Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Physical Adversarial Camouflage through Gradient Calibration and Regularization

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that physical adversarial camouflage fails mainly because texture gradients are sparse across distances and conflicting across viewpoints, and that fixing both in gradient space yields far stronger detection evasion.

desk verdict The gradient calibration idea is neat and the ablation is clean, but the headline gains rest on an unvalidated baseline conversion; worth a careful reviewer, not face value. read the letter →

arxiv 2508.05414 v1 pith:LGD6XOU4 submitted 2025-08-07 cs.CV

Jiawei Liang , Siyuan Liang , Jianjie Huang , Chenxi Si , Ming Zhang , Xiaochun Cao This is my paper
classification cs.CV
keywords adversarialcamouflagephysicalattackobjectdetectionevasiongradientcalibrationdecorrelationdifferentiablerenderingGram-Schmidtorthogonalizationautonomousdrivingsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's aim is to make physical adversarial camouflage—printed textures that hide vehicles from object detectors—work across the variable distances, angles, and weather conditions of real driving. It pins the weakness of previous textures on two gradient-level defects rather than on the renderer or detector: at longer ranges fewer texture points are sampled, so gradient updates are sparse and locally discontinuous, and different viewpoints inside one training batch push the texture in redundant or opposing directions. To fix these, the paper proposes Nearest Gradient Calibration (NGC), which copies each sampled gradient to nearby unsampled texture points, and Loss-Prioritized Gradient Decorrelation (LPGD), which sorts viewpoint gradients by loss and orthogonalizes them so updates do not cancel. In the paper's experiments the combined method lowers the detector's AP@0.5 far below previous camouflage methods across elevation angles, distances, weather conditions, and black-box detectors, with the largest reported gains of 13.46% average attack success across distances and 11.03% across angles. If accurate, the result matters because it shows that the bottleneck in physical adversarial camouflage is not just appearance but the geometry of gradients.

What carries the argument

Two named mechanisms carry the argument. Nearest Gradient Calibration (NGC) uses KD-tree nearest-neighbor search to propagate the gradient of each sampled texture point to unsampled neighbors within a radius $\tau$, restoring local continuity when distance changes the sampling density. Loss-Prioritized Gradient Decorrelation (LPGD) sorts the batch's viewpoint gradients by adversarial loss, then applies Gram-Schmidt orthogonalization so each gradient contributes only components orthogonal to the already-kept gradients, and averages the result. Together they convert raw backpropagated gradients into a calibrated, decorrelated update direction before the texture is changed.

What would settle it

Re-run all baselines under their native renderers and optimization protocols without standardizing to one UV mask, then print each texture at full vehicle scale and measure AP@0.5; if any baseline reaches or beats the proposed method's 2.16% angle-average AP@0.5 under its own protocol, the core margin is not robust.

Watch

Extended reading notes

Core claim

The paper's central claim is that two gradient-level defects—distance-dependent sparsity and multi-viewpoint conflict—are the main reasons physical adversarial camouflage underperforms, and both are repairable before the texture is updated. It introduces Nearest Gradient Calibration (NGC), which propagates each sampled point's gradient to nearby unsampled texture points within a radius using a KD-tree nearest-neighbor search, so texture updates stay locally continuous at every distance. It then introduces Loss-Prioritized Gradient Decorrelation (LPGD), which sorts the viewpoint gradients by adversarial loss, applies Gram-Schmidt orthogonalization so later gradients add only non-redundant, no

Load-bearing premise

The reported gains assume that normalizing every baseline into the same UV texture format and the same rendering pipeline does not hurt those baselines, and that simulation plus a 1:24 scale model behaves like a full-size vehicle in the field.

