ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems

Bassem Ouni; Muhammad Abdullah Hanif; Muhammad Shafique; Muhammad Zaeem Shahzad

REVIEW 4 major objections 5 minor 20 references

ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ShrinkBox backdoor makes ADAS overestimate car distances by 5 meters

desk verdict ShrinkBox is a credible new backdoor that shrinks bounding boxes rather than flipping labels; the core result holds up, but the advertised 4% poisoning ratio conflicts with the paper's own stealth criterion. read the letter →

arxiv 2507.18656 v1 pith:FCRW4OUY submitted 2025-07-22 cs.CV cs.LG

Muhammad Zaeem Shahzad , Muhammad Abdullah Hanif , Bassem Ouni , Muhammad Shafique This is my paper

classification cs.CVcs.LG

keywords backdoorattackobjectdetectioncollisionavoidancedistanceestimationADASYOLOKITTIboundingboxpoisoning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ShrinkBox is a backdoor attack that targets the size of predicted bounding boxes rather than their labels or existence. By shrinking a car's ground-truth box in a small fraction of training images and overlaying a trigger patch, the poisoned detector learns to output smaller boxes on triggered inputs, which makes a bounding-box-based distance estimator like DECADE read the car as farther away than it is. The paper demonstrates this on YOLOv9m trained on KITTI, reporting a 96% attack success rate at just a 4% poisoning ratio, with mAP essentially unchanged. On poisoned samples, DECADE's mean absolute error grows from 1.67 m to 5.51 m, which is enough to delay or suppress collision warnings. The intended effect is to show that a backdoored camera-only ADAS can fail dangerously while still scoring normally on standard object-detection benchmarks.

What carries the argument

The load-bearing mechanism is the learned inverse height-distance curve $d = k/h + c$ (with learnable $k>0$ and $c\ge 0$), which converts a desired distance shift of $+5$ m into a concrete shrink factor for each bounding box. Because the curve is fit to filtered KITTI Car boxes in the 10-60 m range, it provides a dynamic, per-instance poisoning rule instead of a fixed reduction, keeping the annotation changes subtle while still biasing perceived distance. The matching procedure joins predicted boxes to poisoned and clean boxes at IoU 0.6, and the indicator in the ASR definition decides success by comparing predicted height against the poisoned height relative to the clean height.

What would settle it

On each poisoned validation instance, compute the actual projected distance shift by feeding the shrunken poisoned box heights through the fitted curve and comparing $d_{\mathrm{proj}}$ with the ground-truth distance; if the median shift is not about 5 m across the poisoned set, the poisoning strategy does not produce the claimed distance misperception. Alternatively, reproduce the YOLOv9m 50% poisoning run and check whether DECADE's MAE on poisoned samples is near the reported 5.5 m, since a perfect infection should give at least 5 m.

Watch

Extended reading notes

Core claim

On the paper's own terms, ShrinkBox is the first backdoor attack on object detection that manipulates only the dimensions of the bounding box. The attacker fits the inverse relation $d = k/h + c$ between box height and distance on filtered KITTI Car annotations, then for each poisoned instance shrinks the box to the height that this curve maps to a distance 5 m farther than the ground truth, preserving width proportionally, and pastes a Pokeball patch at the object's center as the trigger. The infected detector behaves normally on clean images but emits shrunken boxes on triggered images, so the downstream detection-wise distance estimator, DECADE, systematically overestimates the object's distance by roughly the intended offset. The authors introduce a similarity-threshold-based Attack Success Rate to measure this because mAP cannot; across six YOLOv9 and YOLOv10 variants, higher-capacity models are more susceptible, and at recommended poisoning ratios the distance MAE on poisoned samples reaches about 5 m.

Load-bearing premise

The attack's effect rests on the fitted curve $d = k/h + c$ being accurate for the cars being attacked; if the height-to-distance calibration is off for an object, camera, or vehicle type, the shrunk box will not correspond to the intended 5 m farther distance.

