Pith. sign in

REVIEW 3 major objections 5 minor 64 references

Lipschitz-constrained SSD detectors improve adversarial robustness by design and combine with adversarial training for gains on unseen attacks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 13:19 UTC pith:UP46VX6U

load-bearing objection Solid empirical methods paper: orthonormalized LipSSD gives real multi-attack robustness and stacks with AT, but the headline 15-point claim is a single-seed held-out gap and the Lipschitz story is only partial. the 3 major comments →

arxiv 2607.06592 v1 pith:UP46VX6U submitted 2026-07-06 cs.CV cs.AI

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

Vincent L\'eb\'e , Yannick Prudent , Corentin Friedrich , Thomas Massena (IRIT , DTIPG - SNCF , UT3) , Ronan Sicre (IRIT) , Franck Mamalet This is my paper
classification cs.CV cs.AI
keywords Lipschitz-constrained networksadversarial robustnessobject detectionSSDLipSSDadversarial trainingsafety-critical visionPascal VOC
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Object detectors used in safety-critical settings are easily broken by small worst-case input changes. Most existing fixes lean on adversarial training, which can fail to transfer across new attacks, budgets, or model families. This paper argues that building Lipschitz constraints into the detector architecture itself is a practical alternative: by forcing every constrained layer to be 1-Lipschitz (via orthogonal convolutions, GroupSort activations, and ℓ2 pooling), the network’s sensitivity to input changes is controlled by design rather than by the attack used at training time. The authors instantiate the idea as LipSSD (and a scaled SLipSSD variant), show that a single temperature hyperparameter on the classification loss steers the accuracy–robustness trade-off, and demonstrate that the same constraints remain complementary to adversarial training. On Pascal VOC the combined approach raises mAP@50 on unseen attacks by as much as 15 points; on the safety-critical LARD and KITTI datasets the Lipschitz detectors improve robustness while largely keeping clean accuracy.

Core claim

Architectural Lipschitz control yields attack-agnostic robustness for single-shot object detection. Under identical training, an adversarially trained LipSSD/SLipSSD improves mAP@50 on unseen white-box attacks by up to 15 points over a classical adversarially trained SSD on Pascal VOC, and on KITTI and LARD the Lipschitz variants raise robustness while largely preserving clean performance.

What carries the argument

LipSSD: every convolutional block is replaced by an orthonormalized 1-Lipschitz block (RKO or AOC orthogonal convolution + GroupSort + ℓ2-norm pooling), the classification head is kept Lipschitz, the box-regression head is left unconstrained, and temperature scaling of the classification cross-entropy steers the accuracy–robustness frontier.

Load-bearing premise

Leaving the box-regression head unconstrained (and one overlapping max-pool only 3-Lipschitz) still keeps overall detector sensitivity low enough for the claimed robustness gains.

What would settle it

Train LipSSD and standard SSD under the same adversarial-training recipe on Pascal VOC, then measure mAP@50 under the paper’s held-out white-box attacks at the reported budgets; if the Lipschitz model no longer gains the claimed ~15 points on unseen attacks, or if clean mAP collapses on KITTI/LARD, the central claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes LipSSD (and a scaled SLipSSD variant), a Single Shot MultiBox Detector whose backbone, extra layers, and classification head are built from 1-Lipschitz orthonormalized convolutions (RKO/AOC), GroupSort, and ℓ2-norm pooling, while the box-regression head and NMS remain unconstrained. A temperature-scaled classification loss is used to control the accuracy–robustness trade-off. Empirical evaluation on Pascal VOC under multiple white-box attacks (PGD on classification/localization, DAG, TOG-F/V/M), plus safety-critical KITTI and LARD, shows improved robust mAP@50 relative to vanilla SSD; combining SLipSSD with MTD adversarial training further improves performance on attacks not used in training (up to ~15 mAP points on TOG-M). An appendix extends the design to LipFCOS.

