Pith. sign in

REVIEW 3 major objections 4 minor 28 references

Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read P3A's central claim is that its PASR-based loss and scale-preserving padding make a patch trained on one detector transfer to unseen detectors at driving resolution better than previous transferable patch attacks.

desk verdict A well-motivated attack paper with a real metric critique, but the load-bearing numbers are currently unverifiable because the new metric's aggregation is ambiguous and no code or error bars are included. read the letter →

arxiv 2508.10600 v1 pith:ZOIRK27H submitted 2025-08-14 cs.CV

Yuxin Cao , Yedi Zhang , Wentao He , Yifan Liao , Yan Xiao , Chang Li , Zhiyong Huang , Jin Song Dong This is my paper
classification cs.CV
keywords adversarialpatchesobjectdetectionautonomousdrivingpedestrianblack-boxattacksattacktransferabilityPASRhigh-resolutionimaging
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that previous transferable patch attacks on pedestrian detectors overstate their practical success, because mean Average Precision can drop nearly to zero while every pedestrian is still detected. P3A replaces that evaluation with a Practical Attack Success Rate (PASR) that counts a person as hidden only when no sufficiently confident, sufficiently overlapping detection remains, and it trains patches with a loss aligned to that condition. It also adds a preprocessing step that keeps patch scale realistic on high-resolution images. The paper reports that a patch optimized this way against a single YOLOv8 surrogate outperforms state-of-the-art transferable patch attacks on unseen models and unseen high-resolution autonomous-driving datasets, under both PASR and mAP-based metrics. If true, it would mean an offline attacker can hide pedestrians from unseen detectors at driving resolutions, and safety evaluators should stop trusting mAP alone.

What carries the argument

Three named components carry the argument. PASR is the evaluation metric: it marks a pedestrian as hidden only when no remaining detection box has IoU with the ground truth above a threshold and confidence above a threshold, making 'hidden' a direct safety condition rather than a proxy. LCSL is the loss designed to optimize exactly that condition, suppressing the localization quality (IoU) and confidence of the strongest detections at the same time. PSPP is the preprocessing step that probabilistically scales and pads the patch so its apparent size on the pedestrian survives the move from low-resolution training data to high-resolution autonomous-driving frames. Together they make the patch

What would settle it

Train the P3A patch on YOLOv8, place it on pedestrians in high-resolution nuScenes frames, and run an unseen detector such as RT-DETRv2 at native resolution. Count pedestrians who still have at least one detection box with IoU above the matching threshold and confidence above the detection threshold. If that count does not drop substantially more for P3A than for T-SEA, or if a large fraction of pedestrians remain detected, the transferability improvement is not established. Repeating the count at several camera distances tests whether the gain holds across scales.

Watch

Extended reading notes

Core claim

The central claim, on the paper's own terms, is that the usual mAP-based protocol for evaluating transferable patch attacks overstates how well an attack hides pedestrians. In practice a detector can fire several overlapping boxes for one pedestrian, and a box can fall just below the IoU matching threshold while still being a usable detection; mAP can therefore drop to nearly zero without a single pedestrian being fully undetected. P3A replaces that protocol with Practical Attack Success Rate (PASR), which counts a pedestrian as hidden only if no predicted box both overlaps the ground truth enough and has enough confidence to count as a detection. Its Localization-Confidence Suppression Loss

Load-bearing premise

The premise that a patch optimized on one YOLOv8 surrogate, with PSPP preprocessing, transfers to the unseen detectors and high-resolution datasets with the margins the experiments report; if that cross-model, cross-resolution transfer does not hold, the practical-attack claim collapses.

