Pith. sign in

REVIEW 4 major objections 5 minor 48 references

Uncertainty Quantification for Collaborative Object Detection Under Adversarial Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding a learned uncertainty head and conformal calibration to collaborative object detection models improves their accuracy under white-box adversarial attacks by an average of 80.41% on the V2X-Sim driving benchmark.

desk verdict A useful combination of adversarial training and UQ for collaborative perception, but the missing adversarial-training-only control leaves the headline 'UQ matters' claim untested. read the letter →

arxiv 2502.02537 v1 pith:JFDYCK6U submitted 2025-02-04 cs.CV cs.LG

Huiqun Huang , Cong Chen , Jean-Philippe Monteuuis , Jonathan Petit , Fei Miao This is my paper · ORCID
classification cs.CVcs.LG
keywords collaborativeobjectdetectionadversarialattacksuncertaintyquantificationconformalpredictiontrainingPGDattackautonomousdrivingmulti-agentperception
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a trust layer—recalibrated uncertainty estimates—can make collaborative object detection models substantially more robust to adversarial attacks. Collaborative object detection lets several vehicles share raw sensor data or mid-level features to detect objects together, but a maliciously perturbed message from one agent can distort another agent's detections. The proposed TUQCP framework trains an existing detector with PGD-perturbed shared information, adds a lightweight uncertainty head that predicts per-vertex variance for each bounding box, and calibrates that variance with conformal prediction. On the V2X-Sim autonomous-driving benchmark, the paper reports an average 80.41% improvement in detection accuracy over attacked baseline models. The claim matters because safety-critical systems like self-driving cars need both accurate and trustworthy perception under attack.

What carries the argument

The argument rides on three mechanisms working together. First, PGD adversarial training generates perturbations on the shared information of $M$ randomly selected agents during training, so the model learns from attacked inputs. Second, a learning-based uncertainty head $F^1_\omega$, sharing the regression head's structure, outputs a $J\times J$ variance for each bounding-box vertex and is trained with an additional KLD-based uncertainty loss $L_{UQ}(\omega,\theta)$ (Eq. 4–5) to minimize variance while fitting the ground truth. Third, conformal calibration computes scores $s(x,y)=|y-f_\theta(x)|/F^1_\omega(x)$ on a validation set and takes their $(1-\alpha)$ quantile $\hat{q}$, turning the learned uncertainty into calibrated intervals $f_\theta(x) \pm \hat{q} F^1_\omega(x)$. The calibrated quantile is what carries the trustworthiness claim.

What would settle it

Train DiscoNet with the same PGD adversarial training and the same loss weights but remove the uncertainty head and $L_{UQ}$; if the resulting AP@IoU=0.5 under the same PGD test matches DiscoNet+TUQCP's 47.74 (Table 3), then the claim that uncertainty quantification drives the robustness gain is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that uncertainty quantification is not just a diagnostic add-on for collaborative object detection; it is an active defense mechanism. Under white-box PGD attacks, where the attacker knows the full model, TUQCP adds perturbations to the shared information of randomly selected agents during training. The detector and a learning-based uncertainty head $F^1_\omega$ are then trained jointly, with an additional Kullback-Leibler divergence loss $L_{UQ}$ (Eq. 4–5) that penalizes large predicted variance and location error. The learned uncertainty is calibrated by split conformal prediction on a validation set, producing a quantile $\hat{q}$ and prediction intervals $f_\theta(x) \pm \hat{q} F^1_\omega(x)$ with coverage near $1-\alpha$. Across early-collaboration, intermediate-collaboration, and single-agent models, the paper reports consistent accuracy gains under the same PGD attacks, culminating in the 80.41% average improvement.

Load-bearing premise

The load-bearing premise is that the observed accuracy gains come from the uncertainty-quantification components—the learned variance head and its loss term—rather than from the PGD adversarial training alone, and the paper's experiments do not include an adversarial-training-only control to test that premise.

