{"id":"402ed034-aab2-44bc-9ed4-a67e6c035828","arxiv_id":"2507.04762","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"ARLOT uses a least-squares graph over multi-agent bounding boxes to denoise adversarial detections and a two-stage Kalman tracking association to improve 3D multi-object tracking under point-cloud attacks.","lead":"This paper presents ARLOT, a method that reduces adversarial noise in 3D multi-agent vehicle tracking by smoothing detection centroids with a graph-based least-squares optimization. It reports up to 23.3% improvement in tracking accuracy over existing multi-agent trackers on the V2V4Real dataset under point-cloud attacks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Least-squares fusion cannot remove common-mode adversarial bias in the anchors, so the claimed denoising mechanism is unproven and the 23.3% headline may not be attributable to it.","rationale":"The reader's weakest assumption identifies the same load-bearing issue: the anchor vectors in Eqs. 11-12 are built from the other agent's attacked detections, so they inherit the attack bias. A least-squares blend of two biased estimates does not remove a common shift; it only averages independent noise. The paper's own experimental regime attacks both vehicles, yet it provides no measurement of how correlated the induced centroid errors are across agents, nor any sensitivity study of the anchor construction. The empirical tables also show mixed results, with sAMOTA and MT slightly negative versus DMSTrack in several rows, so the only consistently positive signal is AMOTA. Even that signal could arise from the two-stage tracking association rather than from graph-based denoising. Because the method is parameter-free and the anchor definition is not fully reproducible, the conditional verdict is appropriate: acceptance should require a synthetic common-bias experiment or an analysis of cross-agent error correlation, together with code or detailed pseudocode for the anchor construction.","tokens_in":10168,"tokens_out":8884,"duration_ms":110625,"concrete_test":"Run ARLOT on a synthetic two-agent tracking sequence with known ground truth. For each common object, shift both agents' detection centroids by the same vector b (e.g., b = (0.2, 0.2, 0) m) and add independent zero-mean noise; apply the Section III method and measure the residual centroid error of the smoothed detections. If the residual error is approximately |b|, the method does not denoise common-mode bias. Separately, under the actual 25 cm attack, compute the Pearson correlation of per-object centroid errors between the two agents; if it is strongly positive, the same bias is present in the reported experiments.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that least-squares graph smoothing of multi-agent bounding boxes acts as a denoiser. In Section III-B (Eqs. 11-12), the anchors c_t_ij and c_t_ji are formed from the other agent's perturbed detections and track velocities. For the fully connected graph used here, L = N I - J, so the solution of Eq. (10) satisfies (L^2 + I)u = L^2 u_0 + c. In the eigenbasis of L, the constant mode is set exactly to the mean anchor value and the remaining modes are a convex combination of the input and the anchor. If both agents are attacked (Table IV), u_0 and c carry the same adversarial bias; a common-mode shift b is therefore preserved, not reduced. The paper never reports the cross-agent correlation of the per-object centroid errors induced by the Section II-B attack, nor does it test the sensitivity of the anchor construction. Since the headline 23.3% gain appears only in the both-vehicles-attacked regime, the improvement cannot be attributed to the proposed least-squares denoising without this analysis. The definition of c_t_ij is also dimensionally unclear (R^N versus four listed scalars), making the sensitivity test impossible to reproduce as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ARLOT, a multi-agent 3D object tracking pipeline that applies least-squares graph regularization to bounding-box centroids from two vehicles, followed by two-stage Hungarian/IoU association and Kalman filtering, with the aim of mitigating adversarial point-cloud perturbations. The method is evaluated on the V2V4Real dataset against single- and multi-agent tracking baselines under 20 cm and 25 cm perturbations with and without a rotation-based defense, reporting improvements up to 23.3% in AMOTA. The presentation also includes an ablation-free comparison of mAP under attack and several qualitative figures of