Pith. sign in

REVIEW 4 major objections 4 minor 30 references

Bounding-box Watermarking: Defense against Model Extraction Attacks on Object Detectors

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes bounding-box watermarking (BBW), which injects a backdoor into extracted object detectors by subtly resizing the bounding boxes of trigger objects in API responses, and reports that this watermark reliably identifies…

desk verdict The first backdoor watermarking defense for object detectors, with solid experiments and a real but openly acknowledged fragility when the attacker's substitute data sits outside the defender's training distribution. read the letter →

arxiv 2411.13047 v2 pith:KGLIQGBG submitted 2024-11-20 cs.CR cs.CV

Satoru Koda , Ikuya Morikawa This is my paper · ORCID
classification cs.CRcs.CV
keywords modelextractionattackbackdoorwatermarkingobjectdetectionbounding-boxpoisoningAPIresponsetriggerclusterownershipverificationdeeplearningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that model extraction attacks on object detectors can be detected after the fact using a backdoor-based watermark that is practical, stealthy, and functionality-preserving. It proposes bounding-box watermarking (BBW), which alters only the geometry of bounding boxes in API responses for a small, compact class of trigger objects. If the attacker trains a copy on those responses, the copy learns to output distorted boxes on trigger objects, and a ratio-based suspiciousness score can pick it out. The reported experiments show perfect or near-perfect verification accuracy across a wide range of poisoning ratios and box-rescaling magnitudes on three datasets. The significance is that ownership of a stolen detector can be demonstrated through its public API without degrading detection accuracy.

What carries the argument

The central object is the bounding-box watermark itself: a poisoner that rescales the width and height of predicted boxes on trigger objects by a factor δ, a trigger indicator defined as membership in a compact density-based cluster of object feature vectors, and the suspiciousness score S that compares prediction inconsistency on trigger versus non-trigger objects. The mechanism works by making the backdoor a geometric bias on a semantically coherent object class: any model trained on poisoned responses inherits the bias, while non-extracted models do not.

What would settle it

Train an extracted model on substitute data whose object features lie entirely outside the defender's trigger cluster, for instance using COCO images when the target was trained on VOC07, and compute the suspiciousness score from Eq. (6); the paper reports verification AUROC collapsing to 4.0% at a 1% nominal poisoning ratio in exactly this non-i.i.d. setting. A systematic sweep that maps verification AUROC as a function of distribution overlap between trigger cluster and substitute data would settle the conditions under which the verifiability condition Eq. (2) actually holds.

Watch

Extended reading notes

Core claim

The paper claims that a defender operating an object-detection API can watermark any model extracted from it by silently resizing the predicted bounding boxes of a predefined set of trigger objects, while leaving labels and all other boxes unchanged. Because the attacker trains the extracted model on these poisoned API responses, the extracted model inherits a backdoor: it outputs slightly distorted boxes only on trigger objects. During verification, the defender queries both the original and the suspicious model with a key-set containing trigger and non-trigger objects, pairs up detections by category and IoU overlap, and computes the suspiciousness score S in Eq. (6): the average prediction inconsistency on trigger objects divided by the same average on non-trigger objects. A watermarked model scores well above 1, while a non-watermarked model scores close to 1. The paper reports AUROC of 100% in many configurations on VOC07, TrafficSigns, and CityPersons, including a case where only 2% of API responses are poisoned with a 1.05x box expansion.

Load-bearing premise

The defender's trigger objects must actually appear in the data the attacker uses to train the extracted model; if the attacker's substitute data does not overlap the trigger cluster, no poisoned response ever reaches the extracted model and the watermark cannot form.

