PaperlayerView exact revision on arXiv

Source-linked AI summary

AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Driving

Yuting Wu, Dongfang Guo, Xiangzhong Luo, Qun Song, Rui Tan

arXiv:2608.16031v1cs.LGcs.CV

TL;DR

Existing defenses can degrade against novel or adaptive attacks on camera-based object detectors. AdROD generates a changing ensemble of diverse detectors per frame, and across diverse attack settings it outperforms representative defenses and generalizes better than evaluated adversarial-training baselines.

  • Problem

    Existing defenses often target specific attack characteristics, leaving robustness limited against novel or adaptive adversaries.

  • Method

    AdROD uses parameter-efficient low-rank HyperNetworks to generate per-frame diverse detector ensembles, augmented with functional diversity and two serving modes.

  • Results

    Across diverse attack settings and tested shifts, AdROD outperforms representative baseline defenses and generalizes better than evaluated adversarial-training baselines.

  • Takeaways & Limitations

    AdROD supports deployment goals spanning robust detection and runtime-efficient defense in autonomous-driving object detection.

  • Takeaways & Limitations

    Directly adapting standard HyperNetworks to camera-based detection faces substantial parameter growth and cannot address intrusive physical patches through weight diversity alone.

Abstract

from arXiv · show

Camera-based object detectors are vulnerable to physical adversarial attacks designed to suppress detections. While adversarial training and input purification offer some protection, they often overfit to specific attack distributions and fail on adaptive adversaries. This paper presents AdROD, an embedded, stochastic ensemble defense software designed for autonomous driving. AdROD employs {\em low-rank HyperNetworks}, which require only 1.6\% of the parameter footprint of standard HyperNetworks, to generate diverse detectors at a per-frame rate, making it impractical for attackers to obtain the deployed detectors in time. To further improve adversarial robustness, AdROD incorporates a novel \emph{functional diversity} mechanism, which couples stochastic weight updates with unique input-space transformations. We design two serving modes of AdROD that strike different trade-offs between robustness and runtime overhead: AdROD-I, a continuous protection mode for maximum resilience that leverages inter-detector disagreement to recover compromised detections, and AdROD-II, an on-demand mode triggered by kinematic discontinuities in object tracking. Through comprehensive evaluation with synthetic benchmarks, physically deployed adversarial patches, and end-to-end safety tests in the OpenCDA co-simulator, AdROD outperforms five baseline defenses and exhibits superior generalizability compared with the evaluated adversarial-training baselines, while maintaining real-time performance for safely stopping the vehicle at a stop sign instrumented with adversarial patches.

I. INTRODUCTION · II. PRELIMINARIES AND RELATED WORK · A. Camera-based Object Detection and Adversarial Attacks

Camera-based DNN detectors underpin autonomous-vehicle perception but remain vulnerable to physical attacks, especially adversarial patches that suppress critical-object detections. AdROD addresses limitations of attack-specific defenses with per-frame stochastic detector ensembles generated by parameter-efficient low-rank HyperNetworks, functional diversity, and adaptive serving modes.

  • I. INTRODUCTION: Camera-based DNN detectors are essential to autonomous-vehicle perception but can be disrupted by physical adversarial patches attached to critical road objects.Such attacks embed crafted perturbations into scenes to suppress detections and create safety risks.
  • I. INTRODUCTION: Adversarial defenses designed for particular attack characteristics lose robustness against novel attacks and adaptive adversaries.Adaptive adversaries actively optimize perturbations to bypass deployed defenses.
  • I. INTRODUCTION: AdROD generates a diverse detector ensemble from random noise at the per-frame rate and fuses its predictions into robust detection results.Continuous ensemble variation creates a moving target that limits an adversary’s timely exploitation of DNN gradients.
  • I. INTRODUCTION: AdROD-II dynamically activates ensemble defense when a low-overhead tracker detects abrupt object disappearances under benign base-detector monitoring.This on-demand strategy prioritizes runtime efficiency by treating discontinuities as potential attack signals.
  • I. INTRODUCTION: 1.6% is AdROD’s parameter footprint relative to standard HyperNetworks, enabled by low-rank updates to a pretrained base detector.The design avoids full weight replacement while preserving knowledge from the factory model and stabilizing training.
  • I. INTRODUCTION: AdROD adds functional diversity by coupling randomized weight diversity with unique input transformations.This dual-layer randomization is presented as improving robustness while using computational headroom from the low-rank design.
  • A. Camera-based Object Detection and Adversarial Attacks: Modern camera-based detectors include one-stage architectures such as YOLO and two-stage architectures such as Faster R-CNN, with both using NMS to filter redundant boxes.The related-work discussion presents these architectures as the main categories of contemporary object detectors.
  • A. Camera-based Object Detection and Adversarial Attacks: Physical attacks include regional solid patches or stickers and global semi-transparent overlays, with patches receiving attention for their simplicity and low cost.The patch formulation uses a binary mask and spatial transformation to modify a benign image, with a loss combining confidence reduction and color constraints.

