Pith. sign in

REVIEW 5 major objections 5 minor 66 references

PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read One adversarial training recipe defeats both patch and texture attacks

desk verdict Sensible composite AT recipe, credible transfer results, but the 'strong adaptive settings' claim for texture attacks is not supported by the described evaluation. read the letter →

arxiv 2506.23581 v2 pith:GTPJQ6IQ submitted 2025-06-30 cs.CV cs.AIcs.LG

Xiao Li , Yiming Zhu , Yifan Huang , Wei Zhang , Yingzhe He , Jie Shi , Xiaolin Hu This is my paper · ORCID
classification cs.CVcs.AIcs.LG
keywords adversarialtrainingphysicallyrealizableattackspatchestexturesobjectdetectionpersongradient-guidedpatchselectionrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Object detectors used in autonomous driving and surveillance can be hidden by printed patches or by adversarial clothing textures. This paper argues that one training recipe, PBCAT, can defend a single detector against both types of physically realizable attack. PBCAT trains on a composite perturbation: a small patch inside each object's bounding box, narrowed to the half of its sub-patches with the largest average gradient norms, plus an imperceptible whole-image noise within a tiny $\ell^\infty$ budget. The claimed payoff is person-detection AP50 of 60.2% under AdvTexture and 56.4% under AdvCaT in adaptive white-box tests, with a 29.7 percentage-point gain over prior defenses on AdvTexture and training cost close to standard adversarial training.

What carries the argument

The load-bearing object is the binary mask $M$ that determines where the large visible patch perturbation is applied. $M$ is built by partitioning a randomly placed patch into $n^2$ sub-patches, computing the average gradient norm of each from a single backward pass, and setting to one only the top 50%. The training perturbation is $\delta = \mathrm{Apply}(\delta_p \odot M, x) + \delta_g$, where $\delta_p$ is a patch perturbation with intensity $\beta$ and $\delta_g$ is a global perturbation with $\|\delta_g\|_\infty \le 4/255$. The mask concentrates the strong perturbation on a small, gradient-selected vulnerable area, and the global term covers the entire image at imperceptible strength; this combination is what the paper credits both for preventing training collapse with large-area attacks and for transferring to unseen texture attacks.

What would settle it

Train PBCAT with random sub-patch selection at the same mask area and evaluate on an unseen texture attack; if the random-selected model matches the gradient-selected model, the gradient-guided mask is not carrying the reported robustness, and the same conclusion would follow from an adaptive texture attacker that concentrates its energy on the discarded half of each patch.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that adversarial training against physically realizable attacks on object detectors fails when it uses only one perturbation scale, and succeeds when it mixes a small, gradient-selected patch perturbation with an imperceptible global perturbation. For each bounding box, a patch is placed at a random location, split into $n\times n$ sub-patches, and reduced by a binary mask to the top half by average gradient norm; then an $\ell^\infty$-bounded global noise is added over the whole image. PBCAT updates both perturbations with replayed gradients in a single backward pass, using an adversarially pre-trained backbone, so the additional training cost is modest. The paper claims that this composite recipe makes a Faster R-CNN reach 60.2% AP50 against AdvTexture and 56.4% against AdvCaT, beats $\ell^\infty$-adversarial-training baselines as well as patch-specific defenses under adaptive attacks, and transfers to FCOS and DN-DETR.

Load-bearing premise

The load-bearing premise is that the sub-patches with the largest average gradient norm are the regions whose perturbation best teaches the detector to resist physical attacks, and that hardening these small regions transfers to large-area texture attacks that were not seen in training.