Significance. Adversarial robustness for object detection is less developed than for classification, and most defenses remain tied to attack-specific adversarial training. An architectural, attack-agnostic Lipschitz design that is complementary to AT and that largely preserves clean performance on KITTI/LARD is a useful practical contribution. Strengths include multi-attack evaluation, budget curves, an explicit temperature Pareto front, honest reporting of the clean/robust trade-off on VOC, and a non-trivial extension to FCOS. Code release is promised. The work does not claim certificates (correctly, given NMS/IoU), so its value is empirical robust design rather than formal guarantees.

major comments (3)
  1. Abstract and §4.2.2 / Table 2: the headline claim that adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical AT-SSD rests on a single-seed MTD comparison (SLipSSD-MTD vs MTD-SSD at ε=5). On the two attacks used in training (Acls/Areg) the Lip model is slightly worse; gains appear only on held-out attacks. Without multi-seed variance or repeated runs, it is unclear whether the ~15-point TOG-M gap is a stable architectural effect or an optimization artifact. At least multi-seed means/std or a second AT recipe would be needed to support the abstract claim as stated.
  2. §3.2.3 and §2.3: the box-regression head is left unconstrained and the overlapping max-pool remains 3-Lipschitz, so the global Lipschitz constant of the detector is only partially controlled. The paper correctly notes that Lipschitz expressivity for regression is open and that NMS/IoU block certificates. Given that localization-targeted attacks (Areg) are a main evaluation axis, the manuscript should either (i) quantify how much of the robust mAP gain survives when the free head is also constrained or ablated, or (ii) clearly reframe the contribution as “Lipschitz backbone + classification head” rather than a fully Lipschitz detector. Without that, the architectural story is weaker than the abstract suggests.
  3. §4.3 / Table 3: LARD robust mAP is reported on a random 1000-image subset of the ~52k test set, with no error bars or repeated sampling. Clean performance is on the full set. For a safety-critical dataset this is a load-bearing evaluation detail; either evaluate the full test set under attack (or a stratified multi-seed subsample with variance) or qualify the LARD robustness claims more carefully.
minor comments (5)
  1. Figure 1 caption and abstract use “LipSSD” while several VOC tables emphasize SLipSSD; clarify which variant is the primary proposed model and keep naming consistent in the abstract.
  2. §4.1: attack iteration counts (40/100/50) and ε choices differ by dataset; a short justification that the budget is saturated for all models would help reproducibility.
  3. Appendix A (LipFCOS) is a valuable generalization but is only briefly mentioned in the main text; a one-sentence pointer in the contributions list would improve visibility.
  4. Typos / polish: “accuracyrobustness” (abstract), occasional spacing around ε and mAP@50, and “Bj ¨orck” encoding artifacts in the PDF.
  5. Related work on certified detection (Appendix C) is useful; a brief cross-reference in §2.3 would help readers who stop at the main text.

Circularity Check

0 steps flagged

No significant circularity: robustness claims are empirical measurements against external white-box attacks and public datasets, not reductions of outputs to fitted or self-defined inputs.

full rationale

The paper's central claims (attack-agnostic robustness of LipSSD/SLipSSD, temperature-controlled accuracy-robustness trade-off, complementarity with MTD adversarial training, and gains on KITTI/LARD) are established by training models with known Lipschitz building blocks (RKO/AOC orthonormalized convolutions, GroupSort, ℓ2-pooling from TorchLip/Orthogonium and prior classification/segmentation work) and then measuring mAP@50 under independent white-box attacks (PGD Acls/Areg, DAG, TOG-F/V/M) on public datasets. Temperature τ and the RMS fan-out/fan-in scale are free hyperparameters whose effect is plotted empirically (Figs. 3–5, 10); they do not redefine the evaluation metric or force the reported mAP numbers by construction. The unconstrained box-regression head and residual 3-Lipschitz max-pool are openly acknowledged limitations, not hidden redefinitions of the Lipschitz claim. Self-citations supply reusable operators and the temperature idea, not the measured robustness outcomes. No equation equates a claimed prediction to a fitted quantity, no uniqueness theorem is imported to forbid alternatives, and no known empirical pattern is merely renamed. The derivation chain is therefore self-contained against external benchmarks; the single minor self-citation load is non-load-bearing tooling.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 2 invented entities

The central claim is empirical robustness from architectural Lipschitz control. It rests on standard composition bounds for Lipschitz constants, the practical choice to leave regression unconstrained, and several training/evaluation hyperparameters (temperature, RMS fan scaling, attack budgets). No new physical entities are postulated; invented pieces are architectural variants and the temperature-scaled detection loss.

