Pith. sign in

REVIEW 4 major objections 5 minor 58 references

AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domain

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read AutoDetect uses an autoencoder's per-slice reconstruction errors to flag BadDet-style poisoned images, and the paper's experiments show it separates clean from poisoned samples across military and general object-detection datasets more reli

desk verdict A simple, honest patch-detection paper with a self-inflicted inconsistency: its own ablation shows detection works only when the slice size equals the patch, contradicting the no-knowledge claim. read the letter →

arxiv 2509.03179 v1 pith:X2F75UNA submitted 2025-09-03 cs.CV cs.AI

Alma M. Liezenga , Stefan Wijnja , Puck de Haan , Niels W. T. Brink , Jip J. van Stijn , Yori Kamphuis , Klamer Schutte This is my paper
classification cs.CVcs.AI
keywords datapoisoningbackdoorattacksobjectdetectionadversarialpatchesautoencoderanomalyreconstructionerrormilitarytargetBadDet
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that patch-based poisoning of military object detectors is a real but currently constrained threat, and that the most practical defense is a simple autoencoder that measures per-slice reconstruction error. It introduces AutoDetect, which flags an image as poisoned when its largest slice error is an outlier relative to a distribution fitted on clean validation slices. Across MS COCO, VOC2007, and a small military-vehicle dataset, AutoDetect separates poisoned from clean images more reliably than industrial anomaly detectors and the PAD patch defense, while using far less compute and memory. The same experiments show that the BadDet GMA attack requires poisoning 20–40% of training data to reach meaningful success rates, and that much of the apparent attack effect may come from mislabeled data rather than the patch itself.

What carries the argument

The slice error: each image is tiled, via a stride-1 sliding window implemented with mean pooling, into equal squares; the autoencoder's mean reconstruction error per slice is the anomaly signal. The maximum slice error of a query image is then scored against a normal distribution of clean-validation slice errors, so patch detection reduces to one univariate outlier test.

What would settle it

Give AutoDetect a fixed slice size and test it against patches of several sizes in a blind protocol where the defender commits to the slice size before seeing any poisoned image. If AUROC stays high for mismatched sizes, the method is patch-size-agnostic; if it falls toward 0.5, the method's usefulness depends on guessing the attacker's patch size, contradicting the stated assumption. The paper's own Table 3 already shows this breakdown for the 10×10 patch with a 25×25 slice.

Watch

Extended reading notes

Core claim

The paper introduces AutoDetect, a data-only defense against patch-based poisoning in object detection. An autoencoder pretrained on generic clean images reconstructs each candidate image; the image is divided into small square slices, the mean reconstruction error of each slice is computed, and the largest slice error is compared with a normal distribution fitted on slice errors from a small clean validation set. A query image whose maximum slice error falls in the upper percentile of that distribution is flagged as poisoned. On the BadDet GMA attack with 25×25 patches at random positions, AutoDetect reports AUROC values of 0.965 on MS COCO, 0.941 on MilCivVeh, and 0.970 on VOC2007, outperf

Load-bearing premise

The detection power sits on the assumption that the defender's slice size roughly matches the attacker's patch size; the paper's own ablation shows performance drops toward chance when the two differ, even though the method is presented as requiring no knowledge of patch size.