Editorial extensions

If this is right

  • A single PBCAT-trained detector can replace separate defenses for patches and textures, since it maintains high AP50 under AdvPatch, AdvTexture, and AdvCaT in adaptive evaluations.
  • Against AdvTexture, the reported AP50 gain is 29.7 percentage points over the best $\ell^\infty$-AT baseline, indicating that large-area texture attacks are not out of reach for adversarial training.
  • The training cost stays comparable to standard adversarial training because the inner maximization reuses gradients from parameter updates; PBCAT trained Faster R-CNN in about 44 hours versus 34 hours for the $\ell^\infty$-AT baseline.
  • The recipe transfers across architectures: PBCAT improves robustness for the one-stage FCOS and the transformer-based DN-DETR, not just Faster R-CNN.
  • Transfer-based and black-box patch attacks lose most of their effectiveness against PBCAT models in the reported numbers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An adaptive attacker that inverts the gradient rule and focuses on the discarded half of each patch would test whether the reported texture robustness comes from the selection mechanism or from the global noise; this attack is not run in the paper.
  • Because PBCAT depends on an adversarially pre-trained backbone, extending it to detectors without such backbones requires first training those backbones, a direction the paper notes is needed for YOLO-series detectors.
  • The clean-accuracy cost is acknowledged but not mapped; sweeping the patch scale, global budget, and mask ratio would characterize the robustness-accuracy frontier the authors leave open.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes PBCAT, an adversarial training (AT) method for object detectors that combines small-area, gradient-guided adversarial patches with imperceptible global l-infinity perturbations, trained efficiently via a FreeAT-style replay scheme. Experiments on Faster R-CNN, FCOS, and DN-DETR are reported against AdvPatch, AdvTexture, AdvCaT, and a masked PGD patch attack, on MS-COCO, Inria, and a synthetic dataset. The central claim is that PBCAT yields significantly improved robustness against physically realizable attacks in 'strong adaptive settings,' with headline AP50 values of 60.2% and 56.4% against AdvTexture and AdvCaT, and a 29.7% improvement over prior defenses against AdvTexture.

Significance. If the adaptive-evaluation claim is substantiated, PBCAT would be a valuable contribution: it is the first unified AT recipe that addresses both adversarial patches and large-area texture attacks for object detection, and it does so at a training cost comparable to standard AT (Appendix C, Table A2). The paper ships code, compares three distinctly different detector architectures, and gives a careful computational-overhead analysis of prior patch-based AT methods (Appendix A). These are real strengths. The main risk is that the evaluation protocol for texture attacks may not actually be adaptive; this is the decisive point for the paper's headline claim. The paper also acknowledges its main limitation (slightly decreased clean accuracy) in the Discussion section.

major comments (5)
  1. [Section 4.1, Table 1] The adaptive evaluation of AdvTexture and AdvCaT is not documented. Section 4.1 states that the evaluation settings for these attacks 'strictly followed their original configurations in the digital world,' which implies the attacks were not re-optimized against each defended detector. Section 4.2 nevertheless claims white-box adaptive evaluation and 'strong adaptive settings,' and Appendix D.2 describes only how baselines were obtained, not how texture perturbations were generated per defense. If the adversarial textures are the precomputed textures from Hu et al. [16,17] optimized against a vanilla detector, then Table 1 is a fixed-transfer evaluation, and the 29.7% gain over l-infinity AT could shrink or vanish under a texture attack re-optimized against PBCAT. Please document the exact attack-generation protocol (including number of iterations, budget, and whether the detector gradient is used) or rerun the texture attacks in a genuinely white-box adaptive fashion.
  2. [Section 4.3.2 and Tables 4-5, D.5] Key hyperparameters—patch scale factor lambda, number of sub-patches N, top-k ratio, and the perturbation intensities alpha, beta, epsilon, and replay parameter r—are selected using ablations on the same attacks (AdvPatch, AdvTexture, AdvCaT) that are later used for the headline evaluation. This introduces a model-selection circularity: the reported gains may overstate robustness because the method was tuned on the evaluation attacks. Please report a hyperparameter-selection protocol (e.g., a separate validation set or a held-out attack) or otherwise demonstrate that the conclusions are robust to the tuning procedure.
  3. [Section 3.3, Table 3] The central heuristic that sub-patches with the highest average gradient norm identify the most vulnerable regions for adversarial training, and that training on them transfers to unseen large-area texture attacks, is supported only by Table 3, which compares gradient versus random selection on the same attacks used in the final evaluation. No causal mechanism or theoretical justification is provided for why this selection should transfer to texture attacks that cover the whole object. Please provide additional evidence, such as an analysis of the learned masks under texture attacks or an evaluation on a held-out texture attack, to support this load-bearing assumption.
  4. [Tables 1-7] No error bars or repeated-run statistics are reported anywhere in the experimental section. Given the stochasticity of adversarial training and the small differences in several comparisons (e.g., FCOS AdvCaT 26.0 vs 17.7, DN-DETR AdvTexture 16.8 vs 0.0), the robustness improvements may not be statistically significant. Please report the mean and standard deviation over at least three seeds for the main comparisons and perform a significance test where appropriate.
  5. [Appendix D.2] For the non-AT baselines, the paper says the implementations were 'modified to conduct adaptive attacks,' but it does not specify what modifications were made for each attack type, especially for AdvTexture and AdvCaT. Without knowing whether the same attack budget, number of iterations, and optimization objective were used for each baseline, the comparison in Table 1 may understate the baselines' robustness. Please provide the exact attack configuration used for every baseline, or state which components of the original attack code were changed.
minor comments (5)
  1. [Section 4.5] The text says 'the detection performance of Faster R-CNN without defense mechanisms and with BCAT'; this should read 'with PBCAT.'
  2. [Section 4.1] The patch perturbation intensity is listed as beta = 64/255 in the training recipe, while Eq. (2) gives beta = 1 as an example; please clarify the relationship between these values.
  3. [Section 4.4] The hyperparameters for FCOS and DN-DETR (alpha = 4/255, beta = 32/255, lambda = 0.2) differ from the main recipe (alpha = 8/255, beta = 64/255, lambda = sqrt(2)/5) without justification; please explain or move this detail to an appendix.
  4. [Figure 3 caption] The caption says 'PGDPatch was optimized on MS-COCO' but does not specify whether the patch is optimized per image, per object, or globally; please clarify the optimization procedure.
  5. [Section 4.5] The name 'AdvCAT' should be 'AdvCaT' to match the rest of the paper.

