pith. sign in

arxiv: 2606.09536 · v1 · pith:T63MK37Rnew · submitted 2026-06-08 · 💻 cs.CV

Adversarial Attack and Disturbance Detection by Hadamard-Coded Output Representations for Object Detection and Semantic Segmentation

Lucas G\"ornhardt , Timo Bartels , Niklas Schwarz , Tim Fingscheidt This is my paper

Pith reviewed 2026-06-27 16:54 UTC · model grok-4.3

classification 💻 cs.CV
keywords Hadamard codesadversarial attack detectiondisturbance detectionsemantic segmentationobject detectionoutput representationsperturbation detection
0
0 comments X

The pith

Hadamard-coded outputs enable single-pass detection of adversarial attacks and disturbances in object detection and semantic segmentation.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that Hadamard codes as output representations, decoded by projecting onto the probability simplex, produce both class probabilities and an inconsistency measure. This inconsistency arises from the redundancy in the codewords and can be used to flag adversarial or disturbed inputs. The method achieves state-of-the-art detection performance for both semantic segmentation and object detection while maintaining equivalent or near-equivalent accuracy on clean data, all in one forward pass without extra models.

Core claim

Hadamard codewords as output representations, decoded via projection onto the probability simplex, yield an inconsistency measure that detects adversarial attacks and input disturbances in a single pass for object detection and semantic segmentation models, while preserving clean-data performance.

What carries the argument

The inconsistency measure derived from projecting Hadamard codeword predictions onto the probability simplex.

If this is right

  • Perturbation detection becomes available for object detection and semantic segmentation without auxiliary networks or multiple passes.
  • Models retain reference-level accuracy on undisturbed data while gaining detection capability.
  • The same framework applies to both semantic segmentation and object detection tasks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The inconsistency signal could be thresholded in real time to trigger safety responses in deployed vision systems.
  • Similar codeword redundancy might be tested in other dense prediction tasks such as depth estimation.

Load-bearing premise

The inconsistency score from the simplex projection separates adversarial or disturbed inputs from the normal range of clean inputs.

What would settle it

Finding that clean inputs with typical natural variations produce inconsistency scores overlapping those of attacked inputs would falsify the detection method.

Figures

Figures reproduced from arXiv: 2606.09536 by Lucas G\"ornhardt, Niklas Schwarz, Tim Fingscheidt, Timo Bartels.

Figure 1
Figure 1. Figure 1: Inference setup using the HadamardNet. The Hadamard decoder is performed according to Sec. 3.2. The perturbation detection is detailed in Sec. 3.3. 3.2 HadamardNet and Hadamard Decoder Following [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Training setup for our HadamardNet. 3.4 HadamardNet and Attack/Disturbance Detector Training HadamardNet: As shown in [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: ROC for our proposed quantile detection (19) for semantic segmen [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: ROC of our proposed regression perturbance detection (18) for ob [PITH_FULL_IMAGE:figures/full_fig_p013_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Two-dimensional histograms over entropy H(P ∗ i ) and maximum posterior prob￾ability P ∗ i,s∗ . (a) Mean ∥e ∗ i ∥1 on clean data from D CS train. (b) Mean ∥e ∗ i ∥1 on FGSM￾attacked data from D CS train with ϵ = 8. (P ∗ i ) (e ∗ i ) Entropy Max (H(P ∗ i )) (P ∗ i,s∗ ) L1-Norm (∥e ∗ i ∥1) FC(32) BatchNorm ReLU FC(16) BatchNorm ReLU FC(1) (zi) (18)/ (19) δ(x) Perturbation Detection Regression Model F [PITH_… view at source ↗
Figure 6
Figure 6. Figure 6: Block diagram for perturbation detection in [PITH_FULL_IMAGE:figures/full_fig_p023_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Performance degradation under perturbations [PITH_FULL_IMAGE:figures/full_fig_p028_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: ROC for our proposed quantile detection (19) for semantic segmen [PITH_FULL_IMAGE:figures/full_fig_p029_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Performance degradation under perturbations [PITH_FULL_IMAGE:figures/full_fig_p031_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Performance degradation under perturbations [PITH_FULL_IMAGE:figures/full_fig_p034_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: ROC of our proposed regression perturbation detection (18) for [PITH_FULL_IMAGE:figures/full_fig_p036_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Performance degradation under perturbations [PITH_FULL_IMAGE:figures/full_fig_p037_12.png] view at source ↗
read the original abstract

