Pith. sign in

REVIEW 3 major objections 6 minor 30 references

Evaluating the Adversarial Robustness of Detection Transformers

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Detection Transformers are substantially vulnerable to standard white-box adversarial attacks, and an attack that uses all decoder-layer losses breaks them with smaller perturbations.

desk verdict The vulnerability survey of DETR variants is solid, but the proposed attack's 'SOTA with less visible perturbations' claim is unsupported because perturbation size is never measured. read the letter →

arxiv 2412.18718 v1 pith:SUNKP2CG submitted 2024-12-25 cs.CV cs.LG

Amirhossein Nazeri , Chunheng Zhao , Pierluigi Pisu This is my paper · ORCID
classification cs.CVcs.LG
keywords adversarialrobustnessDETRobjectdetectionwhite-boxattacksblack-boxtransferabilityFGSMPGDC&Wattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether Detection Transformers (DETR) are robust to adversarial images, and finds that they are not: four DETR variants with ResNet-50 and ResNet-101 backbones lose a large share of average precision under fast gradient sign (FGSM), projected gradient descent (PGD), and Carlini-Wagner (C&W) attacks on both COCO and KITTI. The result matters because DETR is positioned for safety-critical perception in autonomous driving, where a small perturbation to an image could turn a detected pedestrian into a non-detection. To exploit DETR's structure, the authors propose an untargeted attack that first applies a one-step classification perturbation and then runs an iterative C&W-style optimizer that attacks classification, bounding-box regression, and GIoU losses from every decoder layer. On COCO this attack achieves the largest average-precision drop among the tested attacks at qualitatively smaller perturbations than PGD, and its success is reflected in a collapse of the self-attention feature maps. The paper also shows that adversarial examples transfer well among DETR variants but poorly to the CNN-based Faster R-CNN, suggesting that mixed-model ensembles could blunt black-box attacks.

What carries the argument

The load-bearing machinery is the two-stage attack in Algorithm 1. It begins with a one-step FGSM-style update on the classification loss and then optimizes a weighted sum $L_{\mathrm{total}} = \omega_1 L_2(x_{\mathrm{adv}},x) + \omega_2 L_{\mathrm{cls}} + \omega_3 L_{\mathrm{bb}} + \omega_4 L_{\mathrm{iou}}$, where the last two terms are negative $L_1$ and GIoU losses computed from the final output and from each intermediate decoder layer. This loss mixture is what lets the attack push DETR off its object predictions while staying close to the slightly perturbed starting image; the weights $\omega$ are selected by grid search on the same validation set.

What would settle it

Re-run the proposed attack on COCO with the weights in Eq. (9) selected on a separate tuning split and compare AP at matched perturbation budgets (e.g., equal mean $L_2$ distortion or equal $L_\infty$ bound) against PGD and C&W; if PGD or C&W then matches or beats the proposed attack's AP at equal visibility, the paper's 'SOTA performance' claim is falsified. A minimal version: report the mean and standard deviation of AP over several attack runs; if the gap to PGD is within run-to-run noise, the claimed improvement is not established.

Watch

Extended reading notes

Core claim

The central claim is that DETR and its variants are significantly susceptible to standard white-box attacks, and that the proposed intermediate-loss attack is more perturbation-efficient than PGD while matching or exceeding its degradation. Concretely, on COCO, PGD with $\epsilon=0.1$ drops DETR-R50 AP from 0.420 to 0.070, while the proposed attack at $c=0.8$ reaches AP 0.084 on the same model and AP 0.047 on DETR-R50-DC5, below PGD's 0.073 at that model. The authors attribute the attack's effectiveness to its use of the intermediate decoder hidden states: gradients from classification, $L_1$ box regression, and GIoU losses at every decoder layer are combined, so the perturbation disrupts not just the final predictions but the internal representation of objects. Self-attention feature maps from the last encoder layer shrink and lose their object-shaped focus under successful attacks, which the paper reads as evidence that the attention mechanism does not protect DETR against adversarial examples.

