Pith. sign in

REVIEW 4 major objections 6 minor 48 references

Contrastive adversarial training prevents detectors from using attack texture as independent person evidence, cutting texture-only false positives from 46.9% to 7.3%.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 08:02 UTC pith:DTHBSF5Q

load-bearing objection A solid empirical paper that diagnoses a real texture-shortcut failure in physical adversarial training and offers a plausible fix; the main caveat is that the central shortcut metric is built from the same negative-generation recipe used in training, so independence is weaker than claimed. the 4 major comments →

arxiv 2607.21243 v1 pith:DTHBSF5Q submitted 2026-07-23 cs.CV

Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attacks

Yuanhao Huang , Yilong Ren , Jinlei Wang , Xuesong Bai , Zheng Zhang , Haiyang Yu This is my paper
classification cs.CV
keywords adversarial trainingphysically realizable attackperson detectionshortcut learningcontrastive learningadversarial textureobject detectiontexture false positive
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Standard adversarial training against physically realizable attacks can teach a detector the wrong cue: an optimized texture that repeatedly appears on positive person instances becomes evidence for 'person' on its own, so the model fires on human-free texture and fails to transfer to new attack patterns. The paper establishes this 'patch texture shortcut' with a diagnosis metric (texture false-positive rate on human-free inputs) and instance-level feature similarity. It then proposes InsCAT, an instance-level contrastive adversarial training framework whose SICA loss pulls the adversarially textured person's features toward its matched clean-clothing features and pushes them away from a texture-only negative. On rendered driving scenes, InsCAT reaches 82.3% average attack AP, 11.1 points above the strongest baseline, while cutting texture FPR from 46.9% (AT-Mix) to 7.3% and keeping clean AP high. The practical stake is that a detector can report high adversarial AP while still failing on texture-only inputs, and InsCAT shows a training-side fix that removes that gap without a preprocessing stage.

Core claim

The paper's central claim is that the main failure mode of adversarial training against physically realizable person attacks is not weak detection under attack but the evidence the detector learns: repeated co-occurrence of an optimized adversarial texture with positive person labels makes the detector treat the texture pattern itself as an independent decision cue. This 'patch texture shortcut' produces confident person predictions on human-free texture inputs and weak cross-attack generalization, even when attack AP looks strong. The discovery is that this shortcut can be suppressed by instance-level contrastive regulation. InsCAT enforces, per person instance, a triplet relationship: the

What carries the argument

SICA (Structure-Invariant Contrastive Alignment) — an instance-level contrastive loss on ground-truth-aligned RoI features that pulls the adversarial person representation toward its matched clean representation and pushes it away from a texture-only negative. Around it, ROPO (Rendering-Amortised Online Patch Optimisation) maintains a single global adversarial texture through cheap 2D/3D optimizations and a render buffer so the attack signal stays online and training remains affordable, and an adversarial guard coordinates clean, adversarial, and contrastive loss weights to prevent robustness forgetting. The machinery's job is to control not just the strength of the adversarial signal during

Load-bearing premise

The texture-only negative—the current adversarial pattern composited onto a blank background with no human pixels—faithfully isolates the shortcut cue, so pushing adversarial person features away from it does not discard person-relevant information.

