{"id":"96cbd6c1-055b-4c17-9901-a095a7a4654f","arxiv_id":"2608.06674","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Optimizing a bounded l-infinity perturbation against encoder attention collapses DETR and DINO object detection to near-zero mAP, outperforming prior attacks.","lead":"This paper introduces an adversarial attack that directly corrupts the encoder attention of detection transformers, using a small imperceptible image perturbation to drop DETR-R50's COCO mAP from 42.1 to 0.97 and DINO-Swin-L's from 56.8 to 1.44. It argues that targeting attention structure, rather than the detection output, is a stronger and more general attack surface for transformer-based detectors.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed 4x SOTA and 'first direct attention attack' both hinge on an unverified characterization of AFOG's objective; the paper never quotes AFOG's loss, and all baseline numbers are taken from [7] without re-running.","rationale":"The reader's weakest assumption already identifies the same two load-bearing points: the AFOG baseline numbers are quoted without re-running, and AFOG's objective is characterized as detection-only without direct evidence. I agree with that read. The paper's internal evidence—layer-wise ablation, four corruption targets, transfer results, and the consistent margin over random perturbations—supports the claim that the proposed attack is effective in its own evaluation. However, the headline comparison against the prior state of the art depends entirely on external numbers and on a characterization of AFOG that the paper does not substantiate. No internal inconsistency or mathematical flaw is apparent in the attention-corruption formulation; the vulnerability story is plausible. The missing piece is reproducibility of the baseline and verification of AFOG's loss, which is exactly what a conditional verdict should demand. I would keep the reader's CONDITIONAL verdict unchanged, with the condition being that the baseline numbers and AFOG's objective are verified before the SOTA and firstness claims are taken as established.","tokens_in":11875,"tokens_out":5276,"duration_ms":50938,"concrete_test":"Obtain AFOG's official implementation and inspect the exact loss; then run both attacks on the same released DETR-R50 and DINO-Swin-L checkpoints with identical COCO evaluation, reporting per-image mAP and variance. If AFOG's loss contains an encoder-attention term, re-benchmark the comparison controlling for objective; if AFOG's numbers are not reproduced, recompute the claimed ratios. This single check settles both the reproducibility and the novelty conditions.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is numerical: under identical budget and iteration count, the proposed attack reaches 0.97/1.44 mAP versus AFOG's 4.1/7.3. For that claim to be true, two conditions must hold. First, AFOG's quoted numbers must be reproducible under the same checkpoint and evaluation pipeline. The paper states 'Baseline numbers as reported in [7]' and never re-runs AFOG, so the comparison inherits any mismatch in model versions, post-processing, or COCO evaluation. Second, AFOG must not itself directly optimize an encoder-attention objective. The paper asserts this without quoting AFOG's loss function; AFOG's title ('Adversarial attention perturbations') and its reported observation that encoder self-attention collapses make it plausible that an attention term is already present. If AFOG already optimizes attention, the 'first attack' novelty and the claimed 4x reduction are not comparisons of the same attack surface. This is not an accusation of misconduct; it is an unverified load-bearing assumption that the paper should settle before the SOTA claim is accepted.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an evasion attack on detection transformers that directly optimizes an encoder-attention objective under an ℓ∞-bounded perturbation. The attacker selects object tokens from a clean forward pass, defines one of four corruption operators on their pre-softmax attention logits (dispersion, re-ranking, permutation, peak-suppression), and runs PGD to drive the logits toward the corrupted target. The paper reports that the attack reduces DETR-R50 mAP on COCO val2017 from 42.1 to 0.97 and DINO-Swin-L from 56.8 to 1.44, claiming roughly a 4× improvement over AFOG under an identical budget and iteration count. Additional experiments cover eight detection transformers, four corruption targets, layer-wise targeting, pre- versus post-softmax optimization, transferability, and budget/iteration sweeps.","tokens_in":12174,"tokens_out":4008,"duration_ms":41163,"significance":"If the main numerical claims hold, the paper identifies a genuinely new and practically relevant attack surface: the encoder attention of transformer detectors can be driven to a corrupted target with a small, imperceptible perturbation, and this generalizes from dense self-attention to deformable attention. The paper's design has several strengths: the corruption operators are clearly specified; the random-perturbation control in Table III shows that the effect is not due to noise alone; the pre- versus post-softmax comparison in Table VI is a useful ablation; and the layer-wise and transfer experiments help characterize the mechanism. However, the central state-of-the-art claim depends on baseline numbers quoted from a single prior paper without re-running, and one of the paper's own tables