Pith. sign in

REVIEW 5 major objections 6 minor 22 references

Robustifying 3D Perception via Least-Squares Graphs for Multi-Agent Object Tracking

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A training-free least-squares graph denoiser lets cooperating vehicles track 3D objects accurately under adversarial LiDAR attacks, outperforming state-of-the-art multi-agent tracking by up to 23.3%.

desk verdict Plausible training-free smoothing for multi-agent tracking under adversarial point clouds, but the headline gain is cherry-picked and the denoising mechanism isn't shown to work against correlated attacks. read the letter →

arxiv 2507.04762 v2 pith:BGJDX7UI submitted 2025-07-07 cs.CV

Maria Damanaki , Ioulia Kapsali , Nikos Piperigkos , Alexandros Gkillas , Aris S. Lalos This is my paper · ORCID
classification cs.CV
keywords adversarialattacksLiDARpointcloudsmulti-agentobjecttrackingleast-squaresgraphsgraphsignalprocessingKalmanfilterV2V4Real3Ddetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that adversarial perturbations injected into the point clouds of connected autonomous vehicles can be suppressed by treating the vehicles' noisy 3D detections as nodes of a fully connected graph and solving a least-squares smoothing problem over that graph. The proposed ARLOT framework uses differential coordinates and anchor points from overlapping detections to correct each bounding-box centroid, then associates the refined detections with existing tracks in two Hungarian-algorithm stages updated by Kalman filters. On the real-world V2V4Real dataset under 20 cm and 25 cm perturbations, ARLOT improves tracking accuracy over state-of-the-art single- and multi-agent baselines by up to 23.3% in AMOTA, without adversarial training or any auxiliary defense module. The central message is that cooperation itself, implemented as a training-free graph denoiser, can be a defense mechanism.

What carries the argument

The load-bearing object is the least-squares graph scheme adapted from least-squares meshes: a fully connected undirected graph whose nodes are the perturbed 3D bounding boxes of two (or more) agents, with a Laplacian matrix that encodes adjacency and differential coordinates that capture each node's deviation from the centroid of its neighbours. Anchoring is supplied by two vectors built from the complementary detection of the other agent plus track velocities, so the system solves two least-squares problems per spatial attribute, producing denoised centroid sets J_ij and J_ji. These refined detections are then matched to tracks through two successive Hungarian-association stages using 3D IoU, with a linear Kalman filter updating track states and a lifetime module confirming or deleting tracks. The role of the machinery is to turn redundant multi-agent observations into a geometric constraint that pulls perturbed centroids back toward a consensus position.

What would settle it

A targeted adversarial attack that shifts overlapping detections at both agents along a common direction (rather than independently) would break the anchor assumption; if ARLOT's AMOTA under such a correlated attack falls to or below the single-agent baseline's, the claim that cooperation alone provides resilience is falsified. More simply, a sensitivity study that corrupts the anchor vectors and measures the resulting centroid error would show the method's tolerance boundary.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that a least-squares graph formulation over fused multi-vehicle detections removes the centroid displacement caused by adversarial LiDAR perturbations, and that the resulting smoothed detections, when fed into a two-stage tracking-association pipeline, yield 3D multi-object tracking that is more accurate than existing SAMOT and MAMOT pipelines under attack. The analytical solution of the extended Laplacian system provides two refined detection sets, one anchored to each cooperating vehicle, and the two-stage association recovers objects that were missed or falsely detected by the attacked detector. Evaluated on V2V4Real, the claimed improvement reaches 23.3% in AMOTA over the best baseline under 25 cm noise applied to both vehicles, with gains also in tracking precision and mostly-tracked ratio. The paper presents ARLOT as a cost-efficient mitigation that requires no training, no learned parameters, and no additional defense mechanisms.

Load-bearing premise

The anchor points used to stabilise the least-squares solution come from the other agent's detections and track velocities, so if an attack shifts the detections of both agents in the same direction on the same object, the smoothed centroid will be biased and will not return to the true location.