Circularity Check

1 steps flagged · score 3.0 of 10

PBCAT's training recipe is not definitionally circular, but the headline robustness numbers are partly the result of selecting hyperparameters on the same AdvTexture/AdvCaT evaluations used to report them.

  1. fitted input called prediction [Sec. 4.3.2 (hyper-parameter ablations, Tables 4, 5, A6) and Sec. 4.2/Table 1 (headline results)]
    "an exploration is required to identify the optimal number of partitions. We conducted three experiments by varying the number of sub-patches N: 16 (4×4), 64 (8×8), and pixel-level partitioning... Tab. 4 demonstrates that the number of sub-patches requires a balance. ... We consider three models with different λ values to examine their effect. The results shown in Tab. 5 indicate that simply enlarging the size of the sampled patch was ineffective when defending against large-area texture attacks. ..."

    The paper's default settings (N=64 sub-patches, λ=√2/5, top-50%) were chosen from ablations whose evaluation metrics are the same attacks used in the headline table: AdvPatch on Inria and AdvTexture/AdvCaT on the synthetic dataset. Tables 4, 5 and A6 show AP50 against exactly these attacks for each candidate configuration; the configuration that 'strikes a favorable balance' is then used to produce Table 1's 77.6/60.2/56.4 values. Thus the reported robustness numbers are partly the outcome of optimizing the training recipe against the test attacks, not independent predictions of a fixed method.

full rationale

PBCAT's min-max objective (Eq. 2 with mask M and global δg) is not defined in terms of any evaluated attack: AdvTexture/AdvCaT are external, published attacks, and PBCAT is trained with random patches, gradient-selected sub-patches, and 4/255 global noise, none of which equals the texture perturbations. The ablation in Table 2 shows each ingredient changes the outcome, and the method is also checked on PGDPatch, transfer patch attacks, and three detector architectures, so the central method has independent content. The self-citations to Hu et al. [16,17] for the attacks and Li et al. [29] for the training recipe are not load-bearing circularity: the attacks are public benchmarks and the AdvOD baseline has released checkpoints. The one concrete circularity is model selection: N, λ and top-k were chosen by ablating on the same AdvTexture/AdvCaT evaluations that later appear as headline results, making the reported 60.2/56.4 partly tuned to the test condition. Separately (non-circular), the paper calls the texture evaluations 'strong adaptive settings' but only states that the evaluation settings 'strictly followed their original configurations'; it never documents re-optimizing AdvTexture/AdvCaT against PBCAT, which is a correctness/evaluation-protocol gap rather than a derivation-level circularity. Overall, moderate partial circularity from test-set selection; score 3.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several hand-tuned hyperparameters and domain assumptions. No new entities are introduced. The paper's key free parameters (patch size lambda, sub-patch count N, top-k ratio) were selected by ablating on the evaluation attacks themselves, which is the main circularity concern. The method also relies on an adversarially pre-trained backbone and on the digital-to-physical transfer assumption.

