A Black-Box Evaluation Framework for Semantic Robustness in Bird's Eye View Detection

Fu Wang; Guangliang Cheng; Wenjie Ruan; Xiangyu Yin; Xiaowei Huang; Yanghao Zhang; Zeyu Fu

REVIEW 3 major objections 4 minor 48 references

A Black-Box Evaluation Framework for Semantic Robustness in Bird's Eye View Detection

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a black-box, query-based framework which adversarially optimises three everyday semantic perturbations—geometric scaling and translation, colour shift, and motion blur—can degrade camera-based Bird's Eye View…

desk verdict New benchmark and optimizer for adversarial semantic robustness in BEV detection, but the surrogate objective needs stronger validation against mAP before the model ranking can be trusted. read the letter →

arxiv 2412.13913 v3 pith:CFA5LJ2N submitted 2024-12-18 cs.CV

Fu Wang , Yanghao Zhang , Xiangyu Yin , Guangliang Cheng , Zeyu Fu , Xiaowei Huang , Wenjie Ruan This is my paper · ORCID

classification cs.CV

keywords black-boxrobustnessevaluationBird'sEyeViewdetectionsemanticperturbationscolourshiftmotionblurgeometrictransformationdeterministicglobaloptimisationSimpleDIRECT

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that existing robustness evaluations of camera-based Bird's Eye View detection are too optimistic because they use randomised or fixed natural corruptions, which measure average-case rather than worst-case behaviour. It proposes a black-box framework that adversarially optimises three common semantic perturbations—geometric transformation, colour shift, and motion blur—to find the perturbation that most degrades a BEV detector's output. The central move is to replace the discontinuous mAP metric with a smoothed, distance-based surrogate function, and then to search over the perturbation parameters with a new deterministic optimisation algorithm called SimpleDIRECT. The authors show that this optimised perturbation consistently reduces mAP far more than random search or fixed natural corruptions, and they use it to benchmark ten recent BEV models. If the framework is sound, it provides a more demanding and more realistic measure of how BEV perception systems will behave under camera anomalies and adverse driving conditions.

What carries the argument

The load-bearing pieces are the surrogate objective and the SimpleDIRECT optimiser. The surrogate is $L(F(S_\theta(x)), y) = \sum_{v=1}^{V} \min(\min D(\hat{y}^v_\theta, y_v), \tau)$, which sums, over all ground-truth boxes, the distance to the closest matching prediction capped at the matching threshold $\tau$; it is continuous and negatively correlated with the number of matched boxes, so maximising it pushes matched boxes away and discourages new matches. SimpleDIRECT is a gradient-free deterministic global optimiser derived from DIRECT: it selects the $R$ highest-scoring nodes by potential improvement $I(\Theta_j) = L(\theta_j) + 0.5\,\delta(\Theta_j)\,\hat{K}_j$, where $\delta$ is the node diameter and $\hat{K}_j$ is the largest observed local slope, and retains the largest-diameter node to keep DIRECT's convergence guarantee. This combination allows a black-box search over high-dimensional perturbation parameters with far fewer model queries than standard DIRECT or Bayesian optimisation.

What would settle it

Look for a BEV model and a perturbation where mAP drops sharply while the value of Eq. (3) barely moves—for example, a perturbation that mainly makes the model emit confident boxes far from any ground truth. Since Eq. (3) only penalises matched pairs, such a case would break the claimed surrogate relationship.

Watch

Extended reading notes

Core claim

The paper's central claim is that worst-case semantic perturbations, found through black-box optimisation, expose vulnerabilities in BEV detection models that random natural-corruption benchmarks miss. Specifically, maximising the surrogate loss in Eq. (3), a sum over ground-truth boxes of the capped 2D centre distance between matched predictions and annotations, drives the number of correctly matched boxes down and thereby degrades mAP. The authors introduce SimpleDIRECT, a simplification of the DIRECT global optimisation algorithm that ranks potential-optimal nodes by a slope-informed improvement score rather than the analytic comparison of Eq. (5), preserving DIRECT's convergence properties while reducing redundant queries. Across colour shift, geometric transformation, and motion blur, SimpleDIRECT outperforms random perturbation, fixed natural corruption, DIRECT, and Bayesian optimisation baselines. The resulting benchmark of ten BEV models finds PolarFormer, which uses a polar-coordinate representation, to be the most robust, while BEVDet, which had looked resilient under natural corruption, is fully compromised with its precision reduced to zero.

