact set.

full rationale

The paper's temporal-consistency idea is not circular in itself: it compares YOLO outputs between frames separated by 0.5 s, and the MSE statistics (μ=46.9 vs 25.5) are an empirical observation. No load-bearing self-citation chain or imported uniqueness theorem is present; the cited prior work is external. The only substantive circularity is the evaluation protocol: Section 3.5 defines k_optimal and λ_optimal as the minimizers of a mAP-based objective over x_adv and x_clean, and Sections 4.5 and 4.7 use the same 200-video evaluation set for both tuning and final reporting. No validation split is described. Consequently Table 2's ADAV numbers are fitted values, not independent measurements, and the claim in Section 4.8 that ADAV 'significantly outperforms the next-best LGS' is not supported as a prediction. The skeptical scenario (patch present during the 0.5 s warm-up, making the 'assumed clean' reference also attacked) is a real limitation of the temporal-consistency signal but is not circularity; it belongs in correctness or robustness risk. Overall, one central evaluation step reduces to fitting, so the circularity score is 7 rather than higher, because the method's architecture itself is not defined in terms of the performance numbers.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The defense builds on the empirical assumptions that clean driving scenes are temporally consistent at 0.5s intervals, that the reference frame can be kept clean, and that gradient attribution concentrates on the patch. The two thresholds k and lambda are fitted to the test data, which is the main circularity burden.

free parameters (4)

k (MSE temporal consistency threshold) = not reported in text
Tuned by grid search in Section 3.5 to balance clean and adversarial mAP; the reported performance depends on this choice.
lambda (suspicion score multiplier) = not reported in text
Tuned simultaneously with k in Section 3.5; dynamic threshold n = median + lambda * IQR.
Reference frame interval = 0.5 seconds
Chosen by hand in Section 3.2; controls the sensitivity of the temporal consistency check.
Patch region size and stride = 20x20 box filter, stride 5
Hand-selected in Section 3.3 to balance localization granularity and information loss.

assumptions (5)

domain assumption A clean reference frame exists 0.5s before the target frame
Section 3.2: the queue is initialized from the first 0.5 seconds, which is assumed to be clean or cleaned with LGS.
domain assumption Object detector outputs are temporally consistent on clean driving scenes
Section 3.2: 'the same objects should be detected in similar locations between two frames close to each other temporally'.
domain assumption An object vanishing patch breaks temporal consistency
Section 3.2: 'when an adversarial patch enters... temporal consistency is broken'.
domain assumption Gradient attribution with guided backpropagation localizes the patch
Section 3.3: 'the saliency map should primarily flag pixels in the adversarial patches'; no independent validation of this claim.
domain assumption YOLOv5's one-stage architecture is fully differentiable
Section 3.1: needed for the gradient computation; NMS is not differentiable and its handling is not described.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Real-Time Defense Against Object Vanishing Adversarial Patch Attacks for Object Detection in Autonomous Vehicles." pith.science (2026). https://pith.science/paper/FUAJGY7L

@misc{pith2026241206215,
  author       = {Pith},
  title        = {Pith review of: A Real-Time Defense Against Object Vanishing Adversarial Patch Attacks for Object Detection in Autonomous Vehicles},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FUAJGY7L}},
  note         = {Machine review of arXiv:2412.06215}
}

read the original abstract

Autonomous vehicles (AVs) increasingly use DNN-based object detection models in vision-based perception. Correct detection and classification of obstacles is critical to ensure safe, trustworthy driving decisions. Adversarial patches aim to fool a DNN with intentionally generated patterns concentrated in a localized region of an image. In particular, object vanishing patch attacks can cause object detection models to fail to detect most or all objects in a scene, posing a significant practical threat to AVs. This work proposes ADAV (Adversarial Defense for Autonomous Vehicles), a novel defense methodology against object vanishing patch attacks specifically designed for autonomous vehicles. Unlike existing defense methods which have high latency or are designed for static images, ADAV runs in real-time and leverages contextual information from prior frames in an AV's video feed. ADAV checks if the object detector's output for the target frame is temporally consistent with the output from a previous reference frame to detect the presence of a patch. If the presence of a patch is detected, ADAV uses gradient-based attribution to localize adversarial pixels that break temporal consistency. This two stage procedure allows ADAV to efficiently process clean inputs, and both stages are optimized to be low latency. ADAV is evaluated using real-world driving data from the Berkeley Deep Drive BDD100K dataset, and demonstrates high adversarial and clean performance.