Conventional one-hot encodings often yield poorly calibrated models, being overconfident under attack, and letting entropy-based detection algorithms fail. Previous image classification works have demonstrated that Hadamard-coded output representations can improve adversarial robustness. However, attempts to integrate Hadamard codes into semantic segmentation fall far behind state-of-the-art models in mean intersection-over-union performance. Regarding object detection, such output encodings have not yet been investigated at all. Further, no prior art addressed intrinsic codeword inconsistencies or actually exploited intrinsic codeword redundancy. Accordingly, we first derive a novel decoding procedure for Hadamard codewords towards optimal class-wise probabilities, solving the underlying optimization problem by using the projection onto the probability simplex. Second, our optimization delivers a measure of prediction inconsistency. Third, we are the first to show how to exploit these inconsistencies for adversarial attack and disturbance detection. Fourth, we introduce HadamardNet, a framework employing Hadamard codes as output representations for semantic segmentation and object detection models and tasks. We conduct a comprehensive evaluation both on disturbances and adversarial attacks, achieving state-of-the-art perturbation detection performance for both tasks in only a single detection pass, while delivering equivalent or close-by reference performance on clean data.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper introduces Hadamard-coded output representations for object detection and semantic segmentation via a new framework called HadamardNet. It derives a decoding step that projects onto the probability simplex to obtain class-wise probabilities, yielding both optimal probabilities and an inconsistency measure. This measure is then exploited to detect adversarial attacks and input disturbances in a single forward pass, with claims of state-of-the-art detection performance while preserving clean-data accuracy comparable to standard one-hot baselines.

Significance. If the simplex-projection decoder is shown to solve a well-posed optimization and the inconsistency signal proves robust under controlled baselines, the work would offer a practical, single-pass mechanism for perturbation detection in dense-prediction tasks that leverages code redundancy without requiring multiple inferences. The extension to object detection and the explicit use of intrinsic inconsistencies are novel relative to prior Hadamard work limited to classification.

major comments (2)
  1. [Abstract / Methods decoding section] Abstract and Methods (decoding derivation): the claim that simplex projection 'solves the underlying optimization problem' is not supported by an explicit statement of the objective function being minimized or a derivation showing that the projection is its solution. Without this, it is unclear whether the reported inconsistency metric is a theoretically justified quantity or merely a side-effect of an inexact decoder, which is load-bearing for the central exploitation argument and the SOTA detection claim.
  2. [Evaluation / detection experiments] Evaluation sections (adversarial and disturbance detection): no comparison is provided against alternative decoders (nearest-codeword, linear, or softmax) to isolate whether the inconsistency signal arises specifically from the Hadamard structure or from the projection step itself. This omission weakens the assertion that the method exploits 'intrinsic codeword inconsistencies' rather than decoder artifacts.
minor comments (2)
  1. [Methods] Notation for the Hadamard matrix and codeword length should be introduced with an explicit equation early in the methods section to avoid ambiguity when the inconsistency metric is later defined.
  2. [Tables reporting clean performance] The abstract states 'equivalent or close-by reference performance on clean data'; the corresponding tables should report both mIoU / mAP deltas and statistical significance tests against the one-hot baseline.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. We will revise the manuscript to provide an explicit optimization objective and derivation for the simplex projection decoder, as well as add the requested decoder ablations to strengthen the claims about the source of the inconsistency signal.

read point-by-point responses

  1. Referee: [Abstract / Methods decoding section] Abstract and Methods (decoding derivation): the claim that simplex projection 'solves the underlying optimization problem' is not supported by an explicit statement of the objective function being minimized or a derivation showing that the projection is its solution. Without this, it is unclear whether the reported inconsistency metric is a theoretically justified quantity or merely a side-effect of an inexact decoder, which is load-bearing for the central exploitation argument and the SOTA detection claim.

    Authors: We agree that the presentation would benefit from greater explicitness. The objective minimized by the decoder is the Euclidean distance between the (scaled) network output vector and a probability vector constrained to the simplex; the Euclidean projection onto the simplex is the unique closed-form solution to this convex program. In the revised manuscript we will state this objective function in the Methods section and include a short derivation confirming that the projection step solves it, thereby grounding the inconsistency measure theoretically rather than as a decoder artifact. revision: yes

  2. Referee: [Evaluation / detection experiments] Evaluation sections (adversarial and disturbance detection): no comparison is provided against alternative decoders (nearest-codeword, linear, or softmax) to isolate whether the inconsistency signal arises specifically from the Hadamard structure or from the projection step itself. This omission weakens the assertion that the method exploits 'intrinsic codeword inconsistencies' rather than decoder artifacts.