What would settle it

After training, generate a new adversarial texture by optimizing against the InsCAT detector itself, composite it onto a blank background, and measure person-confidence detections on that human-free image: if the model fires confidently on the new texture alone (texture FPR well above the reported 7.3% and close to or above the undefended rate), the claim that InsCAT suppresses the texture shortcut rather than memorizing the eight evaluation textures would be refuted.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Attack AP alone can mask a texture shortcut; reporting texture FPR on human-free inputs and instance-level feature similarity should accompany AP in physical adversarial robustness evaluation.
  • Instance-level contrastive alignment transfers across detector families (one-stage, two-stage, Transformer) with direct inference and no preprocessing latency.
  • A single online-optimized texture with a render buffer makes physical adversarial training computationally practical, by amortizing the differentiable rendering cost.
  • Robustness to unseen attack textures improves more from constraining what the detector learns than from broadening the training attack distribution alone.
  • Detectors trained this way keep near-clean performance (e.g., 96.0 clean AP on rendered scenes) while resisting eight independently generated textures.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the texture shortcut is a general label-coupling phenomenon, the same contrastive-triplet recipe should transfer to other physically realizable attacks where an object-specific pattern is repeatedly paired with positive labels, such as printed patterns on vehicles or signs.
  • The texture-only negative could be made harder by compositing the texture onto a non-target object (e.g., a mannequin or background surface) rather than a blank canvas; the paper's blank-background choice likely underestimates the shortcut's persistence.
  • A concrete prediction from the paper's distance analysis: InsCAT's benefit should vanish beyond roughly 15 m, where apparent scale—not texture—limits detection; this suggests scale-aware instance alignment as the next lever.
  • Because SICA operates on mid-level RoI features, it could be coupled with adaptive attacks that optimize texture to mimic clean-person features; whether the margin δ=0.35 in Eq. (11) holds under such attacks is an open question.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper identifies a failure mode in physical adversarial training for person detectors, which it calls the patch texture shortcut: when an optimized clothing texture repeatedly co-occurs with positive person instances, the detector learns to use the texture itself as evidence of person presence. This leads to high attack AP together with false detections on human-free texture-only inputs and poor transfer to unseen textures. The authors propose InsCAT, which combines ROPO (a rendering-amortized online texture optimizer), SICA (an instance-level contrastive alignment that pulls adversarial-person features toward matched clean-person features and pushes them away from texture-only negatives), and an adversarial guard that coordinates the training schedule. The method is evaluated on rendered nuScenes, INRIAPerson, printed garments, and three detector families. The main reported results are an average attack AP of 82.3% on rendered nuScenes (11.1 points above the strongest baseline PAD), a texture false-positive rate reduction from 46.9% (AT-Mix) to 7.3% (InsCAT), and a physical-world F1 of 96.6% with FPR 1.8%.

Significance. If the central claim holds, the paper makes a useful contribution: it provides a concrete diagnosis of shortcut learning in physical adversarial training and a training mechanism that explicitly targets texture-based decision cues while preserving clean accuracy and direct-inference latency. The paper's strengths include a clean ablation isolating the SICA objective (Table 5), evaluation on several independently generated attack textures, cross-architecture validation, and a training-efficiency analysis of ROPO. The code is promised publicly. The main risk is that the central shortcut-resistance metric (texture FPR) is generated by the same synthetic procedure used to create the SICA negatives, so the reported reduction may reflect specialization to that input distribution rather than general shortcut suppression. This concern, together with the partially confounded clean-rendered comparison and the narrow physical evaluation, prevents immediate acceptance.