Editorial extensions

If this is right

  • A defender can screen a training set for BadDet-style patch poisoning using only the dataset plus a small clean validation set, with no access to the detector that will be trained.
  • Because the autoencoder is pretrained on generic imagery, the method transfers to a new domain without needing a large clean target-domain training set.
  • Industrial anomaly detectors that assume near-identical normal images are not reliable for object-detection datasets with diverse scenes.
  • The BadDet GMA attack on military object detectors requires poisoning 20–40% of training data to achieve meaningful success, and at those rates normal performance degrades enough that the attack is unlikely to go unnoticed.
  • Choosing a slice size close to the expected patch size is necessary for high detection performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The size-matching dependence suggests a multi-scale AutoDetect (several slice sizes with a combined outlier score) as a natural modification that could remove the need to guess patch size.
  • The poor performance of memory-bank anomaly detectors on MS COCO points to scene diversity rather than patch type as the limiting factor; this implies AutoDetect's implicit-manifold approach may carry over to other patch-based backdoor attacks, not just BadDet's GMA.
  • The paper evaluates detection only, not the full defense loop; a direct extension would be to remove flagged images, retrain the detector, and measure whether attack success drops.
  • Since the real military vector is likely a physical printed patch rather than digital blending, testing AutoDetect against photographs of physically applied patches would show whether the digital-blending results transfer.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies BadDet-style patch-based poisoning attacks on object detection in a military setting, introduces a small custom dataset (MilCivVeh), evaluates attack feasibility on YOLOv3/YOLOv10, and proposes AutoDetect, an unsupervised autoencoder-based method that flags poisoned images by thresholding the maximum reconstruction error over image slices. On a 50%-poisoned test scenario with 25x25 patches, AutoDetect reports AUROCs of 0.965 (MS COCO), 0.941 (MilCivVeh), and 0.970 (VOC2007), and the paper claims it outperforms or matches existing patch/anomaly detection methods while being lighter. Ablations vary patch type, patch size, and slice size.

Significance. If the central claim were robust, AutoDetect would be a valuable lightweight, model-agnostic defense in an understudied area: patch-based poisoning of object detectors, with a military use case. The paper provides a concrete threat evaluation on a new dataset and is honest about limitations, including the need for a clean validation set and the limited size/representativeness of MilCivVeh. Its methodological simplicity and use of an out-of-domain pretrained autoencoder are genuine strengths. However, the slice-size matching issue and uneven baselines mean the headline performance claim is not yet established.

major comments (4)
  1. [§3.1, §3.3.1, §5.2, Tables 1 and 3] The threat model states 'no knowledge of the appearance, size or location' of the patch, but the default slice size is fixed at 25x25 and Table 2 evaluates only 25x25 patches. Table 3 shows that with slice 25, AUROC for 10x10 and 15x15 patches is 0.503 and 0.527, essentially random. These small sizes are not irrelevant: Table 1 reports the highest ASR at r=30% for YOLOv10 with a 10x10 patch (39.4%) and for YOLOv3 with a 15x15 patch (28.9%). Section 5.1's suggestion that such patches may not 'impact performance ... enough to be relevant' is contradicted by the paper's own attack results. The headline AUROCs are therefore achieved with a slice size matched to the attack, not under the stated assumption of no patch-size knowledge.
  2. [§3.5.2, Table 2] The comparison against existing methods is not apples-to-apples. PatchCore is run on only 5% of COCO/VOC training data, PaDiM on 10%, PAD on 10% (COCO) and 25% (VOC), and the TRACE numbers are imported from [28] using different detectors (YOLO variant, DETR, Faster-RCNN) and possibly different patch/poisoning configurations. These subsampled baselines are likely to underperform their full-data versions, so the claim that AutoDetect 'outperforms' them is not supported. The baselines should be run under identical data, patch, and model settings, or the claim should be qualified accordingly.
  3. [§4.2, Table 2] All AUROC values are reported as point estimates with no error bars, confidence intervals, or number of runs. AutoDetect involves stochastic autoencoder training and random patch placement; the difference to TRACE on COCO (0.965 vs 0.924) could be within run-to-run variability. Reporting multiple seeds or bootstrap intervals is necessary to support the performance claim.
  4. [§3.3.1] The method's core component, the autoencoder, is not specified: no architecture, layer sizes, latent dimension, input resolution, or reconstruction loss are given beyond optimizer, learning rate, batch size, and epoch count. This prevents reproduction and makes the 'lightweight' claim unverifiable. Please provide the architecture or a reference/implementation link.
minor comments (5)
  1. [§2.1] 'on-to-one' should be 'one-to-one'.
  2. [§3.3] Typo: 'adverarial patch detection' should be 'adversarial patch detection'.
  3. [§3.4] Formatting: 'MilCivV eh' should be 'MilCivVeh'.
  4. [§3.5.1] Grammar: 'we used two version of the MilCivVeh test set' should be 'two versions'.
  5. [Figures 4 and 5] The dense line plots are hard to read; adding distinct markers per dataset and error bars would improve interpretability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: AutoDetect is an empirical method evaluated on held-out data; the slice-size/patch-size matching is a tuning limitation, not a circular derivation.