B. Adversarial Defenses … A. Threat Model

The paper motivates dynamic, stochastic defenses for physically plausible camera-based attacks, highlighting limitations of adversarial training, purification, fixed ensembles, and direct HyperNetwork adaptation. Its threat model defines detection failures, attacker knowledge, and physically constrained attack patterns under private runtime randomness.

  • B. Adversarial Defenses: Adversarial training adds no inference latency but can overfit attack-specific distributions and generalize poorly to novel threats.Exhaustively anticipating all potential attacks is impractical.
  • B. Adversarial Defenses: Model-diversity and runtime-randomness defenses improve robustness, but fixed ensembles and direct object-detection deployment create adaptive-attack, latency, and benign-accuracy challenges.Stochastic defenses include dropout, random activation pruning, and HyperNetwork-based dynamic ensembles.
  • C. HyperNetworks and Their Limitations: Standard HyperNetworks generate target-model weights by mapping shared random noise z ∈R1×d through layer-specific generators.The generated weight matrix Θ′ replaces the target layer’s original weights Θ.
  • C. HyperNetworks and Their Limitations: Directly adapting HyperNetworks from image classification and LiDAR detection to camera-based detection is challenging because physical camera patches corrupt target-related visual content differently from sparse LiDAR point injections.The supplied passage introduces two adaptation challenges and contrasts LiDAR and camera attack structure.
  • A. Threat Model: An attack succeeds when the target is undetected, misclassified, or poorly localized, covering failures in object presence, class identity, and localization quality.Poor localization is defined using low IoU.
  • A. Threat Model: The threat model includes weak attacks optimized against an undefended vanilla model and strong attacks with full white-box knowledge of AdROD except runtime stochastic noise vectors.The strong setting follows prior studies and assumes the attacker can optimize the adversarial pattern against the known pipeline.
  • A. Threat Model: Adversarial patterns are physically plausible and may be attached to, projected onto, or placed near target objects visible to the victim camera.Examples include stop signs, persons, vehicles, and traffic lights.
  • A. Threat Model: The attacker cannot modify the digital image stream or arbitrarily perturb every pixel.This constrains attacks to patterns that remain visible to the victim camera.

B. Challenges of HyperNetwork-based Defense · IV. A NEW HYPERNETWORK DESIGN FOR ADROD · A. Low-rank HyperNetworks

The paper identifies scalability, robustness–false-positive, and serving-efficiency challenges for HyperNetwork-based defenses, then addresses them with low-rank generation, functional diversity, and deployment modes. AdROD’s low-rank design generates efficient weight updates while balancing detection accuracy against adversarial robustness.