major comments (4)
  1. [§3.4, §4.3.2, Eq. (11)] The central evidence for shortcut suppression is the texture FPR on human-free texture-only images (Fig. 5). These images are constructed by the same five-step procedure used for the SICA negative x_neg(p*) in Sec. 3.4: random scaling, tiling, cropping, sparse masking, and compositing onto a blank background. SICA explicitly optimizes the adversarial embedding to be dissimilar from this exact synthetic distribution. A low FPR on this recipe therefore does not establish that the detector has ceased using texture as a cue when texture appears on persons or in natural scenes; it may only have learned to reject the specific 'blank background + sparse mosaic' input class. The held-out textures in Fig. 5 vary texture appearance but not the composition recipe, so they do not break this correlation. The physical 'handheld texture' condition resembles the same blank-background negative. Please ad
  2. [§4.1, §4.2.1, Table 1] The headline 11.1-point gain over PAD is not a like-for-like training comparison. InsCAT is fine-tuned on rendered nuScenes composites (404 CAMFRONT backgrounds) and on COCO with rendered adversarial instances, whereas PAD and the other purification baselines use the same frozen pretrained detector without any rendered-domain training. This explains the large clean-rendered improvement (96.0 vs 80.6) and likely contributes to the attack-AP margin. The internal AT-Mix baseline, matched in rendering exposure and training schedule, is the correct adversarial-training comparator; its gap to InsCAT is much smaller (78.1 vs 82.3 AP in Sec. 4.3.2, or 0.802 vs 0.773 AP50 in Table 5). Please report like-for-like adversarial-training baselines (AT-Mix, plus PBCAT on YOLOv5n if feasible) with error bars, and qualify the PAD comparison as an inference-only comparison.
  3. [§4.6, Table 9] The physical validation uses one subject and two garments (AdvReal-v5 and AdvSerial-v5), both produced by the same group that developed the training attack optimizer (Refs. [20,21]); ROPO's 3D branch is explicitly built on [20]. The 'handheld texture' condition also resembles the blank-background negative used in training. This setup is too narrow to support the claim that FPR suppression generalizes to independently generated physical textures. Please add more subjects, garments, and environments, ideally with textures produced by an independent source, and report failure cases and per-sequence variability.
  4. [§4.2, Tables 1–3, 8] The main cross-attack and physical tables report single runs without error bars or significance tests. Table 7 shows run-to-run standard deviations around 0.01–0.03 for INRIAPerson AP50 and 0.03 for nuScenes AP50, which suggests that some of the reported differences could be within noise. Please report mean±std over at least three seeds for the central comparisons, and state whether the 11.1-point margin over PAD and the FPR reduction are statistically significant.
minor comments (6)
  1. [Abstract] The final phrase 'decision cu' appears to be missing the letter 'e'—should read 'decision cue'.
  2. [§3.4] Clarify that the same reference bounding box is used to define the RoI on the blank negative canvas. Currently the reader has to infer this from Fig. 3 and the phrase 'the bounding box is used only to determine the spatial extent.'
  3. [§4.3.2] Define the texture-FPR metric precisely: how are detections counted on human-free images, what IoU threshold is used, and are all detections treated as false positives regardless of class confidence?
  4. [Table 5] The checkmark notation in the component columns needs a small legend; it is currently not self-explanatory that a checkmark means the component is enabled.
  5. [Fig. 7] The caption should state what the solid and dashed curves represent for each garment condition and how the per-distance confidence values were aggregated over the five videos.
  6. [§4.1] State explicitly which of the reported baselines were retrained (L∞-AT, PBCAT, AT-Mix) and which were used frozen; the current text mentions this for purification methods but not for all adversarial-training baselines.

Circularity Check

1 steps flagged

Texture-FPR headline metric is trained on the same human-free texture-only negative recipe as SICA, making the shortcut-suppression evidence partially circular; cross-attack AP on unseen textures remains independent.

specific steps
  1. self definitional [Sec. 3.4 (Dynamic Negative Sample Generation), Eq. (11), Sec. 4.3.2 (Texture Shortcut Diagnosis, Fig. 5)]
    "Given the updated patch p⋆ after inner maximisation, the negative is constructed in five steps. ... The resulting sparse texture is finally composited onto a blank background canvas. ... (Eq. 11) w_neg (1/N) Σ max(0, s_neg - m_neg) ... We evaluate each model on human-free texture-only images, where each attack texture is presented without any human instance and every detected person is counted as a false positive."