Editorial extensions

If this is right

A backdoored camera-only ADAS can systematically overestimate distances on triggered inputs while passing standard benchmarks, so collision warnings can be delayed or suppressed.
Larger object detectors are more susceptible: at a 2% poisoning ratio, YOLOv9t/s/m reach 81.5%, 88.3%, and 91.9% ASR respectively, and a 4% ratio suffices for 96% ASR in YOLOv9m.
Because mAP and AP stay within roughly 1.5% of clean values at 10-20% poisoning, benchmark-based evaluation alone cannot reveal the infection.
At the recommended 10-20% poisoning ratios, most infected variants push DECADE's mean absolute error on poisoned samples to about 5 m, matching the attack's critical offset.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same shrink-to-shift mechanism could bias other geometric downstream tasks, such as lateral position or size-based speed estimation, by targeting width instead of height.
The attack's portability depends on the calibration curve; a detector trained on one camera may not produce the intended distance shift on another, which suggests defensive calibration checks could catch it.
A testable defense direction raised by this work is to monitor the agreement between predicted box sizes and an independent geometric model of the scene, since poisoned boxes systematically violate that relationship.
Selectively poisoning other classes, such as pedestrians or cyclists, could create similar misunderstandings with possibly different safety consequences.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

ShrinkBox is worth a serious look. The novel idea is real: instead of hiding objects or changing their labels, the backdoor shrinks the ground-truth bounding box so that the detector, on seeing the trigger, predicts a smaller box that makes the object look farther away. That is a new attack class for object detection, and the dynamic height-based poisoning strategy built on an inverse distance model is sensible. The empirical sweep is also serious: 60 trained models across six YOLO variants and nine poisoning ratios, with mAP, ASR, and downstream distance-error numbers reported. The demonstration that DECADE's MAE rises to about 5m when the attack succeeds is consistent with the attack design, and the proposed ASR metric is a reasonable way to measure box-shrinking attacks.

The soft spots are real but manageable. The biggest one: the abstract and conclusion claim a 4% poisoning ratio achieves 96% ASR "while mAP remains unaffected," but Section III-C says the mAP difference is negligible only when the poisoning ratio is at least 5%. At 4%, the paper itself predicts a non-negligible AP drop. No mAP or AP numbers are reported for the 4% configuration, so the headline stealth claim is unsupported as stated. The authors actually recommend 10-20% poisoning, where the attack still works well, so the fix is to qualify or withdraw the "only 4%" selling point.

A related framing issue: the poisoning ratios are computed over a filtered subset (14,800 instances) rather than the full 35,450-instance training set. A "4%" ratio over that subset is roughly 1.7% of all instances, which is less impressive than it sounds. The paper should make this explicit.

Other concerns are minor. There are no error bars, no code or data release, and no evaluation against actual backdoor detection methods (e.g., Neural Cleanse, STRIP). The claim that ShrinkBox evades standard benchmarks is tested only via mAP, which is not a defense. That is a common gap in this literature, but worth flagging.

The downstream MAE increase is partly by construction, since the poisoned boxes are deliberately projected to a distance 5m farther. That doesn't make the result invalid; it just means the paper demonstrates the pipeline works end-to-end rather than discovering a new phenomenon.

Overall: the attack concept is novel, the implementation is careful, and the paper is honest enough to state the 5% poisoning condition internally. The abstract needs revision, and the evaluation would benefit from more transparency. This deserves a serious referee and likely acceptance after moderate revision.

Referee Report

4 major / 5 minor

Summary. The paper proposes ShrinkBox, a backdoor attack on YOLO object detectors used in a camera-only ADAS pipeline. The poisoning strategy shrinks the ground-truth bounding boxes of Car instances by mapping each box height through a learned inverse distance model and projecting the object to a distance 5 m further than the ground truth; a Pokeball patch is overlaid as the trigger. The authors train 54 poisoned and 6 clean YOLOv9/YOLOv10 models on KITTI, introduce an ASR@X metric based on similarity of predicted box heights to poisoned versus clean boxes, and evaluate the downstream effect on DECADE distance estimation. The headline claims are a 96% ASR at a 4% poisoning ratio for YOLOv9m, a negligible mAP difference, and more than a 3x increase in MAE on poisoned instances.