trajectories.","tokens_in":10426,"tokens_out":6661,"duration_ms":73271,"significance":"If the claims are established, ARLOT would offer a training-free, communication-light defense against adversarial LiDAR attacks, which is practically appealing. The closed-form least-squares derivation and the use of a real-world cooperative dataset are strengths, and the paper explicitly positions the method as not requiring additional defense mechanisms. However, the current evidence does not yet demonstrate that the least-squares graph stage removes the adversarial bias: the anchor construction is underspecified, the reported improvements are not computed against a consistent baseline, and no uncertainty quantification is provided. The central denoising mechanism therefore needs additional analysis and experiments before the empirical claims can be accepted.","major_comments":[{"comment":"The anchor vectors ct_ij and ct_ji are defined by listing four scalars (mxj,m, mxj,m, uxi,m, uxj,m) but are asserted to lie in R^{N^t}, where N^t is the number of nodes in the fully connected graph. The mapping from each graph node to a specific anchor coordinate is never specified, and the symbols mxj,m and uxi,m are not introduced before their use. This makes the method impossible to reproduce exactly as written.","section":"Section III-B, Eqs. (11)-(12)"},{"comment":"For the fully connected graph used in the paper, the Laplacian is L = N I - J, so the least-squares normal equations reduce to (L^T L + I) u = L^T L u0 + c. If both the input centroids u0 and the anchors c are shifted by the same constant vector b, the solution u inherits exactly the same shift b. Since both agents' detections are produced from the same point-cloud attack in the both-vehicles-attacked scenario, the anchors can carry the same adversarial bias as the inputs. The paper does not report the cross-agent correlation of per-object centroid errors under the Section II-B attack, nor does it ablate the anchor construction, so the claimed denoising effect in Table IV is not established.","section":"Section III-A/III-B"},{"comment":"The parenthetical percentage improvements in Table IV are not computed against a consistent baseline. In the 25 cm+Defense row, AMOTA (+23.3%) is relative to V2V4Real (11.93), while sAMOTA (-0.08%) is relative to DMSTrack (48.22), and AMOTP (+13.93%) is relative to V2V4Real (28.28). The headline 'up to 23.3%' is therefore not a comparison with the best-performing baseline across all metrics, and the claim that ARLOT outperforms both baselines on all metrics is contradicted by the sAMOTA value of 48.18 versus DMSTrack's 48.22 in the same row.","section":"Table IV"},{"comment":"All tracking results are reported as single point estimates with no standard deviations, confidence intervals, or number of repeated runs. Several margins are very small (e.g., Table IV sAMOTA 48.18 vs. 48.22 for DMSTrack), so the claimed consistent improvements are not statistically supported. The paper should provide error bars or at least a stability analysis over multiple attack realizations and dataset sequences.","section":"Tables II-IV and Section IV-B"},{"comment":"The tracking parameters age = 2 and hits = 3 are stated without any sensitivity analysis. Since track lifetime management directly affects sAMOTA, MT, and identity switches, the robustness of the conclusions to these two free parameters should be reported.","section":"Section IV-A"}],"minor_comments":[{"comment":"There is a typo: 'usind' should be 'using' in the third paragraph.","section":"Section I"},{"comment":"The plus/minus notation in the tables is not defined precisely; the caption says 'with respect to the maximum deviation of the state-of-the-art MAMOT methods,' but the text never explains what 'maximum deviation' means or why some entries show a negative percentage when the raw value is higher than the baseline.","section":"Tables II-IV"},{"comment":"The statement that the computational complexity is 'equal or lower than O((2NtNt)2)' is ambiguous; it should be written as O((2N^t)^2) or O((N^t)^2) and justified more clearly.","section":"Section III-A"},{"comment":"The phrase 'complimentary information' should be 'complementary information'.","section":"Section III-B"},{"comment":"The caption contains a typo: 'Bening Point Clouds' should be 'Benign Point Clouds'.","section":"Table II caption"},{"comment":"The lines 'Update, Initialize Tracks' and 'Update, Initialize, Terminate Tracks' do not specify which Kalman update or track-management rules are applied; a reference to the equations or a short description would improve