Load-bearing premise

The state-of-the-art claim rests on loss weights $\omega$ chosen by grid search and evaluated on the same COCO validation set with single-run AP values, so the reported advantage over PGD and C&W may not be an out-of-sample result.

Editorial extensions

If this is right

  • DETR-based perception systems in safety-critical settings can be degraded by simple white-box attacks, so robustness cannot be assumed from the attention mechanism alone.
  • Because adversarial examples transfer strongly across DETR variants, an attacker with access to any one DETR model can mount effective black-box attacks on other DETR models.
  • Limited cross-network transfer to Faster R-CNN implies that ensembles mixing transformer and CNN detectors may increase black-box robustness.
  • Self-attention feature maps shrink under successful attacks, which offers a diagnostic signal for detecting adversarial inputs and for designing attention-aware defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the decoder-layer losses are the true source of the attack's power, then attaching the same loss stack to a CNN detector with multiple prediction heads should reproduce the effect; this test is not in the paper.
  • The transfer-rate metric in Eq. (7) is normalized by per-model clean AP, so values above 100% do not necessarily mean stronger attacks; reporting matched $L_2$ or $L_\infty$ perturbation norms would sharpen the comparison.
  • Because the loss weights are selected on the validation set, the state-of-the-art claim may be optimistic; a held-out tuning split or cross-validation would tell whether the advantage over PGD and C&W generalizes.
  • The KITTI results show a different attack ranking than COCO, suggesting dataset-specific training and object scales matter; that variation is worth studying rather than treating the COCO result as universal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents an empirical evaluation of the adversarial robustness of four DETR object-detection models (DETR-R50, DETR-R50-DC5, DETR-R101, DETR-R101-DC5) on MS-COCO and KITTI under three standard white-box attacks (FGSM, PGD, C&W) extended to DETR, plus a proposed two-stage attack that combines an initial one-step perturbation with a modified C&W procedure using intermediate decoder losses and a weighted total loss. It also reports intra-network transferability among DETR variants and cross-network transferability to Faster R-CNN, and it analyzes self-attention feature maps. The paper's central claims are that DETRs are significantly vulnerable to standard adversarial attacks and that the proposed attack achieves state-of-the-art performance with less visible perturbations on COCO.

Significance. If the vulnerability results hold, this is a useful reference point for the community: it extends well-known attacks to DETR, provides transferability data across DETR variants and to a CNN detector, and examines self-attention behavior under attack. The large AP drops under PGD and C&W in Table I provide robust support for the core vulnerability claim. However, the proposed attack's 'SOTA with less visible perturbations' claim is not supported by the current evidence, because perturbation size is never quantified, the loss weights are tuned on the same validation set used for evaluation, and no error bars are reported. The paper's main empirical contribution, the vulnerability benchmark, is plausible but needs the tuning and reporting issues addressed; the attack contribution needs substantial additional evidence. No code or machine-checked artifacts are provided at this stage.