free parameters (4)
  • classification temperature τ
    Single hyperparameter used to move along the accuracy-robustness Pareto front of SLipSSD (Sec. 3.3, Fig. 4); values such as 0.1–5 are chosen by training, not derived.
  • SLipSSD RMS fan-out/fan-in scale
    Optional multiplicative scale on convolutions that raises clean accuracy by increasing the effective Lipschitz constant (Sec. 3.2.4).
  • attack budgets ε and iteration counts
    Evaluation uses dataset-specific ε (e.g., 3.0/5.0 on VOC, 1.0/3.0 on KITTI/LARD) and fixed iteration counts (PGD 40, DAG 100, TOG 50); results depend on these choices.
  • learning rates / optimizer settings
    SSD vs LipSSD use different Adam LRs and weight-decay choices (Sec. 4.2); these affect the reported clean/robust operating points.
axioms (4)
  • standard math Composition bound: Lip(f_n ∘ … ∘ f_1) ≤ product of layer Lipschitz constants, so 1-Lipschitz layers yield a globally controlled network.
    Invoked in Sec. 2.3 as the construction principle for LipSSD.
  • domain assumption Orthogonal/spectral reparametrizations (RKO, AOC, Björck) plus GroupSort and ℓ2 pooling sufficiently control sensitivity for empirical robustness even without certificates.
    Core design premise of Sec. 3; certificates are explicitly said to be hard due to NMS/IoU/regression.
  • ad hoc to paper Leaving the box-regression head unconstrained does not erase the robustness benefit of a Lipschitz backbone and classification head.
    Stated as a pragmatic choice because Lipschitz regression expressivity is open (Sec. 3.2.3).
  • domain assumption White-box ℓ2 attacks (PGD/DAG/TOG) are an adequate stress test of detector stability for safety-critical claims.
    Evaluation protocol in Sec. 4.1; no black-box or physical-world attacks are required for the paper’s conclusions.
invented entities (2)
  • LipSSD / SLipSSD architectures no independent evidence
    purpose: SSD rebuilt from orthonormalized 1-Lipschitz blocks with optional RMS scaling and temperature-scaled CE.
    Primary proposed models; independent evidence is only the paper’s own experiments, not external deployments.
  • LipFCOS architecture no independent evidence
    purpose: Appendix generalization of the same Lipschitz design to FCOS/FPN.
    Shows architecture transfer beyond SSD; again only internal empirical support.

pith-pipeline@v1.1.0-grok45 · 21951 in / 3289 out tokens · 24062 ms · 2026-07-11T13:19:04.504033+00:00 · methodology

0 comments
read the original abstract

Object detectors have many applications in safety-critical systems, but they are known to be sensitive to worst-case perturbations such as adversarial attacks, which limits their applicability in real-world scenarios. Compared with classification, adversarial robustness for object detection has received less attention, and existing methods are often tied to adversarial training, whose performance may not transfer across attacks, perturbation budgets, or architectures. In this work, we introduce Lipschitz-constrained variants of object detection architectures as robust-by-design alternatives to standard detectors. We validate this approach with LipSSD, a Lipschitz-constrained Single Shot MultiBox Detector (SSD), and provide a comprehensive study of its adversarial robustness using multiple white-box adversarial attacks and datasets. We first analyze the accuracyrobustness trade-off induced by Lipschitz constraints and show that it can be controlled through a single training hyperparameter. We then demonstrate that Lipschitzconstrained detectors are complementary to adversarial training: under the same training setup on the Pascal VOC dataset, adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical adversarially trained SSD. Finally, we use more specific safety-critical datasets such as LARD and KITTI, and show that Lipschitz-constrained detectors can improve robustness while largely preserving clean performance. These results suggest that architectural Lipschitz control is a practical and attack-agnostic direction for improving the robustness of object detectors.

Figures

Figures reproduced from arXiv: 2607.06592 by Corentin Friedrich, DTIPG - SNCF, Franck Mamalet, Ronan Sicre (IRIT), Thomas Massena (IRIT, UT3), Vincent L\'eb\'e, Yannick Prudent.