Editorial extensions

If this is right

  • Attack effectiveness rises: angle-averaged AP@0.5 falls to 2.16% and distance-averaged AP@0.5 to 2.53%, versus 13.19% and 15.99% for the best previous method.
  • Weather robustness improves by an average of 19.38 percentage points in AP@0.5 over the strongest baseline across noon, sunset, night, fog, and rain settings.
  • The camouflage transfers to other detectors: white-box YOLOv3 drops to 2.16%, while black-box YOLOX, Faster R-CNN, Mask R-CNN, DETR, and PVT all show lower AP@0.5 than the baselines in most cases.
  • Both components contribute: ablations show NGC alone lowers AP@0.5 on YOLOv3 from 11.75% to 3.45%, LPGD alone to 8.63%, and the combination to 2.16%.
  • The added computation is modest: NGC adds 18% per-iteration time and LPGD adds 4.6% over the base forward and backward pass.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension beyond the paper: the same gradient propagation idea could be applied to any differentiable-rendering attack where UV sampling density varies, including patches and 3D objects other than vehicles.
  • The loss-prioritized orthogonalization implies a design choice: it privileges hard viewpoints at the expense of easy ones; testing other ordering rules would reveal whether this bias is the actual source of the gain.
  • The real-world results are on a 1:24 scale printed model, so full-scale deployment remains the decisive test of whether the simulation margins survive material, size, and lighting changes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper proposes a physical adversarial camouflage framework for vehicle detectors, built on two gradient-level techniques: Nearest Gradient Calibration (NGC), which propagates gradients from sampled UV points to nearby unsampled points via a KD-tree search with radius τ, and Loss-Prioritized Gradient Decorrelation (LPGD), which sorts per-viewpoint gradients by loss and Gram-Schmidt-orthogonalizes them before averaging. The method is evaluated in CARLA against DAS, FCA, DTA, ACTIVE, and RAUCA, with YOLOv3 as the white-box target and several other detectors as black-box transfer targets, across elevation angles, distances, weather conditions, and a printed 1:24-scale real-world test. The paper reports large AP@0.5 reductions relative to RAUCA and claims an average increase in attack success rate of 13.46% across distances, 11.03% across angles, and 19.38% across weather conditions.

Significance. The two optimization pathologies identified—distance-dependent gradient sparsity and cross-view gradient conflict—are plausible, and the proposed fixes are simple, transparent, and computationally cheap: NGC is O(M log N) and LPGD is O(m^2 k). The ablation in Table 6 shows that each component helps on both YOLOv3 and Faster R-CNN, and the runtime analysis in Table 5 is useful. However, the headline SOTA claim rests on a comparison protocol in which all baselines are converted to a common UV parametrization, mask, and renderer; the paper provides no evidence that this conversion is neutral. In addition, all results are single-run AP values, hyperparameters τ and k are selected on the evaluation metric itself, and no code or data are released. These issues currently leave the quantitative margin unestablished to the standard the abstract claims, though the underlying ideas are reasonable and potentially useful.

major comments (4)
  1. [§4.1, Comparison Baselines] The claim of SOTA gains is established only through the standardized-UV comparison. All baselines (DAS, FCA, DTA, ACTIVE, RAUCA) are converted into the authors' UV parametrization and rendered with the same ModernGL pipeline and mask K. This is not shown to be neutral: each baseline was designed with its own renderer, UV layout, and auxiliary components (e.g., DTA's shadow network, ACTIVE's background-color integration, RAUCA's weather-aware rendering). The conversion can discard texture updates outside K, resample UV maps lossily, or erase method-specific effects, and the proposed method is optimized under exactly this protocol. A native-vs-standardized comparison for at least RAUCA (and ideally all baselines) is needed to bound the conversion loss; without it, the 11–19 point margins in Tables 1–3 cannot be attributed to the method.
  2. [§4.5/Figure 7 and Tables 1–4] The hyperparameters τ (search radius) and k (LPGD batch size) are selected by observing AP on the same evaluation protocol used for the final comparison. With no separate validation set and single-run AP values, the reported improvements may be partly due to selection on the test metric. Please use a validation split for hyperparameter selection and report mean±std over multiple optimization runs (or at least over evaluation samples) for Tables 1–4. This is especially important because the reported margins over RAUCA (e.g., 13.46% across distances) are the paper's central quantitative claim.
  3. [§4.3, Real-World Settings] Figure 6 reports only relative curves with no numeric AP values, sample sizes, confidence intervals, or comparison to any baseline camouflage printed and evaluated under identical conditions. The real-world experiment can at most demonstrate feasibility; it does not support the relative SOTA claim. Please provide the underlying numbers and, if possible, one or more baseline textures in the same physical protocol.
  4. [Abstract and §4.1] The abstract promises an 'average increase in attack success rate (ASR)' of 13.46%/11.03%, but the experiments report AP@0.5, a precision-recall metric. ASR is never defined in Section 4.1. If ASR is intended as 1−AP or as a detection-failure rate, the equivalence and the direction of improvement must be stated; otherwise the headline percentages cannot be verified from Tables 1–3.
minor comments (5)
  1. [References] Incomplete reference: 'Muxue et al., ;' lacks year, title, and venue. Please correct and update any references that now have published versions (e.g., RAUCA is cited as an arXiv preprint).
  2. [Figure 6] Panel (b) is labeled 'Distance (Relative)' but the axis and absolute scale are not defined. Please add axes and clarify the unit or normalization.
  3. [Table 4] The abbreviation 'FrRCN' is not defined in the caption or text; use 'Faster R-CNN' or define it at first use.
  4. [Throughout] There are several typographical issues, including missing spaces before citations (e.g., 'RAUCA[Zhou et al., 2024]' in §2.3) and 'Wanget al.' in Table 2. A careful proofread is needed.
  5. [Algorithm 1] The pseudocode computes ∇T' but does not show the texture update step. Please include the update rule (e.g., Adam step) so the optimization loop is complete.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the method is empirically benchmarked against external baselines; the baseline-standardization concern is an evaluation-validity risk, not a circular reduction.