Editorial extensions

If this is right

  • Watermark verification requires only API access to the suspicious model; no internal weights or training data are needed.
  • Because the poison changes only box dimensions, legitimate users keep functionally correct detections; the paper reports watermarked models' mAP50 stays close to the baseline.
  • The watermark survives common countermeasures: weight pruning and finetuning remove it only when the extracted model's detection capability also collapses.
  • The trigger design is transferable across model architectures; BBW verified extracted Faster R-CNN models on VOC07 and TrafficSigns with 100% AUROC in tested configurations.
  • The verification logic is robust to imperfect adaptive attackers: when an odd-box detector removes 80% of poisoned responses, a weaker backdoor still remains and partially preserves the watermark signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because BBW poisons only the geometry of the output, the same recipe should transfer to other structured-prediction APIs, such as segmentation masks, keypoints, or tracking boxes, where a small geometric distortion on a compact trigger class can act as a watermark.
  • The compact-trigger-cluster principle suggests a general rule for response-poisoning watermarks: the more semantically coherent the poisoned subspace, the easier it is for any trained copy to learn the backdoor; this could be tested by varying cluster compactness while holding the poisoning ratio fixed.
  • The distribution-overlap dependency points to an arms race: an attacker who can estimate the defender's trigger subspace and avoid it in substitute queries could suppress the backdoor, so a practical extension would be an adaptive trigger that tracks the substitute distribution.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes BBW, a backdoor-based watermarking defense against model extraction attacks (MEAs) on object detectors. The defender poisons API responses by distorting bounding boxes (BBs) of objects that fall into a trigger cluster, defined via DBSCAN on features of the defender's training data. Extracted models trained on poisoned responses learn to output distorted BBs only for trigger objects. Verification computes a suspiciousness score S (Eq. (6)) as the ratio of mean prediction inconsistency on trigger vs. nontrigger paired objects, and the model is judged extracted if S is sufficiently large. Experiments on VOC07, TrafficSigns, and CityPersons with YOLOv8 report AUROC up to 100% in numerous configurations, plus ablations comparing compact vs. random trigger clusters and robustness to pruning, finetuning, and an adaptive attacker that filters odd BBs.

Significance. If the central claim holds, BBW would be the first backdoor-based watermarking defense that is practical, stealthy, and functionality-preserving for object-detection APIs. The work covers three datasets, six poisoning magnitudes, and three poisoning ratios, and includes quantitative verification results, visual evidence of the watermark, and robustness studies against common countermeasures. The experimental breadth is a strength, as is the explicit analysis of the compact trigger cluster and the honest reporting of failure cases such as the non-i.i.d. transferability experiment in Sec. 7.2. The significance is, however, conditional on a distributional overlap assumption between the defender's trigger cluster and the attacker's substitute data; the paper acknowledges this but does not integrate it into the formal claim or the abstract.