  • B. Challenges of HyperNetwork-based Defense: Standard HyperNetworks require 67×, 88×, and 84× more parameters than YOLO-nano, YOLO-small, and YOLO-medium, causing memory problems and poor training convergence.This motivates a parameter-efficient HyperNetwork design.
  • B. Challenges of HyperNetwork-based Defense: Lowering confirmation thresholds can recover compromised stop signs but inevitably increases benign false positives, motivating objectness variance as a discriminative metric.Both victim objects and benign false positives often have low detection confidence.
  • B. Challenges of HyperNetwork-based Defense: 66.9 FPS for YOLO-small on Jetson AGX Xavier falls to 5.4 FPS for a continuous ensemble of 10 generated models at 640×640 resolution.This motivates trading computational resources for safety while avoiding unnecessary overhead during safe vehicle operation.
  • IV. A NEW HYPERNETWORK DESIGN FOR ADROD: AdROD addresses these challenges through low-rank generation, functional diversity, and two deployment modes, while optimizing only on benign images and annotations.Its objective combines average detection loss with weight diversity loss across the generated ensemble.
  • A. Low-rank HyperNetworks: AdROD combines LoRA with HyperNetworks to generate updates for a factory-designed base detector instead of generating target-model weights directly.For pretrained weights Θ, generators produce A and B, whose product BA updates the weights as Θ′ = Θ+BA.
  • A. Low-rank HyperNetworks: The low-rank update factorization uses A ∈ Rr×a and B ∈ Rb×r with r ≪ min{a, b}, preserving the base detector’s original weights while adding BA.The updated weights are Θ′ = Θ+BA.
  • A. Low-rank HyperNetworks: At r=4, YOLO-small low-rank HyperNetworks require only 1.6% of standard HyperNetwork parameters, balancing accuracy and adversarial robustness.Across ranks {1, 4, 8, 16, 32, 64}, r=1 severely degrades mAP, r=64 causes training instability, and larger ranks reduce adversarial robustness despite mAP peaking at r=32.

B. Diversifying Models for Robustness

AdROD builds functional diversity by combining diverse model weights with distinct input transformations to disrupt attack transferability. Weight diversity alone causes a sharp mAP drop, motivating the added input-level countermeasure, while the diversity coefficient β reduces ASR before saturating at β ≥2.5.

  • Functional diversity: AdROD establishes functional diversity by integrating weight diversity with input transformations across an ensemble of K models.The weight diversity score γ_n is defined across models using Pearson correlation on flattened updated-layer weight matrices.
  • Functional diversity: The low-rank HyperNetworks are jointly optimized with detection loss plus a β-weighted diversity penalty.The training ensemble used for diversity-loss computation can remain smaller than the serving ensemble to reduce GPU memory usage.
  • Coefficient impact: β ≥2.5 marks the saturation region after increasing β initially lowers ASR.Fig. 5 further reports that functional diversity improves robustness over weight diversity alone, while AdROD-I mitigates benign detection-accuracy degradation.
  • Input transformations: Weight diversity alone causes mAP to drop sharply, motivating an orthogonal input-level countermeasure.This result indicates that diversifying weights without input transformations is insufficient for robust detection.

1) Functional Diversity: · V. TWO SERVING MODES OF ADROD · A. AdROD-I

AdROD’s functional diversity couples stochastic detector updates with matching input transformations to reduce attack transferability, while its two serving modes balance robustness against runtime and benign accuracy. AdROD-I uses uncertainty-aware ensemble selection and base-detector merging to recover detections affected by false positives and transformation-induced false negatives.

  • 1) Functional Diversity:: Functional diversity jointly generates detector weight updates and input transformations from the HyperNetwork noise vector z, making each detector decode its corresponding transformed input.This coupling is intended to reduce attack transferability across ensemble members.
  • 1) Functional Diversity:: AdROD implements the transformation with high-throughput block-wise pixel shuffling, partitioning each image into nonoverlapping P×P blocks and deriving channel permutations from z.The red-channel permutation is obtained by average-pooling z and ranking the pooled vector.
  • 1) Functional Diversity:: 26.3 percentage points: with P = 4, functional diversity reduces average ASR for β ∈[0, 2.0] versus weight diversity alone.P = 4 balances adversarial-patch distortion against benign feature preservation; larger P values increase distortion but degrade benign accuracy.
  • 1) Functional Diversity:: 10.5 percentage points: the ensemble incurs an mAP drop from affirmative fusion accumulating false positives and transformation-induced false negatives.The paper addresses this limitation with an attack-aware fusion scheduler in the following section.
  • V. TWO SERVING MODES OF ADROD: AdROD-I uses ensemble disagreement as an attack indicator, whereas AdROD-II uses kinematic discontinuities to avoid unnecessary ensemble execution.The two modes target different trade-offs between adversarial robustness, benign accuracy, and runtime overhead.
  • A. AdROD-I: AdROD-I distinguishes benign false positives with uncertainty-aware selection and merges ensemble predictions with base-detector results to correct transformation-induced false negatives.The design combines high-confidence predictions likely to be benign with low-confidence, highly uncertain victim candidates.
  • A. AdROD-I: The ensemble result combines confident and victim candidate boxes using NMS, with τc > τ to impose a stricter benign-confirmation threshold while Q controls victim recovery.Increasing Q improves victim recovery but increases the risk of including additional detections.
  • A. AdROD-I: With τc = 0.5 and Q = 10, sequential uncertainty-aware selection and base/ensemble merging reclaim benign detection accuracy without compromising established adversarial robustness.The merge retains detections with IoU < 0.6 from both the base and ensemble results to recover benign and victim objects.