full rationale

The paper makes no formal derivation that reduces to its inputs. AutoDetect is an autoencoder-based anomaly detector; its output scores are measured AUROC on held-out test images (Table 2), with baselines from external methods. The main load-bearing claim—that slice-level reconstruction errors separate clean from poisoned samples—is tested empirically, not derived from the assumption that patches are detectable. The only concern is hyperparameter alignment: Section 3.3.1 sets the baseline slice size to 25x25 and Section 3.2 sets the baseline attack patch to 25x25, and Section 5.2/Table 3 shows performance peaks when slice size equals patch size. This is a tuning/fairness limitation for the claim that no patch-size knowledge is needed, not a circularity: the slice size is not fitted to the test labels, and the paper openly reports the collapse for mismatched sizes and acknowledges that users may need to choose slice size by expected patch size (Section 5.2). No self-citation is load-bearing; citations to the authors' own prior work are contextual (dataset, overviews).

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The central claim rests on several domain assumptions: that patches are detectable by reconstruction error, that a clean validation set is available, that physical patches behave like digital ones, and that the autoencoder generalizes. The free parameters are mostly evaluation and hyperparameter choices, with slice size being the most concerning because it is tuned to the attack patch size.

free parameters (5)
  • Slice size = 25x25 baseline
    Ablation in Section 5.2 shows AUROC peaks when slice size equals patch size; the main evaluation uses 25x25 for a 25x25 patch, tuning the method to the attack.
  • Detection threshold t = suggested >=0.95
    Manually set by the user. AUROC is threshold-independent, so the reported scores reflect an oracle threshold rather than a practical operating point.
  • Blend factor alpha = 0.8
    Chosen for stealth in the attack implementation; affects how visible the patch is and thus how detectable it is.
  • Poisoning rate r for detection evaluation = 0.5
    Detection experiments use a 50% poisoned evaluation set, which is unrealistically high and makes detection easier than at typical poisoning rates.
  • Autoencoder architecture = unspecified
    The architecture is not described in the paper, leaving a significant free choice that affects performance.
assumptions (6)
  • domain assumption Adversarial patches are statistical outliers in real-world images and produce higher autoencoder reconstruction error.
    Core premise of AutoDetect (Section 3.3). Tested only on a few patch types; the banana patch is notably harder to detect.
  • domain assumption The defender has access to a clean validation set from the target domain to fit the slice-error distribution.
    Acknowledged in the limitations (Section 6.1); only 99 images are used for MilCivVeh, but this still requires a trusted clean subset.
  • domain assumption Digitally blended patches behave similarly to physically applied patches in the real world.
    Stated in Section 6.1 as an open question; the entire military scenario depends on this being true.
  • domain assumption Maximum slice error is a sufficient statistic for detecting adversarial patches.
    AutoDetect uses qmax; ablation studies show it fails for small patches or when slice and patch sizes are mismatched.
  • domain assumption BadDet GMA is the representative poisoning attack for military object detection.
    The paper evaluates only this attack and does not test other patch or non-patch poisoning methods.
  • domain assumption An autoencoder pretrained on MS COCO generalizes to other object detection domains.
    Empirically shown on VOC2007 and MilCivVeh, but not guaranteed and results are lower on the out-of-domain military set.

how reviews work

0 comments
Cite this review

Pith. "Pith review of AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domain." pith.science (2026). https://pith.science/paper/X2F75UNA

@misc{pith2026250903179,
  author       = {Pith},
  title        = {Pith review of: AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domain},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X2F75UNA}},
  note         = {Machine review of arXiv:2509.03179}
}
read the original abstract

