Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling

Koichi Ito; Masakatsu Nishigaki; Masora Okano; Tetsushi Ohki

REVIEW 4 major objections 3 minor 15 references

Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling

T0 review · 4 major / 3 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A remote adversarial patch built from tiled, scaled copies and a borderline false positive loss can suppress true-positive face detections more effectively than existing remote patch attacks.

desk verdict The border-line false positive loss is mis-specified (Eq. 9 drives confidence down, not up), and the evaluation's ground-truth self-reference makes the headline TP-reduction claim unreliable; only the tiling idea stands up. read the letter →

arxiv 2412.07996 v1 pith:D6L2UCHG submitted 2024-12-11 cs.CV cs.CRcs.LG

Masora Okano , Koichi Ito , Masakatsu Nishigaki , Tetsushi Ohki This is my paper · ORCID

classification cs.CVcs.CRcs.LG

keywords remoteadversarialpatchfacedetectionattacktilingscalingfalsepositivelossprivacyprotection

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to establish that a remote adversarial patch can obstruct face detection even though faces appear at many scales and face detection has only two classes to choose between. The proposed attack tiles a repeatedly scaled patch across the whole image, so any cropped region contains part of the patch, and it trains the patch with a Borderline False Positive Loss that rewards detections hovering just outside the true-face boundary. In experiments with the S3FD face detector, the method produced fewer true-positive detections than two existing remote patch attacks on both CASIA Gait B and FaceForensics++. If the claim holds, the method is a usable privacy tool: it can keep faces from being detected at capture or publication time without modifying the face itself.

What carries the argument

The argument is carried by three mechanisms. Tiling ($T$) repeats a scaled patch $P^S$ periodically across the image as $P^T[x,y]=P^S[x \bmod w_{P^S},\ y \bmod h_{P^S}]$, so every feature-extraction window sees patch pixels regardless of face position. Scaling ($S$) resizes the patch so its area is $\alpha$ times the area of the largest ground-truth face, matching attack strength to face scale. The Borderline False Positive Loss $L_{bfp}=-\sum_j b_{ij}\log(1-\tilde{p}_{ij})$ selects detections whose maximum IoU with a true face lies between thresholds $\theta_T=0.6$ and $\theta_F=0.3$ and raises their confidence, turning true-positive detections into false positives near the face boundary. This combination is what lets a two-class detector be attacked without redirecting the face class to a background class.

What would settle it

Label a held-out set of face images with human-verified bounding boxes and rerun the CGB and FFP experiments using those boxes as ground truth; if the tiled patch no longer reduces true positives below the baseline methods, the claimed obstruction is an artifact of self-grounding.

Watch

Extended reading notes

Core claim

The paper's central claim is that the combination of tiling, scaling, and the Borderline False Positive Loss gives a remote adversarial patch a stronger face-detection obstruction effect than prior remote patch methods. On the CGB test set, true positives dropped to 1,967 with the proposed patch, versus 2,977 for DPatch and 2,967 for the Lee et al. patch; on FFP, they dropped to 3,227 versus 3,305 and 3,287. The authors further claim that the tiling process removes the position constraint: false negatives spread across the whole image instead of concentrating near the patch's fixed origin, and patches trained on the large-face FFP dataset still suppress true positives on the small-face CGB dataset. In the authors' words, the loss "can successfully disturb the coordinate of the true face."

Load-bearing premise

The evaluation treats the attacked detector's own clean-image detections as ground truth, so the reported true-positive counts measure whether the patch suppresses the detector's own outputs; if those clean-image outputs are inaccurate face labels, the obstruction numbers do not directly tell whether real faces were hidden.

Editorial extensions

If this is right

A single tiled patch can suppress true-positive face detections across positions, so the attacker does not need to know where the face will appear in the frame.
Scaling relative to the largest face makes the attack effective across face-size distributions; patches learned on large-face FFP still keep CGB true positives below 2,000.
Because the patch is remote, it can be applied as a background overlay before image publication or capture, leaving the face region itself untouched.
The method transfers across detectors in the tested settings: MTCNN, S3FD, and RetinaFace all show the same dataset-swap tendency.
The low false-positive count relative to the Lee et al. method indicates that the loss function can be refined to generate more false positives while preserving true-positive suppression.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because ground truth is the detector's own pre-patch output, the natural next test is to score the same patches against human-labeled face boxes; that would tell whether the TP drop reflects hiding real faces or merely suppressing the detector's self-consistent boxes.
The tiling grid is a global periodic pattern, so a practical deployment would need to consider how conspicuous or filterable such a patch is; the paper does not address patch stealth.
The borderline false positive idea likely transfers to other binary detectors, such as person-presence or deepfake classifiers, where class redirection is also impossible and boundary-confusing detections are the only lever.
A direct extension would be to combine the borderline loss with a term that encourages false positives more aggressively, since the paper notes that the loss often stayed at zero early in optimization.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The paper's central loss function appears to have the wrong sign, and the evaluation defines ground truth as the attacked detector's own clean-image outputs. That combination makes the headline claim hard to trust.