Editorial extensions

If this is right

  • An attacker can train one printable patch offline on a single open-source detector and deploy it against black-box detectors without querying them at run time.
  • A safety evaluation that reports only mAP can miss the case where every pedestrian is still detected; PASR gives a direct count of pedestrians that are truly hidden.
  • Patches trained with PSPP should keep their effectiveness when deployment images are higher resolution than the training data, the regime where earlier transferable patches degrade.
  • The reported gains are for pedestrian targets under IoU/confidence thresholds; applying the same recipe to other object classes or detection tasks would require re-tuning those thresholds.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the mAP-versus-PASR gap is a general evaluation hazard, so any transferable attack or defense tuned to mAP should be re-examined under a metric that demands complete suppression of all overlapping detections.
  • Inference: the high-resolution transfer gain could be driven mostly by PSPP's scale preservation; an ablation that holds the loss fixed and removes only the padding component would isolate how much of the improvement comes from preprocessing rather than LCSL.
  • Inference: because the surrogate is a single YOLOv8 detector, the transfer claim is evidence about that family of experiments, not a universal statement; checking transformer-based detectors at native high resolution would test how far the generalization goes.
  • Inference: PASR's IoU threshold makes distance a hidden variable: small far-away pedestrian boxes are harder to match by IoU, so a distance-stratified PASR would show whether the attack really hides pedestrians at distance or merely exploits the metric.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes P3A, a transferable adversarial-patch framework for 2D object detection in autonomous driving. It introduces a new metric, Practical Attack Success Rate (PASR), intended to measure whether a pedestrian is truly hidden (via IoU-based matching and confidence suppression) rather than merely whether mAP drops. It also proposes a Localization-Confidence Suppression Loss (LCSL) to optimize PASR, and a Probabilistic Scale-Preserving Padding (PSPP) preprocessing step to improve transferability to high-resolution datasets. The authors claim that P3A outperforms prior transferable patch attacks (e.g., T-SEA) on unseen detectors and unseen high-resolution datasets under both PASR and mAP-based metrics.

Significance. If the claims are substantiated, the paper makes a useful step toward safety-relevant evaluation of adversarial patch attacks: mAP is known to be a poor proxy for whether an object is actually undetected, and a metric that directly reflects pedestrian hiding is valuable for the autonomous-driving community. The proposed loss and preprocessing strategy for high-resolution transfer are also practical contributions. The paper evaluates against multiple modern detectors and datasets, which is a strength. However, the central quantitative claims rely on a metric whose definition is not fully pinned down, and the experimental reporting lacks statistical rigor; these issues currently prevent the results from being accepted as stated.

major comments (3)
  1. [Section III, Eq. (6)] PASR is the metric used for all headline comparisons, but the manuscript does not specify whether it averages over images, over object instances, or over detection matches, nor the exact confidence and IoU thresholds used in the success criterion. This is load-bearing: if PASR is per-image (success if any pedestrian is hidden), the reported large relative gains in Tables II and VIII could shrink or vanish under per-object averaging. The authors must provide the precise aggregation formula and the threshold values, and ideally report PASR under multiple aggregation choices to show the comparative conclusions are robust.
  2. [Section IV (experiments)] The experimental tables report point estimates with no error bars or repeated runs. Patch optimization is stochastic, and the reported differences between P3A and prior work may be within run-to-run variance. For a fair and reproducible comparison, the paper should report mean and standard deviation over at least three independent optimization runs, and specify the baseline hyperparameters (patch initialization, number of iterations, learning rate schedule) for all compared methods, including T-SEA.
  3. [Section III (LCSL) and Table II] PASR and LCSL share the same IoU matching and confidence-suppression components, so the absolute PASR on the surrogate YOLOv8 is partly a re-statement of the optimization objective. The comparative claim would be stronger if the authors showed that P3A also outperforms baselines under mismatched thresholds (e.g., evaluating PASR with IoU thresholds different from the one used in training) to rule out that the advantage is an artifact of tuning to a specific threshold.
minor comments (4)
  1. [Abstract/Notation] The paper alternates between 'P$^3$A' and 'P3A'; please use a consistent notation throughout.
  2. [Figure 1] The caption of Figure 1 mentions 'ASR' but the abstract and main text define only PASR and mAP. Please define ASR or remove it.
  3. [References] Some references are incomplete, e.g., Reference [18] lists pages as '0–0'. Please update all references to final bibliographic data.
  4. [Section I] The introduction would benefit from a explicit statement of the PASR aggregation rule at least in prose, so that readers can interpret the metric even before reaching the formal definition.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: P3A's transferability claims are comparative, tested on unseen models/datasets, and corroborated by mAP-based metrics; the PASR/LCSL overlap is a metric-design caveat, not a circular derivation.