Poisoning attacks pose an increasing threat to the security and robustness of Artificial Intelligence systems in the military domain. The widespread use of open-source datasets and pretrained models exacerbates this risk. Despite the severity of this threat, there is limited research on the application and detection of poisoning attacks on object detection systems. This is especially problematic in the military domain, where attacks can have grave consequences. In this work, we both investigate the effect of poisoning attacks on military object detectors in practice, and the best approach to detect these attacks. To support this research, we create a small, custom dataset featuring military vehicles: MilCivVeh. We explore the vulnerability of military object detectors for poisoning attacks by implementing a modified version of the BadDet attack: a patch-based poisoning attack. We then assess its impact, finding that while a positive attack success rate is achievable, it requires a substantial portion of the data to be poisoned -- raising questions about its practical applicability. To address the detection challenge, we test both specialized poisoning detection methods and anomaly detection methods from the visual industrial inspection domain. Since our research shows that both classes of methods are lacking, we introduce our own patch detection method: AutoDetect, a simple, fast, and lightweight autoencoder-based method. Our method shows promising results in separating clean from poisoned samples using the reconstruction error of image slices, outperforming existing methods, while being less time- and memory-intensive. We urge that the availability of large, representative datasets in the military domain is a prerequisite to further evaluate risks of poisoning attacks and opportunities patch detection.

Figures

Figures reproduced from arXiv: 2509.03179 by the authors.

Figure 1
Figure 1. All adversarial patches used in the experiments. The left-most patch has been used as main patch, the [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. A graph showing the reference distribution of [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. One example image for each of the used datasets, resized to a 320x320 format, with a 25x25 adversarial [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Performance measured by AUROC of AutoDetect across three datasets, three patches and varied patch [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]
Figure 5
Figure 5. Figure 5: Results (AUROC) of AutoDetect across varying slice and patch sizes, for MS COCO with patch HTBD, [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

58 extracted references · 54 canonical work pages

  1. [28]

    Test-time backdoor detection for object detection models,

    Zhang, H., Wang, Y., Yan, S., Zhu, C., Zhou, Z., Hou, L., Hu, S., Li, M., Zhang, Y., and Zhang, L. Y., “Test-time backdoor detection for object detection models,” in [ Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) ], 24377–24386 (June 2025)

    work page 2025

  2. [1]

    Yolo-g: A lightweight network model for improving the performance of military targets detection,

    Kong, L., Wang, J., and Zhao, P., “Yolo-g: A lightweight network model for improving the performance of military targets detection,” IEEE Access 10, 55546–55564 (2022)

    work page 2022

  3. [2]

    Deep learning for automatic target recognition with real and synthetic infrared maritime imagery,

    Westlake, S. T., Volonakis, T. N., Jackman, J., James, D. B., and Sherriff, A., “Deep learning for automatic target recognition with real and synthetic infrared maritime imagery,” in [Artificial intelligence and machine learning in defense applications II ], 11543, 41–53, SPIE (2020)

    work page 2020

  4. [3]

    Improving object detector training on synthetic data by starting with a strong baseline methodology,

    Ruis, F. A., Liezenga, A. M., Heslinga, F. G., Ballan, L., Eker, T. A., den Hollander, R. J., van Leeuwen, M. C., Dijk, J., and Huizinga, W., “Improving object detector training on synthetic data by starting with a strong baseline methodology,” in [ Synthetic Data for Artificial Intelligence and Machine Learning: Tools, Techniques, and Applications II ], ...

    work page 2024

  5. [4]

    Transforming the multidomain battlefield with ai,

    Gallagher, M. J. and Oughton, D. E. J., “Transforming the multidomain battlefield with ai,” (September 20424)

    work page

  6. [5]

    A system-driven taxonomy of attacks and defenses in adversarial machine learning,

    Sadeghi, K., Banerjee, A., and Gupta, S. K. S., “A system-driven taxonomy of attacks and defenses in adversarial machine learning,” IEEE Transactions on Emerging Topics in Computational Intelligence 4(4), 450–467 (2020)

    work page 2020

  7. [6]

    Adversarial machine learning: A taxonomy and ter- minology of attacks and mitigations,

    Vassilev, A., Oprea, A., Fordyce, A., and Anderson, H., “Adversarial machine learning: A taxonomy and ter- minology of attacks and mitigations,” tech. rep., NIST Trustworthy and Responsible AI, National Institute of Standards and Technology (2024)

    work page 2024

  8. [7]