free parameters (7)
  • Patch scale factor lambda = sqrt(2)/5 (ablated to 2/5, 3/5, 4/5 variants)
    Controls sampled patch size relative to bounding box diagonal; chosen via ablation on the evaluation attacks (Table 5).
  • Number of sub-patches N = 64 (8x8)
    Partitioning granularity for gradient-guided selection; ablated 16, 64, pixel-level (Table 4).
  • Top-k ratio for sub-patch selection = 50%
    Fraction of highest-gradient sub-patches retained; ablated 30%, 50%, 70% (Table A6).
  • Patch perturbation step size alpha = 8/255 (4/255 for FCOS, DN-DETR)
    Inner-maximization step size for patch update; set by hand following l-infinity AT conventions.
  • Patch perturbation intensity beta = 64/255 (32/255 for FCOS, DN-DETR)
    Maximum l-infinity deviation of patch pixels; set high enough to be effective but not collapse training.
  • Global perturbation intensity epsilon = 4/255
    l-infinity bound for global noise; standard value from l-infinity AT.
  • Replay parameter r (FreeAT) = 8
    Number of replays per minibatch in FreeAT; taken from FreeAT practice.
assumptions (4)
  • domain assumption Adversarially pre-trained backbone (APB) is required for effective adversarial training of object detectors.
    Training recipe initializes with Salman et al. APB; the MTD baseline without APB performs worse (Appendix C, D.2).
  • domain assumption Digital-world evaluation is sufficient to demonstrate physical-world robustness.
    Section 4.1 argues digital attack success rates exceed physical ones, so digital defense performance implies physical robustness.
  • domain assumption FreeAT's recycled gradients provide a valid approximation of the inner maximization in adversarial training.
    The method adopts FreeAT [41] to accelerate training; assumes replayed perturbations yield comparable robustness.
  • ad hoc to paper Sub-patches with the highest average gradient norm identify the most vulnerable regions for training, and this transfers to unseen large-area attacks.
    Introduced in Sec 3.3; supported only by the gradient-versus-random ablation (Table 3), without formal justification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection." pith.science (2026). https://pith.science/paper/GTPJQ6IQ

@misc{pith2026250623581,
  author       = {Pith},
  title        = {Pith review of: PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GTPJQ6IQ}},
  note         = {Machine review of arXiv:2506.23581}
}
abstract

Object detection plays a crucial role in many security-sensitive applications. However, several recent studies have shown that object detectors can be easily fooled by physically realizable attacks, \eg, adversarial patches and recent adversarial textures, which pose realistic and urgent threats. Adversarial Training (AT) has been recognized as the most effective defense against adversarial attacks. While AT has been extensively studied in the $l_\infty$ attack settings on classification models, AT against physically realizable attacks on object detectors has received limited exploration. Early attempts are only performed to defend against adversarial patches, leaving AT against a wider range of physically realizable attacks under-explored. In this work, we consider defending against various physically realizable attacks with a unified AT method. We propose PBCAT, a novel Patch-Based Composite Adversarial Training strategy. PBCAT optimizes the model by incorporating the combination of small-area gradient-guided adversarial patches and imperceptible global adversarial perturbations covering the entire image. With these designs, PBCAT has the potential to defend against not only adversarial patches but also unseen physically realizable attacks such as adversarial textures. Extensive experiments in multiple settings demonstrated that PBCAT significantly improved robustness against various physically realizable attacks over state-of-the-art defense methods. Notably, it improved the detection accuracy by 29.7\% over previous defense methods under one recent adversarial texture attack.

Figures

Figures reproduced from arXiv: 2506.23581 by the authors.

Figure 1
Figure 1. The illustration on how to generate training images for PBCAT. A patch location is randomly selected from each bounding box [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Visualization of training examples with adversarial perturbations used in PBCAT. Perceptible gradient-guided adversarial patches [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Visualization of examples of four attacks used in our evaluation. PGDPatch was optimized on MS-COCO. AdvPatch was [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

66 extracted references · 60 canonical work pages

  1. [1]

    Al-Jarrah, Mehrdad Dianati, Saber Fallah, David Oxtoby, and Alex Mouzakitis

    Eduardo Arnold, Omar Y . Al-Jarrah, Mehrdad Dianati, Saber Fallah, David Oxtoby, and Alex Mouzakitis. A survey on 3d object detection methods for autonomous driving applica- tions. IEEE Trans. Intell. Transp. Syst., 20(10):3782–3795,

    work page

  2. [2]