    The SICA training negative is a human-free texture tile composited onto a blank background, and Eq. (11) directly penalises s_neg = z_adv^T z_neg, the similarity between adversarial-person features and this texture-only embedding. The texture-FPR diagnostic evaluates the same input type—human-free texture-only images with no human instance—using the same blank-background composition recipe. The reported drop from 46.9% (AT-Mix) to 7.3% (InsCAT) is therefore largely an in-sample consequence of training on that negative distribution, not an independent measurement that texture has ceased to act as a person cue in natural contexts. The fact that the eight evaluation textures are unseen mitigates but does not remove the circularity: the blank-background tile recipe and the surrogate s_neg obje

full rationale

InsCAT's cross-attack robustness claim has substantial independent content. The online training texture is newly initialised and optimised during training; none of the eight evaluation textures is used in training; six of them (AdvPatch, AdvTexture, AdvT-shirt, NatPatch, TRDPatch, T-SEA) come from external groups; and the AT-Mix baseline controls for adversarial exposure and guard scheduling. This prevents a 6-8 score. The circular element is concentrated in the shortcut-suppression diagnostics. The texture-only negative of Sec. 3.4—human-free texture composited on a blank background—is the same input type used as the texture-FPR evaluation of Sec. 4.3.2, and Eq. (11) directly optimises separation from that negative's embedding. Hence the headline FPR drop from 46.9% to 7.3% is substantially a report of the training objective rather than an independent test that texture is no longer used as a cue when it appears on real persons or in natural scenes. The feature-similarity metrics (s_neg, gap) are likewise direct terms of LSICA, so they are self-referential diagnostics. The physical evaluation uses only two textures from the authors' own attack family ([20,21]), which narrows, but does not by itself make circular, the real-world support. These issues warrant a moderate score, not a high one, because the core cross-attack AP numbers on unseen textures are computed against an objective external to the fitted FPR/similarity diagnostics.

Axiom & Free-Parameter Ledger

7 free parameters · 4 axioms · 0 invented entities

The method introduces no new physical entities; its central load-bearing assumptions are (i) that texture shortcuts form under physical adversarial training, (ii) that clean/adversarial matched renderings isolate garment appearance, and (iii) that blank-background texture-only negatives capture the shortcut cue. Free parameters are numerous but sensitivity is reported for only λ and w_neg.

free parameters (7)
  • TV regularization weight λ_tv = 3.5
    Chosen by authors to balance texture smoothness against attack strength.
  • Adversarial mix ratio ρ_adv = 0.30
    Fraction of COCO images augmented with the adversarial texture during training.
  • ROPO schedule (f_i, m, n_p, n_r) = f_i=20, m=120, n_p=5, n_r=4
    Refresh interval, render buffer capacity, inner Adam steps, and renderings per refresh.
  • SICA loss hyperparameters (λ, δ, m_neg, p_s) = λ=0.3, δ=0.35, m_neg=0.10, p_s=0.70
    Base loss weight, similarity gap margin, negative similarity margin, and trajectory-snapshot probability.
  • Training schedule weights (w_c, w_a, α_s, ε_c, ε_a) = w_c=0.5, w_a=2.0, α_s=1.5, ε_c=ε_a=0.03
    Clean/adversarial loss weights, SICA scale, and validation tolerances for the gated scheduler.
  • SICA component weights (w_pos, w_gap, w_neg) = w_pos=0.05, w_gap=0.8, w_neg=0.8
    Weights for positive alignment, gap, and negative-separation terms in Eq. (11).
  • UV tile scale s_t = 0.45
    Tiling scale of the shared texture on the garment UV atlas.
axioms (4)
  • domain assumption The detector can reduce the training loss by treating the attack pattern itself as evidence for object presence.
    Assumed in §1 and used to justify SICA; supported indirectly by post-hoc texture FPR and feature similarity, not by a controlled causal intervention.
  • domain assumption Clean and adversarial renderings share identical geometry and scene conditions, so their RoI features form a valid positive pair.
    §3.3 'Scene consistent rendering' and §3.5 'structure-invariant'; if the renderer introduces confounds beyond garment appearance, the alignment target is not person semantics.
  • domain assumption A human-free texture-only image is a faithful negative for the shortcut cue.
    §3.4 constructs negatives from the online texture on blank background; the loss (Eq. 11) assumes pushing away from this negative reduces shortcut without harming person features.
  • standard math Standard backpropagation through the detector and PyTorch3D renderer is valid for updating the shared texture.
    The training loop relies on differentiable rendering and detection losses; no formal verification is provided.