    Adversarial ai in the cyber domain,

    Brink, N., Kamphuis, Y., Maas, Y., Jansen-Ferdinandus, G., van Stijn, J., Poppink, B., de Haan, P., and Chiscop, I., “Adversarial ai in the cyber domain,” (2023)

    work page 2023

Show all 58 references
  1. [8]

    Baddet: Backdoor attacks on object detection,

    Chan, S.-H., Dong, Y., Zhu, J., Zhang, X., and Zhou, J., “Baddet: Backdoor attacks on object detection,” in [European conference on computer vision ], 396–412, Springer (2022)

    2022

  2. [9]

    Reflection backdoor: A natural backdoor attack on deep neural networks,

    Liu, Y., Ma, X., Bailey, J., and Lu, F., “Reflection backdoor: A natural backdoor attack on deep neural networks,” in [European Conference on Computer Vision ], 182–199, Springer (2020)

    2020

  3. [10]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Zeng, Y., Pan, M., Just, H. A., Lyu, L., Qiu, M., and Jia, R., “Narcissus: A practical clean-label backdoor attack with limited information,” in [ Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security ], CCS ’23 , 771–785 (2023)

    2023

  4. [11]

    Defending against adversarial ai attacks: an overview,

    Brink, N., van Stijn, J., Stachyra, P., Spinnler, O., and Kamphuis, Y., “Defending against adversarial ai attacks: an overview,” (2024)

    2024

  5. [12]

    Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,

    Zhu, M., Wei, S., Zha, H., and Wu, B., “Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features,” Advances in Neural Information Processing Systems 36, 1132–1153 (2023)

    2023

  6. [13]

    Towards a proactive {ML} approach for detecting backdoor poison samples,

    Qi, X., Xie, T., Wang, J. T., Wu, T., Mahloujifar, S., and Mittal, P., “Towards a proactive {ML} approach for detecting backdoor poison samples,” in [ 32nd USENIX Security Symposium (USENIX Security 23) ], 1685–1702 (2023)

    2023

  7. [14]

    Pad: Patch-agnostic defense against adversarial patch attacks,

    Jing, L., Wang, R., Ren, W., Dong, X., and Zou, C., “Pad: Patch-agnostic defense against adversarial patch attacks,” in [Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) ], 24472–24481 (June 2024)

    2024

  8. [15]

    Efficientad: Accurate visual anomaly detection at millisecond- level latencies,

    Batzner, K., Heckler, L., and K¨ onig, R., “Efficientad: Accurate visual anomaly detection at millisecond- level latencies,” in [ Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)], 128–138 (January 2024)

    2024

  9. [16]

    The mvtec ad 2 dataset: Ad- vanced scenarios for unsupervised anomaly detection,

    Heckler-Kram, L., Neudeck, J.-H., Scheler, U., K¨ onig, R., and Steger, C., “The mvtec ad 2 dataset: Ad- vanced scenarios for unsupervised anomaly detection,” arXiv preprint arXiv:2503.21622 (2025)

    2025

  10. [17]

    Towards total recall in in- dustrial anomaly detection,

    Roth, K., Pemula, L., Zepeda, J., Sch¨ olkopf, B., Brox, T., and Gehler, P., “Towards total recall in in- dustrial anomaly detection,” in [ Proceedings of the IEEE/CVF conference on computer vision and pattern recognition], 14318–14328 (2022)

    2022

  11. [18]

    Threats to training: A survey of poisoning attacks and defenses on machine learning systems,

    Wang, Z., Ma, J., Wang, X., Hu, J., Qin, Z., and Ren, K., “Threats to training: A survey of poisoning attacks and defenses on machine learning systems,” ACM Computing Surveys 55(7), 1–36 (2022)

    2022

  12. [19]

    Bullseye polytope: A scalable clean- label poisoning attack with improved transferability,

    Aghakhani, H., Meng, D., Wang, Y.-X., Kruegel, C., and Vigna, G., “Bullseye polytope: A scalable clean- label poisoning attack with improved transferability,” in [ 2021 IEEE European Symposium on Security and Privacy (EuroS&P) ], 159–178 (2021)