Editorial extensions

If this is right

  • Existing COD models can gain adversarial robustness without any change to their detection architecture; the defense is added at training time and through an auxiliary head.
  • The same framework is claimed to work across collaboration modes—early raw-data sharing, intermediate feature sharing, and single-agent detection—suggesting the defense is model-agnostic.
  • The conformal calibration gives a finite-sample coverage guarantee for the predicted bounding-box locations, which is precisely what a downstream planner would need to treat detections as intervals rather than points.
  • The trained model retains comparable accuracy when attacked with different PGD objectives at test time (classification loss, regression loss, and combined loss), indicating some robustness to attack variation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An ablation the paper does not run—adversarial training alone, without the uncertainty head and $L_{UQ}$—would determine whether the 80.41% gain comes from uncertainty quantification or from PGD training itself.
  • The conformal coverage guarantee is stated for a fixed model and validation set; an adaptive attacker who observes the calibrated interval and optimizes against it could violate the guarantee, which the paper does not test.
  • Because attackers are chosen randomly during training, a natural stronger test is worst-case subset selection; conversely, the framework could be extended by attacking the uncertainty head itself rather than the detection loss.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TUQCP, a wrapper framework for collaborative object detection (COD) models that combines PGD-based adversarial training, a learning-based uncertainty head (DM), an uncertainty loss term, and conformal prediction calibration. The authors evaluate TUQCP on V2X-Sim across intermediate-collaboration models (V2VNet, DiscoNet, When2com, CoMamba), an early-collaboration model (Upper-bound), and a single-agent detector (Lower-bound), reporting large improvements in AP under white-box PGD attacks, lower KLD/NLL values for the TUQCP variants, and an ablation over components of the framework.

Significance. If the results are reproducible and the attribution is correct, the paper would provide a modular, architecture-agnostic defense for collaborative perception that also outputs calibrated uncertainty intervals, which is useful for safety-critical autonomous driving. The strength of the paper is its breadth: the method is tested on six different detection architectures, and the conformal prediction component gives a distribution-free statistical guarantee in principle. However, the central attribution claim—that uncertainty quantification, rather than standard adversarial training, drives the robustness gains—is not isolated by the current experiments, and the reported uncertainty metrics are partly the same objectives used for training. These issues are fixable but require additional experiments and clearer reporting before the claims can be accepted.

major comments (4)
  1. [§4.4, Table 3] The ablation does not include the key control condition needed to support the abstract's claim that uncertainty quantification is important for adversarial robustness. Table 3 compares DiscoNet(PGD Test), DiscoNet+DM(PGD Test), DiscoNet+DM(PGD Train+Test), and DiscoNet+TUQCP, but there is no 'DiscoNet(PGD Train+Test)' row, i.e., a model trained with PGD adversarial training and without the DM uncertainty head or the LUQ loss of Eq. (3). As reported, the gain from 25.27 to 45.12 AP@0.5 could be produced by ordinary PGD adversarial training alone; the current comparisons attribute 7.92% to adversarial training on top of DM, but never test adversarial training without UQ. Please add an adversarial-training-only control and, if possible, an adversarial-training-plus-CP-but-no-DM condition.
  2. [Abstract and Table 1] The headline 80.41% improvement is not recoverable from Table 1 without an unspecified aggregation rule. Computing per-model relative AP improvements at IoU=0.5 gives an average of 72.9% across all six rows, at IoU=0.7 gives 75.7%, and the average over all 12 values is 74.3%. The value 80.41% is obtained only if the Lower-bound (single-agent) row is excluded and the two IoU-specific mean relative improvements are averaged. Please state the exact aggregation formula used for the headline number, and report the per-model and per-IoU improvements in the text or a table.
  3. [§3.4, Eq. (7), and Algorithm 1] The conformal prediction guarantee, as written, is void because the validation/calibration set D2 is used in training. Equation (2) defines the objective on D = {D1, D2}, Algorithm 1 line 7 updates the parameters using L(θ, ω|D), and line 6 computes the conformal quantile from D2 inside the training loop. Split conformal prediction requires the calibration data to be exchangeable with the test data and not used to fit the model; the paper's protocol therefore cannot deliver the coverage statement in Eq. (7). Please revise the training/calibration split (e.g., use a separate calibration set only after training is complete) and report empirical test-time coverage for α = 0.1.
  4. [§4.1, Eq. (4), and Eq. (8)] The uncertainty quality evaluation is partially circular. The paper reports KLD and NLL as uncertainty metrics, but Eq. (4) (KLD) is exactly the LUQ training loss and Eq. (8) (NLL) is the same Gaussian negative log-likelihood functional form. Reporting lower values of the training objective does not independently establish that the uncertainty estimates are calibrated or useful. Please complement the KLD/NLL numbers with empirical conformal coverage, interval widths, and, if possible, a comparison to the uncertainty estimates of a baseline COD model without the proposed UQ head.
minor comments (5)
  1. [Eq. (1)] The formal definition of the attack, [δm] = min_{δm} {arg max Lcls(...)}, is not meaningful as written because the minimization and argmax are nested incorrectly; Algorithm 2 gives the intended PGD procedure, but the equation should be rewritten to define the perturbation as the solution of a constrained maximization with the appropriate projection.
  2. [Algorithm 1] The algorithm computes the conformal quantile inside the per-epoch loop (line 6), which is confusing because calibration should be a post-training step. Please clarify whether the calibration set is used only once after training or repeatedly during training.
  3. [Figure 1 caption] The caption states that TUQCP quantifies the 'preliminary object detection uncertainty ˆp of each object', but the symbol should be ˆσ to match Section 3.3; this appears to be a typo.
  4. [Table 2] The rows for PGD(Cla) and PGD(Cla+Loc) report identical AP values (47.74 and 42.08) and nearly identical KLD/NLL values; please clarify whether the two attack objectives produce different perturbations, and if so why the results coincide.
  5. [General] All results are single-run point estimates with no standard deviations or multiple seeds; given that the headline claims are large percentage improvements, reporting variability would increase confidence.