readability.","section":"Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":"The paper's strongest claim rests on a denoising mechanism that is not demonstrated: the least-squares solution provably preserves any constant common-mode shift, and the anchor vectors are defined too imprecisely to test this. In addition, the arithmetic behind the reported percentage improvements in Table IV is inconsistent, which makes the headline 'up to 23.3%' misleading. The idea is salvageable if the authors provide a proper correlation/sensitivity analysis for the anchors, correct the baseline comparisons, and add uncertainty quantification. As written, the evidence is not yet sufficient for acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi [Name],\n\nThis paper applies least-squares graph smoothing to multi-agent 3D detection centroids before two-stage tracking association, as a training-free defense against adversarial point-cloud perturbations. That specific combination is new as far as I know, and the authors test it on real V2V4Real data against relevant baselines.\n\nThe good parts: the least-squares formulation itself is standard and correct; applying it to denoise shared detections across agents is a legitimate new application. The two-stage association with a Kalman filter is a reasonable way to handle the extra false positives/negatives the attack induces. They also show clearly that the attack badly degrades single-agent detection mAP, which motivates the problem.\n\nThe soft spots are in the evaluation and the anchor construction. The headline '23.3%' only appears when comparing against V2V4Real in the both-vehicles-attacked, 25cm+defense, AMOTA row; against the stronger DMSTrack baseline the gain is about 5%, and several sAMOTA and MT numbers are negative. No error bars, no code release, and the anchor vectors in Eq. 11-12 are dimensionally unclear: they're written as R^N but list four scalars. That alone makes the method hard to reproduce as written.\n\nMore substantively, the least-squares denoising has a blind spot that the paper doesn't address. In the fully connected graph, the constant mode of the solution is set exactly to the mean of the anchor vector. If both agents are attacked and the perturbations shift detections in a correlated direction, that common-mode bias survives the smoothing. The paper never reports the cross-agent correlation of centroid errors or tests sensitivity to anchor construction. So the claimed denoising mechanism is not actually established by the experiments, and the improvement could come from the tracking association rather than the graph smoothing.\n\nWho is this for? A reader working on cooperative perception robustness might find the idea useful as a baseline or a cheap defense to compare against. It's not a foundational paper, and the evaluation needs serious tightening before I'd trust the numbers. But the method is simple, training-free, and the core idea has some plausibility.\n\nRecommendation: send it to peer review, but with a clear expectation of major revision: fix the anchor definitions, add error bars, report all metrics honestly, and include a sensitivity analysis for the anchor construction under correlated attacks.","headline":"Plausible training-free smoothing for multi-agent tracking under adversarial point clouds, but the headline gain is cherry-picked and the denoising mechanism isn't shown to work against correlated attacks.","tokens_in":10935,"tokens_out":3316,"would_cite":false,"duration_ms":34856,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A training-free least-squares graph denoiser lets cooperating vehicles track 3D objects accurately under adversarial LiDAR attacks, outperforming state-of-the-art multi-agent tracking by up to 23.3%.","keywords":["adversarial attacks","LiDAR point clouds","multi-agent object tracking","least-squares graphs","graph signal processing","Kalman filter","V2V4Real","3D object detection"],"falsifier":"A targeted adversarial attack that shifts overlapping detections at both agents along a common direction (rather than independently) would break the anchor assumption; if ARLOT's AMOTA under such a correlated attack falls to or below the single-agent baseline's, the claim that cooperation alone provides resilience is falsified. More simply, a sensitivity study that corrupts the anchor vectors and measures the resulting centroid error would show the method's tolerance boundary.","tokens_in":10011,"feed_emoji":"🚗","tokens_out":4257,"duration_ms":42030,"temperature":0.7,"pith_summary":"The paper argues that adversarial perturbations injected into the