Load-bearing premise

Everything rests on the assumption that increasing the summed, capped distance between predicted and ground-truth box centres is a reliable stand-in for reducing detection accuracy; if a model loses accuracy mainly by inventing new false detections, this objective can miss the damage.

Editorial extensions

If this is right

If the framework is right, previously reported robustness numbers from randomised natural-corruption studies understate the worst-case vulnerability of camera-based BEV detection models.
Robustness on clean frames does not predict semantic robustness: models with similar clean mAP can differ sharply under optimised semantic perturbations, as the PolarFormer versus ORA3D and PETR comparisons show.
The black-box nature of the framework means it can be applied to new BEV models without access to their gradients, making it a drop-in robustness evaluation tool.
The case study on the full validation set indicates that optimising perturbations on a small fraction of frames and reusing them across a scene can still degrade performance substantially, so an adversary does not need to query every frame.
The appendix's ImageNet classifier experiments show that SimpleDIRECT also improves attack success rates and runtime over DIRECT on geometric transformations, suggesting the optimiser transfers beyond BEV perception.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: because the surrogate in Eq. (3) only rewards increasing the distance of matched boxes and does not penalise false positives or classification errors, the benchmark may miss a different failure mode in which optimised perturbations mainly cause the model to emit confident boxes far from any ground truth; incorporating such a penalty could yield even stronger attacks.
Editorial inference: the benchmark optimises each frame independently; in a real deployment an attacker would need perturbations that transfer across scenes and camera configurations, so the absolute mAP drops reported here are likely an upper bound on field exploitability.
Editorial inference: the robustness advantage attributed to PolarFormer is tied to its polar-coordinate geometry, but the paper does not isolate that factor from architecture capacity or training details; an ablation that keeps the backbone and training fixed while swapping the coordinate representation would test the causal claim.
Editorial inference: the temporal-information findings in the case study suggest a testable hypothesis—that multi-frame temporal fusion regularises the BEV representation against optimised semantic perturbations—which the paper itself flags as future work.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The paper is worth a serious look. It does two concrete things: it formulates adversarial semantic perturbations for multi-view BEV detection and optimizes them with a new variant of DIRECT, and it benchmarks ten recent BEV models under those perturbations. That benchmark, even if imperfect, is the first of its kind and the results are striking — BEVDet collapses to zero mAP under all three perturbation families while PolarFormer holds up much better. Those findings alone justify referee time.

What's new: the threat model is a clean extension of natural-corruption evaluation (RoboBEV) to worst-case optimization. SimpleDIRECT is a modest but real algorithmic contribution: it replaces the analytic PO condition in DIRECT with a slope-based scoring and top-R selection, and the paper shows it beats standard DIRECT on both the BEV task and ImageNet classifiers. The empirical work is honest — they compare against random search, natural corruptions, DIRECT, and BO-EI.

Where I'm cautious: the surrogate objective in Eq. (3) is the load-bearing piece. It sums capped centre distances and is meant to track mAP degradation, but it doesn't penalize false positives at all, and mAP lives and dies by precision at multiple confidence thresholds. The validation in Fig. 2 only shows correlation with a recall-like match count on five frames and five models. That's too thin to establish that the surrogate is faithful across the ten-model benchmark, especially for models whose failure mode is generating spurious boxes. The appendix ablation adds a classification-score term but doesn't test a false-positive penalty, so the gap remains open. The main benchmark also uses only five frames — no error bars, no significance tests — and the hyperparameters H=6 and R=3 are tuned on the same PETR models that appear in the main comparison. The code isn't released yet, which makes it harder to reproduce the benchmark.

None of this is fatal. The case study on the full validation set, where they optimize on 5% of frames and transfer, is a sensible use of limited compute. The overall picture — optimized semantic perturbations are far more damaging than random corruptions — is directionally solid. But the specific robustness ranking of the ten models should be read with the surrogate gap in mind.