major comments (3)
  1. [Sec. V-B.1, Table I, Algorithm 1, Eq. (10)] The claim that the proposed attack 'achieves SOTA performance with less visible perturbations on the COCO dataset' is not testable from the reported data. Table I reports only AP and AR; no L2, L-infinity, or perceptual perturbation-size metric is given for any attack, and Algorithm 1 has no explicit norm budget or projection. Moreover, Eq. (10) defines Loss_dm between x_adv and x where x has already been modified by the initial one-step perturbation in Algorithm 1 (line 2), so the method does not directly minimize distance to the original clean image. The comparison is therefore not apples-to-apples with PGD (which has an L-infinity constraint, although its setup is ambiguous: the text states eps=0.03/0.1 while also specifying L-infinity bounds of +/-10/255) or with C&W (which minimizes L2). Even on the AP axis alone, the SOTA claim is model-dependent: PGD at eps=0.1 achieves lower AP than Ours on DETR-R50 (0.070 vs 0.084) and DETR-R101 (0.060 vs 0.063), while Ours is better only on the two DC5 variants (0.047 vs 0.073 and 0.034 vs 0.063). Quantitative perturbation-size measurements are required before this claim can be assessed.
  2. [Sec. IV-C and Table I] The optimal loss weights omega in Eq. (9) are determined by a grid search on the same COCO validation set that is then used to report the attack comparison in Table I, as stated in Sec. IV-C ('The optimal weight values omega are determined using a grid search approach'). No held-out tuning set, grid range, or final weight values are provided. In addition, all AP/AR numbers are single-run and no error bars or confidence intervals are given, so the differences between Ours and PGD/C&W (for example, 0.047 vs 0.073 for DETR-R50-DC5) cannot be distinguished from run-to-run variation. An out-of-sample evaluation protocol, with standard deviations across at least a few runs, is needed to support the SOTA claim.
  3. [Eq. (7) and Table II] The transferability metric TR in Eq. (7) is not a rate and is not bounded: TR_{m,n} = (AP^m_clean - AP^m_adv(n)) / (AP^n_clean - AP^n_adv(n)) can exceed 100% (e.g., PGD from DETR-R50 to DETR-R50-DC5 in Table II is 109.0%) and can be negative or undefined when the denominator is small. Because it is normalized by the source model's own AP drop, it conflates the source model's vulnerability with the transferability of the perturbations; the reported values may overstate intra-network transferability and understate cross-network transferability. The conclusions that 'PGD demonstrates the best intra-network transferability' and 'FGSM shows the best cross-network transferability' therefore need to be re-derived from raw AP values or from a properly defined transferability measure, such as the ratio of target AP drop at a matched perturbation budget.
minor comments (6)
  1. [Eq. (4), Sec. IV-A] The FGSM formulation is ambiguous: Eq. (4) writes x_adv = x + eps sign(grad_x(-J(θ,x,t_c))) with J defined as a cross-entropy loss, which would decrease the loss if read literally; the accompanying sentence 'we set J = -J' is confusing. Please clarify the sign convention. Also, 'untargated' should be 'untargeted'.
  2. [Sec. IV-C, Algorithm 1] Algorithm 1 has several reproducibility issues: line 10 states 'Update w_i with gradient decent w_i <- grad_{w_i} (...)' but omits the optimizer, learning rate, and iteration count for the inner update; line 11 'if Losstotal does not converge then return' appears inverted, since the method should return when it converges. Please provide the full optimization details and correct the convergence condition.
  3. [Eq. (1)] Eq. (1) has a bracketing error: it reads [softmax(P(θ,x), sigmoid(B(θ,x)] and should be [softmax(P(θ,x)), sigmoid(B(θ,x))]. Similarly, Eq. (3) contains a typo ('ta denotes and ground-truth annotations').
  4. [Sec. V-A.1] The PGD setup is ambiguous: the text says 'eps is set to 0.03, and 0.1, with a total of 10 iterations' and then 'The L-infinity bounds are set to +/-10/255.' If eps is the step size, the total perturbation budget after 10 iterations is not stated; if eps is the L-infinity bound, the 10/255 statement is inconsistent with eps=0.1. Please report the exact budget and step-size schedule.
  5. [Sec. V-C / Fig. 3] The qualitative claim that the proposed attack produces 'the least salient features' in the self-attention maps (Sec. V-C, Fig. 3) is based on a single sample image and should be supported by quantitative measures or by multiple examples.
  6. [General] The paper states that code will be available upon publication, but for a benchmark-style evaluation paper, providing the code and configuration files in the initial submission would substantially improve reproducibility. Also, the 'first comprehensive study' claim in Sec. II should be softened given the prior work on DETR robustness cited in [23]-[25].