Circularity Check

1 steps flagged · score 2.0 of 10

Accuracy claim is benchmarked externally, but the uncertainty-reduction metric is the same objective minimized during training.

  1. self definitional [Sec. 3.3 Eq. (4) (training loss) and Sec. 4.1 "Uncertainty Evaluation Metrics" (KLD/NLL metrics)]
    "We introduce the Kullback–Leibler divergence (KLD) ... as additional loss term ... LUQ(ω,θ) = ... ((yi,h,k − ˆyi,h,k)^2)/(2ˆσ^2_i,h,k) + log(|ˆσ_i,h,k|). ... To verify the performance of TUQCP in reducing the estimated uncertainty, we adopt the KLD and Negative Log-Likelihood (NLL) ... we calculate the average KLD as Eq. 4"

    The quantity reported as evidence of reduced uncertainty is the training objective itself. The average KLD is defined by reference to Eq. 4, which is exactly the LUQ term minimized in Eq. (3), and NLL in Eq. (8) is the same Gaussian negative log-likelihood up to constants. Minimizing LUQ over θ and ω during training directly optimizes the KLD/NLL numbers later presented as validation, so the claimed reduction in detection uncertainty is partly a restatement of the training objective rather than an independent test of whether UQ improves robustness. The AP improvements against external attacked baselines remain independent, so the headline accuracy claim is not circular.

full rationale

The headline 80.41% AP improvement is computed against external attacked baselines (V2VNet, DiscoNet, When2com, CoMamba, Upper-bound, Lower-bound), so that central claim is not circular. The only self-referential element is the uncertainty evaluation: KLD (Eq. 4) and NLL (Eq. 8) are the same objectives used in the training loss of Eq. (3), making the reported uncertainty reduction largely a reflection of the training loss. Separately, the ablation in Table 3 lacks an adversarial-training-only control (DiscoNet trained with PGD but without the DM head or LUQ), so the paper's attribution of robustness gains to UQ is experimentally underdetermined; that is a missing control rather than a circular derivation. No load-bearing self-citation was found: the cited prior UQ works are background and do not force the framework's design. Overall, the central accuracy claim has independent content, and the self-reference is limited to a secondary metric, warranting a low circularity score.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method's central results rest on a standard Gaussian uncertainty model, PGD adversarial training, and split conformal prediction. The main empirical claims depend on unstated loss weights and a specific threat model; no code or data is released, so the assumptions are hard to audit independently.