Editorial extensions

If this is right

  • ARLOT improves AMOTA by up to 23.3% over state-of-the-art MAMOT baselines and by up to 404.77% over SAMOT under adversarial noise, without any added defense mechanism.
  • Because the method requires no training or learned parameters, it can be dropped into existing tracking-by-detection pipelines for connected vehicles without modifying the detector.
  • The two-stage association with Kalman filtering suppresses both false positives and missed detections caused by the attack, as shown by gains in MT ratio and AMOTP.
  • The least-squares denoising also improves AMOTP under benign conditions by 11.13% over MAMOT baselines, indicating the graph smoothing helps even without adversarial noise.
  • The framework is presented as scalable to more than two agents, since the graph formulation and association stages extend naturally to additional vehicles.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same anchor-based least-squares denoising could be applied to any system with overlapping observations, such as multi-sensor fusion within a single vehicle, not only multi-vehicle cooperation.
  • A natural strengthening would be to weight the anchor vectors by detection confidence, which the paper does not explore but which could reduce bias when one agent's detection is heavily corrupted.
  • A testable extension is to measure performance under correlated adversarial perturbations across agents; the paper's current attack model perturbs agents' point clouds independently, so a coordinated shift could reveal the anchor assumption's boundary.
  • The method's training-free nature makes it a lightweight complement to learned defenses, and it could be combined with adversarial training to stack robustness gains.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes ARLOT, a multi-agent 3D object tracking pipeline that applies least-squares graph regularization to bounding-box centroids from two vehicles, followed by two-stage Hungarian/IoU association and Kalman filtering, with the aim of mitigating adversarial point-cloud perturbations. The method is evaluated on the V2V4Real dataset against single- and multi-agent tracking baselines under 20 cm and 25 cm perturbations with and without a rotation-based defense, reporting improvements up to 23.3% in AMOTA. The presentation also includes an ablation-free comparison of mAP under attack and several qualitative figures of trajectories.

Significance. If the claims are established, ARLOT would offer a training-free, communication-light defense against adversarial LiDAR attacks, which is practically appealing. The closed-form least-squares derivation and the use of a real-world cooperative dataset are strengths, and the paper explicitly positions the method as not requiring additional defense mechanisms. However, the current evidence does not yet demonstrate that the least-squares graph stage removes the adversarial bias: the anchor construction is underspecified, the reported improvements are not computed against a consistent baseline, and no uncertainty quantification is provided. The central denoising mechanism therefore needs additional analysis and experiments before the empirical claims can be accepted.

major comments (5)
  1. [Section III-B, Eqs. (11)-(12)] The anchor vectors ct_ij and ct_ji are defined by listing four scalars (mxj,m, mxj,m, uxi,m, uxj,m) but are asserted to lie in R^{N^t}, where N^t is the number of nodes in the fully connected graph. The mapping from each graph node to a specific anchor coordinate is never specified, and the symbols mxj,m and uxi,m are not introduced before their use. This makes the method impossible to reproduce exactly as written.
  2. [Section III-A/III-B] For the fully connected graph used in the paper, the Laplacian is L = N I - J, so the least-squares normal equations reduce to (L^T L + I) u = L^T L u0 + c. If both the input centroids u0 and the anchors c are shifted by the same constant vector b, the solution u inherits exactly the same shift b. Since both agents' detections are produced from the same point-cloud attack in the both-vehicles-attacked scenario, the anchors can carry the same adversarial bias as the inputs. The paper does not report the cross-agent correlation of per-object centroid errors under the Section II-B attack, nor does it ablate the anchor construction, so the claimed denoising effect in Table IV is not established.
  3. [Table IV] The parenthetical percentage improvements in Table IV are not computed against a consistent baseline. In the 25 cm+Defense row, AMOTA (+23.3%) is relative to V2V4Real (11.93), while sAMOTA (-0.08%) is relative to DMSTrack (48.22), and AMOTP (+13.93%) is relative to V2V4Real (28.28). The headline 'up to 23.3%' is therefore not a comparison with the best-performing baseline across all metrics, and the claim that ARLOT outperforms both baselines on all metrics is contradicted by the sAMOTA value of 48.18 versus DMSTrack's 48.22 in the same row.
  4. [Tables II-IV and Section IV-B] All tracking results are reported as single point estimates with no standard deviations, confidence intervals, or number of repeated runs. Several margins are very small (e.g., Table IV sAMOTA 48.18 vs. 48.22 for DMSTrack), so the claimed consistent improvements are not statistically supported. The paper should provide error bars or at least a stability analysis over multiple attack realizations and dataset sequences.
  5. [Section IV-A] The tracking parameters age = 2 and hits = 3 are stated without any sensitivity analysis. Since track lifetime management directly affects sAMOTA, MT, and identity switches, the robustness of the conclusions to these two free parameters should be reported.
minor comments (6)
  1. [Section I] There is a typo: 'usind' should be 'using' in the third paragraph.
  2. [Tables II-IV] The plus/minus notation in the tables is not defined precisely; the caption says 'with respect to the maximum deviation of the state-of-the-art MAMOT methods,' but the text never explains what 'maximum deviation' means or why some entries show a negative percentage when the raw value is higher than the baseline.
  3. [Section III-A] The statement that the computational complexity is 'equal or lower than O((2NtNt)2)' is ambiguous; it should be written as O((2N^t)^2) or O((N^t)^2) and justified more clearly.
  4. [Section III-B] The phrase 'complimentary information' should be 'complementary information'.
  5. [Table II caption] The caption contains a typo: 'Bening Point Clouds' should be 'Benign Point Clouds'.
  6. [Algorithm 1] The lines 'Update, Initialize Tracks' and 'Update, Initialize, Terminate Tracks' do not specify which Kalman update or track-management rules are applied; a reference to the equations or a short description would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ARLOT is a parameter-free least-squares fusion pipeline evaluated against external ground truth.