Recommendation: send it to peer review. The central idea is new and the empirical effort is substantial. I'd ask the authors to validate the surrogate against actual mAP on a larger sample, add error bars, and discuss the false-positive blindness explicitly.

Referee Report

3 major / 4 minor

Summary. This paper proposes a black-box robustness evaluation framework for camera-based BEV detection models. The framework defines a bounded space of semantic perturbations (geometric transformation, colour shift, motion blur), introduces a smooth distance-based surrogate L (Eq. 3) as a proxy for the mAP degradation caused by a perturbation, and optimizes L using a new deterministic global optimization algorithm, SimpleDIRECT, which is a modification of DIRECT that prunes potential-optimal nodes based on a slope-based score. The authors evaluate the framework on the nuScenes mini-validation set, compare it with random search, natural corruption, DIRECT, and Bayesian optimization, and provide a robustness benchmark of ten BEV models. They report that PolarFormer is the most robust model and BEVDet is fully compromised under the optimized perturbations. The paper also includes a case study on the full validation set and a generalization experiment of SimpleDIRECT to ImageNet classifiers.

Significance. If the central premise holds—that maximizing the surrogate L reliably identifies perturbations that most degrade mAP/NDS—this framework would be a useful tool for worst-case robustness assessment of BEV models, and SimpleDIRECT would be a modest but useful optimizer improvement. The code is released, and the approach is black-box and model-agnostic. However, the current evidence for the surrogate's fidelity to mAP is insufficient (only recall-like matching counts on five frames), and the benchmark's statistical basis is very thin (five frames, single runs, no error bars). The contribution is therefore promising but not yet established.

major comments (3)

[Section 'Distance-based Objective Function', Eq. (3), and Fig. 2] The surrogate L sums over ground-truth boxes the capped minimum center distance to any same-class prediction. This quantity is insensitive to false positives (predictions far from all ground truths) and to confidence values, while nuScenes mAP depends on precision (hence false positives) and on confidence thresholds. The paper's only validation of L as a proxy is Fig. 2, which plots L and the number of matched boxes against perturbation strength; the number of matches is a recall-like count, not mAP or precision. No empirical correlation between L and actual mAP/NDS is reported. Since every attack and benchmark result in Tables 2 and 3 is generated by maximizing L, the framework's central claim that it finds perturbations that maximally degrade mAP/NDS is not established. I request a direct validation: compute L and mAP for many random and optimized perturbations across a held-out set of frames and models, and report Spearman rank correlation or a scatter plot. If the correlation is weak, the surrogate should be augmented (e.g., with a false-positive penalty).
[Section 'Benchmarking the Semantic Robustness', Table 3] The benchmark is conducted on five uniformly sampled frames from the mini-validation set, and Table 3 reports single point estimates with no error bars, confidence intervals, or significance tests. The claim that 'PolarFormer demonstrates the best robustness' and 'BEVDet is fully compromised' is therefore not supported against small-sample variance. The full validation set case study (Table 4) uses a different transfer protocol and only two models. Please report results over multiple frame samples (e.g., bootstrapping) and multiple independent optimization runs, or provide the full benchmark on the entire validation set, so that the rankings can be assessed statistically.
[Appendix 'Determining the Depth', Fig. 5, and Table 2] The hyperparameters H=6 and R=3 are chosen based on experiments on PETR with ResNet50 and VoVNet backbones. These values are then applied to all ten models in the benchmark without sensitivity analysis. To rule out overfitting to PETR, please show that the relative performance of SimpleDIRECT (and the benchmark rankings) is stable across a range of H and R values, at least on two or three diverse models.

minor comments (4)

[Section 2, Eq. (3)] The sum is not defined for ground-truth boxes with no same-class prediction; please state the convention (e.g., the inner minimum is taken as τ when no prediction of that class exists).
[Section 'Applying Semantic Perturbations', Eq. (8)] The matrix entries are denoted with θ with subscripts that mix horizontal/vertical and scale/translation; consider making the notation explicit (e.g., a 2×3 affine matrix with separate symbols for scale and translation) to aid reproducibility.
[Abstract and Introduction] The phrase 'worst-case' used throughout overstates what a heuristic black-box optimizer can guarantee; consider replacing with 'adversarially optimized perturbations' or 'best-found worst-case'.
[Table 3] The clean-frame NDS/mAP values are computed on only five frames and are far below standard nuScenes results reported elsewhere; please add a note clarifying that these numbers are per-frame averages on the sampled subset and are not directly comparable to full-validation results.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the benchmark reports actual mAP/NDS after optimizing a hand-designed surrogate, and the self-citations are background rather than load-bearing.