major comments (4)
  1. [§4, Eq. (2)] The verifiability condition in Eq. (2) is stated as S(fw(Dkey)) > S(fn(Dkey)) for all fw, fn in the function space, but the paper's own Sec. 7.2 shows a setting where this fails: with VOC07 target and COCO minitrain substitute data at nominal p=1% (actual poisoning ratio 0.60%), the verification AUROC is 4.0%, worse than random. This directly contradicts the universal quantifier in Eq. (2). The formal claim must be restricted to models that arise under a specified overlap condition, or the condition must be rephrased as a probabilistic statement with an explicit dependence on the actual poisoning ratio.
  2. [§5.3 and §7.2] The trigger cluster is defined on the defender's training-set features, while the poisoning effect depends on whether the attacker's substitute data contains objects whose features fall in the trigger cluster. The defender neither controls nor observes this overlap, yet the threat model in Sec. 4 only says the attacker 'can collect substitute data of the target domain' without quantifying what that implies. The paper should either state and defend a precise distributional-overlap assumption, or provide an estimator/bound for the actual poisoning ratio from observable query statistics. Without this, the abstract's '100% accuracy in a wide variety of experimental scenarios' overstates what is established; the non-i.i.d. result at p=1% is a concrete counterexample.
  3. [§6.2, Table 2] All AUROC values are reported as point estimates from 30 benign and 30 extracted models per configuration, with no confidence intervals or significance tests. The 100.0% values are especially sensitive to this because a single misordered score would lower the estimate. Please report exact binomial/Wilcoxon intervals or at least the number of misordered pairs, so that 'complete verification' is statistically grounded rather than a point estimate.
  4. [§7.2] The Faster R-CNN transferability experiment is reported only as three AUROC numbers, with the CityPersons failure attributed to poor extracted-model performance (mAP50 11.74%). This is reasonable, but the claim that BBW 'is expected to work effectively even against strong MEAs' needs more support: a stronger extracted model can also learn to ignore a subtle BB distortion, especially if the substitute data distribution differs from the defender's. At minimum, the experiment should be interpreted with the same distributional-overlap caveat applied to the YOLOv8 experiments.
minor comments (4)
  1. [§5.2, Eq. (8)] The scale-based inconsistency metric uses sgn(δw−1) and sgn(δh−1) as exponents; when δw and δh differ, the metric mixes multiplication and inversion in a way that is not intuitively explained. A brief justification of this choice would improve readability.
  2. [§6.1, Table 2] The column labeled '1.0' in Table 2 reports results for baseline models that were trained on unpoisoned responses, not on poisoned responses with magnitude 1.0. Renaming the column to 'baseline' or adding a footnote would avoid confusion.
  3. [§7.1, Table 3] The compact-vs-random ablation adjusts epsilon so that the union of balls contains approximately n_sub × p objects in the substitute set, but Table C.3 shows that the actual poisoning ratio can deviate from the nominal p (e.g., CityPersons 5% nominal vs. 3.55% actual). Stating the actual poisoning ratios used in the random-cluster condition would strengthen the comparison.
  4. [Appendix A.2] The text says key-sets 'do not need to be annotated,' but Eq. (5) requires pairing objects between the target and suspicious model outputs using labels and IoU. The intended meaning is that ground-truth human annotations are not needed; please clarify to avoid ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: BBW's verification score is an empirical detector of a deliberately injected backdoor, and the paper's 100% AUROC claim is measured on independently trained models rather than derived from its own definitions.

full rationale

The central claim of the paper is an empirical demonstration, not a derived first-principles result. BBW injects a backdoor by poisoning bounding boxes on trigger objects in API responses (Eqs. 3-4), and the verification score S (Eq. 6) measures whether a suspect model reproduces that distortion on trigger objects relative to nontrigger objects. The reported separation between watermarked and nonwatermarked models is the direct causal consequence of the poisoned training labels; the paper does not fit any parameter to the evaluation labels and then rename it as a prediction. The trigger cluster is chosen on the defender's training set (Alg. 1), and the key-set is drawn from held-out or training splits, but the AUROC is measured on independently trained extracted and benign models, so there is no tautological reduction. The reference list contains no load-bearing self-citations by the authors. The Sec. 7.2 non-i.i.d. limitation, which states that when the distributions of the training and substitute data do not overlap, BBW will fail because no query responses will be poisoned, is a clearly stated boundary condition on backdoor formation, not a circular step in the verification logic. Eq. (2) is a definition of verifiability, not a theorem derived from the method's assumptions, and the empirical results are presented as measurements rather than as consequences of that definition. Accordingly, no circularity is present.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

No new physical or computational entities are introduced. The trigger is a subset of existing objects defined via a feature-space cluster, not a new type of object. The watermarked behavior is a learned bias in bounding-box coordinates. The main free parameters are the poisoning magnitude, poisoning ratio, DBSCAN epsilon, and the IoU pairing threshold.