full rationale

The core derivation is self-contained. In Section III-A, the method solves a standard least-squares problem (Eq. 9) whose unique analytical solution is given by Eq. 10; this is ordinary linear algebra, not a fit to the tracking metrics. The anchor vectors in Eqs. 11-12 are constructed from the agents' perturbed detections and track velocities, so the smoothing operation is self-referential in the sense that its inputs and outputs are related by a linear combination, but this is a fusion/smoothing mechanism rather than a prediction of a fitted quantity. No parameter is learned from or tuned to the evaluation metrics, and the headline claims are assessed against ground-truth tracks in the V2V4Real dataset. The only self-citation in the derivation chain is reference [20], used for a computational-complexity bound; this is not load-bearing for the central robustness claim. Concerns about common-mode adversarial bias surviving the least-squares smoothing, or about the dimensional clarity of the anchor definitions, are correctness or reproducibility risks rather than circularity, because the method does not define its result in terms of the quantity it purports to predict.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The method introduces no new free parameters beyond the tracking thresholds age and hits; the graph construction and least-squares solution are standard. The key domain assumptions concern the effectiveness of the anchor-based smoothing and the representativeness of the attack model, neither of which is directly measured.

free parameters (2)
  • track age threshold = 2
    Number of consecutive failed associations before a track is declared dead. Chosen by hand in Sec. IV-A to 'balance robustness and adaptability'; no sensitivity analysis.
  • track hits threshold = 3
    Number of consecutive successful associations before a track is confirmed. Chosen by hand in Sec. IV-A; affects MT and false positive rates.
assumptions (5)
  • standard math The least-squares solution of the augmented system (Eq. 10) yields the optimal centroid estimates given the graph and anchors.
    The derivation follows from linear least squares; no empirical support is needed for the linear algebra step.
  • domain assumption Differential coordinates and anchor points constructed from the agents' detections capture enough true geometry that the smoothed centroids are closer to ground truth than the raw detections.
    This is the core effectiveness assumption of the denoising step. It is validated only indirectly via tracking metrics, not by a direct analysis of centroid error under adversarial conditions.
  • domain assumption A constant-velocity Kalman filter with the stated process and measurement noise covariances is an adequate motion model.
    Standard in 3D tracking; the paper does not justify covariance choices (Q, R are not specified numerically).
  • domain assumption Hungarian association with 3D IoU correctly associates detections across agents and with existing tracks.
    Standard practice, but under heavy adversarial noise the IoU scores may be unreliable; the paper does not quantify association errors.
  • domain assumption The gradient-based point perturbation attack in Eq. 8 is representative of adversarial threats to LiDAR detectors.
    Only one attack model is tested; the robustness claim is limited to this attack type.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robustifying 3D Perception via Least-Squares Graphs for Multi-Agent Object Tracking." pith.science (2026). https://pith.science/paper/BGJDX7UI