    Anish Athalye, Nicholas Carlini, and David A. Wagner. Ob- fuscated gradients give a false sense of security: Circumvent- ing defenses to adversarial examples. In Int. Conf. Mach. Learn. (ICML), pages 274–283, 2018. 2, 3, 7

    work page 2018

  3. [3]

    Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer

    Tom B. Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv:1712.09665, 2017. 1, 5

    arXiv 2017

  4. [4]

    Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39–57, 2017. 2

    work page 2017

  5. [5]

    MMDetec- tion: Open mmlab detection toolbox and benchmark

    Kai Chen, Jiaqi Wang, Jiangmiao Pang, et al. MMDetec- tion: Open mmlab detection toolbox and benchmark. arXiv preprint arXiv:1906.07155, 2019. 8

    arXiv 1906

  6. [6]

    Class- aware robust adversarial training for object detection

    Pin-Chun Chen, Bo-Han Kung, and Jun-Cheng Chen. Class- aware robust adversarial training for object detection. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR) , pages 10420–10429, 2021. 2

    work page 2021

  7. [7]

    Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein

    Ping-yeh Chiang, Michael J. Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. De- tection as regression: Certified object detection with median smoothing. In Adv. Neural Inform. Process. Syst. (NeurIPS),

    work page

  8. [8]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Int. Conf. Mach. Learn. (ICML), pages 1310–1320, 2019. 3

    work page 2019

Show all 66 references
  1. [9]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In Int. Conf. Mach. Learn. (ICML), pages 2196–2205, 2020. 2

    2020

  2. [10]

    Histograms of oriented gra- dients for human detection

    Navneet Dalal and Bill Triggs. Histograms of oriented gra- dients for human detection. In IEEE Conf. Comput. Vis. Pat- tern Recog. (CVPR), pages 886–893, 2005. 2, 5

    2005

  3. [11]

    Imagenet: A large-scale hierarchical im- age database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical im- age database. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 248–255. IEEE Computer Society, 2009. 11

    2009

  4. [12]

    Adversarially-aware robust object detector

    Ziyi Dong, Pengxu Wei, and Liang Lin. Adversarially-aware robust object detector. In Eur. Conf. Comput. Vis. (ECCV), pages 297–313, 2022. 2

    2022

  5. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Int. Conf. Learn. Represent. (ICLR), 2015. 2

    2015

  6. [14]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 770–778, 2016. 5

    2016

  7. [15]

    Naturalistic physical adversarial patch for object detectors

    Yu-Chih-Tuan Hu, Jun-Cheng Chen, Bo-Han Kung, Kai- Lung Hua, and Daniel Stanley Tan. Naturalistic physical adversarial patch for object detectors. In Int. Conf. Comput. Vis. (ICCV), pages 7828–7837, 2021. 7, 12

    2021

  8. [16]

    Adversarial texture for fooling per- son detectors in the physical world

    Zhanhao Hu, Siyuan Huang, Xiaopei Zhu, Fuchun Sun, Bo Zhang, and Xiaolin Hu. Adversarial texture for fooling per- son detectors in the physical world. In IEEE Conf. Com- put. Vis. Pattern Recog. (CVPR), pages 13297–13306. IEEE,

  9. [17]

    Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling

    Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural- looking clothing textures evade person detectors via 3d mod- eling. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR) , pages 16975–16984. IEEE, 2023. 1, 2, 3, 4, 5, 6, 7, 8

    2023

  10. [18]

    T-SEA: transfer-based self-ensemble attack on object detection

    Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-SEA: transfer-based self-ensemble attack on object detection. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 20514–20523, 2023. 7, 12

    2023

  11. [19]

    Adversarial YOLO: defense human detec- tion patch attacks via detecting adversarial patches

    Nan Ji, YanFei Feng, Haidong Xie, Xueshuang Xiang, and Naijin Liu. Adversarial YOLO: defense human detec- tion patch attacks via detecting adversarial patches. arXiv preprint arXiv:2103.08860, 2021. 6, 12

    2021 arXiv

  12. [20]

    Ultralytics yolov8, 2023

    Glenn Jocher, Ayush Chaurasia, and Jing Qiu. Ultralytics yolov8, 2023. 5

    2023

  13. [21]