pith-pipeline@v1.3.0-alltime-deepseek · 21975 in / 16476 out tokens · 169190 ms · 2026-08-01T08:02:14.688447+00:00 · methodology

0 comments
read the original abstract

AI-enabled visual perception systems are increasingly deployed in intelligent transportation infrastructure and autonomous vehicle related applications. However, physically realizable adversarial appearances pose a significant reliability challenge for these safety-critical systems. Adversarial training is effective, but repeated co-occurrence between adversarial texture and positive person instances can cause detectors to treat the texture itself as evidence of object presence, forming a patch texture shortcut. The detector may then treat texture as evidence for the target, causing false detections on texture-only inputs and weakening cross attack generalisation. We propose InsCAT, an instance-level contrastive adversarial training framework that prevents detectors from using adversarial texture as an independent decision cue. SICA aligns adversarial person features with matched clean features and separates them from texture-only negatives, while ROPO and Guard maintain online attack pressure and coordinate training. We evaluate eight independently generated attack textures on rendered nuScenes, INRIAPerson, printed garments, and three detector families. InsCAT achieves an average attack AP of 82.3% on rendered nuScenes, exceeding the strongest baseline by 11.1 points.Relative to AT-Mix, texture FPR decreases from 46.9% to 7.3%. Physical tests yield an F1 score of 96.6% and an FPR of 1.8%. Consistent gains across separately trained detectors demonstrate applicability across architectures with direct inference. The findings show that robust physical detection depends on preserving target related evidence while preventing adversarial texture from becoming an independent decision cu

Figures

Figures reproduced from arXiv: 2607.21243 by Haiyang Yu, Jinlei Wang, Xuesong Bai, Yilong Ren, Yuanhao Huang, Zheng Zhang.

Figure 1
Figure 1. Figure 1: The patch texture shortcut. The undefended detector, AT-Mix, and InsCAT are evaluated on adversarially clothed persons using attack AP and on human-free texture inputs using texture FPR. texture-only cues. The main contributions are summarised as follows. 1. We identify a hidden reliability issue in AI-based perception systems, where adversarial training can unintentionally en￾courage detectors to rely on … view at source ↗
Figure 2
Figure 2. Figure 2: The InsCAT framework. The top row contains online adversarial texture updates, a posture library covering walking, running, crossing, and sneaking, and dynamically generated human free texture negatives. The middle row shows how the adversarial, clean, and negative sample groups χadv/χcle/χneg are maintained in the sample groups buffer. In the bottom row, Inner MAX freezes the detector and updates the adve… view at source ↗
Figure 3
Figure 3. Figure 3: SICA instance-level contrastive alignment. The three inputs χcle/χadv/χneg share a frozen backbone. A forward hook extracts the selected mid-level feature map, and RoIAlign followed by average pooling and a projection head produces the normalised embeddings z (i) cle/z (i) adv/z (i) neg. Each person instance forms an independent triplet. Within each SICA update, stop-gradient treats the clean and texture-n… view at source ↗
Figure 4
Figure 4. Figure 4: Performance–latency trade-off comparison of different methods on INRIAPerson and NuScenes [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Texture false-positive rate on human-free texture-only images. AT [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Physical-world detection results and Grad-CAM visualizations under AdvReal and AdvSerial. InsCAT improves person detection while reducing responses [PITH_FULL_IMAGE:figures/full_fig_p013_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Detection confidence versus distance for the undefended model and [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: t-SNE visualisation of clean person, adversarial person, and texture-only RoI features for the pretrained model, AT-Mix, and InsCAT. [PITH_FULL_IMAGE:figures/full_fig_p014_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

48 extracted references · 8 linked inside Pith

  1. [1]