@misc{pith2026250704762,
  author       = {Pith},
  title        = {Pith review of: Robustifying 3D Perception via Least-Squares Graphs for Multi-Agent Object Tracking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BGJDX7UI}},
  note         = {Machine review of arXiv:2507.04762}
}
read the original abstract

The critical perception capabilities of EdgeAI systems, such as autonomous vehicles, are required to be resilient against adversarial threats, by enabling accurate identification and localization of multiple objects in the scene over time, mitigating their impact. Single-agent tracking offers resilience to adversarial attacks but lacks situational awareness, underscoring the need for multi-agent cooperation to enhance context understanding and robustness. This paper proposes a novel mitigation framework on 3D LiDAR scene against adversarial noise by tracking objects based on least-squares graph on multi-agent adversarial bounding boxes. Specifically, we employ the least-squares graph tool to reduce the induced positional error of each detection's centroid utilizing overlapped bounding boxes on a fully connected graph via differential coordinates and anchor points. Hence, the multi-vehicle detections are fused and refined mitigating the adversarial impact, and associated with existing tracks in two stages performing tracking to further suppress the adversarial threat. An extensive evaluation study on the real-world V2V4Real dataset demonstrates that the proposed method significantly outperforms both state-of-the-art single and multi-agent tracking frameworks by up to 23.3% under challenging adversarial conditions, operating as a resilient approach without relying on additional defense mechanisms.

Figures

Figures reproduced from arXiv: 2507.04762 by the authors.

Figure 1
Figure 1. Impact of the adversarial perturbation attacks on two [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. ARLOT approach conditions, using an NVIDIA RTX 4090 GPU. Additionally, we define the adversarial parameters k = 40 and α = ϵ/30, with ϵ = 20cm or 25cm depending on the specific attack scenario and the tracking parameters age = 2, and hits = 3 to balance robustness and adaptability. We evaluated our framework on the testing sequences and compared its performance with the state-of-the-art baselines, including the V2V4… view at source ↗
Figure 3
Figure 3. Sequence 0000 Frame 30. Pink: Ego detections. Green: Vehicle 1 detections. Red: Real Objects. Blue: ARLOT trajec￾tories. Red arrows indicate the precise localization of objects under 20cm challenging adversarial noise on both agents. B. Evaluation Study Table I demonstrates the impact of adversarial noise on individual detection performance for two CAVs, as well as the mitigation achieved through rotation-based defe… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 20 canonical work pages

  1. [1]

    Intriguing properties of neural networks,

    C. Szegedy, et al. , “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    arXiv 2013

  2. [2]

    Generating 3d adversarial point clouds,

    C. Xiang, et al., “Generating 3d adversarial point clouds,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 9136–9144

    work page 2019

  3. [3]

    Adversarial shape perturbations on 3d point clouds,

    D. Liu, et al. , “Adversarial shape perturbations on 3d point clouds,” in Computer Vision–ECCV 2020 Workshops: Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16 . Springer, 2020, pp. 88–104

    work page 2020

  4. [4]

    Robustness of 3d deep learning in an adversarial setting,

    M. Wicker, et al. , “Robustness of 3d deep learning in an adversarial setting,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2019, pp. 11 767–11 775

    work page 2019

  5. [5]

    A comprehensive study of the robustness for lidar- based 3d object detectors against adversarial attacks,

    Y . Zhang, et al. , “A comprehensive study of the robustness for lidar- based 3d object detectors against adversarial attacks,” International Journal of Computer Vision , vol. 132, no. 5, pp. 1592–1624, 2024

    work page 2024

  6. [6]

    Robust deep object tracking against adversarial attacks,

    S. Jia, et al. , “Robust deep object tracking against adversarial attacks,” International Journal of Computer Vision , pp. 1–20, 2024

    work page 2024

  7. [7]