    Authors: We acknowledge that direct comparisons to other decoders would help isolate the contribution of the Hadamard code redundancy. In the revision we will add experiments that replace the simplex-projection decoder with nearest-codeword, linear, and softmax baselines while keeping the same Hadamard-trained networks, and report the resulting perturbation detection AUROC / AUPR on both the adversarial and disturbance benchmarks. This will allow readers to assess whether the inconsistency signal is tied to the code structure or to the choice of decoder. revision: yes

Circularity Check

0 steps flagged

No circularity; explicit mathematical projection used for decoding

full rationale

The paper's central derivation introduces a decoding step via projection onto the probability simplex to obtain class-wise probabilities and an inconsistency measure from Hadamard codewords. This is framed as solving an underlying optimization problem through a standard mathematical operation rather than any parameter fitting to evaluation data, self-referential definition, or load-bearing self-citation. The inconsistency signal is then applied to detection tasks, with performance claims evaluated separately on clean, disturbed, and adversarial inputs. No steps reduce by construction to the paper's own inputs or prior self-citations; the procedure remains independent of the target detection results.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Abstract-only view yields no explicit free parameters, axioms, or invented entities; the decoding step is described as solving an optimization problem whose concrete formulation is not supplied.

pith-pipeline@v0.9.1-grok · 5760 in / 924 out tokens · 18574 ms · 2026-06-27T16:54:50.877611+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 5 canonical work pages · 2 internal anchors

  1. [1]

    In: Proc

    Akata, Z., Perronnin, F., Harchaoui, Z., Schmid, C.: Label-Embedding for Attribute-Based Classification. In: Proc. of CVPR. pp. 819–826. Portland, OR, USA (Jun 2013)

    2013

  2. [2]

    In: Proc

    Carion, N., Massa, F., Synnaeve, G., Usunier, N., Kirillov, A., Zagoruyko, S.: End- to-End Object Detection with Transformers. In: Proc. of ECCV. pp. 213–229. Glasgow, United Kingdom (Nov 2020)

    2020

  3. [3]

    Chen, K., Wang, J., Pang, J., Cao, Y., Xiong, Y., Li, X., Sun, S., Feng, W., Liu, Z., Xu, J., Zhang, Z., Cheng, D., Zhu, C., Cheng, T., Zhao, Q., Li, B., Lu, X., Zhu, R., Wu, Y., Dai, J., Wang, J., Shi, J., Ouyang, W., Loy, C.C., Lin, D.: MMDetection: OpenMMLabDetectionToolboxandBenchmark.arXivpreprintarXiv:1906.07155 (2019)

    work page internal anchor Pith review Pith/arXiv arXiv 1906

  4. [4]

    In: Proc

    Chen, L.C., Zhu, Y., Papandreou, G., Schroff, F., Adam, H.: Encoder-Decoder With Atrous Separable Convolution for Semantic Image Segmentation. In: Proc. of ECCV. pp. 801–818. Munich, Germany (Sep 2018)

    2018

  5. [5]

    In: Proc

    Chow, K.H., Liu, L., Loper, M., Bae, J., Gursoy, M.E., Truex, S., Wei, W., Wu, Y.: Adversarial Objectness Gradient Attacks in Real-time Object Detection Systems. In: Proc. of TPS-ISA. pp. 263–272. Atlanta, GA, USA (Oct 2020)

    2020

  6. [6]

    Contributors, M.: MMSegmentation: Openmmlab semantic segmentation toolbox and benchmark.https://github.com/open-mmlab/mmsegmentation(2020)

    2020

  7. [7]

    In: Proc

    Cordts, M., Omran, M., Ramos, S., Rehfeld, T., Enzweiler, M., Benenson, R., Franke, U., Roth, S., Schiele, B.: The Cityscapes Dataset for Semantic Urban Scene Understanding. In: Proc. of CVPR. pp. 3213–3223. Las Vegas, NV, USA (Jun 2016)

    2016

  8. [8]

    Dietterich, T.G., Bakiri, G.: Solving Multiclass Learning Problems via Error- Correcting Output Codes. J. Artif. Intell. Res.2(1), 263–286 (Jan 1995)