B. AdROD-II

AdROD-II is an on-demand defense that activates the ensemble after tracked objects exhibit sustained, abrupt detection loss consistent with adversarial suppression. It uses kinematic tracking to distinguish attacks from benign disappearance and limits overhead through sequential execution with early termination.

  • Activation trigger: AdROD-II triggers ensemble defense only when an attack becomes effective, exploiting adversarial patterns’ brittleness under changing distance and perspective.The mode avoids continuous ensemble execution during benign operation.
  • Activation trigger: AdROD-II identifies adversarial interference through a sustained, sudden loss of detection after an object enters a patch’s effective range.Benign disappearance is described as gradual, involving bounding-box shrinkage, occlusion, or exit from the field of view.
  • Kinematic tracking: A Kalman Filter tracks each object’s position, box dimensions, and velocities to classify disappearance as abrupt when expected gradual scale reduction is absent.The tracked state is [x, y, w, h, ˙x, ˙y, ˙w, ˙h].
  • Defense activation: Objects with abrupt disappearance enter watch set S, remain extrapolated for ℓ frames, and trigger the HyperNetwork ensemble only if suppression persists beyond ℓ.Re-detection and association within the extrapolation window dismiss the disappearance as benign and restore standard tracking.
  • Sequential execution and early termination: After activation, AdROD-II sequentially runs generated models, merges detections associated with KF-extrapolated watch-set states, and stops once all watched objects are recovered.This early termination is used to minimize computational load.
  • Scope of activation: AdROD-II activates only for objects detected and tracked at least once, but benign detector fluctuations can cause false activations.Tracks may begin when objects enter the field of view or later during approach.

VI. IMPLEMENTATION AND EVALUATION · A. Implementation and Evaluation Methodology · B. Benign Detection Accuracy and Overhead

AdROD is evaluated with two pretrained detector architectures, defined training and serving configurations, and comparisons against vanilla, adversarial-training, and five attack-independent defenses. AdROD-I preserves benign accuracy but incurs continuous overhead, whereas AdROD-II reduces attack-free runtime through on-demand activation.