    2021

  13. [20]

    Color backdoor: A robust poisoning attack in color space,

    Jiang, W., Li, H., Xu, G., and Zhang, T., “Color backdoor: A robust poisoning attack in color space,” in [Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) ], 8133– 8142 (June 2023)

    2023

  14. [21]

    Clean-image backdoor: Attacking multi-label models with poisoned labels only,

    Chen, K., Lou, X., Xu, G., Li, J., and Zhang, T., “Clean-image backdoor: Attacking multi-label models with poisoned labels only,” in [The Eleventh International Conference on Learning Representations], (2023)

    2023

  15. [22]

    A dilution-based defense method against poisoning attacks on deep learning systems,

    Park, H. and Cho, Y., “A dilution-based defense method against poisoning attacks on deep learning systems,” International Journal of Electrical and Computer Engineering (IJECE) 14(1), 645–652 (2024)

    2024

  16. [23]

    Mvtec ad–a comprehensive real-world dataset for unsupervised anomaly detection,

    Bergmann, P., Fauser, M., Sattlegger, D., and Steger, C., “Mvtec ad–a comprehensive real-world dataset for unsupervised anomaly detection,” in [ Proceedings of the IEEE/CVF conference on computer vision and pattern recognition], 9592–9600 (2019)

    2019

  17. [24]

    Towards stable backdoor purification through feature shift tuning,

    Min, R., Qin, Z., Shen, L., and Cheng, M., “Towards stable backdoor purification through feature shift tuning,” Advances in Neural Information Processing Systems 36, 75286–75306 (2023)

    2023

  18. [25]

    Black-box backdoor defense via zero-shot image purification,

    Shi, Y., Du, M., Wu, X., Guan, Z., Sun, J., and Liu, N., “Black-box backdoor defense via zero-shot image purification,” Advances in Neural Information Processing Systems 36, 57336–57366 (2023)

    2023

  19. [26]

    Napguard: Towards detecting naturalistic adversarial patches,

    Wu, S., Wang, J., Zhao, J., Wang, Y., and Liu, X., “Napguard: Towards detecting naturalistic adversarial patches,” in [ Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition ], 24367–24376 (2024)

    2024

  20. [27]

    Detectorguard: Provably securing object detectors against localized patch hiding attacks,

    Xiang, C. and Mittal, P., “Detectorguard: Provably securing object detectors against localized patch hiding attacks,” in [Proceedings of the 2021 ACM SIGSAC conference on computer and communications security ], 3177–3196 (2021)

    2021

  21. [29]

    Local gradients smoothing: Defense against localized adversarial attacks,

    Naseer, M., Khan, S., and Porikli, F., “Local gradients smoothing: Defense against localized adversarial attacks,” in [ 2019 IEEE Winter Conference on Applications of Computer Vision (WACV) ], 1300–1307, IEEE (2019)

    2019

  22. [30]

    Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection,

    Liu, J., Levine, A., Lau, C. P., Chellappa, R., and Feizi, S., “Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection,” in [ Proceedings of the IEEE/CVF conference on computer vision and pattern recognition ], 14973–14982 (2022)

    2022

  23. [31]

    Jedi: Entropy-based localization and removal of adversarial patches,

    Tarchoun, B., Ben Khalifa, A., Mahjoub, M. A., Abu-Ghazaleh, N., and Alouani, I., “Jedi: Entropy-based localization and removal of adversarial patches,” in [ Proceedings of the IEEE/CVF conference on computer vision and pattern recognition ], 4087–4095 (2023)

    2023

  24. [32]

    A unified, resilient, and explainable adversarial patch detector,

    Kumar, V. and Agarwal, A., “A unified, resilient, and explainable adversarial patch detector,” in [Proceedings of the Computer Vision and Pattern Recognition Conference ], 30387–30397 (2025)

    2025

  25. [33]

    Natural synthetic anomalies for self-supervised anomaly detection and localization,

    Schl¨ uter, H. M., Tan, J., Hou, B., and Kainz, B., “Natural synthetic anomalies for self-supervised anomaly detection and localization,” in [ European Conference on Computer Vision ], 474–489, Springer (2022)

    2022

  26. [34]

    PaDiM: A Patch Distribution Modeling Framework for Anomaly Detection and Localization,

    Defard, T., Setkov, A., Loesch, A., and Audigier, R., “PaDiM: A Patch Distribution Modeling Framework for Anomaly Detection and Localization,” in [ Pattern Recognition. ICPR International Workshops and Challenges ], Del Bimbo, A., Cucchiara, R., Sclaroff, S., Farinella, G. M.,...