Figure 1
Figure 1. Figure 1: Robust object detection by design. We constrain the Lipschitz constant of an SSD detector, to improve its robust￾ness to input perturbations. Each column shows the same image clean (left) and under a TOG-Vanishing adversarial attack (right, ℓ2 budget ε = 2). The rows compare a vanilla SSD (top) with our LipSSD (bottom). Without ever training on adversarial exam￾ples, LipSSD keeps detecting objects that the… view at source ↗
Figure 2
Figure 2. Figure 2: LipSSD. Backbone and SSD extra layers, rebuilt from 1-Lipschitz operators (spectral and orthogonal convolutions, GroupSort, ℓ2 pooling), produce six multi-scale maps (conv4 3–conv11 2). The shared classification head is Lipschitz while the box-regression head stays unconstrained. SSD score thresholding and NMS are also unchanged. Brown: Lipschitz-constrained, blue: unconstrained box head and standard SSD. … view at source ↗
Figure 3
Figure 3. Figure 3: mAP@50 on the Pascal VOC test set as the budget [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Accuracy-robustness trade-off on Pascal VOC for the [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: mAP@50 on the KITTI test set as the budget [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: SLipSSD preserves detection under attack. Qualitative comparison on two Pascal VOC test images. For the vanilla SSD and our SLipSSD, we show the detections on the clean image and under the six adversarial attacks used for evaluation. SLipSSD is more robust. 5. Conclusion and perspectives In this work, we present LipSSD, a single-shot object de￾tector with Lipschitz-constrained operations to improve the mod… view at source ↗
Figure 7
Figure 7. Figure 7: LipFCOS architecture. VGG backbone, returned layers C3-C5, Lipschitz FPN, and shared FCOS heads. Brown blocks are Lipschitz-constrained; blue blocks are standard FCOS layers. The final box-regression and centerness convolutions remain unconstrained. A.3. Experiments We train LipFCOS on KITTI and LARD using the original FCOS losses and the same protocol as in the main experiments. The goal is not to provide… view at source ↗
Figure 8
Figure 8. Figure 8: mAP@50 under Acls as the attack budget ε increases for KITTI (left) and LARD (right). Note that, for the LARD dataset, the reported mAP@50 is evaluated on only 1,000 samples, resulting in a clean mAP@50 that differs from the value reported in Tab. 4. B. LipSSD additional results This section complements the main LipSSD experiments with additional quantitative and qualitative analyses. First, we report degr… view at source ↗
Figure 9
Figure 9. Figure 9: mAP@50 on LARD under Areg for attack budgets up to ε = 1. Note that, the reported mAP@50 is evaluated on only 1,000 samples, resulting in a clean mAP@50 that differs from the value reported in Tab. 3 favorable compromise when preserving clean performance is important. LipSSD is the more robust variant, and the difference becomes clearer as the attack budget increases (see [PITH_FULL_IMAGE:figures/full_fig… view at source ↗
Figure 10
Figure 10. Figure 10: Accuracy-robustness trade-off on Pascal VOC for the SLipSSD models trained with different temperatures [PITH_FULL_IMAGE:figures/full_fig_p014_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Qualitative comparison under a fabrication objective on KITTI. [PITH_FULL_IMAGE:figures/full_fig_p015_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Qualitative comparison under a fabrication objective on LARD. [PITH_FULL_IMAGE:figures/full_fig_p016_12.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

64 extracted references · 6 linked inside Pith

  1. [1]

    Adver- sarial defenses for object detectors based on gabor convolu- tional layers

    Abdollah Amirkhani and Mohammad Parsa Karimi. Adver- sarial defenses for object detectors based on gabor convolu- tional layers. The visual computer, 38(6):1929–1944, 2022. 3

    1929

  2. [2]

    Sorting out Lips- chitz function approximation

    Cem Anil, James Lucas, and Roger Grosse. Sorting out Lips- chitz function approximation. In Proceedings of the 36th In- ternational Conference on Machine Learning. PMLR, 2019. 2, 3, 4

    2019

  3. [3]

    Analytical bounds on the local lipschitz constants of relu networks

    Trevor Avant and Kristi A Morgansen. Analytical bounds on the local lipschitz constants of relu networks. IEEE Trans- actions on Neural Networks and Learning Systems , 35(10): 13902–13913, 2023. 4