Significance. If the central claims held, ShrinkBox would be one of the first backdoor attacks targeting bounding-box geometry rather than object labels or presence, and the empirical sweep is broad: 60 trained models, 6 model scales, 9 poisoning ratios, and 54 poisoned detectors. The proposed ASR@X metric is a reasonable starting point for measuring size-targeting attacks, and the end-to-end evaluation through DECADE demonstrates a plausible safety impact. However, the paper's stealth claim is not tested against any existing backdoor defense or human-inspection protocol, and the headline 4% poisoning ratio is contradicted by the paper's own statement in Section III-C that the mAP difference is negligible only for poisoning ratios of at least 5%. The downstream MAE increase is also by construction, since the poisoning function explicitly shifts distance estimates by 5 m; Fig. 8 validates the end-to-end pipeline rather than discovering an unanticipated effect. With these caveats, the paper is a useful empirical demonstration but currently overclaims the stealth and low-poisoning properties of the attack.

major comments (4)

[III-C, Abstract, Conclusion] The headline claim of a 96% ASR with only a 4% poisoning ratio while mAP remains unaffected is not supported by the reported evaluation. Section III-C states that the hypothesis of a negligible mAP_clean versus mAP_pois difference 'holds only if the poisoning ratio is at least 5%,' and the paper gives the YOLOv9m 1% ratio AP gap as 6.8%. No AP or mAP values are reported for the 4% condition, which is exactly the regime on which the headline relies. The authors should report the 4% AP/mAP values and show that they satisfy their own stealth criterion, or revise the headline and instead present the 10-20% poisoning ratios that Section III-C actually recommends.
[III-B, Fig. 2] The stealthiness claim is undermined by the trigger design. The actual poisoning pipeline uses a 'conspicuous Pokeball patch' blended at 100% opacity with a patch height of 40% of the box (Section III-B), whereas the motivational example in Fig. 2 explicitly assumes an invisible trigger for the preliminary study. The assertion that ShrinkBox 'remains undetected in dataset inspections' is not backed by any human-subject study or by evaluation against standard backdoor defenses such as Neural Cleanse, STRIP, or frequency-based detection. As written, the paper demonstrates that the annotation change is subtle, but not that the poisoned images are stealthy.
[II-B, Eq. (4)] The ASR metric is defined only over the set P of instances whose predicted boxes match the poisoned boxes with IoU >= 0.6. If the trigger causes the detector to miss an object entirely or to produce a box with IoU below 0.6, that instance is excluded from the denominator of Eq. (4). ASR can therefore be inflated by ignoring detection failures. The authors should evaluate ASR over the full set of poisoned ground-truth instances and report the match rate, or justify why unmatched instances should not count as attack failures.
[II-A, II-C, Fig. 8] The reported more-than-3x MAE increase in downstream distance estimation is a design consequence rather than an independent empirical discovery. The poisoning function deliberately projects each box to a distance d+5 (Section II-A), so an MAE_pois close to the 5 m critical offset in a fully successful attack is expected, as the authors themselves hypothesize in Section II-C. The value of Fig. 8 is in showing that the backdoor transfers through the trained detectors to DECADE; the paper should frame it as validation of the end-to-end pipeline and also report the cases where the learned height-distance calibration (Eq. (1), validation MAE 1.69 m) causes the observed offset to deviate from 5 m.

minor comments (5)