    2021

  27. [35]

    Cutpaste: Self-supervised learning for anomaly detection and localization,

    Li, C.-L., Sohn, K., Yoon, J., and Pfister, T., “Cutpaste: Self-supervised learning for anomaly detection and localization,” in [Proceedings of the IEEE/CVF conference on computer vision and pattern recognition], 9664–9674 (2021)

    2021

  28. [36]

    Draem-a discriminatively trained reconstruction embedding for surface anomaly detection,

    Zavrtanik, V., Kristan, M., and Skoˇ caj, D., “Draem-a discriminatively trained reconstruction embedding for surface anomaly detection,” in [Proceedings of the IEEE/CVF international conference on computer vision], 8330–8339 (2021)

    2021

  29. [37]

    Cflow-ad: Real-time unsupervised anomaly detection with localization via conditional normalizing flows,

    Gudovskiy, D., Ishizaka, S., and Kozuka, K., “Cflow-ad: Real-time unsupervised anomaly detection with localization via conditional normalizing flows,” in [ Proceedings of the IEEE/CVF winter conference on applications of computer vision ], 98–107 (2022)

    2022

  30. [38]

    Sub-image anomaly detection with deep pyramid correspondences,

    Cohen, N. and Hoshen, Y., “Sub-image anomaly detection with deep pyramid correspondences,” arXiv preprint arXiv:2005.02357 (2020)

    2005 arXiv

  31. [39]

    A survey on unsupervised anomaly detection algorithms for industrial images,

    Cui, Y., Liu, Z., and Lian, S., “A survey on unsupervised anomaly detection algorithms for industrial images,” IEEE Access 11, 55297–55315 (2023)

    2023

  32. [40]

    Deep learning-based defect detection of metal parts: evaluating current methods in complex conditions,

    Jezek, S., Jonak, M., Burget, R., Dvorak, P., and Skotak, M., “Deep learning-based defect detection of metal parts: evaluating current methods in complex conditions,” in [ 2021 13th International congress on ultra modern telecommunications and control systems and workshops (IC...

    2021

  33. [41]

    Anomaly detection in nanofibrous materials by cnn-based self-similarity,

    Napoletano, P., Piccoli, F., and Schettini, R., “Anomaly detection in nanofibrous materials by cnn-based self-similarity,” Sensors 18(1), 209 (2018)

    2018

  34. [42]

    Unsupervised surface anomaly detection with diffusion probabilistic model,

    Zhang, X., Li, N., Li, J., Dai, T., Jiang, Y., and Xia, S.-T., “Unsupervised surface anomaly detection with diffusion probabilistic model,” in [ Proceedings of the IEEE/CVF International Conference on Computer Vision ], 6782–6791 (2023)

    2023

  35. [43]

    Fastflow: Unsupervised anomaly detection and localization via 2d normalizing flows,

    Yu, J., Zheng, Y., Wang, X., Li, W., Wu, Y., Zhao, R., and Wu, L., “Fastflow: Unsupervised anomaly detection and localization via 2d normalizing flows,” arXiv preprint arXiv:2111.07677 (2021)

    2021 arXiv

  36. [44]

    Modeling the distribution of normal data in pre-trained deep features for anomaly detection,

    Rippel, O., Mertens, P., and Merhof, D., “Modeling the distribution of normal data in pre-trained deep features for anomaly detection,” in [ 2020 25th International Conference on Pattern Recognition (ICPR) ], 6726–6733, IEEE (2021)

    2020

  37. [45]