  • A. Implementation and Evaluation Methodology: The evaluation uses YOLO-small as the primary detector and Faster R-CNN with a MobileNetV3 backbone to demonstrate architectural generalizability.Both detectors are initialized with Microsoft COCO-pretrained weights.
  • A. Implementation and Evaluation Methodology: Training updates detector backbones and necks with low-rank HyperNetworks using rank r = 4, block size P = 4, coefficient β = 1, and a three-member ensemble.Training uses 640 × 640 COCO images for 9 epochs with batch size 32, cosine-annealed learning rate 10−4 to 10−5, and about 10 hours on a Quadro 8000 GPU.
  • A. Implementation and Evaluation Methodology: Serving uses K = 10 for both variants, with AdROD-I configured by τc = 0.5 and Q = 10 and AdROD-II by extrapolation window ℓ = 3.Training and serving ensemble sizes can differ because detectors are independently generated from sampled random noise.
  • A. Implementation and Evaluation Methodology: AdROD is benchmarked against Vanilla, AdvTrain, JPEG, LGS, SAC, Jedi, and ObjectSeeker using the defenses’ original configurations.AdvTrain-Class denotes adversarial training against a specified object class with regional patch attacks.
  • A. Implementation and Evaluation Methodology: Evaluation measures attack success rate, benign precision, recall, mAP50, mAP50:95, and runtime overhead in λ relative to vanilla YOLO per-image latency.mAP50 and mAP50:95 are reported on the COCO validation dataset.
  • B. Benign Detection Accuracy and Overhead: AdROD-I’s benign detection accuracy is comparable to Vanilla and superior to adversarial-training baselines on COCO validation data.AdROD-II is excluded because COCO lacks continuous video frames for tracking, while Jedi is omitted for an unfair direct overhead comparison.
  • B. Benign Detection Accuracy and Overhead: 1.1λ is LGS’s overhead, while SAC, JPEG, and ObjectSeeker require 5.6λ, 6.7λ, and 96.6λ, respectively.AdvTrain adds no inference latency; LGS’s speed comes with accuracy loss from global image distortion, while other costs arise from U-Net processing, CPU encoding, or exhaustive sliding-mask passes.
  • B. Benign Detection Accuracy and Overhead: 13.11λ is AdROD-I’s static overhead, limiting throughput to 5.4 FPS, whereas AdROD-II uses 1.03λ and reaches 68.7 FPS without attacks.AdROD-II activates its ensemble on demand, executes members sequentially, and terminates early with dynamic subset size k ≤ K.

C. Sensitivity Analysis and Ablation Study · D. Robustness Analysis at the Perception Level · 1) Physical Outdoor Evaluation:

The sensitivity and ablation studies identify ensemble size as AdROD-I’s primary tuning factor and show that weight and functional diversity are both necessary for effective defense. Physical outdoor evaluation confirms that both AdROD variants reduce attack success, with AdROD-I achieving lower average ASR and AdROD-II maintaining near-baseline overhead before activation.

  • C. Sensitivity Analysis and Ablation Study: Increasing K lowers ASR but slightly reduces mAP and increases computational overhead nearly linearly, with robustness gains diminishing beyond K =10.The tested ensemble sizes are K ∈{2, 3, 4, 10, 20, 30}.
  • C. Sensitivity Analysis and Ablation Study: Increasing Q lowers ASR while slightly degrading mAP, making Q a secondary tuning parameter because outcomes are less sensitive to it than to K.Q controls how many highly uncertain bounding boxes are retained during ensemble merging.
  • C. Sensitivity Analysis and Ablation Study: ASR is 0.033 at ℓ=1 versus 0.058 at ℓ=3, but ℓ=1 causes high overhead because benign false negatives frequently trigger AdROD-II.The extrapolation window ℓ controls defense-trigger sensitivity and requires continuous video frames for evaluation.
  • C. Sensitivity Analysis and Ablation Study: Block-wise pixel shuffling without retraining degrades detection accuracy and increases ASR, showing that the transform alone is ineffective as a defense.The ablation evaluates training-free use of the transformation against configurations using trained low-rank HyperNetworks.
  • C. Sensitivity Analysis and Ablation Study: Weight diversity and functional diversity are both essential, while AdROD-I recovers most mAP loss and AdROD-II preserves benign accuracy through selective fusion.AdROD-II fuses only validated and recovered objects with base detector outputs.
  • 1) Physical Outdoor Evaluation:: The physical test attaches a printed SysAdv patch to a stop sign, while a vehicle-mounted camera approaches from 20 m on a restricted private road.The patch was selected for strong digital-to-physical transferability and system-level effectiveness.
  • 1) Physical Outdoor Evaluation:: AdROD-I achieves an average ASR of 0.025, while AdROD-II achieves 0.058; both variants significantly reduce ASR across all distance ranges.AdROD-II’s higher ASR is attributed to defense activation only after disappearance of the victim object is detected.

2) Real-world Third-party Vehicle Evaluation:

The third-party evaluation used a vehicle traveling at 20 km/h with a wide-field-of-view camera, testing SysAdv at 640×640 and 1280×1280. AdROD substantially reduced attack success rates for both resolutions and serving modes.