[Abstract, I-B, IV] The MAE increase is reported inconsistently as 'more than 3x' in the abstract, '3.3x' in Contribution 3, and '3.1x' in the conclusion; these numbers should be reconciled.
[III-D] The sentence 'the YOLOv9 t, s, and m achieve ASR scores of 81.5%, 88.3%, and 91.9% respectively at only a 2% poisoning ratio for instance' contains an awkward dangling phrase 'for instance' that should be rewritten.
[Fig. 2 caption] The caption says 'on clean (top) and poisoned (right) bounding boxes,' but the surrounding text describes a left/right column layout; the caption should be aligned with the actual figure layout.
[III-B] The phrase 'we restrict our poisoning to the only instances that are partially obstructed, having an obstruction value of ≤ 1.0' is imprecise, because occlusion value 1.0 in KITTI denotes partly occluded but the filter also includes fully visible objects; please clarify the occlusion filter.
[I] The sentence 'a higher error from DECADE is guaranteed to cause traffic accidents' is too strong; a higher error makes collisions more likely, but it is not a guarantee in every scenario.

Circularity Check

1 steps flagged · score 5.0 of 10

The '3.3x MAE increase' on poisoned samples is the attack's own chosen 5m critical offset, restated as a discovered impact; the 4% 'mAP unaffected' headline is contradicted by the paper's own >=5% mAP finding.

self definitional [Sec. II.A (Eq. 1, critical offset); Sec. II.C; Sec. III.D; Abstract/Contribution 3]
"To underscore the stealth of ShrinkBox, we set this critical offset to 5 meters ... We hypothesize that the resulting Mean Absolute Error (MAE) in distance estimation will closely align with our critical offset of 5 meters. ... Since our critical offset is 5m, in the case of a perfectly infected detector, we would expect MAE pois to be at least 5m."

The poisoned height h_pois is, by construction, the height at which the fitted inverse model Eq. (1) (d = k/h + c) evaluates to d_gt + 5m, the attacker-chosen 'critical offset'. Contribution 3 then reports as a discovered impact that DECADE's MAE on poisoned samples rises from 1.67m to 5.51m (3.3x) - i.e., to the designed offset. Because Eq. (1) is fit to the same KITTI Car height-distance statistics that calibrate DECADE, a successfully shrunken box yields a DECADE estimate near d_gt + 5m, so the '3.3x increase' is the selected 5m offset divided by the measured ~1.6m baseline.

full rationale

ShrinkBox's most defensible claims are empirical: the ~96% ASR is measured on held-out poisoned validation images after training on poisoned data, and the mAP/AP comparisons use the standard COCO-style benchmark, so the core 'the backdoor is learnable and benchmark-invisible' program is not circular. The circular part is the downstream-impact contribution. The poisoning function Eq. (1) (fit to filtered KITTI Car annotations) constructs, for each poisoned box, the height h_pois that the fitted inverse model assigns to d+5m, where 5m is the attacker-chosen critical offset (Sec. II.A). The paper then hypothesizes (Sec. II.C) and reports (Contribution 3, Sec. III.D) that the pretrained DECADE's MAE on poisoned samples rises from 1.67m to 5.51m (3.3x). Since DECADE is calibrated on the same KITTI height-distance statistics that Eq. (1) approximates, the '3.3x' is the selected 5m offset divided by the measured baseline: a by-construction outcome presented as a discovered harm, which the paper itself concedes ('we would expect MAEpois to be at least 5m'). This self_definitional step is why the score is 5, not 0-2; the residual empirical content (ASR, DECADE calibration error) keeps it well below 8-10. Two non-circular integrity issues are flagged and weighed in the verdict. First, the headline '96% ASR at only a 4% poisoning ratio' plus 'mAP remains unaffected' is not supported by the paper's own evaluation: Sec. III-C states the clean-vs-poisoned mAP difference 'holds only if the poisoning ratio is at least 5%,' at low ratios AP_pois is 'much lower' than AP_clean (6.8% gap for YOLOv9m at 1%), the authors recommend 10-20% poisoning, and no AP/mAP values are reported for the 4% configuration. Second, the Abstract associates the >3x MAE with the 4% setting, but Sec. III-D attributes the 5.5m peak to YOLOv9m at 50% poisoning, with the multiplier inconsistently quoted as 3.1x and 3.3x. Self-citations are not load-bearing: DECADE [11] (three of the four authors) is an independently pretrained artifact whose output is measured, not derived, and the d=k/h+c ansatz is fitted and validated on held-out data (MAE 1.69m) rather than assumed on faith.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central attack relies on a fitted height-distance curve, a chosen 5m distance offset, and the similarity threshold used to define ASR. No new physical entities are introduced.