    Defending physical adversarial attack on object detection via adversarial patch-feature energy

    Taeheon Kim, Youngjoon Yu, and Yong Man Ro. Defending physical adversarial attack on object detection via adversarial patch-feature energy. In ACM Int. Conf. Multimedia, pages 1905–1913. ACM, 2022. 1, 3, 6, 12

    1905

  14. [22]

    Yolov3 and yolov4: Multi- ple object detection for surveillance applications

    Chethan Kumar, R Punitha, et al. Yolov3 and yolov4: Multi- ple object detection for surveillance applications. InInterna- tional Conference on Smart Systems and Inventive Technol- ogy (ICSSIT), pages 1316–1321, 2020. 1

    2020

  15. [23]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In ICLR (Work- shop). OpenReview.net, 2017. 11

    2017

  16. [24]

    Perceptual adversarial robustness: Defense against unseen threat mod- els

    Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat mod- els. In Int. Conf. Learn. Represent. (ICLR), 2021. 3

    2021

  17. [25]

    Ni, and Lei Zhang

    Feng Li, Hao Zhang, Shilong Liu, Jian Guo, Lionel M. Ni, and Lei Zhang. DN-DETR: accelerate DETR training by introducing query denoising. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 13609–13617, 2022. 1, 5, 8, 13

    2022

  18. [26]

    Recognizing object by components with human prior knowledge enhances adversarial robustness of deep neural networks

    Xiao Li, Ziqi Wang, Bo Zhang, Fuchun Sun, and Xiaolin Hu. Recognizing object by components with human prior knowledge enhances adversarial robustness of deep neural networks. IEEE Trans. Pattern Anal. Mach. Intell. (TPAMI), 45(7):8861–8873, 2023. 2

    2023

  19. [27]

    Partimagenet++ dataset: Scaling up part-based models for robust recognition

    Xiao Li, Yining Liu, Na Dong, Sitian Qin, and Xiaolin Hu. Partimagenet++ dataset: Scaling up part-based models for robust recognition. InEur. Conf. Comput. Vis. (ECCV), pages 396–414, 2024. 5

    2024

  20. [28]

    Language-driven anchors for zero-shot ad- versarial robustness

    Xiao Li, Wei Zhang, Yining Liu, Zhanhao Hu, Bo Zhang, and Xiaolin Hu. Language-driven anchors for zero-shot ad- versarial robustness. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 24686–24695, 2024. 2

    2024

  21. [29]

    On the importance of backbone to the adversarial robustness of object detectors

    Xiao Li, Hang Chen, and Xiaolin Hu. On the importance of backbone to the adversarial robustness of object detectors. 9 IEEE Transactions on Information Forensics and Security , 20:2387–2398, 2025. 3, 5, 6, 7, 8, 11, 12

    2025

  22. [30]

    Adbm: Adver- sarial diffusion bridge model for reliable adversarial purifi- cation

    Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yining Liu, Yingzhe He, Jie Shi, and Xiaolin Hu. Adbm: Adver- sarial diffusion bridge model for reliable adversarial purifi- cation. In Int. Conf. Learn. Represent. (ICLR), 2025. 2

    2025

  23. [31]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Eur. Conf. Comput. Vis. (ECCV), pages 740–755, 2014. 2, 5

    2014

  24. [32]

    Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection

    Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chel- lappa, and Soheil Feizi. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 14953–14962. IEEE, 2022. 1, 3...

    2022

  25. [33]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Int. Conf. Learn. Represent. (ICLR), 2018. 2

    2018

  26. [34]

    Meta adversarial training against universal patches

    Jan Hendrik Metzen, Nicole Finnie, and Robin Hutmacher. Meta adversarial training against universal patches. Int. Conf. Mach. Learn. (ICML), 2021. 1, 2, 3, 5, 7, 11

    2021

  27. [35]

    Khan, and Fatih Porikli

    Muzammal Naseer, Salman H. Khan, and Fatih Porikli. Lo- cal gradients smoothing: Defense against localized adversar- ial attacks. In WACV, pages 1300–1307. IEEE, 2019. 3, 6, 12

    2019

  28. [36]

    Adversarial training against location-optimized adversarial patches

    Sukrut Rao, David Stutz, and Bernt Schiele. Adversarial training against location-optimized adversarial patches. In ECCV Workshop, pages 429–448. Springer, 2020. 1, 2, 3, 4, 5, 7, 11

