NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors

Bowen Li; Dezhong Yao; Hai Jin; Leo Yu Zhang; Shengshan Hu; Wei Wan; Yufei Song; Zhifei Yu; Ziqi Zhou

REVIEW 5 major objections 6 minor 57 references

NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a single white-box attack recipe, combining spatial box-shift and classification-confusion losses with wavelet-based high-frequency perturbation, can make nine modern object detectors effectively blind at an 8/255…

desk verdict The reported attack numbers are likely real, but the 'model-agnostic' claim rests on an unspecified adaptation of the classification loss to detectors without a background class. read the letter →

arxiv 2412.16955 v1 pith:FWIS7PQV submitted 2024-12-22 cs.CV

Ziqi Zhou , Bowen Li , Yufei Song , Zhifei Yu , Shengshan Hu , Wei Wan , Leo Yu Zhang , Dezhong Yao

show 1 more author

Hai Jin

This is my paper · ORCID

classification cs.CV

keywords adversarialattackobjectdetectionmodel-agnosticspatial-frequencyfusiondiscretewavelettransformboundingboxregressionwhite-boxthreatmodelmAPevaluation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

NumbOD is an adversarial attack against object detectors that claims to be model-agnostic: it uses only the detector's final outputs—predicted bounding boxes and class scores—rather than internal components like region proposal networks or non-maximum suppression. The attack combines a spatial loss that pushes predicted boxes toward an image corner and shifts classification scores toward background, with a frequency loss that uses the discrete wavelet transform to concentrate perturbation in high-frequency texture regions while leaving low-frequency structure intact. On 5,000 images from MS-COCO and PASCAL VOC with an 8/255 budget, the paper reports mAP50 collapsing from clean values of 47.58 to 60.79 down to 0.27 to 5.49 across nine detectors spanning two-stage, single-stage, and transformer architectures, and claims it outperforms six prior attacks on both effectiveness and stealthiness. If true, the result would mean that architectural differences among modern detectors offer little protection against a single output-level attack recipe.

What carries the argument

The load-bearing object is the total attack loss $J_{total} = J_{sa} + J_{fa}$. $J_{sa}$ (spatial coordinated deviation attack) is the sum of a localization loss $J_{loc}$ that pulls predicted bounding-box corners toward $(0,0)$ using Smooth L1, and a classification loss $J_{cls}$ that suppresses ground-truth class scores and raises the background class score; $J_{fa}$ (critical frequency interference attack) is built on the discrete wavelet transform: it reconstructs the image from low-frequency coefficients ($\phi(x)$) and from high-frequency coefficients ($\psi(x)$), then minimizes the low-frequency difference between benign and adversarial images while maximizing the high-frequency difference. The dual-track target selection chooses top-k boxes by IoU quality for regression and by label match for classification, so the perturbation is spent on high-quality object boxes rather than background. This machinery is what lets the attack stay model-agnostic: only final outputs and the DWT coefficients enter the loss.

What would settle it

Compute the spatial loss of Equations 4–5 on a detector's post-NMS, post-filtering outputs while blocking gradients at the non-differentiable stages; if mAP50 no longer collapses, the reported blindness depends on an undocumented access to internal (pre-NMS) predictions rather than on final outputs alone.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that object detectors can be made effectively blind by optimizing a single loss defined on their final outputs, provided the loss couples three mechanisms: (1) a dual-track target-selection step that picks the top-k bounding boxes separately for regression and classification quality; (2) a spatial coordinated deviation attack, $J_{sa} = J_{loc} + \lambda J_{cls}$, where $J_{loc}$ uses Smooth L1 to drag predicted box corners toward $(0,0)$ and $J_{cls}$ minimizes the score of the true label while maximizing the background class score; and (3) a critical frequency interference attack, $J_{fa} = J_d(\phi(x), \phi(x+\delta)) - J_d(\psi(x), \psi(x+\delta))$, in which $\phi$ extracts the low-frequency component and $\psi$ the high-frequency component via discrete wavelet transform, pushing perturbation into high-frequency regions. The paper reports that this fusion reduces mAP50 to below 5.5 on all nine tested detectors on MS-COCO at $\epsilon = 8/255$, and that it beats FGSM, PGD, DAG, RAP, TOG, and LGP on Faster R-CNN and VFNet; it also shows the attack retains much of its effect under corruption, pruning, fine-tuning, and adversarial training.