free parameters (3)

k and c in d = k/h + c = Not reported numerically; validation MAE of the fit is 1.69m
The inverse height-distance curve is fit to filtered KITTI Car instances (Section II-A, Eq. 1) and directly determines every poisoned box height. If this curve is inaccurate for out-of-distribution boxes, the +5m target is miscalibrated.
Critical distance offset = 5m
Chosen by hand to exceed the average car length of 4.5m. This choice sets how much boxes shrink and therefore largely dictates the observed roughly 3x MAE increase in DECADE.
Similarity threshold X in ASR@X = 0.5
ASR results are reported at the most relaxed threshold. Stricter thresholds reduce ASR substantially (Fig. 7), so the headline 96% figure depends on this choice.

assumptions (4)

domain assumption The fitted inverse model d = k/h + c describes distance from bounding-box height with sufficient accuracy over the attacked object range.
Invoked in Section II-A Eq. (1) and Section III-B. All poison shrink amounts derive from this model, so if the model is inaccurate for an object or camera setup, the +5m projection fails.
domain assumption A DNN object detector can learn a trigger-to-shrunk-box association from a small poisoned subset while preserving clean-image behavior.
Standard backdoor learning assumption invoked throughout the paper. It is validated empirically only for the tested YOLO variants and the filtered KITTI subset, not guaranteed in general.
domain assumption DECADE's distance estimates are strongly and monotonically tied to bounding-box dimensions, particularly height.
Used in Section II-C to predict downstream impact. If DECADE relied more on other cues, the MAE increase would not track the 5m offset.
domain assumption The filtered KITTI subset (Car class, 10-60m, non-truncated, occlusion<=1.0) is representative of the collision-avoidance operating regime.
Section III-A/B restricts all training and evaluation to this subset, so conclusions about KITTI-wide operation rest on this representativeness assumption.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems." pith.science (2026). https://pith.science/paper/FCRW4OUY

@misc{pith2026250718656,
  author       = {Pith},
  title        = {Pith review of: ShrinkBox: Backdoor Attack on Object Detection to Disrupt Collision Avoidance in Machine Learning-based Advanced Driver Assistance Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FCRW4OUY}},
  note         = {Machine review of arXiv:2507.18656}
}

read the original abstract

Advanced Driver Assistance Systems (ADAS) significantly enhance road safety by detecting potential collisions and alerting drivers. However, their reliance on expensive sensor technologies such as LiDAR and radar limits accessibility, particularly in low- and middle-income countries. Machine learning-based ADAS (ML-ADAS), leveraging deep neural networks (DNNs) with only standard camera input, offers a cost-effective alternative. Critical to ML-ADAS is the collision avoidance feature, which requires the ability to detect objects and estimate their distances accurately. This is achieved with specialized DNNs like YOLO, which provides real-time object detection, and a lightweight, detection-wise distance estimation approach that relies on key features extracted from the detections like bounding box dimensions and size. However, the robustness of these systems is undermined by security vulnerabilities in object detectors. In this paper, we introduce ShrinkBox, a novel backdoor attack targeting object detection in collision avoidance ML-ADAS. Unlike existing attacks that manipulate object class labels or presence, ShrinkBox subtly shrinks ground truth bounding boxes. This attack remains undetected in dataset inspections and standard benchmarks while severely disrupting downstream distance estimation. We demonstrate that ShrinkBox can be realized in the YOLOv9m object detector at an Attack Success Rate (ASR) of 96%, with only a 4% poisoning ratio in the training instances of the KITTI dataset. Furthermore, given the low error targets introduced in our relaxed poisoning strategy, we find that ShrinkBox increases the Mean Absolute Error (MAE) in downstream distance estimation by more than 3x on poisoned samples, potentially resulting in delays or prevention of collision warnings altogether.