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper reports empirical attack evaluations and a proposed attack whose claims are measurements and comparisons, not derivations from their own outputs.

full rationale

The paper's central claims are empirical: DETR models are vulnerable to FGSM, PGD, and C&W, and the proposed intermediate-loss attack degrades COCO/KITTI AP relative to clean baselines. These are measurements on standard benchmarks, and none of the reported quantities is defined in terms of the conclusion it supports. The proposed attack uses DETR's own intermediate losses as a design choice and is then evaluated on DETR models; that is expected methodology for an attack tailored to a family of architectures, not a circular derivation. The hyperparameters omega in Eq. (9) are selected by grid search in Sec. IV-C and evaluated on the same COCO validation set reported in Table I; this is a tuning/selection effect and an out-of-sample limitation, but it is not a case of a fitted parameter being renamed as a prediction. Similarly, the 'SOTA with less visible perturbations' claim lacks a quantitative perturbation-size metric and is therefore hard to verify, but the absence of a measurement is an evaluation gap, not circularity. The paper also does not rely on any load-bearing self-citation: references to prior work concern external baselines, datasets, and classic attacks, and the vulnerability finding is an independent empirical result rather than a restatement of any cited claim. No equation in the paper reduces to another by construction, and no known result is merely renamed. Accordingly, the appropriate finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central numerical claims rest on unverified model checkpoints, a validation-set-tuned attack recipe, and a transferability metric normalized by source-model drop. No new physical or mathematical entities are introduced.

free parameters (3)
  • Loss weights omega1..omega4 = not reported
    Weighting of perturbation, class, box, and IoU losses in Eq. (9); chosen by grid search to maximize attack performance on the same COCO validation set, so the attack comparison absorbs this tuning.
  • Initial perturbation constant alpha = 0.3
    Step size for the one-step initialization in Algorithm 1, chosen by hand; the claimed small-perturbation advantage depends on it.
  • C&W balance constant c for proposed attack = 0.8
    Set for the proposed attack with 200 iterations; no sensitivity analysis on this value is reported.
assumptions (4)
  • domain assumption Pretrained DETR weights from [5] faithfully represent the DETR architecture and the KITTI retraining is representative.
    Evaluation treats model behavior as typical of DETR; no checkpoints or model cards are provided to verify training quality.
  • domain assumption AP and AR on COCO val and the KITTI split are accepted measures of detection performance and attack effectiveness.
    The paper never reports attack success rates or per-instance label confusions, so AP drop is the only quantitative support for misclassification.
  • ad hoc to paper The transferability metric TR in Eq. (7) is a valid way to compare attacks across models with differing clean AP.
    TR is normalized by source-model AP drop and can exceed 100%; the paper interprets values as high or limited without validating the metric or comparing to alternatives.
  • domain assumption Attacks are evaluated as untargeted, so any wrong class or missed detection counts as success.
    The paper's claims about inducing misclassification rely on this definition; targeted or class-specific failures are not reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Evaluating the Adversarial Robustness of Detection Transformers." pith.science (2026). https://pith.science/paper/SUNKP2CG

@misc{pith2026241218718,
  author       = {Pith},
  title        = {Pith review of: Evaluating the Adversarial Robustness of Detection Transformers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SUNKP2CG}},
  note         = {Machine review of arXiv:2412.18718}
}
read the original abstract

Robust object detection is critical for autonomous driving and mobile robotics, where accurate detection of vehicles, pedestrians, and obstacles is essential for ensuring safety. Despite the advancements in object detection transformers (DETRs), their robustness against adversarial attacks remains underexplored. This paper presents a comprehensive evaluation of DETR model and its variants under both white-box and black-box adversarial attacks, using the MS-COCO and KITTI datasets to cover general and autonomous driving scenarios. We extend prominent white-box attack methods (FGSM, PGD, and CW) to assess DETR vulnerability, demonstrating that DETR models are significantly susceptible to adversarial attacks, similar to traditional CNN-based detectors. Our extensive transferability analysis reveals high intra-network transferability among DETR variants, but limited cross-network transferability to CNN-based models. Additionally, we propose a novel untargeted attack designed specifically for DETR, exploiting its intermediate loss functions to induce misclassification with minimal perturbations. Visualizations of self-attention feature maps provide insights into how adversarial attacks affect the internal representations of DETR models. These findings reveal critical vulnerabilities in detection transformers under standard adversarial attacks, emphasizing the need for future research to enhance the robustness of transformer-based object detectors in safety-critical applications.