Load-bearing premise

The attack assumes that the detector's final predicted boxes and class scores give a usable gradient signal for optimization, even though standard detectors route those outputs through non-differentiable steps like non-maximum suppression, score filtering, and top-k selection, and the paper does not spell out how the loss is computed despite those steps.

Editorial extensions

If this is right

If NumbOD's central claim holds, a white-box adversary does not need to know whether a detector is two-stage, single-stage, or transformer-based: final-box-level optimization suffices to drive mAP50 below 5.5 on MS-COCO with an 8/255 budget.
The frequency-loss result implies that high-frequency texture regions are a concentrated vulnerability: steering the same perturbation budget away from low-frequency structure raises both effectiveness and perceptual stealthiness.
The paper's defense experiments imply that standard robustness measures—input corruption, pruning, fine-tuning, and adversarial training—do not by themselves restore reliable detection against this attack.
The comparison against FGSM, PGD, DAG, RAP, TOG, and LGP implies that previous attacks deceive either classification or regression, whereas NumbOD's joint spatial-frequency objective is what suppresses both at once.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

We infer that the attack's efficiency and model-agnostic label rest on an unstated implementation detail: standard detector outputs pass through non-differentiable non-maximum suppression, score filtering, and top-k selection, so for Equations 4–5 to supply gradients, the loss must be computed either on raw pre-NMS predictions or through a differentiable surrogate. If the reported code uses pre-NM
We infer that Equation 5's explicit background class cannot be applied verbatim to detectors such as YOLO and RepPoints that do not expose a background class; the paper does not document the adaptation, so the nine-model uniform claim is stronger than the written loss supports unless such an adaptation exists.
We infer a testable extension: if high-frequency interference is the main driver, then a frequency-only variant should already suppress detection on texture-rich objects, and a low-frequency-only variant should fail; the paper's ablation runs components but does not isolate this asymmetry across all nine models.
We infer that the white-box recipe may transfer better than structure-specific attacks because it targets a common output geometry; a black-box transfer experiment across detectors would test this directly but is not reported.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the results are probably real, but the paper as written overclaims 'model-agnostic' because it never says how Eq. 5 is applied to detectors without an explicit background class like YOLOv5 and RepPoints. That's the main thing to know.

What's new: a white-box attack combining two output-based spatial losses (corner-collapse to (0,0) and foreground-background separation) with a DWT-based frequency decoupling loss, plus a dual-track top-k target selection. The combination is new, and the ablation shows each piece contributes. Running on nine detectors and two datasets with a code link is good practice. The defense evaluation (corruption, pruning, fine-tuning, adversarial training) is a useful addition.

Soft spots, roughly in order.

First, Eq. 5 explicitly uses a background class c_K among K+1 class scores. YOLOv5's head gives objectness and K class probabilities; RepPoints also differs. The paper never documents how c_K is derived for these models. If the code substitutes 1 - objectness, that's a materially different loss and the paper should say so. As written, the unified formulation is misleading. This affects the headline because YOLO and RepPoints are in Table 1.

Second, the paper doesn't say whether the spatial loss is computed on raw pre-NMS predictions or on post-NMS outputs. The boxes that survive NMS and top-k have no gradient through those stages; if they use a differentiable surrogate or a fixed set, that should be stated. It's a reproducibility issue, not necessarily a flaw.

Third, the 'IW-SSIM' column appears to be 100*(1-IW-SSIM), since raw IW-SSIM near 1 would give numbers like 0.17 on that scale. That's a mislabel or a missing transformation.

Fourth, no error bars or multiple runs, the top-k value isn't reported, and the SOTA comparison is only on Faster R-CNN and VFNet. All minor and fixable.

The central idea holds up as an attack recipe; the missing details don't make me doubt the numbers, they make me doubt the model-agnostic framing. This is a solid empirical paper that deserves peer review with a request for proper specification and a code-checked appendix.

For you: if you work on adversarial detection or robustness evaluation, it's worth a look once the authors fix the background-class handling. I'd send it to a serious reviewer.