    1995

  9. [9]

    International Journal of Com- puter Vision88(2), 303–338 (Sep 2010)

    Everingham, M., Van Gool, L., Williams, C.K.I., Winn, J., Zisserman, A.: The PASCAL Visual Object Classes (VOC) Challenge. International Journal of Com- puter Vision88(2), 303–338 (Sep 2010)

    2010

  10. [10]

    International Journal of Computer Vision (IJCV)111(1), 98–136 (Jan 2015)

    Everingham, M., Van Gool, L., Williams, C.K.I., Winn, J., Zisserman, A.: The Pascal Visual Object Classes Challenge: A Retrospective. International Journal of Computer Vision (IJCV)111(1), 98–136 (Jan 2015)

    2015

  11. [11]

    In: Proc

    Frome, A., Corrado, G.S., Shlens, J., Bengio, S., Dean, J., Ranzato, M., Mikolov, T.: DeViSE: A Deep Visual-Semantic Embedding Model. In: Proc. of NeurIPS. pp. 2121–2129. Lake Tahoe, NV, USA (Dec 2013)

    2013

  12. [12]

    In: Proc

    Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Ex- amples. In: Proc. of ICLR. pp. 1–10. San Diego, CA, USA (May 2015)

    2015

  13. [13]

    In: Proc

    Hendrycks, D., Gimpel, K.: A Baseline for Detecting Misclassified and Out-of- Distribution Examples in Neural Networks. In: Proc. of ICLR. pp. 1–12. Toulon, France (Apr 2017) 16 L. Görnhardt et al

    2017

  14. [14]

    In: Proc

    Hoffer, E.,Hubara, I.,Soudry,D.: FixYourClassifier: TheMarginal Value ofTrain- ing the Last Weight Layer. In: Proc. of ICLR - Workshops. pp. 1–11. Vancouver, Canada (Apr 2018)

    2018

  15. [15]

    IEEE Access12, 194367–194377 (2024)

    Hoyos, A., Rivera, M.: Hadamard Layer for Improve Semantic Segmentation. IEEE Access12, 194367–194377 (2024)

    2024

  16. [16]

    IEEE Access9, 118324–118333 (2021)

    Hoyos, A., Ruiz, U., Chavez, E.: Hadamard’s Defense Against Adversarial Exam- ples. IEEE Access9, 118324–118333 (2021)

    2021

  17. [17]

    In: Proc

    Hsu, D.J., Kakade, S.M., Langford, J., Zhang, T.: Multi-Label Prediction via Com- pressed Sensing. In: Proc. of NeurIPS. pp. 772–780. Vancouver, BC, Canada (Dec 2009)

    2009

  18. [18]

    In: Proc

    Klingner, M., Bär, A., Fingscheidt, T.: Improved Noise and Attack Robustness for Semantic Segmentation by Using Multi-Task Training with Self-Supervised Depth Estimation. In: Proc. of CVPR - Workshops. pp. 1299–1309. Seattle, WA, USA (Jun 2020)

    2020

  19. [19]

    In: Proc

    Klingner, M., Kumar, V.R., Yogamani, S., Bär, A., Fingscheidt, T.: Detecting Adversarial Perturbations in Multi-Task Perception. In: Proc. of IROS. pp. 13050– 13057. Kyoto, Japan (Oct 2022)

    2022

  20. [20]

    Econometrica46(1), 33–50 (1978)

    Koenker, R., Bassett, G.: Regression Quantiles. Econometrica46(1), 33–50 (1978)

    1978

  21. [21]

    In: Proc

    Kong, E.B., Dietterich, T.G.: Error-Correcting Output Coding Corrects Bias and Variance. In: Proc. of ICML. pp. 313–321. Tahoe City, CA, USA (Jul 1995)

    1995

  22. [22]

    In: Proc

    Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial Examples in the Physical World. In: Proc. of ICLR - Workshops. pp. 1–14. Toulon, France (Apr 2017)

    2017

  23. [23]

    In: Proc

    Li, S., Zhu, S., Paul, S., Roy-Chowdhury, A., Song, C., Krishnamurthy, S., Swami, A., Chan, K.S.: Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency. In: Proc. of ECCV. pp. 396–413. Glasgow, United Kingdom (Nov 2020)

    2020

  24. [24]

    In: Proc

    Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., Zitnick, C.L.: Microsoft COCO: Common Objects in Context. In: Proc. of ECCV. pp. 740–755. Zurich, Switzerland (Sep 2014)