Figures

Figures reproduced from arXiv: 2412.06215 by the authors.

**Figure 1.** The Object Vanishing Adversarial Patch Object detection in AVs is performed on video data, since AVs must constantly process a stream of sequential image data to make real-time decisions. Object vanishing patch attacks can be applied to videos by applying an adversarial patch to each individual frame. However, existing defenses have focused on defending object detection models on singular images. This is reflected… view at source ↗

**Figure 2.** ADAV Methodology 3.2 Patch Detection Intuitively, the same objects should be detected in similar locations between two frames close to each other temporally. This work refers to this concept as temporal consistency. When an object vanishing adversarial patch enters into the field of view of an AV between two temporally close frames, temporal consistency is broken, since the adversarial patch will suppress several … view at source ↗

**Figure 3.** Adversarial vs Clean Performance 4 Experiments 4.1 Dataset This work uses the BDD100K dataset [13] for training YOLOv5s, generating adversarial patches, and for evaluation. The BDD100K dataset is composed of 100,000 40 second long videos recorded at 30 frames per second (FPS) from vehicle dashcams. BDD100K is a diverse dataset containing several vehicle and object types from multiple cities in different weather cond… view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Adversarial Patch 4.4 Synthetic Adversarial Video Creation In a realistic attack scenario, adversarial patches are placed on objects in motion relative to the AV (e.g. signs, other vehicles). To create an adversarially attacked video from a clean video in BDD100K, an a…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 10 canonical work pages

[7]

In: 3rd International Conference on Electrical, Computer, Communica- tions and Mechatronics Engineering (ICECCME 2022) (2022)

Pavlitskaya, S., Hendl, J., Kleim, S., M¨ uller, L., Wylczoch, F., Z¨ ollner, J.M.: Sup- press with a patch: Revisiting universal adversarial patch attacks against object detection. In: 3rd International Conference on Electrical, Computer, Communica- tions and Mechatronics Engineering (ICECCME 2022) (2022)

work page 2022
[1]

https://blog

eduonix: Real world implementations of the yolo algorithm. https://blog. eduonix.com/2022/01/real-world-implementations-of-yolo-algorithm/ , ac- cessed: 2024-06-30

work page 2022
[2]

In: ACM Trans- actions on Multimedia Computing, Communications, and Applications (2023) 12 Jaden Mu jaden.mu@gmail.com

Ferrari, C., Becattini, F., Galteri, L., Bimbo, A.D.: (compress and restore)n: A robust defense against adversarial attacks on image classification. In: ACM Trans- actions on Multimedia Computing, Communications, and Applications (2023) 12 Jaden Mu jaden.mu@gmail.com

work page 2023
[3]

https://github.com/ultralytics/yolov5 (2020)

Jocher, G.: ultralytics/yolov5: v3.1 - bug fixes and performance improvements. https://github.com/ultralytics/yolov5 (2020). https://doi.org/10.5281/ zenodo.4154370, https://doi.org/10.5281/zenodo.4154370

doi:10.5281/zenodo.4154370 2020
[4]

Lee, M., Kolter, Z.: On physical adversarial patches for object detection (2019), https://arxiv.org/abs/1906.11897

arXiv 2019
[5]

Liu, X., Yang, H., Liu, Z., Song, L., Li, H., Chen, Y.: Dpatch: An adversarial patch attack on object detectors (2019), https://arxiv.org/abs/1806.02299

arXiv 2019
[6]

In: 2019 IEEE Winter Conference on Applications of Computer Vision (W ACV) (2019)

Naseer, M., Khan, S.H., Porikli, F.: Local gradients smoothing: Defense against localized adversarial attacks. In: 2019 IEEE Winter Conference on Applications of Computer Vision (W ACV) (2019)

work page 2019
[8]

In: Workshop at Inter- national Conference on Learning Representations (2014)

Simonyan, K., Vedaldi, A., Zisserman, A.: Deep inside convolutional networks: Visualising image classification models and saliency maps. In: Workshop at Inter- national Conference on Learning Representations (2014)

work page 2014

Show all 14 references

[9]

In: 3rd International Conference on Learning Representations (ICLR 2015) (2015)

Springenberg, J.T., Dosovitskiy, A., Brox, T., Riedmiller, M.: Striving for sim- plicity: The all convolutional net. In: 3rd International Conference on Learning Representations (ICLR 2015) (2015)

2015
[10]

In: Proceedings of 31st Annual Network and Distributed System Security Symposium (NDSS 2024) (2024)

Tsuruoka, G., Sato, T., Chen, Q.A., Nomoto, K., Kobayashi, R., Tanaka, Y., Mori, T.: Poster: Adversarial retroreflective patches: A novel stealthy attack on traffic sign recognition at night. In: Proceedings of 31st Annual Network and Distributed System Security Symposium (NDS...