What's actually new: tiling a remote patch so any crop of the image contains patch pixels is a sensible idea for face detectors, where small faces are common. Scaling the patch to match the face area is a natural extension of DPatch and Lee et al., but I don't think anyone had done exactly this combination for face detection. The positional-robustness experiment (shifting faces and plotting FN heatmaps) is a decent way to show tiling distributes the obstruction effect across the image, and I'd credit that.

The soft spots are load-bearing. Equation (9) defines L = -Σ b log(1-p). Minimizing that drives p toward 0, which suppresses detection confidence. The prose says the loss is meant to increase confidence of borderline detections to create false positives. That's the opposite. The authors' own Section V notes the loss often stayed 0 and optimization stalled, which is exactly what you'd expect from an objective that penalizes high confidence. The data agree: Table I shows the proposed method produces almost no false positives (7 on CGB, 56 on FFP) compared to Lee et al. (38k and 27k). So the "borderline false positive" mechanism is either not implemented as written or not working as claimed.

The evaluation's ground truth is also self-referential. Section IV-A1 sets the GT to the detector's pre-patch detections, so "TP reduction" measures suppression of S3FD's own outputs, not whether real faces are hidden. If S3FD is accurate on these images, that's defensible, but the paper doesn't validate it, and the hyperparameters (alpha, theta_T, theta_F) were tuned on the same evaluation setup. That makes the reported numbers look overfit. There is no code and the results appear to come from single runs, so reproducibility is weak.

The tiling idea and the heatmap are worth a look for someone working on adversarial patches for privacy. But the main contribution—the loss function—is mis-specified or at least unverified, and the evaluation doesn't support the stronger claims. I would not send this to peer review in its current form. The authors should fix the loss, describe what they actually optimized, validate against human-annotated ground truth, and release code. As written, it's a reject.

Referee Report

4 major / 3 minor

Summary. The manuscript proposes a remote adversarial patch (RAP) attack against face detectors, addressing two challenges: variation in face scale and the two-class nature of face detection. The proposed patch application method tiles a scaled patch across the image so that any crop contains patch pixels, and the proposed Borderline False Positive Loss is intended to raise the confidence of detections whose IoU with a true face is in a borderline interval, thereby creating false positives near the face and disturbing true-positive coordinates. Experiments compare the method with DPatch and Lee et al. on CASIA Gait B and FaceForensics++, using S3FD, MTCNN, and RetinaFace, and the paper reports TP/FP counts, F values, and AP. The paper concludes that the proposed method obstructs face detection more effectively than existing remote adversarial patch methods and exhibits robustness to face scale and position.

Significance. The paper addresses an underexplored and practically motivated problem, and the tiling/scaling patch placement is a plausible way to make a remote patch robust to face scale and position. The manuscript evaluates on two datasets and three face detectors, and it is candid about some limitations, such as the loss often being zero during optimization. However, the central loss mechanism appears to be implemented with the wrong sign, the evaluation uses the attacked detector's own pre-attack outputs as ground truth, and the standard metrics in Table I are substantially worse than the comparison method. These issues mean that the paper's main claims, as written, are not supported.

major comments (4)