    Huang, Q

    Y . Huang, Q. Zhang, J. Xing, M. Cheng, H. Yu, Y . Ren, X. Xiong, Advswap: Covert adversarial perturbation with high frequency info-swapping for autonomous driving perception, in: 2024 IEEE 27th International Conference on Intelligent Transportation Systems (ITSC), 2024, pp. 1686–1693. doi:10.1109/ITSC58415.2024.10920187

    arXiv 2024

  2. [2]

    K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.- Y . Chen, Y . Wang, X. Lin, Adversarial t-shirt! evading person detectors in a physical world, in: European con- ference on computer vision, Springer, 2020, pp. 665–681

    2020

  3. [3]

    S. Thys, W. Van Ranst, T. Goedemé, Fooling automated surveillance cameras: adversarial patches to attack person detection, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    2019

  4. [4]

    Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, X. Hu, Ad- versarial texture for fooling person detectors in the phys- ical world, in: Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, 2022, pp. 13307–13316

    2022

  5. [5]

    Z. Hu, W. Chu, X. Zhu, H. Zhang, B. Zhang, X. Hu, Phys- ically realizable natural-looking clothing textures evade person detectors via 3d modeling, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 16975–16984

    2023

  6. [6]

    Kumar, A

    V . Kumar, A. Agarwal, A unified, resilient, and ex- plainable adversarial patch detector, in: Proceedings of the Computer Vision and Pattern Recognition Conference, 2025, pp. 30387–30397

    2025

  7. [7]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial at- tacks, arXiv preprint arXiv:1706.06083 (2017)

    Pith/arXiv arXiv 2017

  8. [8]

    Zhang, J

    H. Zhang, J. Wang, Towards adversarially robust object detection, in: Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019, pp. 421–430

    2019

  9. [9]

    X. Li, Y . Zhu, Y . Huang, W. Zhang, Y . He, J. Shi, X. Hu, Pbcat: Patch-based composite adversarial training against physically realizable attacks on object detection, in: Pro- ceedings of the IEEE/CVF International Conference on Computer Vision, 2025, pp. 24456–24466

    2025

  10. [10]

    Kurakin, I

    A. Kurakin, I. Goodfellow, S. Bengio, Adversarial ma- chine learning at scale, arXiv preprint arXiv:1611.01236 (2016)

    Pith/arXiv arXiv 2016

  11. [11]

    Geirhos, J.-H

    R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, F. A. Wichmann, Shortcut learn- ing in deep neural networks, Nature Machine Intelligence 2 (2020) 665–673. 15

    2020

  12. [12]

    H. Shah, K. Tamuly, A. Raghunathan, P. Jain, P. Netra- palli, The pitfalls of simplicity bias in neural networks, Advances in Neural Information Processing Systems 33 (2020) 9573–9585

    2020

  13. [13]

    Bayer, S

    J. Bayer, S. Becker, D. Münch, M. Arens, J. Beyerer, Higher-order adversarial patches for real-time object de- tectors, arXiv preprint arXiv:2601.04991 (2026)

    arXiv 2026

  14. [14]

    Strack, F

    L. Strack, F. Waseda, H. H. Nguyen, Y . Zheng, I. Echizen, Defending against physical adversarial patch attacks on infrared human detection, in: 2024 IEEE International Conference on Image Processing (ICIP), IEEE, 2024, pp. 3896–3902

    2024

  15. [15]

    Ilyas, S

    A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, A. Madry, Adversarial examples are not bugs, they are features, Advances in neural information processing sys- tems 32 (2019)

    2019

  16. [16]

    T. B. Brown, D. Mané, A. Roy, M. Abadi, J. Gilmer, Adversarial patch, CoRR abs/1712.09665 (2017). URL:http://arxiv.org/abs/1712.09665. arXiv:1712.09665

    Pith/arXiv arXiv 2017

  17. [17]

    Hu, B.-H

    Y .-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, W.-H. Cheng, Naturalistic physical adversarial patch for object detectors, in: Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 7848–7857