2024
[11]

In: 30th USENIX Security Symposium (USENIX Security 21)

Xiang, C., Bhagoji, A.N., Sehwag, V., Mittal, P.: Patchguard: A provably robust defense against adversarial patches via small receptive fields and masking. In: 30th USENIX Security Symposium (USENIX Security 21). pp. 2237–2254. USENIX As- sociation (Aug 2021), https://www.usen...

2021
[12]

In: Proceedings of Computer and Communications Security (2021)

Xiang, C., Mittal, P.: Detectorguard: Provably securing object detectors against localized patch hiding attacks. In: Proceedings of Computer and Communications Security (2021)

2021
[13]

In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR) 2020 (2020)

Yu, F., Chen, H., Wang, X., Xian, W., Chen, Y., Liu, F., Madhavan, V., Darrell, T.: Bdd100k: A diverse driving dataset for heterogeneous multitask learning. In: IEEE Conference on Computer Vision and Pattern Recognition (CVPR) 2020 (2020)

2020
[14]

IEEE Transactions on Image Processing 31, 6976–6990 (2022)

Yu, Y., Lee, H.J., Lee, H., Ro, Y.M.: Defending person detection against adversar- ial patch attack by using universal defensive frame. IEEE Transactions on Image Processing 31, 6976–6990 (2022). https://doi.org/10.1109/tip.2022.3217375, http://dx.doi.org/10.1109/TIP.2022.3217375

2022

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [7]

In: 3rd International Conference on Electrical, Computer, Communica- tions and Mechatronics Engineering (ICECCME 2022) (2022)

Pavlitskaya, S., Hendl, J., Kleim, S., M¨ uller, L., Wylczoch, F., Z¨ ollner, J.M.: Sup- press with a patch: Revisiting universal adversarial patch attacks against object detection. In: 3rd International Conference on Electrical, Computer, Communica- tions and Mechatronics Engineering (ICECCME 2022) (2022)

work page 2022

[2] [1]

https://blog

eduonix: Real world implementations of the yolo algorithm. https://blog. eduonix.com/2022/01/real-world-implementations-of-yolo-algorithm/ , ac- cessed: 2024-06-30

work page 2022

[3] [2]

In: ACM Trans- actions on Multimedia Computing, Communications, and Applications (2023) 12 Jaden Mu jaden.mu@gmail.com

Ferrari, C., Becattini, F., Galteri, L., Bimbo, A.D.: (compress and restore)n: A robust defense against adversarial attacks on image classification. In: ACM Trans- actions on Multimedia Computing, Communications, and Applications (2023) 12 Jaden Mu jaden.mu@gmail.com

work page 2023

[4] [3]

https://github.com/ultralytics/yolov5 (2020)

Jocher, G.: ultralytics/yolov5: v3.1 - bug fixes and performance improvements. https://github.com/ultralytics/yolov5 (2020). https://doi.org/10.5281/ zenodo.4154370, https://doi.org/10.5281/zenodo.4154370

doi:10.5281/zenodo.4154370 2020

[5] [4]

Lee, M., Kolter, Z.: On physical adversarial patches for object detection (2019), https://arxiv.org/abs/1906.11897

arXiv 2019

[6] [5]

Liu, X., Yang, H., Liu, Z., Song, L., Li, H., Chen, Y.: Dpatch: An adversarial patch attack on object detectors (2019), https://arxiv.org/abs/1806.02299

arXiv 2019

[7] [6]

In: 2019 IEEE Winter Conference on Applications of Computer Vision (W ACV) (2019)

Naseer, M., Khan, S.H., Porikli, F.: Local gradients smoothing: Defense against localized adversarial attacks. In: 2019 IEEE Winter Conference on Applications of Computer Vision (W ACV) (2019)

work page 2019

[8] [8]

In: Workshop at Inter- national Conference on Learning Representations (2014)

Simonyan, K., Vedaldi, A., Zisserman, A.: Deep inside convolutional networks: Visualising image classification models and saliency maps. In: Workshop at Inter- national Conference on Learning Representations (2014)

work page 2014