    2023

  4. [4]

    Lipschitz Con- strained Neural Networks for Robust Object Detection at Sea

    Jonathan Becktor, Frederik Sch ¨oller, Evangelos Boukas, Mogens Blanke, and Lazaros Nalpantidis. Lipschitz Con- strained Neural Networks for Robust Object Detection at Sea. IOP Conference Series: Materials Science and Engi- neering, 929(1), 2020. 2, 3, 5

    2020

  5. [5]

    Batch nor- malization increases adversarial vulnerability and decreases adversarial transferability: A non-robust feature perspective

    Philipp Benz, Chaoning Zhang, and In So Kweon. Batch nor- malization increases adversarial vulnerability and decreases adversarial transferability: A non-robust feature perspective. In ICCV, pages 7818–7827, 2021. 6

    2021

  6. [6]

    Pay attention to your loss : understanding misconceptions about Lipschitz neural networks

    Louis B ´ethune, Thibaut Boissin, Mathieu Serrurier, Franck Mamalet, Corentin Friedrich, and Alberto Gonzalez Sanz. Pay attention to your loss : understanding misconceptions about Lipschitz neural networks. In NeurIPS, 2022. 2, 3, 5, 6

    2022

  7. [7]

    ˚Ake Bj ¨orck and C. Bowie. An iterative algorithm for com- puting the best estimate of an orthogonal matrix.SIAM Jour- nal on Numerical Analysis, 8(2):358–364, 1971. 3, 4

    1971

  8. [8]

    An adaptive orthogonal convolution scheme for efficient and flexible CNN architectures

    Thibaut Boissin, Franck Mamalet, Thomas Fel, Agustin Martin Picard, Thomas Massena, and Mathieu Serrurier. An adaptive orthogonal convolution scheme for efficient and flexible CNN architectures. In ICML, 2025. 2, 4, 5

    2025

  9. [9]

    Lard 2.0: Enhanced datasets 1https://www.deel.ai/ and benchmarking for autonomous landing systems

    Yassine Bougacha, Geoffrey Delhomme, M ´elanie Ducoffe, Augustin Fuchs, Jean-Brice Ginestet, Jacques Girard, Sofi- ane Kraiem, Franck Mamalet, Vincent Mussot, Claire Pagetti, and Thierry Sammour. Lard 2.0: Enhanced datasets 1https://www.deel.ai/ and benchmarking for autonomous landing systems. In ERTS, 2026. 2, 7

    2026

  10. [10]

    A theoretical analysis of feature pooling in visual recognition

    Y-Lan Boureau, Jean Ponce, and Yann LeCun. A theoretical analysis of feature pooling in visual recognition. In ICML,

  11. [11]

    End- to-end object detection with transformers

    Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End- to-end object detection with transformers. In ECCV, pages 213–229. Springer, 2020. 4

    2020

  12. [12]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 2

    2017

  13. [13]

    Overload: Latency attacks on object detection for edge devices

    Erh-Chung Chen, Pin-Yu Chen, I Chung, Che-Rung Lee, et al. Overload: Latency attacks on object detection for edge devices. In CVPR, 2024. 2

    2024

  14. [14]

    Class- Aware Robust Adversarial Training for Object Detection

    Pin-Chun Chen, Bo-Han Kung, and Jun-Cheng Chen. Class- Aware Robust Adversarial Training for Object Detection. In CVPR, 2021. 2, 3, 4, 5

    2021

  15. [15]

    Robust and accurate object detection via adversarial learning

    Xiangning Chen, Cihang Xie, Mingxing Tan, Li Zhang, Cho- Jui Hsieh, and Boqing Gong. Robust and accurate object detection via adversarial learning. In CVPR, 2021. 2, 3

    2021

  16. [16]

    Adversarial intensity awareness for ro- bust object detection

    Jikang Cheng, Baojin Huang, Yan Fang, Zhen Han, and Zhongyuan Wang. Adversarial intensity awareness for ro- bust object detection. Computer Vision and Image Under- standing, 251:104252, 2025. 4, 5

    2025

  17. [17]