Referee Report

5 major / 6 minor

Summary. The paper proposes NumbOD, a white-box adversarial attack against object detectors that aims to be model-agnostic by using only the detector's final outputs (bounding boxes and class scores) rather than its internal structures. The method combines a spatial loss that pushes predicted boxes toward a corner and drives classification toward an explicit background class, with a frequency-domain loss based on the discrete wavelet transform that encourages perturbations to concentrate in high-frequency components. Experiments on nine object detectors (Faster R-CNN, Cascade R-CNN, SABL, Sparse R-CNN, RepPoints, Deformable DETR, VFNet, TOOD, YOLOv5) and two datasets (MS-COCO, PASCAL VOC) report mAP50 dropping from roughly 47–61 to below 5.5 under an 8/255 L-infty budget, together with comparisons against six prior attacks and an ablation study. The paper claims that NumbOD outperforms all existing approaches in both effectiveness and stealthiness.

Significance. If the method is fully specified and reproducible, this is a practically relevant contribution: most existing object-detector attacks are architecture-specific (e.g., targeting RPN or NMS), whereas a simple output-only attack that works across two-stage, one-stage, and transformer-based detectors would be useful for robustness evaluation. The paper includes a public code link, evaluates on nine detectors and two datasets, and the reported attack success is striking. However, the central 'model-agnostic' claim is currently undermined by underspecification of how the loss is applied to detector outputs (pre-NMS vs. post-NMS) and how the background-class term in Eq. (5) is instantiated for detectors that do not have an explicit background class. These issues are load-bearing for reproducibility and for the claim that the attack uses only final outputs. The metric definition for IW-SSIM is also inconsistent with the reported numbers. The contribution is promising, but the manuscript needs substantial clarification and additional experimental rigor before the claims are supportable.

major comments (5)

[Methodology, 'Spatial coordinated deviation attack', Eqs. (4)-(5)] The manuscript does not specify whether Jloc and Jcls are computed on pre-NMS raw predictions or on the post-NMS final detections. Standard detectors (Faster R-CNN, YOLOv5, Deformable DETR) involve non-differentiable NMS, score filtering, and top-k selection; a loss defined on the final boxes has zero gradient through these stages. The paper must state the exact tensors used: for example, losses on raw per-anchor or per-query predictions, a differentiable surrogate, or a straight-through estimator. This is central both to reproducibility of the reported mAP numbers and to the claim that the attack is model-agnostic and relies only on final output features.
[Methodology, 'Spatial coordinated deviation attack', Eq. (5)] Equation (5) assumes an explicit background class c_K among K+1 output class probabilities. YOLOv5's classification head outputs K class-conditional probabilities plus an objectness score, with no background class; RepPoints and Deformable DETR use different head designs. The paper reports attack results for all three detectors in Table 1 but never documents how c_K is obtained for them. If c_K is replaced by 1-o (objectness complement) or some other quantity, the gradient of the loss changes substantially and the unified formulation in Eq. (5) is misleading. Provide the exact per-model instantiation of this loss for each detector family, or the 'model-agnostic' claim is unsupported.
[Experiments, 'Attack Performance', Table 1] The evaluation is based on a single randomly selected set of 5000 images per dataset with no repetition, no seeds, and no error bars. Because the attack uses stochastic optimization (Adamax) and random sample selection, detector-to-detector differences such as mAP50 0.38 vs. 0.59 may not be statistically meaningful. Report variance over multiple independent runs and specify the sampling protocol, or explicitly state that results come from a single run and soften comparative claims such as 'significantly dropping' and 'our method outperforms all existing approaches.'
[Experiments, 'Evaluation metrics'] The statement 'we default to multiplying the values of mAP, IW-SSIM, and NMSE by 100' is inconsistent with the reported numbers: mAP values in the tables are already percentages, and IW-SSIM values around 0.17 cannot be the product of a standard IW-SSIM score and 100. The numbers are consistent with reporting 100*(1-IW-SSIM) as a distance measure. Define the exact quantity reported in Tables 1 and 2, and use consistent notation, because the stealthiness comparison in Table 2 depends on this definition.
[Experiments, 'Comparison Study', Table 2] The abstract and comparison section claim NumbOD 'outperforms all existing approaches in terms of effectiveness and stealthiness,' but Table 2 shows FGSM has a lower (better) IW-SSIM value (0.16 vs. 0.17 on Faster R-CNN/MS-COCO), and the text acknowledges that FGSM 'excels over us on the IW-SSIM metric.' Revise the claim to say NumbOD outperforms on effectiveness and on most stealthiness metrics, or provide a statistical test showing the IW-SSIM difference is not significant.