free parameters (5)
  • Poisoning magnitude delta = 0.8, 0.9, 0.95, 1.05, 1.1, 1.2 (grid)
    Chosen by defender; paper evaluates a grid but does not provide a principled selection rule. Affects verification accuracy and stealth trade-off.
  • Poisoning ratio p = 1%, 2%, 3% for VOC07/TrafficSigns; 1%, 3%, 5% for CityPersons
    Proportion of objects to poison; must be large enough for the backdoor to form but small enough to stay stealthy. Tuned per dataset.
  • DBSCAN epsilon = Adapted per dataset via Algorithm 1
    Searched until the largest cluster contains approximately n*p objects; determines trigger compactness.
  • IoU pairing threshold eta = 0.7
    Used in Eq. (5) to pair objects between f and g. The paper says the result is insensitive to eta in {0.5,...,0.9}.
  • Key-set size = Subsampled per dataset
    VOC07 and CityPersons use subsets of base splits to save computation; TrafficSigns uses the full training split. Size affects statistical stability.
assumptions (5)
  • domain assumption The extracted model g learns a backdoor from the poisoned BB labels in its substitute training set.
    The paper relies on the model training to associate the visual trigger cluster with distorted BBs (Sec 5.1, Sec 6.1). If the model does not learn this mapping, verification fails.
  • domain assumption The defender can query the suspicious model's API during verification.
    The threat model assumes g releases an API (Sec 4); verification queries that API to obtain predictions. This matches Szyller et al. [22] but may not hold if the attacker keeps the model private.
  • domain assumption BB distortion is small enough to go unnoticed by the attacker and legitimate users.
    The defense requires stealth (Sec 5.1). Whether a 5-20% BB expansion is truly unnoticed is an empirical claim, not proven.
  • ad hoc to paper The feature extractor E (EfficientNet-B4) provides a feature space in which the trigger cluster is coherent and learnable.
    The trigger is defined by clustering in E's feature space; the choice of E is arbitrary and not justified beyond using a pretrained network. The method's effectiveness depends on this choice.
  • domain assumption The target model's predictions on trigger objects are accurate enough that rescaled BBs still correspond to the same objects.
    Poisoning rescales f's predicted BBs; if f's BBs are noisy, the poisoned labels may be inconsistent, confusing the extracted model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bounding-box Watermarking: Defense against Model Extraction Attacks on Object Detectors." pith.science (2026). https://pith.science/paper/KGLIQGBG

@misc{pith2026241113047,
  author       = {Pith},
  title        = {Pith review of: Bounding-box Watermarking: Defense against Model Extraction Attacks on Object Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KGLIQGBG}},
  note         = {Machine review of arXiv:2411.13047}
}
read the original abstract

Deep neural networks (DNNs) deployed in a cloud often allow users to query models via the APIs. However, these APIs expose the models to model extraction attacks (MEAs). In this attack, the attacker attempts to duplicate the target model by abusing the responses from the API. Backdoor-based DNN watermarking is known as a promising defense against MEAs, wherein the defender injects a backdoor into extracted models via API responses. The backdoor is used as a watermark of the model; if a suspicious model has the watermark (i.e., backdoor), it is verified as an extracted model. This work focuses on object detection (OD) models. Existing backdoor attacks on OD models are not applicable for model watermarking as the defense against MEAs on a realistic threat model. Our proposed approach involves inserting a backdoor into extracted models via APIs by stealthily modifying the bounding-boxes (BBs) of objects detected in queries while keeping the OD capability. In our experiments on three OD datasets, the proposed approach succeeded in identifying the extracted models with 100% accuracy in a wide variety of experimental scenarios.

Figures

Figures reproduced from arXiv: 2411.13047 by the authors.

Figure 1
Figure 1. Overview of proposed model watermarking approach. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. BB poisoning patterns each of which comprises the object label c and the BB coor￾dinate bb (Eq. (1)). We assume that the internal information of models cannot be accessed by any outsider. Threat Model The attacker’s goal is to obtain an ex￾tracted model g whose functionality is sufficiently similar to that of the target model f. They cannot acquire the train￾ing data of f, but they can collect substitute data of the… view at source ↗
Figure 3
Figure 3. Histograms of scale-based prediction inconsistency be [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Visualization of our proposed watermark on the VOC07 [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Trigger objects in (a,b) VOC07 and (c,d) CityPersons. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Watermark robustness to weight pruning. the literature has demonstrated that such attacks are possible against classification models. Hence, protecting OD models from data-free MEAs by BBW is our future work. Other OD Model So far we assumed that the attacker used a ne…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 24 canonical work pages