free parameters (6)
  • Loss weights w1, w2, w3 (Eq. 3)
    Weights balancing regression, classification, and UQ losses; values are not disclosed, so the training objective is underspecified and likely tuned on the validation set.
  • Conformal error rate alpha = 0.1
    User-chosen target coverage level; the paper does not report empirical coverage of the conformal intervals on the test set.
  • PGD perturbation budget epsilon = 0.5 (0.3 for When2com)
    Attack strength during adversarial training and testing; Table 4 shows AP collapses at epsilon=0.9, so the headline gains are sensitive to this choice.
  • PGD iterations K = 25
    Number of attack refinement steps; sensitivity results at K=15 and K=35 differ by several AP points.
  • Number of malicious agents M = 2
    Fraction of attackers in each scene; robustness is demonstrated only for 2 of 6 agents being malicious.
  • PGD learning rate eta = 0.1
    Step size for attack generation; together with epsilon and K it defines the effective attack strength.
assumptions (5)
  • domain assumption Each variable of every bounding box vertex is independent and follows a single-variate Gaussian distribution (Section 3.1).
    This distributional assumption defines the uncertainty head and the KLD/NLL losses; if the true error distribution is not Gaussian, the uncertainty estimates are misspecified.
  • domain assumption Ground truth bounding box vertices are Dirac delta functions (Section 3.3).
    Used to derive the KL divergence uncertainty loss; this is a common object detection approximation but still a modeling choice.
  • domain assumption Validation and test data are exchangeable for split conformal prediction (Section 3.4).
    The conformal coverage guarantee in Eq. 7 requires exchangeability; the paper does not analyze distribution shift across V2X-Sim scenes.
  • domain assumption Attackers have white-box access and only add bounded perturbations to the to-be-shared information (Section 3.1).
    The threat model excludes adaptive attacks that target the uncertainty head or corrupt the ego agent's own data; robustness claims are scoped to this attack class.
  • domain assumption PGD with a fixed budget is an adequate surrogate for the minimal perturbation in Eq. 1.
    The optimization in Eq. 1 is written as a min over arg max, but the implementation uses standard PGD, which only approximates the worst-case perturbation within the budget.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Uncertainty Quantification for Collaborative Object Detection Under Adversarial Attacks." pith.science (2026). https://pith.science/paper/JFDYCK6U

@misc{pith2026250202537,
  author       = {Pith},
  title        = {Pith review of: Uncertainty Quantification for Collaborative Object Detection Under Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JFDYCK6U}},
  note         = {Machine review of arXiv:2502.02537}
}
read the original abstract

Collaborative Object Detection (COD) and collaborative perception can integrate data or features from various entities, and improve object detection accuracy compared with individual perception. However, adversarial attacks pose a potential threat to the deep learning COD models, and introduce high output uncertainty. With unknown attack models, it becomes even more challenging to improve COD resiliency and quantify the output uncertainty for highly dynamic perception scenes such as autonomous vehicles. In this study, we propose the Trusted Uncertainty Quantification in Collaborative Perception framework (TUQCP). TUQCP leverages both adversarial training and uncertainty quantification techniques to enhance the adversarial robustness of existing COD models. More specifically, TUQCP first adds perturbations to the shared information of randomly selected agents during object detection collaboration by adversarial training. TUQCP then alleviates the impacts of adversarial attacks by providing output uncertainty estimation through learning-based module and uncertainty calibration through conformal prediction. Our framework works for early and intermediate collaboration COD models and single-agent object detection models. We evaluate TUQCP on V2X-Sim, a comprehensive collaborative perception dataset for autonomous driving, and demonstrate a 80.41% improvement in object detection accuracy compared to the baselines under the same adversarial attacks. TUQCP demonstrates the importance of uncertainty quantification to COD under adversarial attacks.

Figures

Figures reproduced from arXiv: 2502.02537 by the authors.