minor comments (6)

[Methodology, 'Critical frequency interference attack', Eqs. (6)-(8)] The matrix notation in Eqs. (6)-(8) is confusing: the image x is used both for the original image and for the decomposed sub-bands, and the reconstruction of phi(x) and psi(x) from single sub-bands should be described more precisely. Clarify the dimensions and the role of the dropped mid-frequency components.
[Methodology, 'Key Challenges and Intuitions'] The sentence 'deep neural networks are biased towards image textures' is stated without a citation; add a reference to the texture-bias literature (e.g., Geirhos et al., ICLR 2019) to support this premise.
[Methodology, 'Spatial-Frequency Fusion Attack'] The value of k in the dual-track target selection strategy is never reported. Please include the chosen k and any sensitivity analysis in the implementation details.
[Methodology, 'Problem Formulation'] Equation (1) writes the objective as an expectation over the data distribution, but the actual attack appears to be image-specific. Clarify whether the formulation is per-image or universal and how Eq. (1) relates to the optimization procedure described in 'Spatial-Frequency Fusion Attack.'
[Experiments, 'Comparison Study'] RAP and LGP use perturbation budgets that are not L-p norm constrained, while NumbOD and the other baselines use 8/255. The comparison would be fairer if a non-L-p-constrained variant of NumbOD were also reported, or if the text explicitly discussed why the comparison is still meaningful.
[General editorial] There are several typographical and phrasing issues: 'as follow' should be 'as follows', 'the first model-agnostic' should be 'a model-agnostic', and the phrase 'we default to multiplying the values of mAP, IW-SSIM, and NMSE by 100' should be rewritten for clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: NumbOD's attack loss is a direct white-box objective evaluated on benchmark detectors, and the cited prior work is contextual rather than load-bearing.

full rationale

This paper reports a white-box adversarial attack whose objective J_total = J_sa + J_fa is defined directly on detector outputs (Eqs. 3-9) and is optimized on the same images used for evaluation; that is standard attack methodology, not a circular prediction. No equation is obtained by fitting a parameter to the evaluation quantity, and no result is imported from the authors' prior work as a load-bearing premise. The self-citations (e.g., Zhou et al. 2023a,b, 2024a,b; Song et al. 2025; Wang et al. 2025) are contextual references to prior adversarial-example work and do not supply any theorem or assumption on which the attack's effectiveness depends. The potential ambiguity about whether Eq. 5's background class c_K exists for YOLOv5/RepPoints and whether gradients flow through NMS is a reproducibility/correctness concern about unspecified implementation details, not a circularity of the derivation. The attack's empirical claim, that the crafted noise lowers mAP, is externally evaluated on benchmark detectors rather than being an artifact of the loss definition alone. Therefore no circular step is exhibited.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The methodological inventory is fairly clean: the attack is an optimization procedure and postulates no new entities. The free parameters are attack hyperparameters, one of which (top-k) is never reported. The key assumptions are domain assumptions about detector outputs and frequency sensitivity; the most fragile is that gradients can be computed through the final outputs, which conflicts with non-differentiable NMS post-processing. These assumptions are not independently grounded beyond the paper's own experiments.

free parameters (4)

lambda (spatial loss weight) = 100
Weight balancing Jloc and Jcls in Eq. 3; chosen by hand, no sensitivity analysis reported.
top-k (target boxes per track) = not reported
Dual-track target selection in 'Dual-track attack target selection strategy'; k is never specified, so the exact selection behavior is unreproducible.
epsilon (perturbation budget) = 8/255
Standard l-infinity budget, adopted from prior work; not fitted, but sets the attack strength.
Adamax learning rate / weight decay / epochs = 0.03 / 0.02 / 50
Optimizer settings from Implementation details; no grid search or sensitivity study.