full rationale

The derivation chain is not circular. Eq. (3) is a hand-designed, distance-based surrogate for the discontinuous mAP metric, chosen by the authors rather than fitted to the evaluation metric; the paper's headline tables (Tabs. 3, 4, and 7) all report actual nuScenes mAP/NDS measured after optimizing that surrogate, so the evaluation numbers are not outputs of a fitted loss. The validation in Fig. 2 relates the surrogate to matched-box counts rather than to mAP directly, and the Appendix's 'Discussion about the Objective Function' explicitly tests Eq. (13) and concedes that classification scores are omitted ('their impact becomes negligible if the detected boxes are dismissed for falling outside the distance threshold'); this is a surrogate-validity concern, not a circular reduction, because no mAP value is derived from the surrogate by construction. The self-citations to Wang et al. (2023) supply geometric Lipschitz continuity, slope tracking, and a parameter-free DIRECT convergence bound; these are prior published results whose assumptions do not include the BEV robustness ranking, so they are background rather than load-bearing circular support. No fitted parameter is renamed a prediction, no uniqueness claim is imported from the authors' own work, and no known result is merely relabelled. Therefore no circular step meets the quote-and-reduction bar.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical or model-level entities. Its free parameters are experimental hyperparameters (gamma, kernel size, depth, R, query budget), and its main assumptions are continuity properties needed by DIRECT plus the validity of the surrogate objective and the representativeness of the mini subset.

free parameters (5)

Perturbation severity gamma = Colour gamma in [0.1, 0.4], geometry gamma in [0.04, 0.1]; gamma=0.3 for colour and gamma=0.1 for geometry in main…
Hand-chosen bounds define the threat model and directly control the amount of distortion each attack is allowed to apply.
Motion blur kernel size = {5, 7, 9, 11}
Kernel size sets the severity of motion blur; the paper fixes and sweeps these values rather than deriving them from data.
Maximum partition depth H = 6
Selected from experiments in Appendix Fig. 5 on PETR models; used for all benchmark runs, so results depend on this choice.
Number of PO nodes R = 3
Chosen from Table 2 as the best setting on PETR models and then applied across the ten-model benchmark without held-out validation.
Query budget = 2000 queries in Table 2, 2500 queries in the benchmark
The budget determines how thoroughly SimpleDIRECT explores the perturbation space; larger budgets could find stronger attacks and change the benchmark ranking.

assumptions (5)

domain assumption Colour shifting is Lipschitz continuous for small perturbations
Explicitly assumed in the section 'Applying Semantic Perturbations': 'A rigorous proof of continuity for colour projection is beyond the scope of this paper. We assume that colour shifting is Lipschitz continuous for small perturbations.' DIRECT and SimpleDIRECT rely on Lipschitz continuity for their global optimization convergence arguments.
domain assumption Geometric transformation is Lipschitz continuous
The paper cites Li et al. 2021 and Wang et al. 2023 for this property and uses it to justify applying DIRECT to scaling and translation perturbations.
standard math DIRECT convergence guarantees transfer to SimpleDIRECT
The paper relies on Gablonsky 2001 and Theorem 2 from Wang et al. 2023 to state that SimpleDIRECT preserves DIRECT's convergence guarantees because it always selects the largest-diameter node.
ad hoc to paper Eq. (3) is a valid surrogate for mAP and NDS degradation
The objective sums capped centre distances and is only empirically validated on five frames and five models in Fig. 2. It does not penalize false positives or classification errors, so its equivalence to detection precision is not generally established.
domain assumption The nuScenes mini-validation subset is representative of full-set robustness
The ten-model benchmark uses the mini-validation set, and the full-set case study covers only two models with perturbations transferred across frames. Ranking conclusions implicitly assume the mini subset approximates full-dataset behaviour.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Black-Box Evaluation Framework for Semantic Robustness in Bird's Eye View Detection." pith.science (2026). https://pith.science/paper/CFA5LJ2N