Figures

Figures reproduced from arXiv: 2412.18718 by the authors.

Figure 2
Figure 2. Robustness Score of DETR variants on KITTI. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 1
Figure 1. Robustness Score of DETR variants on COCO. [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 3
Figure 3. Object detection on a sample image from COCO [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Object detection results on sample images under various adversarial attacks. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 10 canonical work pages

  1. [1]

    Object detection in au- tonomous vehicles: Status and open challenges,

    A. Balasubramaniam and S. Pasricha, “Object detection in au- tonomous vehicles: Status and open challenges,” arXiv preprint arXiv:2201.07706, 2022

    arXiv 2022

  2. [2]

    Benchmarking robustness in object detection: Autonomous driving when winter is coming,

    C. Michaelis, B. Mitzkus, R. Geirhos, E. Rusak, O. Bringmann, A. S. Ecker, M. Bethge, and W. Brendel, “Benchmarking robustness in object detection: Autonomous driving when winter is coming,” arXiv preprint arXiv:1907.07484, 2019

    arXiv 1907

  3. [3]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  4. [4]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly,et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020

    arXiv 2010

  5. [5]

    End-to-end object detection with transformers,

    N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and S. Zagoruyko, “End-to-end object detection with transformers,” in European conference on computer vision . Springer, 2020, pp. 213– 229

    2020

  6. [6]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfel- low, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  7. [7]

    Learning ordered top-k adversarial attacks via adversarial distillation,

    Z. Zhang and T. Wu, “Learning ordered top-k adversarial attacks via adversarial distillation,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2020, pp. 776– 777

    work page 2020

  8. [8]

    Explaining and harness- ing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014

    arXiv 2014

Show all 30 references
  1. [9]

    Towards the science of security and privacy in machine learning,

    N. Papernot, P. McDaniel, A. Sinha, and M. Wellman, “Towards the science of security and privacy in machine learning,” arXiv preprint arXiv:1611.03814, 2016

    2016 arXiv

  2. [10]

    On the robustness of vision transformers to adversarial examples,

    K. Mahmood, R. Mahmood, and M. Van Dijk, “On the robustness of vision transformers to adversarial examples,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 7838–7847

    2021

  3. [11]

    On the adversarial robustness of vision transformers,

    R. Shao, Z. Shi, J. Yi, P.-Y . Chen, and C.-J. Hsieh, “On the adversarial robustness of vision transformers,” arXiv preprint arXiv:2103.15670 , 2021

    2021 arXiv

  4. [12]

    Detects ec: Evaluating the robustness of object detection models to adversarial attacks,

    T. Du, S. Ji, B. Wang, S. He, J. Li, B. Li, T. Wei, Y . Jia, R. Beyah, and T. Wang, “Detects ec: Evaluating the robustness of object detection models to adversarial attacks,” International Journal of Intelligent Systems, vol. 37, no. 9, pp. 6463–6492, 2022

    2022

  5. [13]

    Adversarial attacks on faster r-cnn object detector,

    Y . Wang, K. Wang, Z. Zhu, and F.-Y . Wang, “Adversarial attacks on faster r-cnn object detector,” Neurocomputing, vol. 382, pp. 87–95, 2020

    2020

  6. [14]

    Anchor detr: Query design for transformer-based detector,

    Y . Wang, X. Zhang, T. Yang, and J. Sun, “Anchor detr: Query design for transformer-based detector,” inProceedings of the AAAI conference on artificial intelligence , vol. 36, no. 3, 2022, pp. 2567–2575