assumptions (4)

domain assumption Neural networks are biased toward high-frequency texture information, so increasing high-frequency differences while holding low-frequency differences small improves attack efficiency and stealthiness.
Motivates the critical frequency interference attack; cited to Luo et al. 2022 and Wang et al. 2022, not proven by the paper.
domain assumption The final outputs of all nine object detectors expose a background class score c_K and box coordinates suitable for the loss in Eqs. 4-5, or an equivalent differentiable form.
Eq. 5 raises c_K while lowering c_gt; YOLO-style objectness outputs and RepPoints do not expose an explicit background class, and the paper does not describe the adaptation.
ad hoc to paper Gradients can be computed for the loss defined on the detector's output boxes (the NMS-differentiability assumption).
Eqs. 4-5 are defined on predicted boxes; standard inference pipelines include non-differentiable NMS, so this assumption is needed for the attack to be implementable but is not stated.
domain assumption Selecting top-k boxes by IoU with ground truth and optimizing only those boxes suffices to make the detector numb to all objects.
This is the rationale of the dual-track selection strategy; supported by ablations on Faster R-CNN only.

how reviews work

0 comments

Cite this review

Pith. "Pith review of NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors." pith.science (2026). https://pith.science/paper/FWIS7PQV

@misc{pith2026241216955,
  author       = {Pith},
  title        = {Pith review of: NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FWIS7PQV}},
  note         = {Machine review of arXiv:2412.16955}
}

read the original abstract

With the advancement of deep learning, object detectors (ODs) with various architectures have achieved significant success in complex scenarios like autonomous driving. Previous adversarial attacks against ODs have been focused on designing customized attacks targeting their specific structures (e.g., NMS and RPN), yielding some results but simultaneously constraining their scalability. Moreover, most efforts against ODs stem from image-level attacks originally designed for classification tasks, resulting in redundant computations and disturbances in object-irrelevant areas (e.g., background). Consequently, how to design a model-agnostic efficient attack to comprehensively evaluate the vulnerabilities of ODs remains challenging and unresolved. In this paper, we propose NumbOD, a brand-new spatial-frequency fusion attack against various ODs, aimed at disrupting object detection within images. We directly leverage the features output by the OD without relying on its internal structures to craft adversarial examples. Specifically, we first design a dual-track attack target selection strategy to select high-quality bounding boxes from OD outputs for targeting. Subsequently, we employ directional perturbations to shift and compress predicted boxes and change classification results to deceive ODs. Additionally, we focus on manipulating the high-frequency components of images to confuse ODs' attention on critical objects, thereby enhancing the attack efficiency. Our extensive experiments on nine ODs and two datasets show that NumbOD achieves powerful attack performance and high stealthiness.

Figures

Figures reproduced from arXiv: 2412.16955 by the authors.

**Figure 2.** Dual-track attack target selection strategy [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** The pipeline of our method tion). This approach further enhances the attack’s effectiveness and stealthiness. By designing such fusion attack in both spatial and frequency domains, we strategically target crucial areas within images while simultaneously deceiving regression and classification subtasks. This provides an efficient optimization direction for generating adversarial examples, resulting in successful a… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Visualizations of the adversarial examples made by different methods against Faster R-CNN on MS-COCO [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: Ablation Study. C-mAP50 and P-mAP50 denote the mAP50 results on MS-COCO and PASCAL VOC, Others stand the same meaning. et al. 2020), we set the upper bound of the adversarial perturbation to 8/255. We set the hyperparameters λ to 100, while the training epoch is set …

**Figure 6.** Figure 6: The attack performance of NumbOD against different defenses on the MS-COCO dataset. (a) - (d) examine four de [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 46 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Aich, A.; Ta, C.-K.; Gupta, A.; Song, C.; Krishnamurthy, S.; Asif, S.; and Roy-Chowdhury, A. 2022. Gama: Generative adversarial multi-object scene attacks. In Proceedings of the 36th Advances in Neural Information Processing Systems (NeurIPS'22), 36914--36930

work page 2022
[4]

Cai, Z.; and Vasconcelos, N. 2019. Cascade R-CNN: high quality object detection and instance segmentation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1483--1498

work page 2019
[5]

Carlini, N.; and Wagner, D. 2017. Towards evaluating the robustness of neural networks. In Proceedings of the IEEE Symposium on Security and Privacy (SP'17), 39--57

work page 2017
[6]

Chen, P.-C.; Kung, B.-H.; and Chen, J.-C. 2021. Class-aware robust adversarial training for object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21), 10420--10429

work page 2021
[7]