contradicts the claimed generality. These issues are load-bearing for the headline claims and need to be resolved before the results can be accepted.","major_comments":[{"comment":"The central claim of a ~4× improvement over AFOG rests entirely on baseline numbers taken from [7] without re-running AFOG under the same checkpoints, post-processing, and COCO evaluation pipeline. Because the paper states 'Baseline numbers as reported in [7]' and provides no seed-level variance or error bars, the comparison may inherit any mismatch in model versions or evaluation protocol. Please re-run AFOG with the same evaluation pipeline and report mean and standard deviation over multiple random starts for both AFOG and the proposed attack; without this, the 0.97 versus 4.1 comparison is not established.","section":"Section IV-B, Table I"},{"comment":"The paper's novelty claim ('first attack that directly optimizes an encoder-attention objective') and the comparison against AFOG both depend on the assertion that AFOG optimizes a detection-loss objective and corrupts attention only incidentally. However, the manuscript never quotes AFOG's loss function, and AFOG's title ('Adversarial attention perturbations for large object detection transformers') makes the characterization non-obvious. Please quote AFOG's objective explicitly and demonstrate that it contains no encoder-attention term; otherwise the 'identical attack surface' premise of the comparison, and the claim of being first, are not verifiable.","section":"Sections II-B and IV-B"},{"comment":"The text states that 'Our attack achieves State-of-the-art over seven models with significant margins,' but Table II shows that on ConvNeXt the proposed attack reaches 3.98 mAP while AFOG reaches 3.9 mAP, so the attack does not beat AFOG on that model. The row count is also inconsistent with the claimed 'seven models.' This contradiction directly undermines the generalization claim and must be corrected by either fixing the numbers or revising the claim to reflect the actual matrix.","section":"Section IV-C, Table II"},{"comment":"The headline DETR result uses dispersion and the headline DINO result uses re-ranking as the corruption target, and the target choice appears to be made per model after evaluating all options. Since Table III shows that the ranking of targets differs between DETR and DINO, the per-model selection is a mild form of selection bias that should be disclosed in the main comparison. Please either fix a single target a priori for both models or report the headline result for all four targets side by side in Table I.","section":"Section IV-B, Tables I and III"}],"minor_comments":[{"comment":"The sentence beginning 'More recently, and Nazeri et al. [6] propose...' contains a grammatical error ('More recently, and Nazeri et al.') and should be rewritten.","section":"Section II-A"},{"comment":"The text says the attack is 'blind to the detector's output during optimization,' but the target token set O is derived from a clean forward pass with a confidence threshold. This is not blindness to the detector's output; it is merely the absence of a detection loss. Please reword to avoid an inaccurate characterization.","section":"Section III-A, Eq. (3)"},{"comment":"The column header 'AFOGOurs' is missing a space, and the table would benefit from a note clarifying that dispersion is the fixed corruption target for all rows.","section":"Table II"},{"comment":"The phrase 'a ~4× reduction in resulting mAP' is ambiguous; the intended meaning is that the resulting mAP is about four times lower than AFOG's, not that the drop is multiplied by four. Please rephrase for clarity.","section":"Abstract and Section I"},{"comment":"The figure caption states that each axis is swept with the other at its default, but the axes are not labeled with units or the default values in the caption. Please add these details.","section":"Section IV-E-4, Figure 5"}],"recommendation":"major_revision","confidential_remarks":"The main uncertainty is whether AFOG's objective has been characterized accurately. If AFOG already contains an encoder-attention term, the paper's novelty and the 'identical attack surface' comparison would both be compromised. I would recommend that the editor require the authors to quote AFOG's loss and, if possible, obtain confirmation from the AFOG authors or an independent re-run."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I'd send this to a serious referee, but the SOTA claim should be treated as conditional until the comparison is audited.\n\nWhat's new: the attack optimizes an l-infinity bounded input perturbation against the encoder's pre-softmax attention logits, not against detection loss. No patch, no sink token. Four corruption targets (dispersion, re-ranking, permutation, peak-suppression) are defined and tested, and the attack carries over to deformable attention in DINO. That is a real extension, not a rename of AFOG. The numbers are strong if they hold: DETR-R50 from 42.1 to 0.97 mAP versus AFOG's 4.1 under the same reported budget and iterations; DINO-Swin-L from 56.8 to 1.44 versus 7.3. The ablation set is solid: layer-wise targeting, pre- vs post-softmax loss, budget/iteration sweeps, a random perturbation control, and four targets all collapsing detection. The random control at 39.9 mAP is particularly useful, showing the effect comes from the structured objective rather than the noise alone.