Pith. sign in

REVIEW 3 major objections 6 minor 23 references

Traversing the Subspace of Adversarial Patches

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Testing three ways to compress adversarial patches, plain PCA matches or beats trained autoencoders at reconstructing attacks and at supplying patches for adversarial training.

desk verdict Useful empirical baseline for adversarial-patch subspaces, but the headline 'no advantages' claim is not supported because the autoencoders get a 2D bottleneck while PCA gets up to 128 components. read the letter →

arxiv 2412.01527 v1 pith:MY36CNK2 submitted 2024-12-02 cs.CV

Jens Bayer , Stefan Becker , David Münch , Michael Arens , Jürgen Beyerer This is my paper · ORCID
classification cs.CV
keywords adversarialpatchesmanifoldhypothesisprincipalcomponentanalysisautoencoderconditionalvariationalobjectdetectiontrainingsubspace
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether adversarial patches, the small image regions that can fool a person detector, really live on a low-dimensional manifold. It tests three ways of compressing a set of optimized attack patches onto a low-dimensional subspace: principal component analysis, a convolutional autoencoder, and a conditional variational autoencoder. It measures how well each method reconstructs the original patches and how well patches sampled from each latent space work when used to train a more robust detector. Across two person-detection datasets, the paper finds that the learned autoencoders offer no clear advantage over PCA. The conclusion strengthens the manifold hypothesis for adversarial patches and suggests that a simple linear basis is enough for both analysis and defense-oriented data augmentation.

What carries the argument

The central object is the set of prime patches, attacked-optimized image patterns that hide persons from a detector, together with three dimensionality-reduction embeddings of those patches. Eigenpatches, the principal components of the patch matrix, form a linear basis whose combinations reconstruct patches; the autoencoder and conditional variational autoencoder instead learn a two-dimensional bottleneck representation that is then sampled during adversarial training. The machinery does two jobs: it tests the manifold hypothesis by asking whether low-dimensional coordinates can recreate effective attacks, and it provides a sampling strategy for generating new training patches without retraining the attack optimizer.

What would settle it

Repeat the reconstruction and adversarial-training experiments with a PCA using exactly 2 components and with autoencoders whose latent sizes are 16, 32, 64, and 128; if the higher-capacity autoencoders recover attacks with lower mAP or produce detectors that are more robust than PCA at matched capacity, the claim that PCA is sufficient would be overturned.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a linear principal component analysis of adversarial patches is as effective as nonlinear autoencoder-based manifold learning for two practical purposes: reconstructing attack patches that still degrade a YOLOv7 person detector, and generating diverse patches for adversarial training. The trained patch set, called prime patches, is compressed with PCA at 16, 32, 64, and 128 components and with two autoencoders whose latent space is fixed to two dimensions. When reconstructed patches are used in attacks, all three methods produce a mean average precision drop of more than 0.2, but the PCA reconstructions stay closest to the original patches, while the conditional variational autoencoder collapses many reconstructions to similar outputs. In adversarial training on the INRIA Person and CrowdHuman datasets, the PCA-sampled patches produce detectors whose robustness to prime patches is comparable to, and sometimes better than, the autoencoder-sampled patches, with lower training cost. The paper therefore concludes that sophisticated manifold learning is not needed for this patch set and this detector, and that a small set of prime patches or PCA-sampled patches suffices.

Load-bearing premise

The conclusion that PCA is as good as the autoencoders assumes a fair comparison, but the autoencoders are limited to a two-dimensional latent space while PCA is given 16 to 128 components, and the paper never tests PCA with two components or autoencoders with a larger latent space.