    Detec- tion as Regression: Certified Object Detection with Median Smoothing

    Ping-yeh Chiang, Michael Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. Detec- tion as Regression: Certified Object Detection with Median Smoothing. In NeurIPS. Curran Associates, Inc., 2020. 17

    2020

  18. [18]

    Adversarial Attack and De- fense of YOLO Detectors in Autonomous Driving Scenarios

    Jung Im Choi and Qing Tian. Adversarial Attack and De- fense of YOLO Detectors in Autonomous Driving Scenarios. In 2022 IEEE Intelligent Vehicles Symposium (IV), 2022. 3

    2022

  19. [19]

    Adversarial objectness gradient attacks in real- time object detection systems

    Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Adversarial objectness gradient attacks in real- time object detection systems. In 2020 Second IEEE Inter- national Conference on Trust, Privacy and Security in Intel- ligent Systems and Applications (TPS-ISA) , pages 263–272,

    2020

  20. [20]

    Certi- fied Adversarial Robustness via Randomized Smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certi- fied Adversarial Robustness via Randomized Smoothing. In ICML, 2019. 2

    2019

  21. [21]

    VerifIoU: Robustness of object detection to perturbations

    No ´emie Cohen, M ´elanie Ducoffe, Ryma Boumazouza, Christophe Gabreau, Claire Pagetti, Xavier Pucel, and Au- drey Galametz. VerifIoU: Robustness of object detection to perturbations. In 44th Digital Avionics Systems Conference (DASC), pages 1–10, Montreal, Canada, 2025. IEEE. 17

    2025

  22. [22]

    Adversarially-Aware Robust Object Detector

    Ziyi Dong, Pengxu Wei, and Liang Lin. Adversarially-Aware Robust Object Detector. In ECCV, 2022. 2, 3, 4, 5, 6

    2022

  23. [23]

    Lard–landing approach runway detection–dataset for vision based landing

    M ´elanie Ducoffe, Maxime Carrere, L ´eo F ´eliers, Adrien Gauffriau, Vincent Mussot, Claire Pagetti, and Thierry Sam- mour. Lard–landing approach runway detection–dataset for vision based landing. arXiv preprint arXiv:2304.09938 ,

    Pith/arXiv arXiv

  24. [24]

    The Pascal Visual Object Classes Challenge: A retrospective

    Mark Everingham, SM Ali Eslami, Luc Van Gool, Christo- pher KI Williams, John Winn, and Andrew Zisserman. The Pascal Visual Object Classes Challenge: A retrospective. IJCV, 111(1):98–136, 2015. 5 9

    2015

  25. [25]

    Vision meets robotics: The kitti dataset

    Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. Vision meets robotics: The kitti dataset. The in- ternational journal of robotics research, 32(11):1231–1237,

  26. [26]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/1412.6572, 2014. 1, 2

    Pith/arXiv arXiv 2014

  27. [27]

    LipNeXt: Scal- ing up Lipschitz-based Certified Robustness to Billion- parameter Models

    Kai Hu, Haoqi Hu, and Matt Fredrikson. LipNeXt: Scal- ing up Lipschitz-based Certified Robustness to Billion- parameter Models. In ICLR, 2025. 2, 3

    2025

  28. [28]

    Adversar- ial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversar- ial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019. 14

    2019

  29. [29]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 ,

    Pith/arXiv arXiv

  30. [30]

    Preventing gradient at- tenuation in lipschitz constrained convolutional networks

    Qiyang Li, Saminul Haque, Cem Anil, James Lucas, Roger Grosse, and J ¨orn-Henrik Jacobsen. Preventing gradient at- tenuation in lipschitz constrained convolutional networks. In NeurIPS, 2019. 2, 4

    2019

  31. [31]

    On the importance of backbone to the adversarial robustness of object detectors

    Xiao Li, Hang Chen, and Xiaolin Hu. On the importance of backbone to the adversarial robustness of object detectors. IEEE Transactions on Information Forensics and Security ,

  32. [32]

    Robust adversarial perturbation on deep proposal-based models

    Yuezun Li, Daniel Tian, Ming-Ching Chang, Xiao Bian, and Siwei Lyu. Robust adversarial perturbation on deep proposal-based models. In BMVC, 2018. 2

    2018

  33. [33]

    Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection

    Jiang Liu, Alexander Levine, Chun Pong Lau, Rama Chel- lappa, and Soheil Feizi. Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In CVPR, pages 14973–14982, 2022. 2, 3

    2022

  34. [34]

    Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yang Fu, and Alexander C. Berg. SSD: Single Shot MultiBox Detector. In ECCV, 2016. 2, 4, 6

    2016

  35. [35]

    Dpatch: An adversarial patch attack on object detectors

    Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen. Dpatch: An adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299, 2018. 2

    Pith/arXiv arXiv 2018

  36. [36]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR, 2018. 2

    2018

  37. [37]

    Fast and flexible robustness certificates for semantic segmentation

    Thomas Massena, Corentin Friedrich, Franck Mamalet, and Mathieu Serrurier. Fast and flexible robustness certificates for semantic segmentation. arXiv preprint arXiv:2512.06010, 2025. 2, 3, 5

    arXiv 2025

  38. [38]

    Spectral Normalization for Generative Ad- versarial Networks

    Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral Normalization for Generative Ad- versarial Networks. In ICLR, 2018. 3, 4

    2018

  39. [39]

    A Survey and Evaluation of Adversarial Attacks in Object Detection

    Khoi Nguyen Tiet Nguyen, Wenyu Zhang, Kangkang Lu, Yu-Huan Wu, Xingjian Zheng, Hui Li Tan, and Liangli Zhen. A Survey and Evaluation of Adversarial Attacks in Object Detection. IEEE Transactions on Neural Networks and Learning Systems, 36(9):15706–15722, 2025. 2

    2025

  40. [40]

    Towards Cer- tified Object Detectors: Certified Runway Detection Using Yolo

    Ashutosh Kumar Nirala and Soumalya Sarkar. Towards Cer- tified Object Detectors: Certified Runway Detection Using Yolo. In ICIP, 2025. 17

    2025

  41. [41]

    You only look once: Unified, real-time object de- tection

    Joseph Redmon, Santosh Divvala, Ross Girshick, and Ali Farhadi. You only look once: Unified, real-time object de- tection. In CVPR, pages 779–788, 2016. 4

    2016

  42. [42]

    Faster r-cnn: Towards real-time object detection with region proposal networks

    Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. In NeurIPS, 2015. 4

    2015

  43. [43]

    Achieving robustness in classification using optimal transport with hinge regularization

    Mathieu Serrurier, Franck Mamalet, Alberto Gonzalez-Sanz, Thibaut Boissin, Jean-Michel Loubes, and Eustasio Del Bar- rio. Achieving robustness in classification using optimal transport with hinge regularization. In CVPR, 2021. 2, 3, 4, 5

    2021

  44. [44]

    Adversarial training for free! In NeurIPS, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NeurIPS, 2019. 3

    2019

  45. [45]

    In- triguing properties of Neural Networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of Neural Networks. In ICLR, 2014. 1, 2

    2014

  46. [46]

    A comprehensive review of YOLO architectures in computer vision: From YOLOv1 to YOLOv8 and YOLO-NAS

    Juan Terven, Diana-Margarita C ´ordova-Esparza, and Julio- Alejandro Romero-Gonz ´alez. A comprehensive review of YOLO architectures in computer vision: From YOLOv1 to YOLOv8 and YOLO-NAS. Machine learning and knowl- edge extraction, 5(4):1680–1716, 2023. 4

    2023

  47. [47]

    Defenses Against Adversarial Attacks on Object Detection: Methods and Future Directions

    Anant Thunuguntla, Prasad Tadepalli, Giuseppe Raffa, Anant Thunuguntla, Prasad Tadepalli, and Giuseppe Raffa. Defenses Against Adversarial Attacks on Object Detection: Methods and Future Directions. Information, 16(11), 2025. 3

    2025

  48. [48]

    FCOS: Fully Convolutional One-Stage Object Detection

    Zhi Tian, Chunhua Shen, Hao Chen, and Tong He. FCOS: Fully Convolutional One-Stage Object Detection. In ICCV,

  49. [49]

    Lipschitz regularity of deep neural networks: analysis and efficient estimation

    Aladin Virmaux and Kevin Scaman. Lipschitz regularity of deep neural networks: analysis and efficient estimation. In NeurIPS, 2018. 3