full rationale

The paper's central claim is that P3A outperforms state-of-the-art transferable patch attacks on unseen models and unseen high-resolution datasets, under both the newly proposed PASR metric and the previous mAP-based metrics. That claim is an empirical, comparative result rather than a derivation from first principles. The only structural overlap is that LCSL is explicitly tailored to PASR, so source-domain PASR numbers are partly a re-statement of the optimization objective; however, the headline conclusions rest on cross-model/cross-dataset transfer, where the objective itself was not optimized, and are corroborated by mAP-based metrics that are external to PASR. Self-citations (e.g., T-SEA) are used for context and as a baseline, not as a load-bearing uniqueness or ansatz justification. No equation in the provided text defines a target quantity in terms of the claimed output, nor is any fitted parameter renamed as a prediction. The PASR aggregation ambiguity raised in the review is a definitional/correctness concern, not a circularity. Therefore no significant circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

No new entities beyond the patch itself. The central risk is that the evaluation uses the same IoU component that training optimizes, so absolute numbers on the surrogate are partly self-fulfilling until the reported cross-model comparisons are independently reproduced.

free parameters (3)
  • IoU threshold p for PASR = 0.5
    Set by hand. The paper tests alternative thresholds in the appendix. This parameter defines the success metric.
  • LCSL weights w_loc and w_conf = not specified
    Used in the combined loss (Eq. 5). Values are not reported in the text, affecting reproducibility.
  • PSPP probability and scale range = not specified
    Hyperparameters of the scale-preserving padding mask. Values are not reported in the text, affecting reproducibility.
assumptions (3)
  • domain assumption An unseen model will behave like the surrogate ensemble on unseen data when the attack objectives are matched.
    The entire transferability claim assumes the surrogate-based optimization transfers to architectures and datasets not seen. The paper tests several detectors but it is still an empirical assumption.
  • domain assumption Digital simulation with JPEG compression, brightness and contrast perturbations approximates physical-world conditions.
    The experiments are done in simulation, and the paper sells physical applicability. No physical-world test is reported.
  • domain assumption Adversarial robustness properties of detectors are stable across single-frame images with patches pasted over the ground truth object.
    The patch is pasted over the object in the image plane. Real 3D geometry may differ, but this is standard in the field.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving." pith.science (2026). https://pith.science/paper/ZOIRK27H

@misc{pith2026250810600,
  author       = {Pith},
  title        = {Pith review of: Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZOIRK27H}},
  note         = {Machine review of arXiv:2508.10600}
}
abstract

Learning-based autonomous driving systems remain critically vulnerable to adversarial patches, posing serious safety and security risks in their real-world deployment. Black-box attacks, notable for their high attack success rate without model knowledge, are especially concerning, with their transferability extensively studied to reduce computational costs compared to query-based attacks. Previous transferability-based black-box attacks typically adopt mean Average Precision (mAP) as the evaluation metric and design training loss accordingly. However, due to the presence of multiple detected bounding boxes and the relatively lenient Intersection over Union (IoU) thresholds, the attack effectiveness of these approaches is often overestimated, resulting in reduced success rates in practical attacking scenarios. Furthermore, patches trained on low-resolution data often fail to maintain effectiveness on high-resolution images, limiting their transferability to autonomous driving datasets. To fill this gap, we propose P$^3$A, a Powerful and Practical Patch Attack framework for 2D object detection in autonomous driving, specifically optimized for high-resolution datasets. First, we introduce a novel metric, Practical Attack Success Rate (PASR), to more accurately quantify attack effectiveness with greater relevance for pedestrian safety. Second, we present a tailored Localization-Confidence Suppression Loss (LCSL) to improve attack transferability under PASR. Finally, to maintain the transferability for high-resolution datasets, we further incorporate the Probabilistic Scale-Preserving Padding (PSPP) into the patch attack pipeline as a data preprocessing step. Extensive experiments show that P$^3$A outperforms state-of-the-art attacks on unseen models and unseen high-resolution datasets, both under the proposed practical IoU-based evaluation metric and the previous mAP-based metrics.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