@misc{pith2026241213913,
  author       = {Pith},
  title        = {Pith review of: A Black-Box Evaluation Framework for Semantic Robustness in Bird's Eye View Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CFA5LJ2N}},
  note         = {Machine review of arXiv:2412.13913}
}

read the original abstract

Camera-based Bird's Eye View (BEV) perception models receive increasing attention for their crucial role in autonomous driving, a domain where concerns about the robustness and reliability of deep learning have been raised. While only a few works have investigated the effects of randomly generated semantic perturbations, aka natural corruptions, on the multi-view BEV detection task, we develop a black-box robustness evaluation framework that adversarially optimises three common semantic perturbations: geometric transformation, colour shifting, and motion blur, to deceive BEV models, serving as the first approach in this emerging field. To address the challenge posed by optimising the semantic perturbation, we design a smoothed, distance-based surrogate function to replace the mAP metric and introduce SimpleDIRECT, a deterministic optimisation algorithm that utilises observed slopes to guide the optimisation process. By comparing with randomised perturbation and two optimisation baselines, we demonstrate the effectiveness of the proposed framework. Additionally, we provide a benchmark on the semantic robustness of ten recent BEV models. The results reveal that PolarFormer, which emphasises geometric information from multi-view images, exhibits the highest robustness, whereas BEVDet is fully compromised, with its precision reduced to zero.

Figures

Figures reproduced from arXiv: 2412.13913 by the authors.

**Figure 2.** A illustration of the impact of semantic perturba [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** An illustration of the first three iterations of solv [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: A illustration of the impact of semantic perturbations operated at different strengths on five BEV perception models. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 5.** Figure 5: A showcase of conducting DIRECT at depth [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

**Figure 6.** Figure 6: A illustration of the perturbed frames and the BEV perceptions produced by DETR3D. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 40 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

J.; and Ward, R

Abdelfattah, M.; Yuan, K.; Wang, Z. J.; and Ward, R. 2021. Towards Universal Physical Attacks On Cascaded Camera-Lidar 3d Object Detection Models. In IEEE International Conference on Image Processing

work page 2021
[4]

H.; et al

Caesar, H.; Bankiti, V.; Lang, A. H.; et al. 2020. nuscenes: A multimodal dataset for autonomous driving. In CVPR

work page 2020
[5]

Cao, Y.; Wang, N.; Xiao, C.; et al. 2021. Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks. In SSP

work page 2021
[6]

Carlini, N.; Athalye, A.; Papernot, N.; Brendel, W.; Rauber, J.; Tsipras, D.; Goodfellow, I.; Madry, A.; and Kurakin, A. 2019. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705

arXiv 2019
[7]

a henb \

Chen, D.; and Kr \"a henb \"u hl, P. 2022. Learning from all vehicles. In CVPR

work page 2022
[8]

Chitta, K.; Prakash, A.; and Geiger, A. 2021. Neat: Neural attention fields for end-to-end autonomous driving. In ICCV

work page 2021

Show all 48 references

[9]

Chowdhury, A.; Karmakar, G.; Kamruzzaman, J.; Jolfaei, A.; and Das, R. 2020. Attacks on self-driving cars and their countermeasures: A survey. IEEE Access, 8: 207308--207342

2020
[10]

Gablonsky, J. M. X. 2001. Modifications of the DIRECT algorithm. North Carolina state university

2001
[11]

Hendrycks, D.; and Dietterich, T. 2019. Benchmarking neural network robustness to common corruptions and perturbations. In ICLR

2019
[12]

Hu, A.; Corrado, G.; Griffiths, N.; Murez, Z.; Gurau, C.; Yeo, H.; Kendall, A.; Cipolla, R.; and Shotton, J. 2022 a . Model-Based Imitation Learning for Urban Driving. In Adv. Neural Inform. Process. Syst

2022
[13]

Hu, S.; Chen, L.; Wu, P.; Li, H.; Yan, J.; and Tao, D. 2022 b . ST-P3 : End-to-end Vision-based Autonomous Driving via Spatial-Temporal Feature Learning. In ECCV

2022
[14]