Figure 1
Figure 1. TUQCP randomly selects M agents as attackers and generates minimum perturbation δm to the shared information Fm of each attacker to the ego-agent, such thatthe object detection error is maximized. Besides predicting the classification probability pˆ and the location yˆ of targeted objects by the COD model, TUQCP quantifies the preliminary object detection uncertainty pˆ of each object through the proposed learning-b… view at source ↗
Figure 2
Figure 2. Visualization of the object detection results of base model ( [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 37 canonical work pages

  1. [1]

    Lidar spoofing attack detection in autonomous vehicles

    [Alheeti et al., 2022] Khattab M Ali Alheeti, Abdulkareem Alzahrani, and Duaa Al Dosary. Lidar spoofing attack detection in autonomous vehicles. In 2022 IEEE ICCE , pages 1–2. IEEE,

    work page 2022

  2. [4]

    Adversarial objectness gradient at- tacks in real-time object detection systems

    [Chow et al., 2020] Ka-Ho Chow, Ling Liu, Margaret Loper, Juhyun Bae, Mehmet Emre Gursoy, Stacey Truex, Wenqi Wei, and Yanzhao Wu. Adversarial objectness gradient at- tacks in real-time object detection systems. In 2020 Second IEEE TPS-ISA, pages 263–272. IEEE,

    work page 2020

  3. [7]

    Detect- ing adversarial samples from artifacts

    [Feinman et al., 2017] Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detect- ing adversarial samples from artifacts. arXiv preprint arXiv:1703.00410,

    arXiv 2017

  4. [9]

    Explaining and harnessing adver- sarial examples

    [Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. arXiv preprint arXiv:1412.6572,

    arXiv 2014

  5. [11]

    Bounding box re- gression with uncertainty for accurate object detection

    [He et al., 2019] Yihui He, Chenchen Zhu, Jianren Wang, Marios Savvides, and Xiangyu Zhang. Bounding box re- gression with uncertainty for accurate object detection. In IEEE/CVF CVPR, pages 2888–2897,

    work page 2019

  6. [13]

    Ad- versarial attack and defense of yolo detectors in au- tonomous driving scenarios

    [Im Choi and Tian, 2022] Jung Im Choi and Qing Tian. Ad- versarial attack and defense of yolo detectors in au- tonomous driving scenarios. In IEEE Intelligent Vehicles Symposium (IV), pages 1011–1017,

    work page 2022

  7. [14]

    [Jasour and Williams, 2019] Ashkan M. Z. Jasour and Brian Charles Williams. Risk contours map for risk bounded motion planning under perception uncertainties. Robotics: Science and Systems,

    work page 2019

  8. [15]

    Dropout infer- ence in bayesian neural networks with alpha-divergences

    [Li and Gal, 2017] Yingzhen Li and Yarin Gal. Dropout infer- ence in bayesian neural networks with alpha-divergences. In ICML, pages 2052–2061. PMLR,

    work page 2017

Show all 48 references
  1. [16]

    Connecting the dots: Detecting adversarial perturbations using context inconsis- tency

    [Li et al., 2020] Shasha Li, Shitong Zhu, Sudipta Paul, Amit Roy-Chowdhury, Chengyu Song, Srikanth Krishnamurthy, Ananthram Swami, and Kevin S Chan. Connecting the dots: Detecting adversarial perturbations using context inconsis- tency. In ECCV 2020, pages 396–413. Springer,

    2020

  2. [17]

    Learn- ing distilled collaboration graph for multi-agent percep- tion

    [Li et al., 2021] Yiming Li, Shunli Ren, Pengxiang Wu, Si- heng Chen, Chen Feng, and Wenjun Zhang. Learn- ing distilled collaboration graph for multi-agent percep- tion. Advances in Neural Information Processing Systems, 34:29541–29552,

    2021

  3. [18]

    V2x-sim: Multi-agent collaborative perception dataset and bench- mark for autonomous driving

    [Li et al., 2022] Yiming Li, Dekun Ma, Ziyan An, Zixun Wang, Yiqi Zhong, Siheng Chen, and Chen Feng. V2x-sim: Multi-agent collaborative perception dataset and bench- mark for autonomous driving. IEEE Robotics and Automa- tion Letters,

    2022

  4. [19]