Editorial extensions

If this is right

  • If PCA is sufficient, future adversarial-patch defenses can be built on a fixed linear basis rather than trained generative models, saving compute and simplifying analysis.
  • Adversarial training can be augmented by sampling linear combinations of principal components, achieving robustness comparable to training on a hand-picked set of prime patches.
  • The low-dimensional structure of adversarial patches is confirmed for object-detector attacks, supporting the manifold hypothesis beyond image classifiers.
  • The failure of the conditional variational autoencoder to spread out its reconstructions suggests that its probabilistic latent space does not easily capture the patch subspace, making PCA the more reliable tool for this setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: The comparison is capacity-asymmetric: the autoencoders are fixed to a 2-dimensional latent space while PCA is given 16 to 128 components. A PCA baseline with 2 components or autoencoders with wider bottlenecks would test whether the conclusion is about linearity or simply about capacity.
  • Editorial: The conditional variational autoencoder's poor reconstruction spread may reflect the difficulty of conditioning or the KL regularization rather than the absence of nonlinear structure; a different VAE objective could behave differently.
  • Editorial: Because PCA-sampled patches generalize to a second dataset, a practical extension would be to use the eigenpatch basis as a cheap, model-agnostic augmentation source for training detectors against a broad family of patch attacks.
  • Editorial: The experiments are limited to person detection with YOLOv7; applying the same reconstruction-versus-attack protocol to other detector families and object classes could reveal whether the linear-subspace result is a property of the patch attack itself or of this architecture and task.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper studies whether adversarial patches used to attack a YOLOv7 person detector lie on a low-dimensional manifold, and whether different dimensionality reduction methods can reconstruct and sample such patches. The authors use a set of 375 'prime' patches generated with different optimization parameter sets, and compare three reduction methods: PCA ('eigenpatches'), a convolutional autoencoder (AE), and a conditional variational autoencoder (CVAE). Reconstruction quality is measured by the mean average precision of the detector when attacked with reconstructed patches, and the sampled latent spaces are also used to generate patches for adversarial training. Experiments are run on the INRIA Person and CrowdHuman datasets. The paper concludes that more sophisticated dimensionality reduction methods offer no advantages over a simple PCA.

Significance. If the central claim were established, the result would be practically useful: it would suggest that linear PCA is sufficient for representing and sampling the studied adversarial patches, and that expensive nonlinear autoencoders are unnecessary for this patch family and detector. The paper has strengths: it uses publicly available datasets, evaluates both reconstruction fidelity and downstream attack/adversarial-training performance, builds directly on the authors' prior eigenpatches work, and provides qualitative t-SNE visualizations. However, the central comparison is confounded by a large capacity mismatch between the methods, and the paper itself acknowledges that the CVAE fails to reconstruct the patches in most cases. As presented, the evidence does not support the universal negative statement in the abstract.

major comments (3)
  1. [4.1.3 and Figure 2] The comparison is capacity-imbalanced. Section 4.1.3 fixes the bottleneck size to 2 for both autoencoders, while Figure 2 and Section 4.1.1 give PCA 16, 32, 64, or 128 components. Table 1 and Figure 5 compare only PCA(64) against the two 2-D autoencoders. The observed mAP differences (0.70 vs. 0.73 and 0.72 in Table 1) are therefore compatible with the alternative explanation that the autoencoders are too capacity-limited to represent the patch manifold, rather than with the claim that nonlinear methods provide no advantage. A matched comparison with PCA(2) and with AE/CVAE latent sizes of 16, 32, 64, and 128 is required before the headline conclusion can be drawn.
  2. [4.3] The paper states that the CVAE 'fails the reconstruction of the patches in most cases' and that multiple reconstructed patches are alike. This is a direct admission that the CVAE is not adequately modeling the patch set under the chosen 2-D bottleneck. Since the abstract and conclusion generalize beyond this specific architecture choice, the conclusion should either be restricted to 2-D autoencoder bottlenecks or the autoencoders must be given capacities comparable to the PCA settings used in the evaluation.
  3. [Tables 2, 3, and 5] The adversarial-training comparison inherits the same capacity mismatch, so the small mAP differences among PCA, AE, and CVAE rows (typically 0.01-0.03) are not interpretable as evidence that the sampling methods are equivalent. Additionally, the reported standard deviations are computed over patches, not over independent training runs, so it is unclear whether the observed differences are statistically meaningful. The authors should either provide training-run variance or temper the claim that 'similar performance can be achieved with a single patch.'
minor comments (6)
  1. [Abstract and Section 5] The abstract's wording 'more sophisticated dimensionality reduction methods offer no advantages' overstates the scope of the experiments. The experiments cover one PCA variant, one AE, and one CVAE on one detector architecture; the conclusion should be explicitly qualified to these methods and settings.
  2. [4.1.3] The model is called a conditional variational autoencoder, but the conditioning mechanism is never described. Figure 2 shows an 'Embed' operation, but the text does not explain what conditioning information is used or how it is incorporated into the encoder/decoder.
  3. [4.3] The mean Euclidean distances reported in Section 4.3 are computed in the t-SNE embedding space. t-SNE distances are not reliable across runs and do not have a consistent metric interpretation; reporting distances in pixel space or in the PCA latent space would be more interpretable.
  4. [Introduction, contribution (ii)] The introduction claims an evaluation of generalization 'across varying detection models and datasets,' but the experiments only vary the training dataset while keeping the YOLOv7 tiny architecture fixed. Either additional detector architectures should be included or the contribution statement should be revised.
  5. [Tables 1-3 and 5] The typesetting of numeric values is inconsistent (e.g., '0 .96' and '0 .90'), which makes the tables hard to read. Please use a uniform formatting style.
  6. [General] The paper does not state whether code or trained models will be released. Such a statement would be helpful for reproducibility, especially for the autoencoder training procedure.