Hu, Y.; Yang, J.; Chen, L.; et al. 2023. Planning-oriented Autonomous Driving. In CVPR

2023
[15]

Huang, J.; Huang, G.; Zhu, Z.; et al. 2021. BEVDet: High-performance multi-camera 3d object detection in bird-eye-view. arXiv preprint arXiv:2112.11790

2021 arXiv
[16]

Jaderberg, M.; Simonyan, K.; Zisserman, A.; and Kavukcuoglu, K. 2015. Spatial Transformer Networks. In NeurIPS

2015
[17]

Jiang, Y.; Zhang, L.; Miao, Z.; et al. 2023. PolarFormer: Multi-camera 3D object detection with polar transformer. In AAAI

2023
[18]

R.; et al

Jones, D. R.; et al. 1993. Lipschitzian optimization without the Lipschitz constant. Journal of Optimization Theory and Applications, 79: 157--181

1993
[19]

Kawaguchi, K.; et al. 2015. Bayesian optimization with exponential convergence. In Adv. Neural Inform. Process. Syst

2015
[20]

Kong, L.; Liu, Y.; Li, X.; Chen, R.; Zhang, W.; Ren, J.; Pan, L.; Chen, K.; and Liu, Z. 2023 a . Robo3d: Towards robust and reliable 3d perception against corruptions. In ICCV

2023
[21]

X.; Cottereau, B

Kong, L.; Xie, S.; Hu, H.; Ng, L. X.; Cottereau, B. R.; and Ooi, W. T. 2023 b . Robodepth: Robust out-of-distribution depth estimation under corruptions. arXiv preprint arXiv:2310.15171

2023 arXiv
[22]

Levkowitz, H.; et al. 1993. GLHS: A generalized lightness, hue, and saturation color model. CVGIP: Graphical Models and Image Processing, 55(4): 271--285

1993
[23]

Li, L.; Weber, M.; Xu, X.; et al. 2021. TSS: Transformation-Specific Smoothing for Robustness Certification. In ACM CCS

2021
[24]

Li, Z.; Wang, W.; Li, H.; et al. 2022. Bevformer: Learning bird’s-eye-view representation from multi-camera images via spatiotemporal transformers. In ECCV

2022
[25]

Liang, Y.; and Huang, D. 2021. Large Norms of CNN Layers Do Not Hurt Adversarial Robustness. In AAAI

2021
[26]

Liu, Y.; Wang, T.; Zhang, X.; and Sun, J. 2022. Petr: Position embedding transformation for multi-view 3d object detection. In ECCV

2022
[27]

Ma, Y.; Wang, T.; Bai, X.; et al. 2022. Vision-centric bev perception: A survey. arXiv preprint arXiv:2208.02797

2022 arXiv
[28]

J.; B \" u rkle, C.; Jarquin, J.; Opitz, M.; Oboril, F.; Scholl, K.; and Bischof, H

Mirza, M. J.; B \" u rkle, C.; Jarquin, J.; Opitz, M.; Oboril, F.; Scholl, K.; and Bischof, H. 2021. Robustness of Object Detectors in Degrading Weather Conditions. In IEEE International Intelligent Transportation Systems Conference

2021
[29]

Mohapatra, J.; Weng, T.-W.; Chen, P.-Y.; et al. 2020. Towards verifying robustness of neural networks against a family of semantic perturbations. In CVPR

2020
[30]

Munos, R. 2011. Optimistic Optimization of a Deterministic Function without the Knowledge of its Smoothness. In Adv. Neural Inform. Process. Syst

2011
[31]

A.; and Mao, Z

Park, W.; Liu, N.; Chen, Q. A.; and Mao, Z. M. 2021. Sensor Adversarial Traits: Analyzing Robustness of 3D Object Detection Sensor Fusion Models. In IEEE International Conference on Image Processing

2021
[32]

Piyavskii, S. 1972. An algorithm for finding the absolute extremum of a function. USSR Computational Mathematics and Mathematical Physics, 12(4): 57--67

1972
[33]

Prakash, A.; Chitta, K.; and Geiger, A. 2021. Multi-modal fusion transformer for end-to-end autonomous driving. In CVPR

2021
[34]