    Unsupervised anomaly localization using variational auto-encoders,

    Zimmerer, D., Isensee, F., Petersen, J., Kohl, S., and Maier-Hein, K., “Unsupervised anomaly localization using variational auto-encoders,” in [ International conference on medical image computing and computer- assisted intervention ], 289–297, Springer (2019)

    2019

  38. [46]

    Gan-based anomaly detection: A review,

    Xia, X., Pan, X., Li, N., He, X., Ma, L., Zhang, X., and Ding, N., “Gan-based anomaly detection: A review,” Neurocomputing 493, 497–535 (2022)

    2022

  39. [47]

    An unsupervised generative adversarial network-based method for defect inspection of texture surfaces,

    Wang, J., Yi, G., Zhang, S., and Wang, Y., “An unsupervised generative adversarial network-based method for defect inspection of texture surfaces,” Applied Sciences 11(1), 283 (2020)

    2020

  40. [48]

    Visual detection of generic defects in industrial components using generative adversarial networks,

    Skilton, R. and Gao, Y., “Visual detection of generic defects in industrial components using generative adversarial networks,” in [2019 IEEE/ASME International Conference on Advanced Intelligent Mechatronics (AIM) ], 489–494, IEEE (2019)

    2019

  41. [49]

    Cfa: Coupled-hypersphere-based feature adaptation for target-oriented anomaly localization,

    Lee, S., Lee, S., and Song, B. C., “Cfa: Coupled-hypersphere-based feature adaptation for target-oriented anomaly localization,” IEEE Access 10, 78446–78454 (2022)

    2022

  42. [50]

    Uninet: A contrastive learning-guided unified framework with feature selection for anomaly detection,

    Wei, S., Jiang, J., and Xu, X., “Uninet: A contrastive learning-guided unified framework with feature selection for anomaly detection,” in [ Conference on Computer Vision and Pattern Recognition (CVPR) ], (2025)

    2025

  43. [51]

    Adam: A method for stochastic optimization,

    Kingma, D. P. and Ba, J., “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980 (2014)

    2014 arXiv

  44. [52]

    The pascal visual object classes (voc) challenge,

    Everingham, M., Van Gool, L., Williams, C. K., Winn, J., and Zisserman, A., “The pascal visual object classes (voc) challenge,” International journal of computer vision 88(2), 303–338 (2010)

    2010

  45. [53]

    Microsoft coco: Common objects in context,

    Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Doll´ ar, P., and Zitnick, C. L., “Microsoft coco: Common objects in context,” in [ European conference on computer vision ], 740–755, Springer (2014)

    2014

  46. [54]

    Open-source datasets for image processing and artificial intelligence research: A compar- ison of imagenet and ms coco datasets,

    Durusoy, O. et al., “Open-source datasets for image processing and artificial intelligence research: A compar- ison of imagenet and ms coco datasets,” International Journal of Sciences and Innovation Engineering 2(5), 639–653 (2025)

    2025

  47. [55]

    Milcivveh computer vision dataset,

    aai, “Milcivveh computer vision dataset,” (2025)

    2025

  48. [56]

    Segment anything,

    Kirillov, A., Mintun, E., Ravi, N., Mao, H., Rolland, C., Gustafson, L., Xiao, T., Whitehead, S., Berg, A. C., Lo, W.-Y., et al., “Segment anything,” in [ Proceedings of the IEEE/CVF international conference on computer vision ], 4015–4026 (2023)

    2023

  49. [57]

    {Meta-Sift}: How to sift out a clean subset in the presence of data poisoning?,

    Zeng, Y., Pan, M., Jahagirdar, H., Jin, M., Lyu, L., and Jia, R., “ {Meta-Sift}: How to sift out a clean subset in the presence of data poisoning?,” in [ 32nd USENIX Security Symposium (USENIX Security 23) ], 1667–1684 (2023)

    2023

  50. [58]

    Apricot: A dataset of physical adversarial attacks on object detection,

    Braunegg, A., Chakraborty, A., Krumdick, M., Lape, N., Leary, S., Manville, K., Merkhofer, E., Strickhart, L., and Walmer, M., “Apricot: A dataset of physical adversarial attacks on object detection,” in [ European Conference on Computer Vision ], 35–50, Springer (2020)

    2020

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.