full rationale

Walking the paper's derivation chain, the central claim is an empirical attack-performance comparison, not a mathematical derivation that presupposes its own conclusion. The objective in Eq. (4) is a standard suppression loss minimized over rendered textures; NGC (Eq. 7) and LPGD (Eqs. 8-9) are training-time gradient modifications, and the reported ASR/AP@0.5 values in Tables 1-4 are measured outcomes from a detector. No fitted parameter is renamed as a prediction: the hyperparameters τ and k are tuned via ablation (Figure 7), but the final reported AP values are not a prediction derived from those fits; they are direct measurements under the chosen settings. The comparison baselines (DAS, FCA, DTA, ACTIVE, RAUCA) are external methods, and the paper's transformation of all methods into 'standardized UV textures' with a common mask K is an evaluation-protocol choice that could unfairly affect baselines, but this is a threat to external validity or fairness, not a circular equation where an output reduces to an input by construction. The paper contains self-citations, but none is load-bearing: no uniqueness theorem, ansatz, or fitted parameter is imported from the authors' prior work to force the result. Thus there is no significant circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The ledger is light because the paper is an empirical method paper, not a derivation. Its main hidden costs are the tuned hyperparameters (tau, k) and domain assumptions about simulator fidelity and cross-method comparability.

free parameters (3)
  • search radius tau = not reported, swept in [0,16]
    Controls how far gradients propagate from sampled to unsampled texture points; Figure 7(a) shows performance peaks at an intermediate tau, so the final value is chosen using this ablation.
  • LPGD batch size k = not reported, swept in [1,40]
    Number of viewpoints orthogonalized per step; Figure 7(b) shows monotonic improvement with k, so the final k is selected on the same evaluation protocol.
  • texture optimization hyperparameters = lr=0.1, 3 epochs
    Set in Section 4.1; standard but not justified by analysis.
assumptions (3)
  • domain assumption CARLA simulator and ModernGL renderer model real-world vehicle appearance closely enough that simulation results transfer to physical prints.
    Section 4.1 and 4.3 use CARLA for training/evaluation and a 1:24 scale model for real-world validation; if sim-to-real gap is large, the central quantitative claims do not transfer.
  • domain assumption Standard UV texture parameterization and masking with K covers the full attackable surface and is equivalent across methods.
    Section 4.1 transforms all baselines to standardized UV textures; this assumes the transformation does not alter attack difficulty.
  • standard math Backpropagation through the renderer and detector yields gradients that can be decorrelated in texture space without loss of validity.
    Used in Equations 6-9; standard in differentiable rendering.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Physical Adversarial Camouflage through Gradient Calibration and Regularization." pith.science (2026). https://pith.science/paper/LGD6XOU4

@misc{pith2026250805414,
  author       = {Pith},
  title        = {Pith review of: Physical Adversarial Camouflage through Gradient Calibration and Regularization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LGD6XOU4}},
  note         = {Machine review of arXiv:2508.05414}
}
read the original abstract