    2018

  50. [50]

    Zico Kolter

    Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and J. Zico Kolter. Beta-CROWN: Effi- cient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification. In NeurIPS,

  51. [51]

    Improving Adversarial Robustness Requires Revisiting Misclassified Examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving Adversarial Robustness Requires Revisiting Misclassified Examples. In ICLR, 2019. 2

    2019

  52. [52]

    Adversarial attacks and defenses in machine learning-empowered communication systems and networks: A contemporary survey

    Yulong Wang, Tong Sun, Shenghong Li, Xin Yuan, Wei Ni, Ekram Hossain, and H Vincent Poor. Adversarial attacks and defenses in machine learning-empowered communication systems and networks: A contemporary survey. IEEE Com- munications Surveys & Tutorials, 25(4):2245–2298, 2023. 2

    2023

  53. [53]

    Re- visiting Adversarial Training at Scale

    Zeyu Wang, Xianhang Li, Hongru Zhu, and Cihang Xie. Re- visiting Adversarial Training at Scale. In CVPR, 2024. 2

    2024

  54. [54]

    Transferable adversarial attacks for image and video object detection

    Xingxing Wei, Siyuan Liang, Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641, 2018. 2

    Pith/arXiv arXiv 2018

  55. [55]

    Ex- ploring Model Learning Heterogeneity for Boosting Ensem- ble Robustness

    Yanzhao Wu, Ka-Ho Chow, Wenqi Wei, and Ling Liu. Ex- ploring Model Learning Heterogeneity for Boosting Ensem- ble Robustness. In 2023 IEEE International Conference on Data Mining (ICDM), 2023. 3 10

    2023

  56. [56]

    Adversarial Examples for Se- mantic Segmentation and Object Detection

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial Examples for Se- mantic Segmentation and Object Detection. In ICCV, 2017. 2, 5

    2017

  57. [57]

    Automatic Perturbation Analysis for Scal- able Certified Robustness and Beyond

    Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai- Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsieh. Automatic Perturbation Analysis for Scal- able Certified Robustness and Beyond. In NeurIPS, 2020. 2

    2020

  58. [58]

    Adversarial attention perturbations for large object de- tection transformers

    Zachary Yahn, Selim Furkan Tekin, Fatih Ilhan, Sihao Hu, Tiansheng Huang, Yichang Xu, Margaret Loper, and Ling Liu. Adversarial attention perturbations for large object de- tection transformers. In ICCV, 2025. 2

    2025

  59. [59]

    A spectral condition for feature learning

    Greg Yang, James B Simon, and Jeremy Bernstein. A spectral condition for feature learning. arXiv preprint arXiv:2310.17813, 2023. 5

    Pith/arXiv arXiv 2023

  60. [60]

    Towards adversarially ro- bust object detection

    Haichao Zhang and Jianyu Wang. Towards adversarially ro- bust object detection. In ICCV, 2019. 2, 3, 4, 5, 6, 7

    2019

  61. [61]

    Efficient Neural Network Robustness Cer- tification with General Activation Functions

    Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient Neural Network Robustness Cer- tification with General Activation Functions. In NeurIPS,

  62. [62]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019. 2

    2019

  63. [63]

    Revisiting transferable adversarial images: System- ization, evaluation, and new insights

    Zhengyu Zhao, Hanwei Zhang, Renjue Li, Ronan Sicre, Lau- rent Amsaleg, Michael Backes, Qi Li, Qian Wang, and Chao Shen. Revisiting transferable adversarial images: System- ization, evaluation, and new insights. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025. 2 11 A. LipFCOS This section studies the generalization of the proposed Lips...

    2025

  64. [64]

    More recently, Nirala and Sarkar [40] trained and certified a modified YOLOv2-based runway detector with IBP on 128×128 LARD [23] crops under ℓ∞ perturbations

    proposed to formally verify the localization robustness of single-object detectors by bounding the worst-case IoU over a perturbation set. More recently, Nirala and Sarkar [40] trained and certified a modified YOLOv2-based runway detector with IBP on 128×128 LARD [23] crops under ℓ∞ perturbations. These formal verification works remain limited in scope an...

    2000