point clouds of connected autonomous vehicles can be suppressed by treating the vehicles' noisy 3D detections as nodes of a fully connected graph and solving a least-squares smoothing problem over that graph. The proposed ARLOT framework uses differential coordinates and anchor points from overlapping detections to correct each bounding-box centroid, then associates the refined detections with existing tracks in two Hungarian-algorithm stages updated by Kalman filters. On the real-world V2V4Real dataset under 20 cm and 25 cm perturbations, ARLOT improves tracking accuracy over state-of-the-art single- and multi-agent baselines by up to 23.3% in AMOTA, without adversarial training or any auxiliary defense module. The central message is that cooperation itself, implemented as a training-free graph denoiser, can be a defense mechanism.","feed_headline":"Graph-smoothed multi-agent tracking beats adversarial noise by 23.3%","feed_subtitle":"No retraining, no defenses: cooperative least-squares denoising keeps 3D tracking accurate under point-cloud attacks.","key_machinery":"The load-bearing object is the least-squares graph scheme adapted from least-squares meshes: a fully connected undirected graph whose nodes are the perturbed 3D bounding boxes of two (or more) agents, with a Laplacian matrix that encodes adjacency and differential coordinates that capture each node's deviation from the centroid of its neighbours. Anchoring is supplied by two vectors built from the complementary detection of the other agent plus track velocities, so the system solves two least-squares problems per spatial attribute, producing denoised centroid sets J_ij and J_ji. These refined detections are then matched to tracks through two successive Hungarian-association stages using 3D IoU, with a linear Kalman filter updating track states and a lifetime module confirming or deleting tracks. The role of the machinery is to turn redundant multi-agent observations into a geometric constraint that pulls perturbed centroids back toward a consensus position.","core_discovery":"On its own terms, the paper claims that a least-squares graph formulation over fused multi-vehicle detections removes the centroid displacement caused by adversarial LiDAR perturbations, and that the resulting smoothed detections, when fed into a two-stage tracking-association pipeline, yield 3D multi-object tracking that is more accurate than existing SAMOT and MAMOT pipelines under attack. The analytical solution of the extended Laplacian system provides two refined detection sets, one anchored to each cooperating vehicle, and the two-stage association recovers objects that were missed or falsely detected by the attacked detector. Evaluated on V2V4Real, the claimed improvement reaches 23.3% in AMOTA over the best baseline under 25 cm noise applied to both vehicles, with gains also in tracking precision and mostly-tracked ratio. The paper presents ARLOT as a cost-efficient mitigation that requires no training, no learned parameters, and no additional defense mechanisms.","pith_inferences":["The same anchor-based least-squares denoising could be applied to any system with overlapping observations, such as multi-sensor fusion within a single vehicle, not only multi-vehicle cooperation.","A natural strengthening would be to weight the anchor vectors by detection confidence, which the paper does not explore but which could reduce bias when one agent's detection is heavily corrupted.","A testable extension is to measure performance under correlated adversarial perturbations across agents; the paper's current attack model perturbs agents' point clouds independently, so a coordinated shift could reveal the anchor assumption's boundary.","The method's training-free nature makes it a lightweight complement to learned defenses, and it could be combined with adversarial training to stack robustness gains."],"forward_implications":["ARLOT improves AMOTA by up to 23.3% over state-of-the-art MAMOT baselines and by up to 404.77% over SAMOT under adversarial noise, without any added defense mechanism.","Because the method requires no training or learned parameters, it can be dropped into existing tracking-by-detection pipelines for connected vehicles without modifying the detector.","The two-stage association with Kalman filtering suppresses both false positives and missed detections caused by the attack, as shown by gains in MT ratio and AMOTP.","The least-squares denoising also improves AMOTP under benign conditions by 11.13% over MAMOT baselines, indicating the graph smoothing helps even without adversarial