Figures

Figures reproduced from arXiv: 2507.18656 by the authors.

**Figure 2.** The left column visualizes the stealthiness of Shrinkbox by [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Overview of the complete pipeline for our ShrinkBox attack [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: The learned estimation function (1) and distributions of [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]

**Figure 5.** Figure 5: Our poisoning ratios and the corresponding images and [PITH_FULL_IMAGE:figures/full_fig_p003_5.png]

**Figure 6.** Figure 6: Evaluation of object detectors infected at different poisoning ratios. [PITH_FULL_IMAGE:figures/full_fig_p004_6.png]

**Figure 7.** Figure 7: ASR evaluation over different similarity thresholds to adjust strictness of matching the predicted boxes with poisoned boxes. [PITH_FULL_IMAGE:figures/full_fig_p005_7.png]

**Figure 8.** Figure 8: End-to-end evaluation of DECADE with infected detectors at different poisoning ratios. [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

20 extracted references · 10 canonical work pages

[1]

Potential reductions in crashes, injuries, and deaths from large-scale deployment of advanced driver assistance systems,

A. J. Benson, B. C. Tefft, A. M. Svancara, and W. J. Horrey, “Potential reductions in crashes, injuries, and deaths from large-scale deployment of advanced driver assistance systems,” Research Brief, 2018

work page 2018
[2]

W. H. Organization, Global status report on road safety 2023 . World Health Organization, 2023

work page 2023
[3]

Object detection in 20 years: A survey,

Z. Zou, K. Chen, Z. Shi, Y . Guo, and J. Ye, “Object detection in 20 years: A survey,” Proceedings of the IEEE, vol. 111, no. 3, pp. 257–276, 2023

2023
[4]

Yolov3: An incremental improvement,

J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” arXiv preprint arXiv:1804.02767 , 2018

arXiv 2018
[5]

Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors,

C.-Y . Wang, A. Bochkovskiy, and H.-Y . M. Liao, “Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors,” in Proceedings of the IEEE/CVF CVPR , 2023, pp. 7464–7475

work page 2023
[6]

Yolov9: Learning what you want to learn using programmable gradient information,

C.-Y . Wang, I.-H. Yeh, and H.-Y . Mark Liao, “Yolov9: Learning what you want to learn using programmable gradient information,” in Euro- pean conference on computer vision . Springer, 2025, pp. 1–21

work page 2025
[7]

Yolov10: Real-time end-to-end object detection,

A. Wang, H. Chen, L. Liu, K. Chen, Z. Lin, J. Han, and G. Ding, “Yolov10: Real-time end-to-end object detection,” arXiv preprint arXiv:2405.14458, 2024

arXiv 2024
[8]

Deep ordinal regression network for monocular depth estimation,

H. Fu et al. , “Deep ordinal regression network for monocular depth estimation,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 2002–2011

work page 2018

Show all 20 references

[9]

Digging into self-supervised monocular depth prediction,

C. Godard, O. Mac Aodha, M. Firman, and G. J. Brostow, “Digging into self-supervised monocular depth prediction,” October 2019

2019
[10]

High quality monocular depth estimation via transfer learning,

I. Alhashim and P. Wonka, “High quality monocular depth estimation via transfer learning,” arXiv e-prints , vol. abs/1812.11941, 2018. [Online]. Available: https://arxiv.org/abs/1812.11941

2018 arXiv
[11]

Decade: Towards designing efficient-yet-accurate distance estimation modules for collision avoidance in mobile advanced driver assistance systems,

M. Z. Shahzad, M. A. Hanif, and M. Shafique, “Decade: Towards designing efficient-yet-accurate distance estimation modules for collision avoidance in mobile advanced driver assistance systems,” in 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)....