  • Evaluation setup: A vehicle traveling at 20 km/h was recorded at 10 FPS using a camera with 74.5° horizontal and 54° vertical fields of view.SysAdv was optimized at 640×640 (LowRes) and 1280×1280 (HighRes).
  • Attack success rates: 0.759 ASR on the vanilla model for SysAdv-HighRes decreased to 0.310 with AdROD-I and 0.345 with AdROD-II.The result demonstrates AdROD’s effectiveness under the evaluated real-world camera setup.
  • Attack success rates: 0.719 ASR on the vanilla model for SysAdv-LowRes decreased to 0.219 with AdROD-I and 0.344 with AdROD-II.The results provide evidence of transfer across the evaluated camera setups and real-world conditions.

3) Diverse Synthetic Evaluation: · 4) Architectural Generalizability: · 5) Adaptive Adversaries:

AdROD maintains robustness across diverse synthetic attacks and extends to Faster R-CNN, while adaptive evaluations show that increasing attacker knowledge or optimizing detector disagreement does not reliably defeat it. Across these evaluations, the defense preserves its advantages through architectural changes, attack variation, and stronger white-box objectives.

  • 3) Diverse Synthetic Evaluation:: AdROD-I achieves the lowest or second-lowest ASR across all tested attack configurations, while baseline robustness varies substantially with attack shape, texture, class, and placement.The evaluation covers COCO subsets and a self-collected dataset with digitally applied attacks on stop signs, persons, traffic lights, and cars.
  • 3) Diverse Synthetic Evaluation:: AdvTrain-StopSign yields high (>0.5) ASRs on cars and degrades on unseen classes, whereas SAC, LGS, and Jedi each degrade under some tested attack variants.These results indicate configuration sensitivity among the evaluated baseline defenses.
  • 3) Diverse Synthetic Evaluation:: AdROD remains more generalizable than adversarial-training baselines when testing shifts from solid regional masking to semi-transparent global masking or mismatched target classes.AdvTrain-Person performs noticeably worse when both class and patch type differ, while adversarial-training robustness declines as attack characteristics shift.
  • 4) Architectural Generalizability:: AdROD extends to Faster R-CNN by updating convolutional layers in the backbone, FPN, and RPN, together with linear layers in the RoI head.The configuration is designed to balance robustness and accuracy, while AdROD-I aligns intermediate RPN outputs to compute ensemble uncertainty.
  • 4) Architectural Generalizability:: 0.09: AdROD-I reduces ASR to about 0.09 across Faster R-CNN settings with only a modest mAP drop and little observable dependence on K.AdROD-II instead becomes more robust as the serving ensemble grows; at K = 4, it achieves the lowest ASR and surpasses AdROD-I.
  • 5) Adaptive Adversaries:: The component-aware adaptive attack progresses from base-detector access to disclosure of historical weights, the HyperNetwork generator, and finally all exposed components.The protocol evaluates surrogate ensemble sizes S = 2 and larger attacker knowledge while averaging the hiding objective over accessible detector components.
  • 5) Adaptive Adversaries:: Increasing the surrogate ensemble size reduces attack effectiveness, although optimized patches remain effective against the vanilla detector, especially when S = 2.The larger ensemble makes optimization harder because one patch must hide the victim object across more generated models.
  • 5) Adaptive Adversaries:: Nonzero disagreement-loss weights produce lower AdROD ASRs than αdis = 0, while sufficiently large weights also reduce vanilla ASR by weakening the patch’s basic hiding ability.The uncertainty-aware attack minimizes objectness variance across the surrogate ensemble, creating conflicting objectives between hiding the object and reducing disagreement.

E. An End-to-End Safety Evaluation · 1) Safety Under Attack:

The OpenCDA/CARLA evaluation tests stopping before an adversarially patched stop sign across cruise speeds and attack-lightness settings. Both AdROD variants preserve safe stopping more effectively than the vanilla model, with AdROD-I avoiding misses at the highest tested speed while AdROD-II can activate too late.