  1. [1]

    https://github.com/giddyyupp/coco-minitrain. 7

    work page

  2. [2]

    https://openai.com/policies/business-terms. 1

    work page

  3. [3]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In USENIX Security Symposium, page 1615–1631, 2018. 1, 2

    work page 2018

  4. [4]

    Self-driving cars dataset.https : //universe.roboflow.com/selfdriving-car- qtywx/self- driving- cars- lfjou, 2023

    SelfDriving Car. Self-driving cars dataset.https : //universe.roboflow.com/selfdriving-car- qtywx/self- driving- cars- lfjou, 2023. visited on 2024-08-01. 5

    work page 2023

  5. [5]

    Baddet: Backdoor attacks on object detection

    Shih-Han Chan, Yinpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. Baddet: Backdoor attacks on object detection. In Computer Vision – ECCV 2022 Workshops, pages 396–412, Cham, 2023. Springer Nature Switzerland. 1, 2, 3

    work page 2022

  6. [6]

    Clean-image backdoor: Attacking multi- label models with poisoned labels only

    Kangjie Chen, Xiaoxuan Lou, Guowen Xu, Jiwei Li, and Tianwei Zhang. Clean-image backdoor: Attacking multi- label models with poisoned labels only. InICLR, 2023. 1, 2, 3

    work page 2023

  7. [7]

    Attacking by aligning: Clean-label backdoor attacks on object detection

    Yize Cheng, Wenbin Hu, and Minhao Cheng. Attacking by aligning: Clean-label backdoor attacks on object detection. arXiv:2307.10487, 2023. 2, 3

    arXiv 2023

  8. [8]

    The cityscapes dataset for semantic urban scene understanding

    Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. InCVPR,

Show all 30 references
  1. [9]

    A density-based algorithm for discovering clusters in large spatial databases with noise

    Martin Ester, Hans-Peter Kriegel, J ¨org Sander, and Xiaowei Xu. A density-based algorithm for discovering clusters in large spatial databases with noise. InKDD, page 226–231,

  2. [10]

    Everingham, L

    M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, and A. Zisserman. The PASCAL Visual Object Classes Challenge 2007 (VOC2007) Results. http://www.pascal- network.org/challenges/VOC/voc2007/workshop/index.html. 5

    2007

  3. [11]

    Planting undetectable backdoors in machine learning models

    Shafi Goldwasser, Michael P Kim, Vinod Vaikuntanathan, and Or Zamir. Planting undetectable backdoors in machine learning models. In2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS), pages 931–942,

  4. [12]

    Choquette-Choo, Varun Chan- drasekaran, and Nicolas Papernot

    Hengrui Jia, Christopher A. Choquette-Choo, Varun Chan- drasekaran, and Nicolas Papernot. Entangled watermarks as a defense against model extraction. InUSENIX Security Symposium, pages 1937–1954, 2021. 2

    1937

  5. [13]

    Defending against model stealing via verifying embedded external features

    Yiming Li, Linghui Zhu, Xiaojun Jia, Yong Jiang, Shu-Tao Xia, and Xiaochun Cao. Defending against model stealing via verifying embedded external features. InAAAI, 2022. 1, 2

    2022

  6. [14]

    Fine- pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- pruning: Defending against backdooring attacks on deep neural networks. InRAID, pages 273–294, 2018. 8

    2018

  7. [15]

    Untargeted backdoor attack against object detection

    Chengxiao Luo, Yiming Li, Yong Jiang, and Shu-Tao Xia. Untargeted backdoor attack against object detection. In ICASSP, pages 1–5, 2023. 1, 2, 3

    2023

  8. [16]