2024
[12]

Disnet: a novel method for distance estimation from monocular camera,

M. A. Haseeb, J. Guan, D. Ristic-Durrant, and A. Gr ¨aser, “Disnet: a novel method for distance estimation from monocular camera,” 10th Planning, Perception and Navigation for Intelligent Vehicles (PPNIV18), IROS, 2018

2018
[13]

Badnets: Evaluating backdooring attacks on deep neural networks,

T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access , vol. 7, pp. 47 230–47 244, 2019

2019
[14]

Targeted backdoor attacks on deep learning systems using data poisoning,

X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

2017 arXiv
[15]

Backdoor attacks and countermeasures on deep learning: A comprehensive review,

Y . Gao, B. G. Doan, Z. Zhang, S. Ma, J. Zhang, A. Fu, S. Nepal, and H. Kim, “Backdoor attacks and countermeasures on deep learning: A comprehensive review,” arXiv preprint arXiv:2007.10760 , 2020

2007 arXiv
[16]

Baddet: Backdoor attacks on object detection,

S.-H. Chan, Y . Dong, J. Zhu, X. Zhang, and J. Zhou, “Baddet: Backdoor attacks on object detection,” in European Conference on Computer Vision. Springer, 2022, pp. 396–412

2022
[17]

Backdoor learning: A survey,

Y . Li, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor learning: A survey,” IEEE Transactions on Neural Networks and Learning Systems , vol. 35, no. 1, pp. 5–22, 2022

2022
[18]

Ultralytics YOLO,

G. Jocher, J. Qiu, and A. Chaurasia, “Ultralytics YOLO,” Jan. 2023. [Online]. Available: https://github.com/ultralytics/ultralytics

2023
[19]

Are we ready for autonomous driving? the kitti vision benchmark suite,

A. Geiger, P. Lenz, and R. Urtasun, “Are we ready for autonomous driving? the kitti vision benchmark suite,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2012

2012
[20]

Dist-yolo: fast object detection with distance estimation,

M. Vajgl, P. Hurtik, and T. Nejezchleba, “Dist-yolo: fast object detection with distance estimation,” Applied sciences, vol. 12, no. 3, p. 1354, 2022

2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Potential reductions in crashes, injuries, and deaths from large-scale deployment of advanced driver assistance systems,

A. J. Benson, B. C. Tefft, A. M. Svancara, and W. J. Horrey, “Potential reductions in crashes, injuries, and deaths from large-scale deployment of advanced driver assistance systems,” Research Brief, 2018

work page 2018

[2] [2]

W. H. Organization, Global status report on road safety 2023 . World Health Organization, 2023

work page 2023

[3] [3]

Object detection in 20 years: A survey,

Z. Zou, K. Chen, Z. Shi, Y . Guo, and J. Ye, “Object detection in 20 years: A survey,” Proceedings of the IEEE, vol. 111, no. 3, pp. 257–276, 2023

2023

[4] [4]

Yolov3: An incremental improvement,

J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” arXiv preprint arXiv:1804.02767 , 2018

arXiv 2018

[5] [5]

Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors,

C.-Y . Wang, A. Bochkovskiy, and H.-Y . M. Liao, “Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors,” in Proceedings of the IEEE/CVF CVPR , 2023, pp. 7464–7475

work page 2023

[6] [6]

Yolov9: Learning what you want to learn using programmable gradient information,

C.-Y . Wang, I.-H. Yeh, and H.-Y . Mark Liao, “Yolov9: Learning what you want to learn using programmable gradient information,” in Euro- pean conference on computer vision . Springer, 2025, pp. 1–21

work page 2025

[7] [7]

Yolov10: Real-time end-to-end object detection,

A. Wang, H. Chen, L. Liu, K. Chen, Z. Lin, J. Han, and G. Ding, “Yolov10: Real-time end-to-end object detection,” arXiv preprint arXiv:2405.14458, 2024

arXiv 2024

[8] [8]

Deep ordinal regression network for monocular depth estimation,

H. Fu et al. , “Deep ordinal regression network for monocular depth estimation,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 2002–2011

work page 2018