    Dual-dimensional adversarial attacks: A novel spatial and temporal attack strategy for multi-object tracking,

    W. Zhang, et al., “Dual-dimensional adversarial attacks: A novel spatial and temporal attack strategy for multi-object tracking,” in 2024 Inter- national Joint Conference on Neural Networks (IJCNN) . IEEE, 2024

    work page 2024

  8. [8]

    Fooling detection alone is not enough: Adversarial attack against multiple object tracking,

    Y . Jia, et al. , “Fooling detection alone is not enough: Adversarial attack against multiple object tracking,” in International Conference on Learning Representations (ICLR’20) , 2020

    work page 2020

Show all 22 references
  1. [9]

    Papmot: Exploring adversarial patch attack against multiple object tracking,

    J. Long, et al. , “Papmot: Exploring adversarial patch attack against multiple object tracking,” in European Conference on Computer Vision . Springer, 2024, pp. 128–144

    2024

  2. [10]

    Physical hijacking attacks against object trackers,

    R. Muller, et al., “Physical hijacking attacks against object trackers,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2309–2322

    2022

  3. [11]

    Siammot: Siamese multi-object tracking,

    B. Shuai, et al. , “Siammot: Siamese multi-object tracking,” in Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 12 372–12 382

    2021

  4. [12]

    Adversarial attacks on multi-agent communication,

    J. Tu, et al. , “Adversarial attacks on multi-agent communication,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021, pp. 7768–7777

    2021

  5. [13]

    Enhancing tracking robustness with auxiliary adversar- ial defense networks,

    Z. Wu, et al. , “Enhancing tracking robustness with auxiliary adversar- ial defense networks,” in European Conference on Computer Vision . Springer, 2024, pp. 198–214

    2024

  6. [14]

    Adversarial attack and defense on point sets,

    J. Yang, et al. , “Adversarial attack and defense on point sets,” arXiv preprint arXiv:1902.10899, 2019

    1902 arXiv

  7. [15]

    Made: Malicious agent detection for robust multi-agent collaborative perception,

    Y . Zhao, et al., “Made: Malicious agent detection for robust multi-agent collaborative perception,” in 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) . IEEE, 2024, p. 13817

    2024

  8. [16]

    Robust multi-agent communication with graph infor- mation bottleneck optimization,

    S. Ding, et al. , “Robust multi-agent communication with graph infor- mation bottleneck optimization,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 46, no. 5, pp. 3096–3107, 2023

    2023

  9. [17]

    Least-squares meshes,

    O. Sorkine, et. al. , “Least-squares meshes,” in Proceedings Shape Modeling Applications, 2004. IEEE, 2004, pp. 191–199

    2004

  10. [18]

    V2v4real: A real-world large-scale dataset for vehicle- to-vehicle cooperative perception,

    R. Xu, et al. , “V2v4real: A real-world large-scale dataset for vehicle- to-vehicle cooperative perception,” in 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  11. [19]

    3d multi-object tracking: A baseline and new evaluation metrics,

    X. Weng, et al., “3d multi-object tracking: A baseline and new evaluation metrics,” in 2020 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) , 2020, pp. 10 359–10 366

    2020

  12. [20]

    Graph laplacian processing based multi-modal localization backend for robots and autonomous systems,

    N. Piperigkos, et al. , “Graph laplacian processing based multi-modal localization backend for robots and autonomous systems,” IEEE Trans- actions on Cognitive and Developmental Systems , 2024

    2024

  13. [21]

    Probabilistic 3d multi-object cooperative tracking for autonomous driving via differentiable multi-sensor kalman filter,

    H.-K. Chiu, et al. , “Probabilistic 3d multi-object cooperative tracking for autonomous driving via differentiable multi-sensor kalman filter,” in 2024 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2024, pp. 18 458–18 464

    2024

  14. [22]

    Second: Sparsely embedded convolutional detection,

    Y . Yan, et al. , “Second: Sparsely embedded convolutional detection,” Sensors, vol. 18, no. 10, p. 3337, 2018

    2018

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.