E.; Truex, S.; Wei, W.; and Wu, Y

Chow, K.-H.; Liu, L.; Loper, M.; Bae, J.; Gursoy, M. E.; Truex, S.; Wei, W.; and Wu, Y. 2020. Adversarial objectness gradient attacks in real-time object detection systems. In Proceedings of the 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA'20), 263--272

work page 2020
[8]

Ding, J.; Xue, N.; Long, Y.; Xia, G.-S.; and Lu, Q. 2019. Learning RoI transformer for oriented object detection in aerial images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'19), 2849--2858

work page 2019

Show all 57 references

[9]

K.; Winn, J.; and Zisserman, A

Everingham, M.; Van Gool, L.; Williams, C. K.; Winn, J.; and Zisserman, A. 2010. The pascal visual object classes (voc) challenge. International Journal of Computer Vision, 88: 303--338

2010
[10]

R.; and Huang, W

Feng, C.; Zhong, Y.; Gao, Y.; Scott, M. R.; and Huang, W. 2021. Tood: Task-aligned one-stage object detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'21), 3490--3499

2021
[11]

Girshick, R.; Donahue, J.; Darrell, T.; and Malik, J. 2014. Rich feature hierarchies for accurate object detection and semantic segmentation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR'14), 580--587

2014
[12]

J.; Shlens, J.; and Szegedy, C

Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and harnessing adversarial examples. In Proceedings of the International Conference on Learning Representations (ICLR'15)

2015
[13]

Han, J.; Ding, J.; Li, J.; and Xia, G.-S. 2021 a . Align deep features for oriented object detection. IEEE Transactions on Geoscience and Remote Sensing, 1--11

2021
[14]

Han, J.; Ding, J.; Xue, N.; and Xia, G.-S. 2021 b . Redet: A rotation-equivariant detector for aerial object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21), 2786--2795

2021
[15]

Y.; Li, M.; and Jin, H

Hu, S.; Zhang, Y.; Liu, X.; Zhang, L. Y.; Li, M.; and Jin, H. 2021. AdvHash: Set-to-set Targeted Attack on Deep Hashing with One Single Adversarial Patch. In Proceedings of the 29th ACM International Conference on Multimedia (MM'21), 2335--2343

2021
[16]

Huang, H.; Chen, Z.; Chen, H.; Wang, Y.; and Zhang, K. 2023. T-sea: Transfer-based self-ensemble attack on object detection. In Proceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition (CVPR'23), 20514--20523

2023
[17]

Li, G.; Xu, Y.; Ding, J.; and Xia, G.-S. 2024 a . Toward Generic and Controllable Attacks Against Object Detection. IEEE Transactions on Geoscience and Remote Sensing, 62: 1--12

2024
[18]

Li, M.; Wang, J.; Zhang, H.; Zhou, Z.; Hu, S.; and Pei, X. 2024 b . Transferable Adversarial Facial Images for Privacy Protection. In Proceedings of the 32nd ACM International Conference on Multimedia (MM'24)

2024
[19]

Li, Y.; Tian, D.; Chang, M.-C.; Bian, X.; and Lyu, S. 2018. Robust adversarial perturbation on deep proposal-based models. arXiv:1809.05962

2018 arXiv
[20]

Lin, T.-Y.; Goyal, P.; Girshick, R.; He, K.; and Doll \'a r, P. 2017. Focal loss for dense object detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV'17), 2980--2988

2017
[21]

Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In Proceedings of the European Conference on Computer Vision (ECCV'14), 740--755

2014
[22]

Luo, C.; Lin, Q.; Xie, W.; Wu, B.; Xie, J.; and Shen, L. 2022. Frequency-driven imperceptible adversarial attack on semantic similarity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22), 15315--15324

2022
[23]

Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In Proceedings of the International Conference on Learning Representations (ICLR'18)

2018
[24]

Moosavi-Dezfooli, S.-M.; Fawzi, A.; and Frossard, P. 2016. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR'16), 2574--2582

2016
[25]

Peng, Z.; Li, S.; Chen, G.; Zhang, C.; Zhu, H.; and Xue, M. 2022. Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22), 13430--13439

2022
[26]

Qin, Y.; Zhang, K.; and Pan, H. 2023. Adversarial attack for object detectors under complex conditions. Computers & Security, 134: 103460

2023
[27]