    2021

  18. [18]

    Huang, Z

    H. Huang, Z. Chen, H. Chen, Y . Wang, K. Zhang, T-sea: Transfer-based self-ensemble attack on object detection, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 20514–20523

    2023

  19. [19]

    X. Wang, J. Chen, Z. Zhang, K. He, Z. Wu, R. Du, Q. Li, G. Liu, Transferable and robust dynamic adversarial at- tack against object detection models, IEEE Internet of Things Journal 12 (2025) 16171–16180

    2025

  20. [20]

    Huang, Y

    Y . Huang, Y . Ren, J. Wang, L. Huo, X. Bai, J. Zhang, H. Yu, Advreal: Physical adversarial patch generation framework for security evaluation of object detection sys- tems, Expert Systems with Applications 296 (2026) 128967

    2026

  21. [21]

    Huang, Y

    Y . Huang, Y . Ren, J. Wang, X. Bai, J. Zhang, H. Yu, Advserial: Physical adversarial attacks on infrastructure- mounted pedestrian detectors via semantic feature sup- pression, 2026. URL:https://arxiv.org/abs/2607. 17069.arXiv:2607.17069

    Pith/arXiv arXiv 2026

  22. [22]

    Naseer, S

    M. Naseer, S. Khan, F. Porikli, Local gradients smooth- ing: Defense against localized adversarial attacks, in: 2019 IEEE winter conference on applications of computer vision (W ACV), IEEE, 2019, pp. 1300–1307

    2019

  23. [23]

    Tarchoun, A

    B. Tarchoun, A. Ben Khalifa, M. A. Mahjoub, N. Abu- Ghazaleh, I. Alouani, Jedi: Entropy-based localization and removal of adversarial patches, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 4087–4095

    2023

  24. [24]

    L. Jing, R. Wang, W. Ren, X. Dong, C. Zou, Pad: Patch- agnostic defense against adversarial patch attacks, in: Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, 2024, pp. 24472–24481

    2024

  25. [25]

    J. Liu, A. Levine, C. P. Lau, R. Chellappa, S. Feizi, Seg- ment and complete: Defending object detectors against adversarial patch attacks with robust patch detection, in: Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, 2022, pp. 14973–14982

    2022

  26. [26]

    K. Xu, Y . Xiao, Z. Zheng, K. Cai, R. Nevatia, Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch, in: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2023, pp. 4632–4641

    2023

  27. [27]

    S. Wu, J. Wang, J. Zhao, Y . Wang, X. Liu, Napguard: To- wards detecting naturalistic adversarial patches, in: Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, 2024, pp. 24367–24376

    2024

  28. [28]

    Shafahi, M

    A. Shafahi, M. Najibi, M. A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, T. Goldstein, Adver- sarial training for free!, Advances in neural information processing systems 32 (2019)

    2019

  29. [29]

    T. Wu, L. Tong, Y . V orobeychik, Defending against phys- ically realizable attacks on image classification, arXiv preprint arXiv:1909.09552 (2019)

    Pith/arXiv arXiv 1909

  30. [30]

    S. Rao, D. Stutz, B. Schiele, Adversarial training against location-optimized adversarial patches, in: European con- ference on computer vision, Springer, 2020, pp. 429–448

    2020

  31. [31]

    J. H. Metzen, N. Finnie, R. Hutmacher, Meta adver- sarial training against universal patches, arXiv preprint arXiv:2101.11453 (2021)

    Pith/arXiv arXiv 2021

  32. [32]

    K. Xiao, L. Engstrom, A. Ilyas, A. Madry, Noise or sig- nal: The role of image backgrounds in object recognition, arXiv preprint arXiv:2006.09994 (2020)

    Pith/arXiv arXiv 2006

  33. [33]

    Geirhos, P

    R. Geirhos, P. Rubisch, C. Michaelis, M. Bethge, F. A. Wichmann, W. Brendel, Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness, in: International conference on learning representations, 2018