\n\nWhere it is soft, in proportion:\n\n- The comparison to AFOG rests entirely on numbers quoted from [7]. Table I says so explicitly. If AFOG cannot be reproduced at 4.1/7.3 under the same checkpoints and evaluation pipeline, the 4x claim is not established. This is the load-bearing issue.\n- The novelty claim also depends on AFOG not directly optimizing an attention objective. The paper asserts AFOG's attention collapse is a byproduct, but never quotes AFOG's loss. Given AFOG's title, the authors need to settle that by direct comparison rather than assertion.\n- No error bars or seeds are reported, and the corruption target per model is chosen after seeing evaluation results. The four-target robustness partially covers this, but variance would help.\n- Minor: in Table II, ConvNeXt is the one model where AFOG (3.9) edges out ours (3.98). The text correctly says seven of eight models, but the abstract's 'state-of-the-art on both' should be read as DETR/DINO, not as every backbone.\n\nThe method itself is coherent, the writing is clear, and the citation pattern looks reasonable. I do not see a load-bearing flaw in the attack construction. The flaw is in the evidence for the comparative claims.\n\nRecommendation: peer review, with a requirement that the authors re-run AFOG or justify the quoted numbers, disclose variance, and quote AFOG's loss when claiming priority. If those checks land, this is a useful paper for anyone working on adversarial robustness of transformer detectors.","headline":"A genuinely new attention-targeting attack with strong results, but the headline SOTA claim depends on an unverified reading of AFOG and re-running of baselines.","tokens_in":12699,"tokens_out":4038,"would_cite":true,"duration_ms":38573,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Corrupting the encoder attention map drops DETR mAP from 42.1 to 0.97 under a tiny bounded perturbation.","keywords":["adversarial attacks","object detection","detection transformers","encoder attention","deformable attention","evasion attack","imperceptible perturbation","DETR"],"falsifier":"Re-run the baseline attack on the same DETR-R50 and DINO-Swin-L checkpoints and COCO evaluation pipeline and check whether it actually produces adversarial mAP of 4.1 and 7.3 under the stated budget and iteration count; if the reproduced baseline is stronger or weaker, the claimed 4x-to-5x improvement is not established. Also inspect the baseline's loss to confirm it does not already directly optimize an encoder-attention objective, which would invalidate the novelty claim.","tokens_in":11719,"feed_emoji":"🎯","tokens_out":8574,"duration_ms":71086,"temperature":0.7,"pith_summary":"This paper sets out to show that the encoder attention of transformer-based object detectors is a direct, imperceptible attack surface. Most existing attacks optimize a detection loss and collapse attention only incidentally, while patch-based attention attacks introduce a visible sink token. The authors instead optimize an $\\ell_\\infty$-bounded input perturbation against the encoder's pre-softmax attention logits, driving the model's own attention toward one of four structured corruption targets. On COCO, this reduces DETR-R50 mAP from 42.1 to 0.97 and DINO-Swin-L from 56.8 to 1.44 under the same budget and iteration count as the strongest prior attack, which reaches 4.1 and 7.3 respectively. Because all four targets collapse detection, the paper argues the vulnerability lies in disrupting the attention structure itself.","feed_headline":"Corrupting attention drops DETR mAP from 42.1 to 0.97","feed_subtitle":"A tiny bounded perturbation to encoder attention outperforms all prior attacks on detection transformers.","key_machinery":"The carrying object is the encoder self-attention logit row $Z^{(m)}_{t:}$ at a chosen encoder layer, restricted to token positions inside predicted boxes. A corruption operator $T$ replaces each clean logit row with a fixed target: dispersion sets all logits equal, re-ranking reverses their order, permutation shuffles key positions, and peak-suppression moves the dominant peak onto the least-attended key. The attack minimizes the MSE between perturbed and target logit rows via projected gradient descent under an $\\ell_\\infty$ budget, optimizing in pre-softmax logit space because post-softmax gradients are attenuated. Because the objective acts on the attention weight distribution rather than the mechanism that produces it, the same operators apply to deformable attention with $S$ replaced by the number of sampled keys $K$.","core_discovery":"The paper claims that an imperceptible perturbation can corrupt a detector's encoder attention directly and thereby collapse detection far more effectively than optimizing the detection output. The attack computes clean attention logit rows at a selected encoder layer for tokens inside predicted boxes, replaces those rows with a corrupted target, and runs projected gradient descent to minimize the mean squared error between perturbed and target logits under an $\\ell_\\infty$ budget. Across four targets that destroy different structural properties of the attention row, detection falls below 3 mAP on DETR-R50 and below 10 mAP on DINO-Swin-L, while a random perturbation of the same budget leaves detection essentially unchanged. The authors conclude that the encoder attention of detection transformers, whether dense or deformable, is a directly exploitable and previously untargeted attack surface.","pith_inferences":["A reader