Research map / Adversarial robustness and security / Attacks on text and graphs
NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes NumbOD, a model-agnostic adversarial attack on object detectors that selects attack targets from final OD outputs and combines spatial coordinate-shift/foreground-background attacks with high-frequency (DWT) perturbation to make detectors miss objects.
Problem
Adversarial attacks on object detectors are typically tied to specific architectural modules (NMS, RPN) and apply image-level perturbations that waste effort on background, so a model-agnostic, efficient attack that disrupts both localization and classification is lacking.
Approach
Uses only the final detector outputs to pick attack targets via a dual-track (regression and classification) top-k IoU selection, then combines directional box-shift and foreground-background separation losses in the spatial domain with a DWT-based loss that concentrates the perturbation on high-frequency components.
Key results
- On MS-COCO with Faster R-CNN, NumbOD reduces mAP50 to 0.38 (from 50.98 clean) with IW-SSIM 0.17 under 8/255 budget, versus 3.36 for DAG and 1.49 for LGP.
- Across nine detectors on MS-COCO, adversarial mAP50 stays below 6% for all models (e.g., 0.27 for Cascade R-CNN, 5.49 for VFNet).
- On PASCAL VOC with Faster R-CNN, NumbOD achieves mAP50 0.54 versus 5.44 for DAG and 3.41 for LGP.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use NumbOD instead of LGP | Faster R-CNN · MS-COCO | mAP50: 1.49 -> 0.38 | Helped |
| Use NumbOD instead of PGD | Faster R-CNN · PASCAL VOC | mAP50: 7.46 -> 0.54 | Helped |
| Use NumbOD instead of TOG | VFNet · MS-COCO | mAP50: 12.85 -> 5.49 | Helped |
| Use NumbOD instead of TOG | VFNet · PASCAL VOC | mAP50: 10.41 -> 1.96 | Helped |
| Add the coordinate-shift loss (J_loc) (ablation) | NumbOD · MS-COCO, Faster R-CNN (ResNet50) | mAP50 | Helped |
| Add the foreground-background classification loss (J_cls) (ablation) | NumbOD · MS-COCO, Faster R-CNN (ResNet50) | mAP50 | Helped |
| Add the low-frequency constraint (J_lfc) (ablation) | NumbOD · MS-COCO, Faster R-CNN (ResNet50) | mAP50 | Helped |
| Add the high-frequency attack loss (J_hfc) (ablation) | NumbOD · MS-COCO, Faster R-CNN (ResNet50) | mAP50 | Helped |
Surprising findings
- FGSM achieves a better IW-SSIM score than NumbOD on MS-COCO (0.16 vs 0.17), though NumbOD is far more effective at reducing mAP.
Limitations
- Evaluated only in the white-box setting with ResNet-based backbones on two datasets
- Some baseline comparisons (RAP, LGP) use their own non-lp budgets, making comparison imperfect
Experimental setup
Datasets: MS-COCO PASCAL VOC
Benchmarks: MS-COCO PASCAL VOC
Metrics: mAP50 mAP75 IW-SSIM NMSE TV
Baselines: FGSM PGD DAG RAP TOG LGP
Builds on: PGD TOG RAP LGP
Closest papers by meaning
- Fusion Is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detection (ICLR 2024 · similarity 0.86)
- Overload: Latency Attacks on Object Detection for Edge Devices (CVPR 2024 · similarity 0.84)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.83)
- Leveraging Perturbation Robustness to Enhance Out-of-Distribution Detection (CVPR 2025 · similarity 0.83)
- Can't Slow Me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices (CVPR 2025 · similarity 0.83)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.