noise.","The framework is presented as scalable to more than two agents, since the graph formulation and association stages extend naturally to additional vehicles."],"supporting_citations":[{"why":"Supplies the least-squares meshes formulation, the source of the graph Laplacian and differential-coordinate machinery used for denoising.","marker":"[17]"},{"why":"Provides the real-world V2V4Real dataset used for all experiments and evaluations.","marker":"[18]"},{"why":"Defines the AB3DMOT baseline, the evaluation metrics (sAMOTA, AMOTA, AMOTP, MT), and the track-lifetime management module that ARLOT adopts.","marker":"[19]"},{"why":"Defines the DMSTrack MAMOT baseline that ARLOT compares against and improves upon in the adversarial scenarios.","marker":"[21]"},{"why":"Defines the untargeted point-wise perturbation attack used to generate adversarial point clouds and the rotation-based defense used as a baseline.","marker":"[5]"},{"why":"Provides the SECOND 3D object detector used by all methods to produce detections from the point clouds.","marker":"[22]"}],"fun_headline_variants":["Least-squares graphs cut adversarial tracking error by 23.3%","Graph denoising boosts multi-agent 3D tracking by 23.3%","Multi-vehicle graph smoothing defeats LiDAR noise by 23.3%","No retraining: graph-based fusion lifts tracking accuracy 23.3%","Cooperative least-squares tracking bests adversarial attacks by 23.3%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The anchor points used to stabilise the least-squares solution come from the other agent's detections and track velocities, so if an attack shifts the detections of both agents in the same direction on the same object, the smoothed centroid will be biased and will not return to the true location.","fun_headline_variants_meta":{"raw":{"variants":["Least-squares graphs cut adversarial tracking error by 23.3%","Graph denoising boosts multi-agent 3D tracking by 23.3%","Multi-vehicle graph smoothing defeats LiDAR noise by 23.3%","No retraining: graph-based fusion lifts tracking accuracy 23.3%","Cooperative least-squares tracking bests adversarial attacks by 23.3%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000551,"raw_usage":{"total_tokens":2630,"prompt_tokens":945,"completion_tokens":1685,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":1582}},"tokens_in":561,"tokens_out":1685,"duration_ms":12652,"temperature":1.0,"reasoning_tokens":1582,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T19:39:44.433511+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A targeted adversarial attack that shifts overlapping detections at both agents along a common direction (rather than independently) would break the anchor assumption; if ARLOT's AMOTA under such a correlated attack falls to or below the single-agent baseline's, the claim that cooperation alone provides resilience is falsified. More simply, a sensitivity study that corrupts the anchor vectors and measures the resulting centroid error would show the method's tolerance boundary.","supporting_citations":[{"cited_title":"Least-squares meshes,","cited_arxiv_id":null,"evidence_quote":"Supplies the least-squares meshes formulation, the source of the graph Laplacian and differential-coordinate machinery used for denoising."},{"cited_title":"V2v4real: A real-world large-scale dataset for vehicle- to-vehicle cooperative perception,","cited_arxiv_id":null,"evidence_quote":"Provides the real-world V2V4Real dataset used for all experiments and evaluations."},{"cited_title":"3d multi-object tracking: A baseline and new evaluation metrics,","cited_arxiv_id":null,"evidence_quote":"Defines the AB3DMOT baseline, the evaluation metrics (sAMOTA, AMOTA, AMOTP, MT), and the track-lifetime management module that ARLOT adopts."},{"cited_title":"Probabilistic 3d multi-object cooperative tracking for autonomous driving via differentiable multi-sensor kalman filter,","cited_arxiv_id":null,"evidence_quote":"Defines the DMSTrack MAMOT baseline that ARLOT compares against and improves upon in the adversarial scenarios."},{"cited_title":"A comprehensive study of the robustness for lidar- based 3d object detectors against adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Defines the untargeted point-wise perturbation attack used to generate adversarial point clouds and the rotation-based defense used as a baseline."},{"cited_title":"Second: Sparsely embedded convolutional detection,","cited_arxiv_id":null,"evidence_quote":"Provides the SECOND 3D object detector used by all methods to produce detections from the point clouds."}],"review_version":1}