    2022

  7. [15]

    Efficient detr: improv- ing end-to-end object detector with dense prior,

    Z. Yao, J. Ai, B. Li, and C. Zhang, “Efficient detr: improv- ing end-to-end object detector with dense prior,” arXiv preprint arXiv:2104.01318, 2021

    2021 arXiv

  8. [16]

    Transferable adversarial attacks on vision transformers with token gradient regularization,

    J. Zhang, Y . Huang, W. Wu, and M. R. Lyu, “Transferable adversarial attacks on vision transformers with token gradient regularization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 16 415–16 424

    2023

  9. [17]

    Towards transferable adversarial attacks on vision transformers,

    Z. Wei, J. Chen, M. Goldblum, Z. Wu, T. Goldstein, and Y .-G. Jiang, “Towards transferable adversarial attacks on vision transformers,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 3, 2022, pp. 2668–2676

    2022

  10. [18]

    Generating transferable adversarial examples against vision trans- formers,

    Y . Wang, J. Wang, Z. Yin, R. Gong, J. Wang, A. Liu, and X. Liu, “Generating transferable adversarial examples against vision trans- formers,” in Proceedings of the 30th ACM International Conference on Multimedia, 2022, pp. 5181–5190

    2022

  11. [19]

    Big transfer (bit): General visual representation learn- ing,

    A. Kolesnikov, L. Beyer, X. Zhai, J. Puigcerver, J. Yung, S. Gelly, and N. Houlsby, “Big transfer (bit): General visual representation learn- ing,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16. Springer, 2020, ...

    2020

  12. [20]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  13. [21]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in International conference on machine learning . PMLR, 2018, pp. 274–283

    2018

  14. [22]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in 2017 ieee symposium on security and privacy (sp). Ieee, 2017, pp. 39–57

    2017

  15. [23]

    Give me your attention: Dot-product attention considered harmful for adversarial patch robustness,

    G. Lovisotto, N. Finnie, M. Munoz, C. K. Mummadi, and J. H. Metzen, “Give me your attention: Dot-product attention considered harmful for adversarial patch robustness,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15 234–15 243

    2022

  16. [24]

    Object-aware transfer-based black-box adversarial attack on object detector,

    Z. Leng, Z. Cheng, P. Wei, and J. Chen, “Object-aware transfer-based black-box adversarial attack on object detector,” inChinese Conference on Pattern Recognition and Computer Vision (PRCV). Springer, 2023, pp. 278–289

    2023

  17. [25]

    Transferable physical attack against object detection with separable attention,

    Y . Zhang, Z. Gong, Y . Zhang, Y . Li, K. Bin, J. Qi, W. Xue, and P. Zhong, “Transferable physical attack against object detection with separable attention,” arXiv preprint arXiv:2205.09592 , 2022

    2022 arXiv

  18. [26]

    Faster r-cnn: Towards real- time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real- time object detection with region proposal networks,” Advances in neural information processing systems , vol. 28, 2015

    2015

  19. [27]

    Ssd: Single shot multibox detector,

    W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, “Ssd: Single shot multibox detector,” in Computer Vision– ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part I 14 . Springer, 2016, pp. 21–37

    2016

  20. [28]

    Deformable detr: Deformable transformers for end-to-end object detection,

    X. Zhu, W. Su, L. Lu, B. Li, X. Wang, and J. Dai, “Deformable detr: Deformable transformers for end-to-end object detection,” arXiv preprint arXiv:2010.04159, 2020

    2010 arXiv

  21. [29]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13 . Springer,...

    2014

  22. [30]

    Are we ready for autonomous driving? the kitti vision benchmark suite,

    A. Geiger, P. Lenz, and R. Urtasun, “Are we ready for autonomous driving? the kitti vision benchmark suite,” in 2012 IEEE conference on computer vision and pattern recognition . IEEE, 2012, pp. 3354– 3361

    2012

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.