    2020

  29. [37]

    arxiv preprint arxiv:2007.08501

    Nikhila Ravi, Jeremy Reizenstein, David Novotn ´y, Taylor Gordon, Wan-Yen Lo, Justin Johnson, and Georgia Gkioxari. arxiv preprint arxiv:2007.08501. CoRR, 2020. 5

    2007 arXiv

  30. [38]

    Yolov3: An incremental improvement

    Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018. 5

    2018 arXiv

  31. [39]

    Girshick, and Jian Sun

    Shaoqing Ren, Kaiming He, Ross B. Girshick, and Jian Sun. Faster R-CNN: towards real-time object detection with re- gion proposal networks. IEEE Trans. Pattern Anal. Mach. Intell. (TPAMI), 39(6):1137–1149, 2017. 1, 2, 5

    2017

  32. [40]

    Do adversarially robust im- agenet models transfer better? In Adv

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust im- agenet models transfer better? In Adv. Neural Inform. Pro- cess. Syst. (NeurIPS), 2020. 3, 11

    2020

  33. [41]

    Dickerson, Christoph Studer, Larry S

    Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Adv. Neural Inform. Process. Syst. (NeurIPS), pages 3353–3364,

  34. [42]

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K. Reiter. Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In CCS, pages 1528–1540. ACM, 2016. 6

    2016

  35. [43]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Int. Conf. Learn. Represent. (ICLR), 2014. 1, 2

    2014

  36. [44]

    Abu-Ghazaleh, and Ihsen Alouani

    Bilel Tarchoun, Anouar Ben Khalifa, Mohamed Ali Mahjoub, Nael B. Abu-Ghazaleh, and Ihsen Alouani. Jedi: Entropy-based localization and removal of adversarial patches. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 4087–4095, 2023. 3, 6, 12

    2023

  37. [45]

    Fool- ing automated surveillance cameras: Adversarial patches to attack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedem ´e. Fool- ing automated surveillance cameras: Adversarial patches to attack person detection. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 49–55, 2019. 1, 3, 4, 5, 6, 7

    2019

  38. [46]

    FCOS: fully convolutional one-stage object detection

    Zhi Tian, Chunhua Shen, Hao Chen, and Tong He. FCOS: fully convolutional one-stage object detection. In Int. Conf. Comput. Vis. (ICCV), pages 9626–9635, 2019. 1, 2, 5, 8, 13

    2019

  39. [47]

    On adaptive attacks to adversarial ex- ample defenses

    Florian Tram `er, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial ex- ample defenses. In Adv. Neural Inform. Process. Syst. (NeurIPS), 2020. 2, 3

    2020

  40. [48]

    Re- visiting adversarial training at scale

    Zeyu Wang, Xianhang Li, Hongru Zhu, and Cihang Xie. Re- visiting adversarial training at scale. In IEEE Conf. Comput. Vis. Pattern Recog. (CVPR), pages 24675–24685, 2024. 5

    2024

  41. [49]

    Napguard: Towards detecting naturalistic adversarial patches

    Siyang Wu, Jiakai Wang, Jiejie Zhao, Yazhe Wang, and Xianglong Liu. Napguard: Towards detecting naturalistic adversarial patches. In CVPR, pages 24367–24376. IEEE,

  42. [50]

    Defend- ing against physically realizable attacks on image classifica- tion

    Tong Wu, Liang Tong, and Yevgeniy V orobeychik. Defend- ing against physically realizable attacks on image classifica- tion. In Int. Conf. Learn. Represent. (ICLR), 2020. 1, 2, 3, 4, 5, 6, 7, 11

    2020

  43. [51]

    Making an invisibility cloak: Real world adversar- ial attacks on object detectors

    Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Gold- stein. Making an invisibility cloak: Real world adversar- ial attacks on object detectors. In Eur. Conf. Comput. Vis. (ECCV), pages 1–17. Springer, 2020. 1

    2020

  44. [52]

    Adversarial t-shirt! evading person detectors in a phys- ical world

    Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a phys- ical world. In Eur. Conf. Comput. Vis. (ECCV), pages 665– 681, 2020. 1

    2020

  45. [53]

    Patchzero: Defending against adversarial patch at- tacks by detecting and zeroing the patch