Circularity Check

0 steps flagged · score 1.0 of 10

No circular derivation: the PCA-versus-autoencoder comparison is empirical, and self-citations to [2] supply data and baselines, not the conclusion.

full rationale

The paper's central claim, that more sophisticated dimensionality reduction methods offer no advantages over PCA, rests on measured mAP values for reconstructed patches and for adversarially trained detectors. These values are obtained by running external detectors on INRIA and Crowdhuman data, not by algebraic construction from the method definitions. The only recurrence to the authors' prior work [2] is as data provenance: the prime patches are the same set as in [2], and the eigenpatch/PCA construction is described there. This is normal self-citation and is not load-bearing: the current paper re-evaluates reconstruction attack performance in Table 1 and adversarial training in Tables 2, 3, and 5, so the conclusions are independently computed here. The capacity imbalance between 2D autoencoder bottlenecks and 16-128 component PCA is a genuine experimental-fairness threat, but it is not circularity: the reported mAPs are not forced by construction, and the paper does not fit a parameter and then rename it a prediction. The t-SNE analyses are descriptive and do not enter the derivation chain circularly. Overall, no step reduces to its own input by definition or by self-citation, so the circularity score is minimal; the score of 1 reflects only the repeated reliance on the authors' own prior paper for the patch set and the eigenpatch method, which is a provenance choice rather than a circular argument.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper's conclusions rest on the manifold hypothesis, on the representativeness of the 375 prime patches, and on mAP as the sole success metric. The main free parameters include the mismatched latent dimensionalities, the chosen PCA component counts, and the patch probability in adversarial training, all set by hand without a matched-depth baseline or uncertainty analysis.

free parameters (4)
  • Autoencoder latent dimensionality = 2
    Both AE and CVAE use a bottleneck of 2 dimensions (Section 4.1.3), while PCA is evaluated with 16 to 128 components; this mismatch is central to the comparison and handicaps the nonlinear methods.
  • PCA component count k = 16, 32, 64, 128
    Chosen by hand (Section 4.1.1 and Figure 2); results vary across k, and no selection criterion or matched-dimensionality baseline is given.
  • Patch probability pi in adversarial training = 0.25 (and 0.05 in Table 5)
    Set by the authors to control how often a box contains a patch during training; affects all adversarial-training results.
  • PCA weight sampling distribution parameters = means and stds from encoded prime patches
    Patches for PCA multi-patched networks are sampled from normal distributions whose parameters are computed from the training set of prime patches (Section 4.1.1); this is a model choice, not an externally fixed value.
assumptions (4)
  • domain assumption Manifold hypothesis: adversarial patches lie on or near a low-dimensional manifold embedded in pixel space.
    Stated in the introduction ('this paper follows the manifold hypothesis [1]') and used to justify interpreting reconstruction and sampling quality as evidence about the structure of adversarial patches; never directly tested.
  • domain assumption The 375 prime patches, optimized for YOLOv7 tiny on INRIA, form a representative sample of adversarial patches for person detection.
    All conclusions about 'adversarial patches' are drawn from this single patch set (Section 4.1, referencing [2]); generalization to other detectors, patch sizes, and datasets is assumed.
  • domain assumption mAP drop on INRIA Person and CrowdHuman is a valid and sufficient measure of patch attack success.
    Used throughout Tables 1 to 5; no alternative metrics, such as attack success rate or physical-world placement, are considered.
  • standard math Standard PCA, autoencoder, and VAE theory (eigen-decomposition, reconstruction loss, KL divergence) is taken as given.
    Invoked in Section 3 to define the methods; these are standard tools, not contributions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Traversing the Subspace of Adversarial Patches." pith.science (2026). https://pith.science/paper/MY36CNK2