    Among us: Adversarially robust collaborative perception by consensus

    [Li et al., 2023] Yiming Li, Qi Fang, Jiamu Bai, Siheng Chen, Felix Juefei-Xu, and Chen Feng. Among us: Adversarially robust collaborative perception by consensus. InIEEE/CVF ICCV, pages 186–195,

    2023

  5. [20]

    Co- mamba: Real-time cooperative perception unlocked with state space models

    [Li et al., 2024] Jinlong Li, Xinyu Liu, Baolu Li, Runsheng Xu, Jiachen Li, Hongkai Yu, and Zhengzhong Tu. Co- mamba: Real-time cooperative perception unlocked with state space models. arXiv preprint arXiv:2409.10699,

    2024 arXiv

  6. [22]

    Adversarial examples that fool detectors

    [Lu et al., 2017] Jiajun Lu, Hussein Sibai, and Evan Fabry. Adversarial examples that fool detectors. arXiv preprint arXiv:1712.02494,

    2017 arXiv

  7. [23]

    Probabilistic object detection via deep ensembles

    [Lyu et al., 2020] Zongyao Lyu, Nolan Gutierrez, Aditya Ra- jguru, and William J Beksi. Probabilistic object detection via deep ensembles. In 2020 ECCV, pages 67–75. Springer,

    2020

  8. [24]

    Detecting adversarial attacks on audiovisual speech recognition

    [Ma et al., 2021] Pingchuan Ma, Stavros Petridis, and Maja Pantic. Detecting adversarial attacks on audiovisual speech recognition. In IEEE ICASSP, pages 6403–6407,

    2021

  9. [25]

    Uncertainty-based detection of adversarial attacks in se- mantic segmentation

    [Maag and Fischer, 2023] Kira Maag and Asja Fischer. Uncertainty-based detection of adversarial attacks in se- mantic segmentation. arXiv preprint arXiv:2305.12825,

    2023

  10. [26]

    Towards deep learning models resistant to adversarial attacks

    [Madry, 2017] Aleksander Madry. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083,

    2017 arXiv

  11. [27]

    Learning an uncertainty-aware object de- tector for autonomous driving

    [Meyer and Thakurdesai, 2020] Gregory P Meyer and Niran- jan Thakurdesai. Learning an uncertainty-aware object de- tector for autonomous driving. In IEEE/RSJ International Conference on IROS, pages 10521–10527,

    2020

  12. [28]

    Dropout sampling for ro- bust object detection in open-set conditions

    [Miller et al., 2018] Dimity Miller, Lachlan Nicholson, Feras Dayoub, and Niko S¨underhauf. Dropout sampling for ro- bust object detection in open-set conditions. In 2018 IEEE ICRA, pages 3243–3249. IEEE,

    2018

  13. [30]

    Adversarial phenomenon in the eyes of bayesian deep learning

    [Rawat et al., 2017] Ambrish Rawat, Martin Wistuba, and Maria-Irina Nicolae. Adversarial phenomenon in the eyes of bayesian deep learning. arXiv preprint arXiv:1711.08244,

    2017 arXiv

  14. [31]

    3d semantic scene completion: A survey

    [Roldao et al., 2022] Luis Roldao, Raoul De Charette, and Anne Verroust-Blondet. 3d semantic scene completion: A survey. International Journal of Computer Vision , 130(8):1978–2005,

    2022

  15. [32]

    Using uncertainty as a defense against adversarial attacks for tabular datasets

    [Santhosh et al., 2022] Poornima Santhosh, Gilad Gressel, and Michael C Darling. Using uncertainty as a defense against adversarial attacks for tabular datasets. In Aus- tralasian Joint Conference on Artificial Intelligence, pages 719–732. Springer,

    2022

  16. [33]

    A tutorial on conformal prediction

    [Shafer and V ovk, 2008] Glenn Shafer and Vladimir V ovk. A tutorial on conformal prediction. Journal of Machine Learning Research, 9(3),

    2008

  17. [35]

    Uncertainty quantification of collaborative detection for self-driving

    [Su et al., 2023] Sanbao Su, Yiming Li, Sihong He, Songyang Han, Chen Feng, Caiwen Ding, and Fei Miao. Uncertainty quantification of collaborative detection for self-driving. In ICRA,