[Section III-A2, Eq. (9)] The Borderline False Positive Loss is defined as L_bfp = -Σ b_ij log(1 - p̃_ij). The prose states that this loss 'increases the confidence value of the inference results' and thereby creates false positives near the true face. However, for a fixed b_ij, the derivative of -log(1-p) with respect to p is 1/(1-p) > 0, so gradient descent on this loss drives p toward 0, not toward higher confidence. This is exactly the opposite of the stated mechanism. Table I is consistent with confidence suppression rather than false-positive creation: the proposed method produces only 7 FPs on CGB and 56 on FFP, far fewer than Lee et al. (38,235 and 26,866). Section V also states that the loss was often 0 and that a different objective is needed to reduce IoU from 1 to 0.6, which undermines the claim in Section IV-B that the Borderline False Positive Loss successfully disturbed true-face coordinates. If the implementation follows Eq. (9), the actual objective is confidence suppression; if it follows the text, Eq. (9) is not the implemented loss and the experiments are not reproducible from the paper.
[Section IV-A1] The evaluation defines ground truth as the attacked detector's own clean-image detections: the paper states 'GT is the inference result d_i of the image I_i before patch application. Therefore, in the experiment, d_i = g_i.' Consequently, TP/FP/FN are computed with respect to S3FD's pre-attack outputs, not independent face labels. Since the attack only needs to suppress S3FD's own detections, the reported 'obstruction' results do not establish that real faces are hidden; they establish only that S3FD's outputs change. This circularity is load-bearing because the paper's main quantitative argument (fewer TP than other methods) is made entirely in these self-referential terms. A valid evaluation should use an independent face-annotation ground truth, such as a standard benchmark with human-verified bounding boxes, and report detection performance separately for true faces.
[Section IV-B, Table I] Table I shows that the proposed method has substantially higher F and AP (less degradation) than Lee et al. on both datasets: on CGB, F=0.791 vs 0.134 and AP=0.999 vs 0.041; on FFP, F=0.978 vs 0.196 and AP=0.999 vs 0.093. The paper explains that F and AP are insensitive to the quantities of interest, but these are the standard detection metrics, and the comparison as reported indicates that Lee et al. degrades overall detection quality much more aggressively. The proposed method's competitive advantage rests entirely on the TP count under the self-referential ground truth. Without an independent evaluation, the claim of superior obstruction is not established.
[Section IV-A3] The hyperparameters α = 5.58, θ_T = 0.6, and θ_F = 0.3 are reported as 'determined from empirical results' without a validation protocol. If these values were selected based on the same test sets used in Tables I and II, the performance comparisons are not independent. The authors should report a proper training/validation split or an ablation over these parameters, especially because the scaling parameter α directly affects the central claim of scale robustness.

minor comments (3)

[Section III-A2] The notation for the loss is inconsistent: Eq. (9) and the surrounding text use 'L_bf pc' with an extra 'c', while elsewhere it is 'Borderline False Positive Loss' or 'L_bfp'. Please unify the notation.
[Section IV-C] The construction of the coordinate-uniform dataset excludes images for which S3FD produced no inference result before patch application. This selection bias should be discussed, since it removes the hardest cases from the positional-robustness evaluation.
[General] The manuscript contains numerous typographical and formatting errors, including 'Furtermore' in Section III and missing spaces in the abstract. A careful proofread is needed.

Circularity Check

1 steps flagged · score 6.0 of 10

Evaluation ground truth is the attacked detector's own clean inference, so the central TP-reduction claim is measured against S3FD itself.

self definitional [Section IV-A1 (Dataset), Eqs. (5)-(7), and Section IV-B]
"In addition, for the purpose of detection obstruction, GT is the inference result di of the image Ii before patch application. Therefore, in the experiment, di = gi."

TP, FP, and FN are defined in Eqs. (5)-(7) relative to gi, and the experiment sets gi = di, where di is S3FD's own clean-image detection. Thus the reported 'obstruction' is literally 'patched S3FD detections differ from clean S3FD detections,' not 'real faces are no longer detected.' The Section IV-B conclusion that fewer TP 'indicates that Borderline False Positive Loss can successfully disturb the coordinate of the true face' equates S3FD's clean boxes with the true face, so the headline success metric is self-defined by the very model being attacked. Since Eq. (9) minimizes -log(1-p) and thereby drives confidence toward zero, the observed TP drop is a direct change to S3FD's outputs under this self-referential ground truth.

full rationale

The paper contains no self-citation chain, no imported uniqueness theorem, and no ansatz smuggled in via citation; its proposed tiling and scaling are genuine algorithmic contributions. The load-bearing circularity is in the evaluation: Section IV-A1 defines ground truth as di, the attacked detector S3FD's own pre-patch inference, so all TP/FP/FN numbers measure how much the patch changes S3FD relative to itself. Consequently the core claim that fewer TP means the loss 'successfully disturb[s] the coordinate of the true face' (Section IV-B) reduces by construction to 'the patch altered S3FD's outputs,' because the 'true face' is S3FD's own clean detection. A separate, non-circular correctness concern is that Eq. (9) has the opposite sign from the text's description: minimizing -Σ b log(1-p) suppresses confidence, not increases it, and Section V admits the loss was often 0 and optimization did not progress, requiring a different objective to reduce IoU from 1 to 0.6. These sign and optimization issues undermine the stated mechanism but are not circularity per se. Because the central TP-reduction result is evaluated against the attacked model's own detections, the circularity score is 6.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

No invented entities are introduced. The attack relies on empirically tuned thresholds and a scaling parameter, on pseudo-ground-truth from the detector itself, and on an assumed but unverified optimization direction for the loss function. These choices are load-bearing because they determine the reported TP/FP numbers.