K.; Swapna, K.; Datta, D.; and Rajest, S

Ramesh, K.; Kumar, G. K.; Swapna, K.; Datta, D.; and Rajest, S. S. 2021. A review of medical image segmentation algorithms. EAI Endorsed Transactions on Pervasive Health and Technology, 7(27): e6--e6

2021
[28]

Redmon, J.; Divvala, S.; Girshick, R.; and Farhadi, A. 2016. You only look once: Unified, real-time object detection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR'16), 779--788

2016
[29]

Ren, S.; He, K.; Girshick, R.; and Sun, J. 2015. Faster r-cnn: Towards real-time object detection with region proposal networks. In Proceedings of the 29th Advances in Neural Information Processing Systems (NeurIPS'15)

2015
[30]

Song, Y.; Zhou, Z.; Li, M.; Wang, X.; Deng, M.; Wan, W.; Hu, S.; and Zhang, L. Y. 2025. PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP'25)

2025
[31]

Sun, P.; Zhang, R.; Jiang, Y.; Kong, T.; Xu, C.; Zhan, W.; Tomizuka, M.; Li, L.; Yuan, Z.; Wang, C.; and Luo, P. 2021. Sparse r-cnn: End-to-end object detection with learnable proposals. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR...

2021
[32]

Tabernik, D.; and Sko c aj, D. 2019. Deep learning for large-scale traffic-sign detection and recognition. IEEE Transactions on Intelligent Transportation Systems, 21(4): 1427--1440

2019
[33]

Tang, G.; Jiang, T.; Zhou, W.; Li, C.; Yao, W.; and Zhao, Y. 2023. Adversarial patch attacks against aerial imagery object detectors. Neurocomputing, 537: 128--140

2023
[34]

Tian, Z.; Shen, C.; Chen, H.; and He, T. 2019. Fcos: Fully convolutional one-stage object detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'19), 9627--9636

2019
[35]

Tramer, F.; and Boneh, D. 2019. Adversarial training and robustness for multiple perturbations. In Proceedings of the 33rd Advances in Neural Information Processing Systems (NeurIPS'19)

2019
[36]

C.; and Lin, D

Wang, J.; Zhang, W.; Cao, Y.; Chen, K.; Pang, J.; Gong, T.; Shi, J.; Loy, C. C.; and Lin, D. 2020. Side-aware boundary localization for more precise object detection. In Proceedings of the European Conference on Computer Vision (ECCV'20), 403--419

2020
[37]

Wang, T.; Yao, Y.; Xu, F.; An, S.; Tong, H.; and Wang, T. 2022. An invisible black-box backdoor attack through frequency domain. In Proceedings of the European Conference on Computer Vision (ECCV'22), 396--413. Springer

2022
[38]

Wang, Y.; Chou, Y.; Zhou, Z.; Zhang, H.; Wan, W.; Hu, S.; and Li, M. 2025. Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature. In Proceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI'25)

2025
[39]

Wei, X.; Huang, Y.; Sun, Y.; and Yu, J. 2024. Unified Adversarial Patch for Visible-Infrared Cross-Modal Attacks in the Physical World. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(4): 2348--2363

2024
[40]

Wei, X.; Liang, S.; Chen, N.; and Cao, X. 2018. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641

2018 arXiv
[41]

Wei, X.; Yu, J.; and Huang, Y. 2023. Physically adversarial infrared patches with learnable shapes and locations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23), 12334--12342

2023
[42]

Xie, C.; Wang, J.; Zhang, Z.; Zhou, Y.; Xie, L.; and Yuille, A. 2017. Adversarial Examples for Semantic Segmentation and Object Detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV'17)

2017
[43]

Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L. 2019. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'19), 2730--2739

2019
[44]

Xie, X.; Cheng, G.; Wang, J.; Yao, X.; and Han, J. 2021. Oriented R-CNN for object detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'21), 3520--3529

2021
[45]

Xu, Y.; Fu, M.; Wang, Q.; Wang, Y.; Chen, K.; Xia, G.-S.; and Bai, X. 2020. Gliding vertex on the horizontal bounding box for multi-oriented object detection. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1452--1459

2020
[46]

Yang, Z.; Liu, S.; Hu, H.; Wang, L.; and Lin, S. 2019. Reppoints: Point set representation for object detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'19), 9657--9666

2019
[47]