    2014

  25. [25]

    In: Proc

    Liu, W., Wang, X., Owens, J., Li, Y.: Energy-based Out-of-Distribution and Ad- versarial Detection. In: Proc. of NeurIPS. pp. 21464–21475. virtual (Dec 2020)

    2020

  26. [26]

    In: Proc

    Loshchilov, I., Hutter, F.: Decoupled Weight Decay Regularization. In: Proc. of ICLR. pp. 1–18. New Orleans, LA, USA (May 2019)

    2019

  27. [27]

    arXiv:2408.10021 (Aug 2024)

    Maag, K., Resner, R., Fischer, A.: Detecting Adversarial Attacks in Semantic Seg- mentation via Uncertainty Estimation: A Deep Analysis. arXiv:2408.10021 (Aug 2024)

    work page arXiv 2024

  28. [28]

    In: Proc

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learn- ing Models Resistant to Adversarial Attacks. In: Proc. of ICLR. pp. 1–28. Vancou- ver, BC, Canada (Apr 2018)

    2018

  29. [29]

    In: Proc

    Metzen, J.H., Kumar, M.C., Brox, T., Fischer, V.: Universal Adversarial Pertur- bations Against Semantic Image Segmentation. In: Proc. of ICCV. pp. 2774–2783. Venice, Italy (Oct 2017)

    2017

  30. [30]

    Journal of Optimization Theory and Applications50(1), 195–200 (1986)

    Michelot, C.: A Finite Algorithm for Finding the Projection of a Point onto the Canonical Simplex ofαn. Journal of Optimization Theory and Applications50(1), 195–200 (1986)

    1986

  31. [31]

    IEEE Trans- actions on Neural Networks and Learning Systems36(9), 15706–15722 (2025)

    Nguyen, K.N.T., Zhang, W., Lu, K., Wu, Y.H., Zheng, X., Li Tan, H., Zhen, L.: A Survey and Evaluation of Adversarial Attacks in Object Detection. IEEE Trans- actions on Neural Networks and Learning Systems36(9), 15706–15722 (2025). https://doi.org/10.1109/TNNLS.2025.3561225

    work page doi:10.1109/tnnls.2025.3561225 2025

  32. [32]

    McGraw-Hill Book Company (1989) Perturbation Detection by Hadamard-Coded Output Representations 17

    Proakis, J.G.: Digital Communications. McGraw-Hill Book Company (1989) Perturbation Detection by Hadamard-Coded Output Representations 17

    1989

  33. [33]

    In: Proc

    Ren, S., He, K., Girshick, R., Sun, J.: Faster R-CNN: Towards Real-Time Object Detection With Region Proposal Networks. In: Proc. of NIPS. pp. 91–99. Montréal, QC, Canada (Dec 2015)

    2015

  34. [34]

    Image and Vision Computing75, 21–31 (2018)

    Rodríguez, P., Bautista, M.A., Gonzàlez, J., Escalera, S.: Beyond One-Hot En- coding: Lower Dimensional Target Embedding. Image and Vision Computing75, 21–31 (2018)

    2018

  35. [35]

    In: Proc

    Ronneberger, O., Fischer, P., Brox, T.: U-Net: Convolutional Networks for Biomed- ical Image Segmentation. In: Proc. of MICCAI. pp. 234–241. Munich, Germany (Oct 2015)

    2015

  36. [36]

    International Journal of Information Security23(1), 299–314 (Feb 2024)

    Ryu, G., Choi, D.: Detection of Adversarial Attacks Based on Differences in Image Entropy. International Journal of Information Security23(1), 299–314 (Feb 2024)

    2024

  37. [37]

    Understanding Measures of Uncertainty for Adversarial Example Detection

    Smith, L., Gal, Y.: Understanding Measures of Uncertainty for Adversarial Exam- ple Detection. arXiv preprint:1803.08533 (Mar 2018)

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  38. [38]

    Sylvester, J.J.: LX. Thoughts on Inverse Orthogonal Matrices, Simultaneous Sign Successions, and Tessellated Pavements in Two or More Colours, With Applica- tions to Newton’s Rule, Ornamental Tile-Work, and the Theory of Numbers. The London, Edinburgh, and Dublin Philosophical Magazine and Journal of Science 34(232), 461–475 (1867)

  39. [39]

    Information16(11) (2025)