free parameters (5)

alpha (scaling parameter) = 5.58
Set from empirical results (Section IV-A3); controls patch size relative to largest ground-truth face area in equation (14), directly shaping optimization.
theta_T (borderline upper IoU threshold) = 0.6
Chosen empirically (Section IV-A3); defines the upper boundary for borderline detections in equation (10).
theta_F (borderline lower IoU threshold) = 0.3
Chosen empirically (Section IV-A3); defines the lower boundary for borderline detections in equation (10).
theta_D (TP/FP IoU threshold) = 0.5
Standard threshold for labeling detections as TP/FP in equations (5)-(7).
patch initial size (wP,hP) = not reported
Patch dimensions are inputs to scaling in equation (13); values are not stated, and the attack result depends on them.

assumptions (5)

domain assumption Detector's clean-image detections are valid ground truth
Section IV-A1 sets gi = di, so all TP/FP/FN counts are relative to the detector being attacked, not independent face labels.
domain assumption Tiling guarantees any cropped region contains patch pixels and that this suffices to influence detection
Section III-B2 states this as the basis for position invariance, but containing patch pixels is assumed sufficient to alter features.
domain assumption Scaling aligns patch area ratio with face area for all face scales
Section III-B1 assumes matching patch area to the largest face area in the image lets a single patch obstruct faces at all scales.
domain assumption A remotely placed patch can alter inference without modifying the target object
Definition of RAP in Section I; the mechanism is assumed rather than derived.
ad hoc to paper Minimizing the Borderline False Positive Loss increases confidence of borderline detections
Equation (9) with min over P and -log(1-p) mathematically decreases confidence as p decreases, contradicting the prose in Section III-A2; the intended optimization direction is an unverified assumption.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling." pith.science (2026). https://pith.science/paper/D6L2UCHG

@misc{pith2026241207996,
  author       = {Pith},
  title        = {Pith review of: Enhancing Remote Adversarial Patch Attacks on Face Detectors with Tiling and Scaling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D6L2UCHG}},
  note         = {Machine review of arXiv:2412.07996}
}

read the original abstract

This paper discusses the attack feasibility of Remote Adversarial Patch (RAP) targeting face detectors. The RAP that targets face detectors is similar to the RAP that targets general object detectors, but the former has multiple issues in the attack process the latter does not. (1) It is possible to detect objects of various scales. In particular, the area of small objects that are convolved during feature extraction by CNN is small,so the area that affects the inference results is also small. (2) It is a two-class classification, so there is a large gap in characteristics between the classes. This makes it difficult to attack the inference results by directing them to a different class. In this paper, we propose a new patch placement method and loss function for each problem. The patches targeting the proposed face detector showed superior detection obstruct effects compared to the patches targeting the general object detector.

Figures

Figures reproduced from arXiv: 2412.07996 by the authors.

**Figure 1.** Schematic diagram of the proposed patch generation method. We propose a patch application method and its learning method to explore the feasibility [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗

**Figure 2.** Detection results for the coordinate uniform dataset. Top row: DPatch, [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 13 canonical work pages

[1]

Privacy visor: Method for preventing face image detection by using differences in human and device sensitivity,

T. Yamada, S. Gohshi, and I. Echizen, “Privacy visor: Method for preventing face image detection by using differences in human and device sensitivity,” in Communications and Multimedia Security: 14th IFIP TC 6/TC 11 International Conference, CMS 2013, Magdeburg, Germany, September 25-26, 2013. Proceedings , vol. 8099, p. 152, books.google.com, 2013

work page 2013
[2]

Ipatch: A remote adversarial patch,

Y . Mirsky, “Ipatch: A remote adversarial patch,” Cybersecurity, vol. 6, no. 1, p. 18, 2023

work page 2023
[3]

DPatch: An ad- versarial patch attack on object detectors,

X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y . Chen, “DPatch: An ad- versarial patch attack on object detectors,” June 2018. arXiv/1806.02299

arXiv 2018
[4]

On physical adversarial patches for object detection,

M. Lee and Z. Kolter, “On physical adversarial patches for object detection,” June 2019. arXiv/1906.11897

arXiv 2019
[5]

Physical adversarial examples for object detectors,

D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Physical adversarial examples for object detectors,” in 12th USENIX workshop on offensive technologies (WOOT 18), 2018

work page 2018
[6]

Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,

S. Thys, W. Van Ranst, and T. Goedeme, “Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,” in 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), IEEE, June 2019

work page 2019
[7]

Multi-scale perturbation fusion adversarial attack on MTCNN face detection system,