Riba, E.; Mishkin, D.; Ponsa, D.; Rublee, E.; and Bradski, G. 2020. Kornia: an Open Source Differentiable Computer Vision Library for PyTorch. In Winter Conference on Applications of Computer Vision

2020
[35]

Shu, M.; Liu, C.; Qiu, W.; and Yuille, A. 2020. Identifying model weakness with adversarial examiner. In AAAI

2020
[36]

Wang, F.; Xu, P.; Ruan, W.; and Huang, X. 2023. Towards Verifying the Geometric Robustness of Large-scale Neural Networks. In AAAI

2023
[37]

Xie, S.; Kong, L.; Zhang, W.; Ren, J.; Pan, L.; Chen, K.; and Liu, Z. 2023 a . RoboBEV: Towards Robust Bird's Eye View Perception under Corruptions. arXiv preprint arXiv:2304.06719

2023 arXiv
[38]

Xie, S.; Li, Z.; Wang, Z.; and Xie, C. 2023 b . On the Adversarial Robustness of Camera-based 3D Object Detection. arXiv preprint arXiv:2301.10766

2023 arXiv
[39]

Xu, P.; Wang, F.; Ruan, W.; Zhang, C.; and Huang, X. 2023. Sora: Scalable Black-Box Reachability Analyser on Neural Networks. In ICASSP

2023
[40]

Yang, R.; Laurel, J.; Misailovic, S.; and Singh, G. 2022. Provable Defense Against Geometric Transformations. In ICLR

2022
[41]

Yang, X.-S. 2010. Engineering optimization: an introduction with metaheuristic applications. John Wiley & Sons

2010
[42]

Yin, X.; Ruan, W.; and Fieldsend, J. 2024. Dimba: discretely masked black-box attack in single object tracking. Machine Learning, 113(4): 1705--1723

2024
[43]

Yu, K.; Tao, T.; Xie, H.; Lin, Z.; et al. 2023. Benchmarking the Robustness of LiDAR-Camera Fusion for 3D Object Detection. In CVPR

2023
[44]

Zhang, C.; Ruan, W.; Wang, F.; Xu, P.; Min, G.; and Huang, X. 2023. Model-agnostic reachability analysis on deep neural networks. In PAKDD

2023
[45]

Zhang, J.; Lou, Y.; Wang, J.; Wu, K.; Lu, K.; and Jia, X. 2022 a . Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles. IEEE Internet Things J. , 9(5): 3443--3456

2022
[46]

Zhang, T.; et al. 2022 b . Proa: A probabilistic robustness assessment against functional perturbations. In ECML PKDD

2022
[47]

Zhang, Y.; Zhu, Z.; Zheng, W.; et al. 2022 c . Beverse: Unified perception and prediction in birds-eye-view for vision-centric autonomous driving. arXiv preprint arXiv:2205.09743

2022 arXiv
[48]

Zhu, Z.; Zhang, Y.; Chen, H.; et al. 2023. Understanding the Robustness of 3D Object Detection With Bird's-Eye-View Representations in Autonomous Driving. In CVPR

2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

J.; and Ward, R

Abdelfattah, M.; Yuan, K.; Wang, Z. J.; and Ward, R. 2021. Towards Universal Physical Attacks On Cascaded Camera-Lidar 3d Object Detection Models. In IEEE International Conference on Image Processing

work page 2021

[4] [4]

H.; et al

Caesar, H.; Bankiti, V.; Lang, A. H.; et al. 2020. nuscenes: A multimodal dataset for autonomous driving. In CVPR

work page 2020

[5] [5]

Cao, Y.; Wang, N.; Xiao, C.; et al. 2021. Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks. In SSP

work page 2021

[6] [6]

Carlini, N.; Athalye, A.; Papernot, N.; Brendel, W.; Rauber, J.; Tsipras, D.; Goodfellow, I.; Madry, A.; and Kurakin, A. 2019. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705

arXiv 2019

[7] [7]

a henb \

Chen, D.; and Kr \"a henb \"u hl, P. 2022. Learning from all vehicles. In CVPR

work page 2022

[8] [8]

Chitta, K.; Prakash, A.; and Geiger, A. 2021. Neat: Neural attention fields for end-to-end autonomous driving. In ICCV

work page 2021