    2018

  34. [34]

    Burgert, O

    T. Burgert, O. Stoll, P. Rota, B. Demir, Imagenet-trained cnns are not biased towards texture: Revisiting feature reliance through controlled suppression, Advances in Neural Information Processing Systems 38 (2026) 60809– 60830

    2026

  35. [35]

    T. Chen, S. Kornblith, M. Norouzi, G. Hinton, A simple framework for contrastive learning of visual representa- tions, in: International conference on machine learning, PmLR, 2020, pp. 1597–1607. 16

    2020

  36. [36]

    K. He, H. Fan, Y . Wu, S. Xie, R. Girshick, Momentum contrast for unsupervised visual representation learning, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 9729–9738

    2020

  37. [37]

    Jiang, T

    Z. Jiang, T. Chen, T. Chen, Z. Wang, Robust pre-training by adversarial contrastive learning, Advances in neural information processing systems 33 (2020) 16199–16210

    2020

  38. [38]

    M. Kim, J. Tack, S. J. Hwang, Adversarial self-supervised contrastive learning, Advances in neural information pro- cessing systems 33 (2020) 2983–2994

    2020

  39. [39]

    L. Fan, S. Liu, P.-Y . Chen, G. Zhang, C. Gan, When does contrastive learning preserve adversarial robustness from pretraining to finetuning?, Advances in neural information processing systems 34 (2021) 21480–21492

    2021

  40. [40]

    B. Sun, B. Li, S. Cai, Y . Yuan, C. Zhang, Fsce: Few- shot object detection via contrastive proposal encoding, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 7352–7362

    2021

  41. [41]

    Caesar, V

    H. Caesar, V . Bankiti, A. H. Lang, S. V ora, V . E. Li- ong, Q. Xu, A. Krishnan, Y . Pan, G. Baldan, O. Beijbom, nuscenes: A multimodal dataset for autonomous driving, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11621–11631

    2020

  42. [42]

    J. H. Metzen, T. Genewein, V . Fischer, B. Bischoff, On detecting adversarial perturbations, arXiv preprint arXiv:1702.04267 (2017)

    Pith/arXiv arXiv 2017

  43. [43]

    W. Xu, H. Huang, S. Pan, Using feature alignment can im- prove clean average precision and adversarial robustness in object detection, in: 2021 IEEE International Confer- ence on Image Processing (ICIP), IEEE, 2021, pp. 2184– 2188

    2021

  44. [44]

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, C. L. Zitnick, Microsoft COCO: Common objects in context, in: Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, Springer, 2014, pp. 740–755

    2014

  45. [45]

    Dalal, B

    N. Dalal, B. Triggs, Histograms of oriented gradients for human detection, in: Proceedings of the 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR’05) - V olume 1 - V olume 01, CVPR ’05, IEEE Computer Society, USA, 2005, p. 886–893. URL:https://doi.org/10.1109/CVPR. 2005.177. doi:10.1109/CVPR.2005.177

    doi:10.1109/cvpr 2005

  46. [46]

    Jocher, A

    G. Jocher, A. Stoken, J. Borovec, L. Changyu, A. Hogan, L. Diaconu, J. Poznanski, L. Yu, P. Rai, R. Ferriday, et al., ultralytics/yolov5: v3. 0, Zenodo (2020)

    2020

  47. [47]

    S. Ren, K. He, R. Girshick, J. Sun, Faster r-cnn: Towards real-time object detection with region proposal networks, IEEE transactions on pattern analysis and machine intelli- gence 39 (2016) 1137–1149

    2016

  48. [48]

    F. Li, H. Zhang, S. Liu, J. Guo, L. M. Ni, L. Zhang, Dn- detr: Accelerate detr training by introducing query denois- ing, in: Proceedings of the IEEE/CVF conference on com- puter vision and pattern recognition, 2022, pp. 13619– 13627. 17

    2022