    Al-Sarawi, Nepal Surya, and Derek Abbott

    Hua Ma, Yinshan Li, Yansong Gao, Alsharif Abuadbba, Zhi Zhang, Anmin Fu, Hyoungshick Kim, Said F. Al-Sarawi, Nepal Surya, and Derek Abbott. Dangerous cloaking: Natu- ral trigger based backdoor attacks on object detectors in the physical world.arXiv:2201.08619, 2022. 2, 3

    2022 arXiv

  9. [17]

    Al-Sarawi, Surya Nepal, and Derek Abbott

    Hua Ma, Yinshan Li, Yansong Gao, Zhi Zhang, Alsharif Abuadbba, Anmin Fu, Said F. Al-Sarawi, Surya Nepal, and Derek Abbott. Transcab: Transferable clean-annotation backdoor to object detection with natural trigger in real- world. In42nd International Symposium on Reliable Dis- ...

    2023

  10. [18]

    Prediction poisoning: Towards defenses against dnn model stealing attacks.arXiv:1906.10908, 2019

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Prediction poisoning: Towards defenses against dnn model stealing attacks.arXiv:1906.10908, 2019. 1, 2

    1906 arXiv

  11. [19]

    Faster r-cnn: Towards real-time object detection with region proposal networks.Advances in neural information process- ing systems, 28, 2015

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks.Advances in neural information process- ing systems, 28, 2015. 8

    2015

  12. [20]

    Fine-tuning is all you need to mitigate backdoor attacks.arXiv:2212.09067, 2022

    Zeyang Sha, Xinlei He, Pascal Berrang, Mathias Humbert, and Yang Zhang. Fine-tuning is all you need to mitigate backdoor attacks.arXiv:2212.09067, 2022. 8

    2022 arXiv

  13. [21]

    Dimon, Keith Manville, and Michael Krumdick

    Anna Snarski, Walker L. Dimon, Keith Manville, and Michael Krumdick. Watermarking for data provenance in object detection. In2022 IEEE Applied Imagery Pattern Recognition Workshop (AIPR), pages 1–7, 2022. 3

    2022

  14. [22]

    Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N. Asokan. Dawn: Dynamic adversarial watermarking of neu- ral networks. InACM MM, page 4417–4425, 2021. 1, 2, 3

    2021

  15. [23]

    Efficientnet: Rethinking model scaling for convolutional neural networks

    Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. InInternational conference on machine learning, pages 6105–6114. PMLR,

  16. [24]

    Reiter, and Thomas Ristenpart

    Florian Tram `er, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. InUSENIX Security Symposium, page 601–618, 2016. 1, 2

    2016

  17. [25]

    Walls, and Nicolas Papernot

    Jean-Baptiste Truong, Pratyush Maini, Robert J. Walls, and Nicolas Papernot. Data-free model extraction. InCVPR, pages 4771–4780, 2021. 7

    2021

  18. [26]

    Embedding watermarks into deep neural networks

    Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. Embedding watermarks into deep neural networks. InICMR, page 269–277, 2017. 1, 2

    2017

  19. [27]

    Ultralytics.https://github.com/ultralytics/ ultralytics. 5

  20. [28]

    Seeing is not believing: Camouflage attacks on image scaling algorithms

    Qixue Xiao, Yufei Chen, Chao Shen, Yu Chen, and Kang Li. Seeing is not believing: Camouflage attacks on image scaling algorithms. InUSENIX Security Symposium, pages 443–460, 2019. 2

    2019

  21. [29]

    Stoecklin, Heqing Huang, and Ian Molloy

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph. Stoecklin, Heqing Huang, and Ian Molloy. Protect- ing intellectual property of deep neural networks with water- marking. InAsiaCCS, page 159–172, 2018. 1, 2

    2018

  22. [30]

    odd BB detector

    Shanshan Zhang, Rodrigo Benenson, and Bernt Schiele. Citypersons: A diverse dataset for pedestrian detection. In CVPR, 2017. 5 1 Dataset Num. Images (Num. Objects) Training Substitute- Test training finetuning VOC072,501 (7,844) 2,259 (7,012) 251 (806) 4,952 (14,976) TrafficSi...

    2017

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.