Source-linked AI summary
Towards Adversarially Robust Object Detection
Haichao Zhang, Jianyu Wang
TL;DR
Object detectors are vulnerable to adversarial attacks, while methods for improving their robustness remain limited. The paper analyzes attacks through a multi-task perspective and develops adversarial training using multiple task-oriented attack sources. Experiments across datasets, attacks, backbones, and architectures demonstrate improved robustness over standard training, while small objects and clean-image robustness remain challenges.
Problem
Object detectors are vulnerable to adversarial attacks, but comparatively few efforts address how to improve their robustness and how individual task losses affect it.
Method
The paper analyzes detector attacks through classification and localization tasks and develops adversarial training with multiple task sources and task-oriented domain constraints.
Results
Experiments on PASCAL-VOC and MS-COCO show improved robustness over standard models across attacks, datasets, backbones, and detector architectures.
Takeaways & Limitations
Adversarial training can improve detector robustness across varied attacks and detector settings when task interactions are handled explicitly.
Takeaways & Limitations
Remaining challenges include small objects, visually confusing appearances, inaccurate predictions, and a trade-off between clean-image accuracy and robustness.
Abstract
from arXiv · showhide
Object detection is an important vision task and has emerged as an indispensable component in many vision system, rendering its robustness as an increasingly important performance factor for practical applications. While object detection models have been demonstrated to be vulnerable against adversarial attacks by many recent works, very few efforts have been devoted to improving their robustness. In this work, we take an initial attempt towards this direction. We first revisit and systematically analyze object detectors and many recently developed attacks from the perspective of model robustness. We then present a multi-task learning perspective of object detection and identify an asymmetric role of task losses. We further develop an adversarial training approach which can leverage the multiple sources of attacks for improving the robustness of detection models. Extensive experiments on PASCAL-VOC and MS-COCO verified the effectiveness of the proposed approach.
1. Introduction
Object detectors are important in real-world vision systems but remain vulnerable to adversarial inputs. This work analyzes detector attacks and develops adversarial training to improve robustness.
- Object detection outputs both semantic labels and object locations, extending image classification for vision systems.
- Figure 1 contrasts standard and robust detectors on clean and adversarial images under a perturbation budget of 8 out of 256.
- Adversarially crafted inputs can attack object detectors, creating a need for defenses in applications such as surveillance and autonomous driving.
- The paper analyzes attack mechanisms, task-loss interactions, and adversarial training for robust detection.
2. Related Work
Prior work established adversarial attacks and defenses for classifiers and developed one- and two-stage object detectors alongside detector-specific attacks. This paper focuses on one-stage detectors.
- FGSM and PGD are representative white-box adversarial attacks for classifiers, while adversarial training is an established defense.
- Object detection research includes one-stage and two-stage detectors, with two-stage methods refining proposals through one or more steps.
- The paper focuses on one-stage detectors because of their essential role across detector variants.
3. Object Detection and Attacks Revisited
The paper revisits detection as a multi-task problem in which classification and localization share computation, then organizes attacks by their use of task losses. It identifies limited understanding of how individual task components affect robustness.
- Object Detection as Multi-Task Learning: A one-stage detector shares a base network between classification and localization, with separate task parameters and training losses.
- Object Detection as Multi-Task Learning: Each detection output contains class probabilities and a bounding box, followed by non-maximum suppression to remove redundant detections.
- Object Detection as Multi-Task Learning: Detector training estimates parameters by minimizing a loss that typically combines classification and localization losses.
- Detection Attacks Guided by Task Losses: Existing attacks can be understood as using classification loss, localization loss, or combinations of both.
- Detection Attacks Guided by Task Losses: The paper identifies insufficient understanding of how individual attack components affect detector robustness.
4. Towards Adversarially Robust Detection
The paper analyzes how classification and localization losses interact under attack and proposes adversarial training with task-oriented domains to improve detector robustness.
- Task-loss interactions: Classification and localization share computations, so attacks targeting one task can affect the other.This coupling makes task-loss interactions central to robustness analysis.
- Task-loss interactions: Task gradients differ in magnitude and direction, indicating imbalance and potential conflicts between classification and localization objectives.Their task domains overlap partly but also contain substantial non-overlapping regions.
- Adversarial training: The proposed training uses classification and localization task domains, Scls ∪ Sloc, as multiple sources for generating adversarial examples.The final training example maximizes the overall loss within these task-oriented domains.
- Adversarial training: Task-oriented constraints allow task-guided adversarial examples without interference between tasks during individual example generation.Relaxing these constraints recovers conventional adversarial training for classification.
- Adversarial training: The training procedure approximately solves a minimax problem by generating perturbed images and training the detector on them.The inner maximization uses efficient FGSM-style steps within each task domain, followed by selection of the example with the largest overall loss.
5. Experiments
Experiments evaluate representative detector settings on PASCAL VOC and MS-COCO, using mAP and adversarial attacks with standardized training and attack procedures.
- Detector settings: Experiments use SSD with VGG16, while also considering multiple detector architectures and backbones.The broader evaluation includes RFB, FSSD, YOLO-V3, ResNet50, and DarkNet53.