The advancement of deep object detectors has greatly affected safety-critical fields like autonomous driving. However, physical adversarial camouflage poses a significant security risk by altering object textures to deceive detectors. Existing techniques struggle with variable physical environments, facing two main challenges: 1) inconsistent sampling point densities across distances hinder the gradient optimization from ensuring local continuity, and 2) updating texture gradients from multiple angles causes conflicts, reducing optimization stability and attack effectiveness. To address these issues, we propose a novel adversarial camouflage framework based on gradient optimization. First, we introduce a gradient calibration strategy, which ensures consistent gradient updates across distances by propagating gradients from sparsely to unsampled texture points. Additionally, we develop a gradient decorrelation method, which prioritizes and orthogonalizes gradients based on loss values, enhancing stability and effectiveness in multi-angle optimization by eliminating redundant or conflicting updates. Extensive experimental results on various detection models, angles and distances show that our method significantly exceeds the state of the art, with an average increase in attack success rate (ASR) of 13.46% across distances and 11.03% across angles. Furthermore, empirical evaluation in real-world scenarios highlights the need for more robust system design.

Figures

Figures reproduced from arXiv: 2508.05414 by the authors.

Figure 2
Figure 2. Illustration of gradient conflicts from different perspec [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Overview of our proposed method. To optimize the texture, we first render the target vehicle image using the texture with a renderer [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Optimized textures for each baseline method and the cor [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Samples under different evaluation conditions [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 7
Figure 7. Figure 7: Ablation study on (a) search radius in NGC and (b) batch [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. AdvSerial: Physical Adversarial Attacks on Infrastructure-mounted Pedestrian Detectors via Semantic Feature Suppression

    cs.CV 2026-07 conditional novelty 6.0 of 10

    AdvSerial uses 2D-3D joint optimization of quilted clothing textures and a serial-frame loss to make high-angle pedestrian detectors fail consistently in physical tests.

Reference graph

Works this paper leans on

37 extracted references · 29 canonical work pages · cited by 1 Pith paper

  1. [1]

    End-to-end object detection with transformers

    [Carion et al., 2020] Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In European conference on computer vision, pages 213–229. Springer,

    work page 2020

  2. [4]

    CARLA: An open urban driving simulator

    [Dosovitskiy et al., 2017] Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. CARLA: An open urban driving simulator. In Conference on robot learning, pages 1–16. PMLR,

    work page 2017

  3. [6]

    The pascal visual object classes challenge: A retrospective

    [Everingham et al., 2015] Mark Everingham, SM Ali Es- lami, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes challenge: A retrospective. International journal of com- puter vision, 111:98–136,

    work page 2015

  4. [9]

    Fast r-cnn

    [Girshick, 2015] Ross Girshick. Fast r-cnn. In International Conference on Computer Vision (ICCV),

    work page 2015

  5. [10]

    Explaining and harnessing adversarial examples

    [Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 ,

    arXiv 2014

  6. [12]

    Neural 3d mesh renderer

    [Kato et al., 2018] Hiroharu Kato, Yoshitaka Ushiku, and Tatsuya Harada. Neural 3d mesh renderer. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3907–3916,

    work page 2018

  7. [16]

    Generate more imperceptible adversarial ex- amples for object detection

    [Liang et al., 2021] Siyuan Liang, Xingxing Wei, and Xi- aochun Cao. Generate more imperceptible adversarial ex- amples for object detection. In ICML 2021 Workshop on Adversarial Machine Learning,

    work page 2021

  8. [18]

    Exploring inconsis- tent knowledge distillation for object detection with data augmentation

    [Liang et al., 2023] Jiawei Liang, Siyuan Liang, Aishan Liu, Ke Ma, Jingzhi Li, and Xiaochun Cao. Exploring inconsis- tent knowledge distillation for object detection with data augmentation. In Proceedings of the 31st ACM Interna- tional Conference on Multimedia, pages 768–778,

    work page 2023

Show all 37 references
  1. [19]

    Object detectors in the open environ- ment: Challenges, solutions, and outlook

    [Liang et al., 2024b] Siyuan Liang, Wei Wang, Ruoyu Chen, Aishan Liu, Boxi Wu, Ee-Chien Chang, Xiaochun Cao, and Dacheng Tao. Object detectors in the open environ- ment: Challenges, solutions, and outlook. arXiv preprint arXiv:2403.16271,

    arXiv

  2. [20]

    Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models

    [Liang et al., 2025] Jiawei Liang, Siyuan Liang, Aishan Liu, and Xiaochun Cao. Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. International Journal of Computer Vision, pages 1–20,

    2025

  3. [24]

    Adversarial instance attacks for interactions between hu- man and object

    [Muxue et al., ] Liang Muxue, Chuan Wang, Siyuan Liang, Aishan Liu, Zeming Liu, Liang Yang, and Xiaochun Cao. Adversarial instance attacks for interactions between hu- man and object. [Redmon and Farhadi, 2018] Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement....