should treat the exact 4x-to-5x margins as provisional because the baseline numbers are quoted from the prior paper rather than re-run on the same checkpoints; re-benchmarking could change the margin even if the core attack remains effective.","If the mechanism is truly attention-structure collapse, then attention-aware regularizers or Lipschitz-bounded attention layers would be a natural defense direction, though the paper does not test defenses.","The same objective, being defined on attention weights rather than the attention mechanism, may extend to other attention-based perception tasks such as instance segmentation or video object detection; that is an extrapolation beyond the paper's experiments."],"forward_implications":["Detection transformers that rely on an encoder attention mechanism inherit this vulnerability, so defenses must protect the attention structure, not just the output loss.","The four-target result implies the failure mode is generic: any structured corruption of the attention distribution collapses detection, so defenses cannot specialize to one corruption type.","Cross-model transfer between DETR and DINO means an attacker can craft perturbations on one attention formulation and degrade another, weakening defenses based on architectural diversity.","The attack's effectiveness at low budgets and iteration counts means an online attacker needs only a few gradient steps to disable a detector."],"supporting_citations":[{"why":"Supplies the baseline attack and the reported adversarial mAP numbers (4.1 on DETR-R50, 7.3 on DINO-Swin-L) that the paper compares against under identical budget and iteration count.","marker":"[7]"},{"why":"Introduces DETR and its global self-attention encoder, the primary victim architecture for the attack.","marker":"[3]"},{"why":"Introduces deformable attention, the mechanism whose generalization to modern detectors the attack demonstrates.","marker":"[4]"},{"why":"Defines DINO and its Swin-L configuration, the second victim model in the transfer and generalization experiments.","marker":"[5]"},{"why":"Provides the projected gradient descent algorithm used to optimize the bounded perturbation.","marker":"[16]"},{"why":"Motivates optimizing pre-softmax logits rather than post-softmax attention maps because gradients are attenuated.","marker":"[9]"},{"why":"Supplies the theoretical motivation that dot-product self-attention is not globally Lipschitz and can be highly sensitive to input perturbations.","marker":"[22]"},{"why":"Defines the MS COCO dataset and evaluation protocol used for all mAP measurements.","marker":"[24]"}],"fun_headline_variants":["Corrupting attention drops DETR mAP to 0.97, best attack yet","Attention attack achieves 4x lower mAP than prior best","Imperceptible attention attack breaks dense and deformable detectors","First direct attack on encoder attention collapses detector mAP"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the previously reported mAP values for the baseline attack are accurate and obtained under the same evaluation pipeline, since the authors compare against those numbers without re-running the baseline.","fun_headline_variants_meta":{"raw":{"variants":["Corrupting attention drops DETR mAP to 0.97, best attack yet","Attention attack achieves 4x lower mAP than prior best","Imperceptible attention attack breaks dense and deformable detectors","First direct attack on encoder attention collapses detector mAP"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000923,"raw_usage":{"total_tokens":3990,"prompt_tokens":1011,"completion_tokens":2979,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":627,"completion_tokens_details":{"reasoning_tokens":2904}},"tokens_in":627,"tokens_out":2979,"duration_ms":22359,"temperature":1.0,"reasoning_tokens":2904,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:42:03.145489+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the baseline attack on the same DETR-R50 and DINO-Swin-L checkpoints and COCO evaluation pipeline and check whether it actually produces adversarial mAP of 4.1 and 7.3 under the stated budget and iteration count; if the reproduced baseline is stronger or weaker, the claimed 4x-to-5x improvement is not established. Also inspect the baseline's loss to confirm it does not already directly optimize an encoder-attention objective, which would invalidate the novelty claim.","supporting_citations":[{"cited_title":"Adversarial attention perturbations for large object detection transformers,","cited_arxiv_id":null,"evidence_quote":"Supplies the baseline attack and the reported adversarial mAP numbers (4.1 on DETR-R50, 7.3 on DINO-Swin-L) that the paper compares against under identical budget and iteration count."},{"cited_title":"Towards deep learning models resistant to adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Provides the projected gradient descent algorithm used to optimize the bounded perturbation."},{"cited_title":"Give me your attention: Dot-product attention considered harmful for adversarial patch robustness,","cited_arxiv_id":null,"evidence_quote":"Motivates optimizing pre-softmax logits rather than post-softmax attention maps because gradients are attenuated."},{"cited_title":"The lipschitz constant of self- attention,","cited_arxiv_id":null,"evidence_quote":"Supplies the theoretical motivation that dot-product self-attention is not globally Lipschitz and can be highly sensitive to input perturbations."}],"review_version":1}