C. Zhang, Y . Qi, and H. Kameda, “Multi-scale perturbation fusion adversarial attack on MTCNN face detection system,” in 2022 4th International Conference on Communications, Information System and Computer Engineering (CISCE) , pp. 142–146, IEEE, May 2022

work page 2022
[8]

Design and interpretation of universal adversarial patches in face detection,

X. Yang, F. Wei, H. Zhang, and J. Zhu, “Design and interpretation of universal adversarial patches in face detection,” in Computer Vision – ECCV 2020 , Lecture notes in computer science, pp. 174–191, Cham: Springer International Publishing, 2020

work page 2020

Show all 15 references

[9]

Robust view trans- formation model for gait recognition,

S. Zheng, J. Zhang, K. Huang, R. He, and T. Tan, “Robust view trans- formation model for gait recognition,” in 2011 18th IEEE International Conference on Image Processing , pp. 2073–2076, Sept. 2011

2011
[10]

FaceForensics++: Learning to detect manipulated facial images,

A. Rossler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, and M. Niess- ner, “FaceForensics++: Learning to detect manipulated facial images,” in 2019 IEEE/CVF International Conference on Computer Vision (ICCV) , pp. 1–11, IEEE, Oct. 2019

2019
[11]

rembg: Rembg is a tool to remove images background

D. Gatis, “rembg: Rembg is a tool to remove images background.”
[12]

Nesterov accelerated gradient and scale invariance for adversarial attacks,

J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” Aug
[13]

Joint face detection and align- ment using multitask cascaded convolutional networks,

K. Zhang, Z. Zhang, Z. Li, and Y . Qiao, “Joint face detection and align- ment using multitask cascaded convolutional networks,” IEEE Signal Process. Lett., vol. 23, pp. 1499–1503, Oct. 2016

2016
[14]

S3FD: Single shot scale-invariant face detector,

S. Zhang, X. Zhu, Z. Lei, H. Shi, X. Wang, and S. Z. Li, “S3FD: Single shot scale-invariant face detector,” in Proceedings of the IEEE International Conference on Computer Vision , pp. 192–201, 2017

2017
[15]

Retinaface: Single-shot multi-level face localisation in the wild,

J. Deng, J. Guo, E. Ververas, I. Kotsia, and S. Zafeiriou, “Retinaface: Single-shot multi-level face localisation in the wild,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pp. 5203–5212, openaccess.thecvf.com, 2020. 6

2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Privacy visor: Method for preventing face image detection by using differences in human and device sensitivity,

T. Yamada, S. Gohshi, and I. Echizen, “Privacy visor: Method for preventing face image detection by using differences in human and device sensitivity,” in Communications and Multimedia Security: 14th IFIP TC 6/TC 11 International Conference, CMS 2013, Magdeburg, Germany, September 25-26, 2013. Proceedings , vol. 8099, p. 152, books.google.com, 2013

work page 2013

[2] [2]

Ipatch: A remote adversarial patch,

Y . Mirsky, “Ipatch: A remote adversarial patch,” Cybersecurity, vol. 6, no. 1, p. 18, 2023

work page 2023

[3] [3]

DPatch: An ad- versarial patch attack on object detectors,

X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y . Chen, “DPatch: An ad- versarial patch attack on object detectors,” June 2018. arXiv/1806.02299

arXiv 2018

[4] [4]

On physical adversarial patches for object detection,

M. Lee and Z. Kolter, “On physical adversarial patches for object detection,” June 2019. arXiv/1906.11897

arXiv 2019

[5] [5]

Physical adversarial examples for object detectors,

D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Physical adversarial examples for object detectors,” in 12th USENIX workshop on offensive technologies (WOOT 18), 2018

work page 2018

[6] [6]

Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,

S. Thys, W. Van Ranst, and T. Goedeme, “Fooling automated surveil- lance cameras: Adversarial patches to attack person detection,” in 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), IEEE, June 2019

work page 2019

[7] [7]

Multi-scale perturbation fusion adversarial attack on MTCNN face detection system,

C. Zhang, Y . Qi, and H. Kameda, “Multi-scale perturbation fusion adversarial attack on MTCNN face detection system,” in 2022 4th International Conference on Communications, Information System and Computer Engineering (CISCE) , pp. 142–146, IEEE, May 2022

work page 2022

[8] [8]

Design and interpretation of universal adversarial patches in face detection,

X. Yang, F. Wei, H. Zhang, and J. Zhu, “Design and interpretation of universal adversarial patches in face detection,” in Computer Vision – ECCV 2020 , Lecture notes in computer science, pp. 174–191, Cham: Springer International Publishing, 2020

work page 2020