    2023

  18. [36]

    Collab- orative multi-object tracking with conformal uncertainty propagation

    [Su et al., 2024] Sanbao Su, Songyang Han, Yiming Li, Zhili Zhang, Chen Feng, Caiwen Ding, and Fei Miao. Collab- orative multi-object tracking with conformal uncertainty propagation. IEEE Robotics and Automation Letters,

    2024

  19. [37]

    Towards robust {LiDAR-based} per- ception in autonomous driving: General black-box adversar- ial sensor attack and countermeasures

    [Sun et al., 2020] Jiachen Sun, Yulong Cao, Qi Alfred Chen, and Z Morley Mao. Towards robust {LiDAR-based} per- ception in autonomous driving: General black-box adversar- ial sensor attack and countermeasures. In USENIX Security 20, pages 877–894,

    2020

  20. [38]

    Adversarial attacks on multi-agent communication

    [Tu et al., 2021] James Tu, Tsunhsuan Wang, Jingkang Wang, Sivabalan Manivasagam, Mengye Ren, and Raquel Urta- sun. Adversarial attacks on multi-agent communication. In IEEE/CVF ICCV, pages 7768–7777,

    2021

  21. [39]

    V2vnet: Vehicle-to-vehicle communi- cation for joint perception and prediction

    [Wang et al., 2020] Tsun-Hsuan Wang, Sivabalan Mani- vasagam, Ming Liang, Bin Yang, Wenyuan Zeng, and Raquel Urtasun. V2vnet: Vehicle-to-vehicle communi- cation for joint perception and prediction. In 2020 ECCV, pages 605–621,

    2020

  22. [40]

    Characterizing adver- sarial examples based on spatial consistency information for semantic segmentation

    [Xiao et al., 2018] Chaowei Xiao, Ruizhi Deng, Bo Li, Fisher Yu, Mingyan Liu, and Dawn Song. Characterizing adver- sarial examples based on spatial consistency information for semantic segmentation. In ECCV 2018, pages 217–234,

    2018

  23. [41]

    Advit: Adversarial frames identifier based on temporal consistency in videos

    [Xiao et al., 2019] Chaowei Xiao, Ruizhi Deng, Bo Li, Tae- sung Lee, Benjamin Edwards, Jinfeng Yi, Dawn Song, Mingyan Liu, and Ian Molloy. Advit: Adversarial frames identifier based on temporal consistency in videos. In IEEE/CVF ICCV, pages 3968–3977,

    2019

  24. [42]

    Adversarial examples for semantic segmentation and object detection

    [Xie et al., 2017] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In IEEE/CVF ICCV, pages 1369–1378,

    2017

  25. [43]

    Bridging the domain gap for multi-agent perception

    [Xu et al., 2022a] Runsheng Xu, Jinlong Li, Xiaoyu Dong, Hongkai Yu, and Jiaqi Ma. Bridging the domain gap for multi-agent perception. arXiv preprint arXiv:2210.08451,

    arXiv

  26. [44]

    V2x-vit: Vehicle-to-everything cooperative perception with vision transformer

    [Xu et al., 2022b] Runsheng Xu, Hao Xiang, Zhengzhong Tu, Xin Xia, Ming-Hsuan Yang, and Jiaqi Ma. V2x-vit: Vehicle-to-everything cooperative perception with vision transformer. In 2022 ECCV,

    2022

  27. [45]

    Uncertainty-aware sar atr: Defending against adversarial attacks via bayesian neural networks

    [Ye et al., 2024] Tian Ye, Rajgopal Kannan, Viktor Prasanna, and Carl Busart. Uncertainty-aware sar atr: Defending against adversarial attacks via bayesian neural networks. In 2024 IEEE Radar Conference, pages 1–6. IEEE,

    2024

  28. [46]

    Adc: Adversarial attacks against object de- tection that evade context consistency checks

    [Yin et al., 2022] Mingjun Yin, Shasha Li, Chengyu Song, M Salman Asif, Amit K Roy-Chowdhury, and Srikanth V Krishnamurthy. Adc: Adversarial attacks against object de- tection that evade context consistency checks. InIEEE/CVF WACV, pages 3278–3287,