@misc{pith2026241201527,
  author       = {Pith},
  title        = {Pith review of: Traversing the Subspace of Adversarial Patches},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MY36CNK2}},
  note         = {Machine review of arXiv:2412.01527}
}
read the original abstract

Despite ongoing research on the topic of adversarial examples in deep learning for computer vision, some fundamentals of the nature of these attacks remain unclear. As the manifold hypothesis posits, high-dimensional data tends to be part of a low-dimensional manifold. To verify the thesis with adversarial patches, this paper provides an analysis of a set of adversarial patches and investigates the reconstruction abilities of three different dimensionality reduction methods. Quantitatively, the performance of reconstructed patches in an attack setting is measured and the impact of sampled patches from the latent space during adversarial training is investigated. The evaluation is performed on two publicly available datasets for person detection. The results indicate that more sophisticated dimensionality reduction methods offer no advantages over a simple principal component analysis.

Figures

Figures reproduced from arXiv: 2412.01527 by the authors.

Figure 1
Figure 1. Reconstruction (right) of an adversarial patch (left) using the first 16 Eigenpatches (middle) [2]. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. A schematic overview of the three dimensionality reduction methods. In general, the input is a prime patch, [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Here, each data point of the t-SNE plot corresponds to the patch itself. The colors of the data points in this [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (4 more)
Figure 3
Figure 3. Figure 3: t-SNE plot of the model backbone activation when attacked with a certain patch. Each marker represents [PITH_FULL_IMAGE:figures/full_fig_p007_3.png]
Figure 4
Figure 4. Figure 4: t-SNE plot of the pixel values of each prime patch. The color indicates the impact of the patch on the mean [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: t-SNE plots of the three reconstruction methods. Conditional Variational Autoencoder (CVAE), Autoencoder [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: The 10 randomly predefined prime patches used in the training for the multi-patched network. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 22 canonical work pages

  1. [1]

    Testing the manifold hypothesis

    Charles Fefferman, Sanjoy Mitter, and Hariharan Narayanan. Testing the manifold hypothesis. Journal of the American Mathematical Society, 29(4):983–1049, 2016

    2016

  2. [2]

    Eigenpatches—adversarial patches from principal components

    Jens Bayer, Stefan Becker, David Münch, and Michael Arens. Eigenpatches—adversarial patches from principal components. In Advances in Visual Computing, pages 274–284, Cham, 2023. Springer Nature Switzerland

    work page 2023

  3. [3]

    Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors

    Chien-Yao Wang, Alexey Bochkovskiy, and Hong-Yuan Mark Liao. Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors. In CVPR, pages 7464–7475, 2023

    work page 2023

  4. [4]

    Jedi : Entropy-based Localization and Removal of Adversarial Patches

    Bilel Tarchoun, Anouar Ben Khalifa, Mohamed Ali Mahjoub, and Nael Abu-ghazaleh. Jedi : Entropy-based Localization and Removal of Adversarial Patches. In CVPR, pages 4087–4095, 2023

    work page 2023

  5. [5]

    The Space of Transferable Adversarial Examples

    Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. The Space of Transferable Adversarial Examples. In arXiv Prepr., pages 1–15, 2017

    work page 2017

  6. [6]

    Sample Based Fast Adversarial Attack Method

    Zhi Ming Wang, Meng Ting Gu, and Jia Hui Hou. Sample Based Fast Adversarial Attack Method. Neural Process. Lett., 50(3):2731–2744, 2019

    work page 2019

  7. [7]