  • E. An End-to-End Safety Evaluation: OpenCDA integrated with CARLA evaluates whether the vehicle stops before a stop line facing a stop sign instrumented with adversarial patches.The stop procedure begins after stop-sign detections occur in at least three frames within a short window, including two consecutive frames.
  • E. An End-to-End Safety Evaluation: 20 Hz is the perception-control rate, and the vanilla model plus both AdROD variants safely stop at all tested speeds from 20 to 40 km/h without attack.The tested range represents increasingly demanding approaches within a low-to-moderate urban-speed regime.
  • E. An End-to-End Safety Evaluation: ζ = 0.5 is the default lightness adjustment for the SysAdv patch, interpolating between its original lightness and ambient-lightness statistics.Only the CIELAB lightness channel is adjusted; chrominance remains unchanged.
  • 1) Safety Under Attack:: As speed increases, the undefended vanilla model rapidly degrades, whereas both AdROD variants produce no missed stops up to 35 km/h.At 40 km/h, AdROD-I still has no misses, while AdROD-II has a rare missed stop.
  • 1) Safety Under Attack:: At high speed, AdROD-II can miss because fewer stop-sign frames prevent it from establishing kinematic tracking and activating its defense.The passage notes that increasing ζ beyond 0.5 affects this evaluation condition, but the supplied text does not state the resulting outcome.
  • 1) Safety Under Attack:: Both AdROD variants leave substantially larger safety margins than vanilla, with their relative advantage differing across vehicle speeds.Fig. 17 reports safe, marginal, and missed-stop percentages plus mean signed distance to the stop line; positive distance indicates stopping before the line.
  • 1) Safety Under Attack:: Reduced perception update frequency is evaluated through missed-stop and marginal-stop rates under computational constraints.Fig. 18 uses solid lines for missed-stop rates and shaded bands for marginal-stop rates.
  • 1) Safety Under Attack:: At 20–35 km/h, AdROD-II achieves slightly larger margins because triggered ensemble defense continuously tracks the stop sign and invokes stopping.AdROD-I may delay recovery and stopping when the attack does not immediately create substantial detector disagreement; at 40 km/h, the trend reverses because AdROD-II waits ℓ frames after tracked-sign loss.

2) Robustness Under Compute Constraints: · VII. DISCUSSION · VIII. CONCLUSION

Under reduced perception rates, AdROD preserves stopping robustness better than the undefended model, especially through AdROD-I at high speeds. The discussion limits AdROD to hiding attacks against genuine bounding-box detections, while the conclusion presents stochastic ensemble generation, functional diversity, and two deployment modes as its main contributions.

  • 2) Robustness Under Compute Constraints:: The evaluation lowers perception rates while keeping vehicle control at 20 Hz, using the latest perception results to bridge execution-rate differences.This simulation models computational constraints such as resource contention.
  • 2) Robustness Under Compute Constraints:: For the undefended vanilla model, missed-stop and marginal-stop rates are mainly affected by vehicle speed rather than perception rate.The comparison spans various cruise speeds and perception rates.
  • 2) Robustness Under Compute Constraints:: At 20–30 km/h, both AdROD variants keep missed-stop and marginal-stop rates near zero across all tested perception rates.The variants effectively suppress missed stops under these operating conditions.
  • 2) Robustness Under Compute Constraints:: At 40 km/h, AdROD-I maintains zero missed stops, whereas AdROD-II develops increased missed and marginal stops at 5–10 Hz.Higher speed and reduced perception rates weaken temporal continuity for object tracking, making abrupt-event detection harder for AdROD-II.
  • VII. DISCUSSION: AdROD addresses attacks that hide genuine objects but not attacks fabricating fake objects, which require object-existence verification or contextual reasoning.The stated scope is camera-based object detection, particularly bounding-box object detectors.
  • VIII. CONCLUSION: The conclusion presents AdROD as a stochastic ensemble defense with efficient HyperNetwork training and functional diversity for camera-based autonomous-driving object detection.These mechanisms are described as enhancing defense performance.
  • VIII. CONCLUSION: AdROD-I targets robust detection, while AdROD-II targets runtime-efficient defense through distinct serving modes.The conclusion states that AdROD outperforms representative baseline defenses and generalizes better than evaluated adversarial-training baselines across diverse attack settings.
Loading 2608.16031v1…