    2022

  29. [47]

    Towards adversarially robust object detection

    [Zhang and Wang, 2019] Haichao Zhang and Jianyu Wang. Towards adversarially robust object detection. In IEEE/CVF ICCV, pages 421–430,

    2019

  30. [48]

    Improving generalization of adversarial training via robust critical fine-tuning

    [Zhu et al., 2023] Kaijie Zhu, Xixu Hu, Jindong Wang, Xing Xie, and Ge Yang. Improving generalization of adversarial training via robust critical fine-tuning. In IEEE/CVF ICCV, pages 4424–4434, 2023

    2023

  31. [2008]

    Under- standing measures of uncertainty for adversarial example detection

    [Smith and Gal, 2018] Lewis Smith and Yarin Gal. Under- standing measures of uncertainty for adversarial example detection. arXiv preprint arXiv:1803.08533,

    2018 arXiv

  32. [2014]

    Shadow-catcher: Looking into shadows to detect ghost objects in au- tonomous vehicle 3d sensing

    [Hau et al., 2021] Zhongyuan Hau, Soteris Demetriou, Luis Mu˜noz-Gonz´alez, and Emil C Lupu. Shadow-catcher: Looking into shadows to detect ghost objects in au- tonomous vehicle 3d sensing. In Computer Security– ESORICS, pages 691–711,

    2021

  33. [2017]

    A review and comparative study on probabilistic object detection in autonomous driving

    [Feng et al., 2021] Di Feng, Ali Harakeh, Steven L Waslan- der, and Klaus Dietmayer. A review and comparative study on probabilistic object detection in autonomous driving. IEEE TITS, 23(8):9961–9980,

    2021

  34. [2018]

    Can you trust your model’s uncertainty? evaluating predictive uncertainty under dataset shift

    [Ovadia et al., 2019] Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, David Sculley, Sebastian Nowozin, Joshua Dillon, Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model’s uncertainty? evaluating predictive uncertainty under dataset shift. Advances in neura...

    2019

  35. [2019]

    Robust multi- agent reinforcement learning with state uncertainty

    [He et al., 2023] Sihong He, Songyang Han, Sanbao Su, Shuo Han, Shaofeng Zou, and Fei Miao. Robust multi- agent reinforcement learning with state uncertainty. TMLR,

    2023

  36. [2020]

    Guaranteeing safety of learned perception modules via measurement-robust con- trol barrier functions

    [Dean et al., 2021] Sarah Dean, Andrew Taylor, Ryan Cosner, Benjamin Recht, and Aaron Ames. Guaranteeing safety of learned perception modules via measurement-robust con- trol barrier functions. In CoRL, pages 654–670,

    2021

  37. [2021]

    Improving out-of- distribution detection via epistemic uncertainty adversarial training

    [Everett et al., 2022] Derek Everett, Andre T Nguyen, Luke E Richards, and Edward Raff. Improving out-of- distribution detection via epistemic uncertainty adversarial training. arXiv preprint arXiv:2209.03148,

    2022 arXiv

  38. [2022]

    Conformal pid control for time series prediction

    [Angelopoulos et al., 2023] Anastasios N Angelopoulos, Em- manuel J Candes, and Ryan J Tibshirani. Conformal pid control for time series prediction. arXiv preprint arXiv:2307.16895,

    2023 arXiv

  39. [2023]

    Analyzing infrastructure lidar placement with realistic lidar simulation library

    [Cai et al., 2023] Xinyu Cai, Wentao Jiang, Runsheng Xu, Wenquan Zhao, Jiaqi Ma, Si Liu, and Yikang Li. Analyzing infrastructure lidar placement with realistic lidar simulation library. In ICRA, pages 5581–5587,

    2023

  40. [2024]

    When2com: Multi-agent percep- tion via communication graph grouping

    [Liu et al., 2020] Yen-Cheng Liu, Junjiao Tian, Nathaniel Glaser, and Zsolt Kira. When2com: Multi-agent percep- tion via communication graph grouping. In IEEE/CVF Conference on CVPR, pages 4106–4115,

    2020

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.