28 extracted references · 15 canonical work pages

  1. [18]

    Fooling automated surveil- lance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedem ´e, “Fooling automated surveil- lance cameras: adversarial patches to attack person detection,” in Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    work page 2019

  2. [19]

    DePatch: Towards Robust Adversarial Patch for Evading Person Detectors in the Real World

    J. Cheng, Y . Zhang, Z. Wang, Z. Qin, and C. Li, “Depatch: Towards robust adversarial patch for evading person detectors in the real world,” arXiv preprint arXiv:2408.06625 , 2024

    work page Pith review arXiv 2024

  3. [20]

    Histograms of oriented gradients for human detection,

    N. Dalal and B. Triggs, “Histograms of oriented gradients for human detection,” in 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR’05) , vol. 1. Ieee, 2005, pp. 886–893

    work page 2005

  4. [21]

    Full-distance evasion of pedestrian detectors in the physical world,

    Z. Cheng, Z. Hu, Y . Liu, J. Li, H. Su, and X. Hu, “Full-distance evasion of pedestrian detectors in the physical world,” in The Thirty-eighth Annual Conference on Neural Information Processing Systems , 2024

    work page 2024

  5. [22]

    Threatening patch attacks on object detection in optical remote sensing images,

    X. Sun, G. Cheng, L. Pei, H. Li, and J. Han, “Threatening patch attacks on object detection in optical remote sensing images,” IEEE Transactions on Geoscience and Remote Sensing , vol. 61, pp. 1–10, 2023

    work page 2023

  6. [23]

    Rademacher complexity for adver- sarially robust generalization,

    D. Yin, R. Kannan, and P. Bartlett, “Rademacher complexity for adver- sarially robust generalization,” in International conference on machine learning. PMLR, 2019, pp. 7085–7094

    work page 2019

  7. [24]

    Yolo9000: better, faster, stronger,

    J. Redmon and A. Farhadi, “Yolo9000: better, faster, stronger,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2017, pp. 7263–7271

    2017

  8. [25]

    Yolov3: An incremental improvement,

    ——, “Yolov3: An incremental improvement,” arXiv preprint arXiv:1804.02767, 2018

    arXiv 2018

Show all 28 references
  1. [26]

    Yolov4: Op- timal speed and accuracy of object detection,

    A. Bochkovskiy, C.-Y . Wang, and H.-Y . M. Liao, “Yolov4: Op- timal speed and accuracy of object detection,” arXiv preprint arXiv:2004.10934, 2020

    2004 arXiv

  2. [27]

    ultralytics/yolov5,

    G. Jocher, A. Stoken, J. Borovec, NanoCode012, ChristopherSTAN, L. Changyu, Laughing, tkianai, A. Hogan, lorenzomammana, yxNONG, AlexWang1900, L. Diaconu, Marc, wanghaoyang0106, ml5ah, Doug, F. Ingham, Frederik, Guilhen, Hatovix, J. Poznanski, J. Fang, L. Yu, changyu98, M. Wan...