Ye, S.; Wang, S.; Wang, X.; Yuan, B.; Wen, W.; and Lin, X. 2018. Defending DNN adversarial attacks with pruning and logits augmentation. In Proceedings of the IEEE Global Conference on Signal and Information Processing (GlobalSIP'18)

2018
[48]

YOLO-V5. 2022. Available online: https://doi.org/10.5281/zenodo.4679653 (V5.0). Accessed on 1 April 2022

2022 doi
[49]

Zhang, H.; Wang, Y.; Dayoub, F.; and Sunderhauf, N. 2021. Varifocalnet: An iou-aware dense object detector. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21), 8514--8523

2021
[50]

Y.; Shi, J.; Li, M.; Liu, X.; and Jin, H

Zhang, Y.; Hu, S.; Zhang, L. Y.; Shi, J.; Li, M.; Liu, X.; and Jin, H. 2024. Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferability. In Proceedings of the 45th IEEE Symposium on Security and Privacy (S&P'24)

2024
[51]

Zheng, L.; Zhang, H.; Sun, S.; Chandraker, M.; Yang, Y.; and Tian, Q. 2017. Person re-identification in the wild. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR'17), 1367--1376

2017
[52]

Zhou, Z.; Hu, S.; Li, M.; Zhang, H.; Zhang, Y.; and Jin, H. 2023 a . Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In Proceedings of the 31st ACM International Conference on Multimedia (MM'23), 6311--6320

2023
[53]

Y.; Hou, J.; and Jin, H

Zhou, Z.; Hu, S.; Zhao, R.; Wang, Q.; Zhang, L. Y.; Hou, J.; and Jin, H. 2023 b . Downstream-agnostic adversarial examples. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'23), 4345--4355

2023
[54]

Y.; Yao, D.; and Jin, H

Zhou, Z.; Li, M.; Liu, W.; Hu, S.; Zhang, Y.; Wan, W.; Xue, L.; Zhang, L. Y.; Yao, D.; and Jin, H. 2024 a . Securely Fine-tuning Pre-trained Encoders Against Adversarial Examples. In Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP'24)

2024
[55]

Y.; Yao, D.; and Jin, H

Zhou, Z.; Song, Y.; Li, M.; Hu, S.; Wang, X.; Zhang, L. Y.; Yao, D.; and Jin, H. 2024 b . Darksam: Fooling segment anything model to segment nothing. In Proceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS'24)

2024
[56]

Zhu, M.; and Gupta, S. 2017. To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint arXiv:1710.01878

2017 arXiv
[57]

Zhu, X.; Su, W.; Lu, L.; Li, B.; Wang, X.; and Dai, J. 2020. Deformable DETR : Deformable Transformers for End-to-End Object Detection. In Proceedings of the International Conference on Learning Representations (ICLR'20)

2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Aich, A.; Ta, C.-K.; Gupta, A.; Song, C.; Krishnamurthy, S.; Asif, S.; and Roy-Chowdhury, A. 2022. Gama: Generative adversarial multi-object scene attacks. In Proceedings of the 36th Advances in Neural Information Processing Systems (NeurIPS'22), 36914--36930

work page 2022

[4] [4]

Cai, Z.; and Vasconcelos, N. 2019. Cascade R-CNN: high quality object detection and instance segmentation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1483--1498

work page 2019

[5] [5]

Carlini, N.; and Wagner, D. 2017. Towards evaluating the robustness of neural networks. In Proceedings of the IEEE Symposium on Security and Privacy (SP'17), 39--57

work page 2017

[6] [6]

Chen, P.-C.; Kung, B.-H.; and Chen, J.-C. 2021. Class-aware robust adversarial training for object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'21), 10420--10429

work page 2021

[7] [7]

E.; Truex, S.; Wei, W.; and Wu, Y

Chow, K.-H.; Liu, L.; Loper, M.; Bae, J.; Gursoy, M. E.; Truex, S.; Wei, W.; and Wu, Y. 2020. Adversarial objectness gradient attacks in real-time object detection systems. In Proceedings of the 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA'20), 263--272

work page 2020

[8] [8]

Ding, J.; Xue, N.; Long, Y.; Xia, G.-S.; and Lu, Q. 2019. Learning RoI transformer for oriented object detection in aerial images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'19), 2849--2858

work page 2019