    2018 arXiv

  4. [25]

    Faster r-cnn: Towards real-time ob- ject detection with region proposal networks

    [Ren et al., 2015] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: Towards real-time ob- ject detection with region proposal networks. Advances in Neural Information Processing Systems (NeurIPS) , 28,

    2015

  5. [26]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    [Ren et al., 2016] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. IEEE transactions on pattern analysis and machine intelligence, 39(6):1137–1149,

    2016

  6. [27]

    DTA: Physical Camouflage Attacks Using Differentiable Transformation Network

    [Suryanto et al., 2022] Naufal Suryanto, Yongsu Kim, Hy- oeun Kang, Harashta Tatimma Larasati, Youngyeo Yun, Thi-Thu-Huong Le, Hunmin Yang, Se-Yoon Oh, and Howon Kim. DTA: Physical Camouflage Attacks Using Differentiable Transformation Network. In Proceedings of the IEEE/CVF C...

    2022

  7. [28]

    ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Universal and Robust Ve- hicle Evasion

    [Suryanto et al., 2023] Naufal Suryanto, Yongsu Kim, Ha- rashta Tatimma Larasati, Hyoeun Kang, Thi-Thu-Huong Le, Yoonyoung Hong, Hunmin Yang, Se-Yoon Oh, and Howon Kim. ACTIVE: Towards Highly Transferable 3D Physical Camouflage for Universal and Robust Ve- hicle Evasion. In Pr...

    2023

  8. [29]

    Goodfellow, and Rob Fergus

    [Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Repre- sentati...

    2014

  9. [30]

    Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack

    [Wang et al., 2022] Donghua Wang, Tingsong Jiang, Jialiang Sun, Weien Zhou, Zhiqiang Gong, Xiaoya Zhang, Wen Yao, and Xiaoqian Chen. Fca: Learning a 3d full-coverage vehicle camouflage for multi-view physical adversarial attack. In Proceedings of the AAAI conference on artific...

    2022

  10. [31]

    Transferable adversarial attacks for image and video object detection

    [Wei et al., 2018] Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641,

    2018 arXiv

  11. [32]

    Physical adversarial attack meets computer vision: A decade survey

    [Wei et al., 2024] Hui Wei, Hao Tang, Xuemei Jia, Zhixi- ang Wang, Hanxun Yu, Zhubo Li, Shin’ichi Satoh, Luc Van Gool, and Zheng Wang. Physical adversarial attack meets computer vision: A decade survey. IEEE Transac- tions on Pattern Analysis and Machine Intelligence,

    2024

  12. [33]

    Real-time kd-tree construction on graph- ics hardware

    [Zhou et al., 2008] Kun Zhou, Qiming Hou, Rui Wang, and Baining Guo. Real-time kd-tree construction on graph- ics hardware. ACM Transactions on Graphics (TOG) , 27(5):1–11,

    2008

  13. [35]

    Deformable DETR: De- formable Transformers for End-to-End Object Detection

    [Zhu et al., 2021] Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable DETR: De- formable Transformers for End-to-End Object Detection. In 9th International Conference on Learning Representa- tions, ICLR 2021, Virtual Event, Austria, May 3-7, 202...

    2021

  14. [36]

    {TPatch}: A triggered physical adversarial patch

    [Zhu et al., 2023] Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, and Wenyuan Xu. {TPatch}: A triggered physical adversarial patch. In 32nd USENIX Security Sym- posium (USENIX Security 23), pages 661–678,

    2023

  15. [37]

    Object detection in 20 years: A survey

    [Zou et al., 2023] Zhengxia Zou, Keyan Chen, Zhenwei Shi, Yuhong Guo, and Jieping Ye. Object detection in 20 years: A survey. Proceedings of the IEEE , 111(3):257– 276, 2023

    2023

  16. [2008]