    Thunuguntla, A., Tadepalli, P., Raffa, G.: Defenses Against Adversarial Attacks on Object Detection: Methods and Future Directions. Information16(11) (2025). https://doi.org/10.3390/info16111003,https://www.mdpi.com/2078-2489/ 16/11/1003

    work page doi:10.3390/info16111003 2025

  40. [40]

    Verma, G., Swami, A.: Error Correcting Output Codes Improve Probability Esti- mationandAdversarialRobustnessofDeepNeuralNetworks.In:Proc.ofNeurIPS. pp. 8646–8656. Vancouver, BC, Canada (Dec 2019)

    2019

  41. [41]

    In: Proc

    Wan, L., Alpcan, T., Viterbo, E., Kuijper, M.: Efficient Error-Correcting Output Codes for Adversarial Learning Robustness. In: Proc. of ICC. pp. 2345–2350. Seoul, South Korea (May 2022)

    2022

  42. [42]

    Machine learning81(1), 21–35 (2010)

    Weston, J., Bengio, S., Usunier, N.: Large Scale Image Annotation: Learning to Rank with Joint Word-Image Embeddings. Machine learning81(1), 21–35 (2010)

    2010

  43. [44]

    In: Proc

    Xie, E., Wang, W., Yu, Z., Anandkumar, A., Alvarez, J.M., Luo, P.: SegFormer: Simple and Efficient Design for Semantic Segmentation with Transformers. In: Proc. of NeurIPS. pp. 12077–12090. virtual (Dec 2021)

    2021

  44. [45]

    In: Proc

    Xu, W., Evans, D., Qi, Y.: Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks. In: Proc. of Network and Distributed Systems Security Symposium. San Diego, CA, USA (Feb 2018)

    2018

  45. [46]

    In: Proc

    Yang, S., Luo, P., Loy, C.C., Shum, K.W., Tang, X.: Deep Representation Learning with Target Coding. In: Proc. of AAAI. pp. 3848–3854. Austin, TX, USA (Jan 2015)

    2015

  46. [47]

    In: Proc

    Yin,M.,Li,S.,Cai,Z.,Song,C.,Asif,M.S.,Roy-Chowdhury,A.K.,Krishnamurthy, S.V.: Exploiting Multi-Object Relationships for Detecting Adversarial Attacks in Complex Scenes. In: Proc. of ICCV. pp. 7858–7867. Montréal, QC, Canada (Oct 2021)

    2021

  47. [48]

    In: Proc

    Yu, F., Chen, H., Wang, X., Xian, W., Chen, Y., Liu, F., Madhavan, V., Darrell, T.: BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning. In: Proc. of CVPR. pp. 1–14. Seattle, WA, USA (Jun 2020) 18 L. Görnhardt et al

    2020

  48. [49]

    In: Proc

    Zhou, B., Zhao, H., Puig, X., Fidler, S., Barriuso, A., Torralba, A.: Scene Parsing through ADE20K Dataset. In: Proc. of CVPR. pp. 633–641. Honolulu, HI, USA (Jul 2017) Perturbation Detection by Hadamard-Coded Output Representations 19 A Hadamard Code Construction and Example Hadamard codes are generated using Sylvester’s construction [38] of the bipolar ...

    2017

  49. [50]

    (46) Using (45) and (46), and exploiting that both ˜Pi and ˇhi are constant w.r.t. minimization overP i, we find arg min Pi∈P ∥ei∥2 2 = arg min Pi∈P (∥Pi∥2 2 −2P T i ˜Pi +∥ ˜Pi∥2 2) = arg min Pi∈P (∥Pi∥2 2 −2P T i ˜Pi + 1 L ˇhT i ˇhi) = arg min Pi∈P ( L 4 ∥Pi∥2 2 − L 2 PT i ˜Pi + 1 4 ˇhT i ˇhi) = arg min Pi∈P ∥ˇei∥2 2 (47) Accordingly, minimizing||ei||2 2...

    2000

  50. [51]

    We report the perturbation detection accuracy measured by AuROC (%) and global AuROC (%) as well as global TPR5% (%) per perturbation across all strengths

    trained onD BDD,Seg train and evaluated on perturbed samples fromDBDD,Seg val . We report the perturbation detection accuracy measured by AuROC (%) and global AuROC (%) as well as global TPR5% (%) per perturbation across all strengths. FGSM and PGD, which also cause the strongest mIoU degradation, achieve the highest detection performance and the AuROC in...