- Datasets and metric: PASCAL VOC uses approximately 16k training images and 4,952 test images across 20 classes, while MS-COCO uses approximately 120k training images and 5k validation images across 80 classes.Performance is evaluated with mAP at IoU threshold 0.5.
- Training and attacks: Models are trained from scratch with SGD, batch size 32, and dataset-specific learning-rate schedules.The image size is 300×300, and adversarial attacks and training use budget ϵ = 8.
- Dataset boundary: VOC2012 test is excluded because annotations required for generating attacks are unavailable.
- Attack implementation: PGD attack methods use sgn(·) steps for normalization and efficiency.
5.2. Impacts of Task Losses on Robustness
The experiments compare standard and task-specific robust models under classification- and localization-loss attacks, showing that task-oriented training improves stability against increasing attack strength.
- Model variants: STD, CLS, and LOC respectively use clean-image, classification-loss, and localization-loss task domains for training.
- Attacks with different steps: STD performance drops rapidly with PGD steps, approaching zero for both classification- and localization-based attacks, whereas CLS and LOC remain relatively stable.The attacks use a fixed budget of 8 in the step-based evaluation.
- Qualitative effects: Under attacks on STD, small perturbations can cause label flipping, missing detections, or spurious detections, with further changes as the budget increases.At ϵ=2, detection results can already change completely; ϵ=8 produces noticeable image changes.
5.3. Beyond Single-Task Domain
The study finds that task domains create different robustness–clean-accuracy trade-offs, while the multi-task domain MTD handles task conflicts better than single-task or task-agnostic alternatives.
- Single-task domains: LOC is less robust than CLS but has higher clean accuracy, so choosing one task domain is not straightforward.
- Task interactions: Simply mixing task domains can compromise performance because classification and localization task gradients conflict.
- Multi-task domain: MTD uses the task-oriented domain Scls ∪ Sloc and achieves performance on par with or better than the best single-domain and task-agnostic models.It provides a proper trade-off across heterogeneous and potentially imbalanced tasks.
- Existing attacks: Against DAG and RAP attacks, MTD performs best, has higher clean-image accuracy than CLS, and performs uniformly well across attacks.The attacks used for training and testing are different.
5.5. Evaluation on Different Backbones
The proposed approach is evaluated across backbones and detector architectures, with consistent robustness improvements reported across these model variations.
- Different backbones: Across VGG16, ResNet50, and DarkNet53 backbones, the proposed approach improves performance under DAG and RAP attacks by 20%–30% absolute.The reported gains are consistent across network structures.
- Evaluation setup: The backbone evaluation reports average performance under DAG and RAP attacks across VGG16, ResNet50, and DarkNet53.
- Qualitative comparison: Figure 8 visually compares the standard model and the proposed model under DAG and RAP attacks with attack budget 8.
- Different architectures: Across SSD, RFB, FSSD, and YOLO-V3, the proposed method improves over the standard method significantly and consistently.This supports applicability across different detector architectures.
5.7. Defense against Transferred Attacks
The proposed detector remains robust against attacks transferred across different backbones, detection architectures, and attack algorithms. Such transferability indicates that moderately robust attacks can generalize across detector designs.
- The proposed model is robust against transferred attacks generated with different algorithms and architectures.The tested SSD+VGG16 model was evaluated against transfers from ResNet and DarkNet backbones and from RFB, FSSD, and YOLO detectors.
- Attacks with a certain level of robustness can transfer across detectors with different backbones or structures.This observation is consistent with previously reported findings cited by the authors.
5.8. Results on MS-COCO
On MS-COCO, which is more challenging because of its larger class count and greater data variation, the proposed defense substantially improves robustness under RAP attacks. The approach performs well across different backbones and detection architectures, while small or visually confusing objects remain challenging.
- The proposed models substantially outperform the standard model under RAP attack on MS-COCO and perform generally well across backbones and detection architectures.The evaluation uses attack budget 8 and 20 PGD steps; the standard model has very low attacked accuracy compared with approximately 40% on clean images.
- Failure cases: Small objects remain challenging for robust detectors and may require better detector architectures.These cases are also challenging for standard detectors.
- Failure cases: Objects with visually confusing appearance remain difficult because they naturally produce low-confidence predictions.The authors relate this challenge more closely to the detector’s classification component.
6. Conclusions
The paper develops adversarial training for robust object detection from a multi-task perspective and validates it across attacks, datasets, backbones, and architectures. The authors characterize the work as an initial step, with remaining challenges involving detector design, clean-accuracy trade-offs, and broader robustness improvements.
- The approach analyzes attacks and task-component effects from a multi-task perspective, then develops adversarial training for robust object detection.The method is evaluated on PASCAL-VOC and MS-COCO against adversarial attacks.
- Experiments demonstrate improved robustness over the standard model across attacks, datasets, detector backbones, and architectures.The reported evaluation covers PASCAL-VOC and MS-COCO.
- The work is an initial step, with future challenges including better loss functions, architectures for small objects, classification advances, and improved clean-accuracy–robustness trade-offs.The authors also identify robustness improvement for other multi-task learning problems as a possible broader direction.