    Rauca: A novel physical adversarial attack on ve- hicle detectors via robust and accurate camouflage gener- ation

    [Zhou et al., 2024] Jiawei Zhou, Linye Lyu, Daojing He, and Yu Li. Rauca: A novel physical adversarial attack on ve- hicle detectors via robust and accurate camouflage gener- ation. arXiv preprint arXiv:2402.15853,

    2024 arXiv

  17. [2013]

    Efficient adversarial attacks for visual object tracking

    [Liang et al., 2020] Siyuan Liang, Xingxing Wei, Siyuan Yao, and Xiaochun Cao. Efficient adversarial attacks for visual object tracking. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVI 16,

    2020

  18. [2014]

    Mask r-cnn

    [He et al., 2017] Kaiming He, Georgia Gkioxari, Piotr Doll´ar, and Ross Girshick. Mask r-cnn. In International Conference on Computer Vision (ICCV),

    2017

  19. [2015]

    YOLOX: Exceeding YOLO Series in

    [Ge et al., 2021] Zheng Ge, Songtao Liu, Feng Wang, Zem- ing Li, and Jian Sun. YOLOX: Exceeding YOLO Series in

    2021

  20. [2016]

    {X-Adv}: Physical adversarial object attacks against x-ray prohibited item detection

    [Liu et al., 2023] Aishan Liu, Jun Guo, Jiakai Wang, Siyuan Liang, Renshuai Tao, Wenbo Zhou, Cong Liu, Xianglong Liu, and Dacheng Tao. {X-Adv}: Physical adversarial object attacks against x-ray prohibited item detection. In 32nd USENIX Security Symposium (USENIX Security 23),

    2023

  21. [2017]

    Centernet: Keypoint triplets for object detection

    [Duan et al., 2019] Kaiwen Duan, Song Bai, Lingxi Xie, Honggang Qi, Qingming Huang, and Qi Tian. Centernet: Keypoint triplets for object detection. In Proceedings of the IEEE/CVF international conference on computer vi- sion, pages 6569–6578,

    2019

  22. [2018]

    Environmental matching attack against un- manned aerial vehicles object detection

    [Kong et al., 2024a] Dehong Kong, Siyuan Liang, and Wenqi Ren. Environmental matching attack against un- manned aerial vehicles object detection. arXiv preprint arXiv:2405.07595,

    arXiv

  23. [2019]

    Moderngl, high perfor- mance python bindings for opengl 3.3+

    [Dombi, 2020] Szabolcs Dombi. Moderngl, high perfor- mance python bindings for opengl 3.3+. https://github. com/moderngl/moderngl,

    2020

  24. [2020]

    MMDetection: Open MMLab Detection Toolbox and Benchmark

    [Chen et al., 2019] Kai Chen, Jiaqi Wang, Jiangmiao Pang, Yuhang Cao, Yu Xiong, Xiaoxiao Li, Shuyang Sun, Wansen Feng, Ziwei Liu, Jiarui Xu, Zheng Zhang, Dazhi Cheng, Chenchen Zhu, Tianheng Cheng, Qijie Zhao, Buyu Li, Xin Lu, Rui Zhu, Yue Wu, Jifeng Dai, Jingdong Wang, Jianpin...

    2019 arXiv

  25. [2021]

    CoRR, abs/2107.08430,

    arXiv

  26. [2022]

    Parallel rectangle flip attack: A query-based black-box attack against object detection

    [Liang et al., 2022b] Siyuan Liang, Baoyuan Wu, Yanbo Fan, Xingxing Wei, and Xiaochun Cao. Parallel rectangle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970,

    arXiv

  27. [2023]

    Towards deep learning models resistant to adversarial attacks

    [Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. stat, 1050(9),

    2017

  28. [2024]

    Gram-schmidt orthogonalization: 100 years and more

    [Leon et al., 2013] Steven J Leon, ˚Ake Bj ¨orck, and Wal- ter Gander. Gram-schmidt orthogonalization: 100 years and more. Numerical Linear Algebra with Applications , 20(3):492–532,

    2013

  29. [2025]

    Ssd: Single shot multibox detector

    [Liu et al., 2016] Wei Liu, Dragomir Anguelov, Dumitru Er- han, Christian Szegedy, Scott Reed, Cheng-Yang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. In European Conference on Computer Vision (ECCV),

    2016

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.