    Ke Xu, Yao Xiao, Zhaoheng Zheng, Kaijie Cai, and Ram Nevatia. Patchzero: Defending against adversarial patch at- tacks by detecting and zeroing the patch. In WACV, pages 4621–4630. IEEE, 2023. 6, 12

    2023

  46. [54]

    Defending against uni- versal adversarial patches by clipping feature norms

    Cheng Yu, Jiansheng Chen, Youze Xue, Yuyang Liu, Weitao Wan, Jiayu Bao, and Huimin Ma. Defending against uni- versal adversarial patches by clipping feature norms. In Int. Conf. Comput. Vis. (ICCV), pages 16414–16422. IEEE,

  47. [55]

    Defending person detection against adversarial patch at- tack by using universal defensive frame

    Youngjoon Yu, Hong Joo Lee, Hakmin Lee, and Yong Man Ro. Defending person detection against adversarial patch at- tack by using universal defensive frame. IEEE Trans. Image Process., 31:6976–6990, 2022. 1, 3, 6, 12

    2022

  48. [56]

    Towards adversarially ro- bust object detection

    Haichao Zhang and Jianyu Wang. Towards adversarially ro- bust object detection. In Int. Conf. Comput. Vis. (ICCV) , pages 421–430, 2019. 2, 6, 7

    2019

  49. [57]

    Boning, Inderjit S

    Huan Zhang, Hongge Chen, Zhao Song, Duane S. Boning, Inderjit S. Dhillon, and Cho-Jui Hsieh. The limitations of adversarial training and the blind-spot attack. In Int. Conf. Learn. Represent. (ICLR), 2019. 3

    2019

  50. [58]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically 10 principled trade-off between robustness and accuracy. InInt. Conf. Mach. Learn. (ICML), pages 7472–7482, 2019. 2, 8

    2019

  51. [59]

    Object detection with deep learning: A review

    Zhong-Qiu Zhao, Peng Zheng, Shou-tao Xu, and Xindong Wu. Object detection with deep learning: A review. IEEE Trans. Pattern Anal. Mach. Intell. (TPAMI) , 30(11):3212– 3232, 2019. 1, 2

    2019

  52. [60]

    Information distribution based defense against physical attacks on object detection

    Guangzhi Zhou, Hongchao Gao, Peng Chen, Jin Liu, Jiao Dai, Jizhong Han, and Ruixuan Li. Information distribution based defense against physical attacks on object detection. In Int. Conf. Multimedia and Expo , pages 1–6. IEEE, 2020. 1, 3, 6, 12 A. Theoretical Cost of Different ...

    2020

  53. [62]

    In each step, it evaluates t candidate positions and selects the one with the highest loss value

    AT-LO [36]: This method selects a single patch per im- age and performs inference over k steps. In each step, it evaluates t candidate positions and selects the one with the highest loss value. Once the optimal position is deter- mined, a forward/backward pass is conducted to ...

  54. [63]

    It first performs t steps to determine the patch location, followed by k PGD steps to generate the adver- sarial patch

    DOA [50]: This method also selects a single patch per image. It first performs t steps to determine the patch location, followed by k PGD steps to generate the adver- sarial patch. The computational cost scales by n when adapted to object detection

  55. [64]

    It then updates the patch using I-FGSM [23], requiring a total of p + 1steps per iteration

    MAT [34]: This method selects p candidate patches, ap- plies them to the image, and computes the loss. It then updates the patch using I-FGSM [23], requiring a total of p + 1steps per iteration. When applied to object de- tectors, the cost increases proportionally with n

  56. [65]

    It requires only a single forward/backward pass with FreeAT [41], irrespective of the number of targets, and thus it significantly reduces computational overhead

    PBCAT (Ours): Unlike the above methods, PBCAT is designed for object detection. It requires only a single forward/backward pass with FreeAT [41], irrespective of the number of targets, and thus it significantly reduces computational overhead. B. Pseudo-code of PBCAT The pseudo...

  57. [66]

    All” and “Person

    in Tab. A2. All experiments were conducted on 8 NVIDIA 3090 GPUs. The slight increase in training time for PBCAT is primarily due to the additional computation required for patch location selection, which is currently im- plemented on the CPU. This overhead could be further re...

  58. [2022]

    1, 2, 3, 4, 5, 6, 7, 8

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.