    Energy Attack: On Transferring Adversarial Examples

    Ruoxi Shi, Borui Yang, Yangzhou Jiang, Chenglong Zhao, and Bingbing Ni. Energy Attack: On Transferring Adversarial Examples. In arXiv Prepr., 2021

    work page 2021

  8. [8]

    Origins of low-dimensional adversarial perturbations

    Elvis Dohmatob, Chuan Guo, and Morgane Goibert. Origins of low-dimensional adversarial perturbations. In Francisco Ruiz, Jennifer Dy, and Jan-Willem van de Meent, editors, AISTATS, pages 9221–9237, 25–27 Apr 2023

    work page 2023

Show all 23 references
  1. [9]

    Are adversarial examples in- evitable? ICLR, 2019

    Ali Shafahi, Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. Are adversarial examples in- evitable? ICLR, 2019

    2019

  2. [10]

    Boosting Adversarial Transferability via Fusing Logits of Top-1 Decomposed Feature

    Juanjuan Weng, Zhiming Luo, Dazhen Lin, Shaozi Li, and Zhun Zhong. Boosting Adversarial Transferability via Fusing Logits of Top-1 Decomposed Feature. arXiv Prepr., may 2023

    2023

  3. [11]

    Washington Garcia, Pin-Yu Chen, Hamilton Scott Clouse, Somesh Jha, and Kevin R.B. Butler. Less is more: Dimension reduction finds on-manifold adversarial examples in hard-label attacks. In SaTML, pages 254–270, 2023

    2023

  4. [12]

    Threat of adversarial attacks on deep learning in computer vision: A survey

    Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6:14410–14430, 2018

    2018

  5. [13]

    A survey on adversarial attacks and defences

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. A survey on adversarial attacks and defences. CAAI Trans. Intell. Technol., 6(1):25–45, 2021

    2021

  6. [14]

    A Tutorial on Adversarial Learning Attacks and Countermeasures

    Cato Pauling, Michael Gimson, Muhammed Qaid, Ahmad Kida, and Basel Halak. A Tutorial on Adversarial Learning Attacks and Countermeasures. In arXiv Prepr., 2022

    2022

  7. [15]

    The Robustness of Computer Vision Models against Common Corruptions: a Survey

    Shunxin Wang, Raymond Veldhuis, and Nicola Strisciuglio. The Robustness of Computer Vision Models against Common Corruptions: a Survey. arXiv Prepr., pages 1–23, may 2023

    2023

  8. [16]

    How many dimensions are required to find an adversarial example? In CVPRW, pages 2353–2360, 2023

    Charles Godfrey, Henry Kvinge, Elise Bishoff, Myles Mckay, Davis Brown, Tim Doster, and Eleanor Byler. How many dimensions are required to find an adversarial example? In CVPRW, pages 2353–2360, 2023

    2023

  9. [17]

    Sirovich and M

    L. Sirovich and M. Kirby. Low-dimensional procedure for the characterization of human faces. Journal of the Optical Society of America A, 4(3):519, 1987

    1987

  10. [18]

    Autoencoders and their applications in machine learning: a survey

    Kamal Berahmand, Fatemeh Daneshfar, Elaheh Sadat Salehi, Yuefeng Li, and Yue Xu. Autoencoders and their applications in machine learning: a survey. Artificial Intelligence Review, 57(2):28, 2024

    2024

  11. [19]

    Learning structured output representation using deep conditional generative models

    Kihyuk Sohn, Xinchen Yan, and Honglak Lee. Learning structured output representation using deep conditional generative models. Advances in Neural Information Processing Systems, 2015-January:3483–3491, 2015

    2015

  12. [20]

    Kingma and Max Welling

    Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. In Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014

    2014

  13. [21]

    Dalal and B

    N. Dalal and B. Triggs. Histograms of Oriented Gradients for Human Detection. In CVPR, volume 1, pages 886–893, 2005

    2005

  14. [22]

    CrowdHuman: A Benchmark for Detecting Human in a Crowd

    Shuai Shao, Zijian Zhao, Boxun Li, Tete Xiao, Gang Yu, Xiangyu Zhang, and Jian Sun. CrowdHuman: A Benchmark for Detecting Human in a Crowd. pages 1–9, 2018

    2018

  15. [23]

    Decoupled weight decay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. ICLR, 2019. 12

    2019

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.