    2020 doi

  3. [28]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” Advances in neural information processing systems , vol. 28, 2015

    2015

  4. [29]

    Ssd: Single shot multibox detector,

    W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y . Fu, and A. C. Berg, “Ssd: Single shot multibox detector,” in European conference on computer vision. Springer, 2016, pp. 21–37

    2016

  5. [30]

    Rt- detrv2: Improved baseline with bag-of-freebies for real-time detection transformer,

    W. Lv, Y . Zhao, Q. Chang, K. Huang, G. Wang, and Y . Liu, “Rt- detrv2: Improved baseline with bag-of-freebies for real-time detection transformer,” arXiv preprint arXiv:2407.17140 , 2024

    2024 arXiv

  6. [31]

    Ultralytics yolov8,

    G. Jocher, A. Chaurasia, and J. Qiu, “Ultralytics yolov8,” 2023. [Online]. Available: https://github.com/ultralytics/ultralytics

    2023

  7. [32]

    Ultralytics yolo11,

    G. Jocher and J. Qiu, “Ultralytics yolo11,” 2024. [Online]. Available: https://github.com/ultralytics/ultralytics

    2024

  8. [33]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13 . Springer,...

    2014

  9. [34]

    Are we ready for autonomous driving? the kitti vision benchmark suite,

    A. Geiger, P. Lenz, and R. Urtasun, “Are we ready for autonomous driving? the kitti vision benchmark suite,” in 2012 IEEE conference on computer vision and pattern recognition . IEEE, 2012, pp. 3354–3361

    2012

  10. [35]

    Bdd100k: A diverse driving dataset for heterogeneous multitask learning,

    F. Yu, H. Chen, X. Wang, W. Xian, Y . Chen, F. Liu, V . Madhavan, and T. Darrell, “Bdd100k: A diverse driving dataset for heterogeneous multitask learning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2020, pp. 2636–2645

    2020

  11. [36]

    nuscenes: A multimodal dataset for autonomous driving,

    H. Caesar, V . Bankiti, A. H. Lang, S. V ora, V . E. Liong, Q. Xu, A. Krishnan, Y . Pan, G. Baldan, and O. Beijbom, “nuscenes: A multimodal dataset for autonomous driving,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11 621–11 631

    2020

  12. [37]

    A2d2: Audi autonomous driving dataset,

    J. Geyer, Y . Kassahun, M. Mahmudi, X. Ricou, R. Durgesh, A. S. Chung, L. Hauswald, V . H. Pham, M. M ¨uhlegg, S. Dorn et al. , “A2d2: Audi autonomous driving dataset,” arXiv preprint arXiv:2004.06320 , 2020

    2004 arXiv

  13. [38]

    Making an invisibility cloak: Real world adversarial attacks on object detectors,

    Z. Wu, S.-N. Lim, L. S. Davis, and T. Goldstein, “Making an invisibility cloak: Real world adversarial attacks on object detectors,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part IV 16 . Springer, 2020, pp. 1–17

    2020

  14. [39]

    Adversarial tex- ture for fooling person detectors in the physical world,

    Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, and X. Hu, “Adversarial tex- ture for fooling person detectors in the physical world,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 13 307–13 316

    2022

  15. [40]

    Dap: A dynamic adversarial patch for evading person detectors,

    A. Guesmi, R. Ding, M. A. Hanif, I. Alouani, and M. Shafique, “Dap: A dynamic adversarial patch for evading person detectors,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 595–24 604

    2024

  16. [41]

    Advart: Adversarial art for camouflaged object detection attacks,

    A. Guesmi, I. M. Bilasco, M. Shafique, and I. Alouani, “Advart: Adversarial art for camouflaged object detection attacks,” in 2024 IEEE International Conference on Image Processing (ICIP). IEEE, 2024, pp. 666–672

    2024

  17. [42]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980 , 2014

    2014 arXiv

  18. [43]

    Pad: Patch- agnostic defense against adversarial patch attacks,

    L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou, “Pad: Patch- agnostic defense against adversarial patch attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 472–24 481

    2024

  19. [44]

    Napguard: Towards de- tecting naturalistic adversarial patches,

    S. Wu, J. Wang, J. Zhao, Y . Wang, and X. Liu, “Napguard: Towards de- tecting naturalistic adversarial patches,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 24 367–24 376

    2024

  20. [45]

    Shalev-Shwartz and S

    S. Shalev-Shwartz and S. Ben-David, Understanding machine learning: From theory to algorithms . Cambridge university press, 2014. 10

    2014

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.