Research map / Adversarial robustness and security / Attacks on text and graphs
Overload: Latency Attacks on Object Detection for Edge Devices
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Overload, a white-box latency attack that crafts adversarial images producing many NMS candidate objects (with a grid-based spatial attention), roughly 10x inference slowdown for YOLOv5 on Jetson NX.
Problem
Object detectors that rely on non-maximum suppression (NMS) can be slowed down by inputs that generate huge numbers of candidate objects, threatening latency-sensitive edge deployments.
Approach
Argues that NMS latency is dominated by the number of objects fed into it, so the attack only maximizes per-object confidence (dropping pairwise-IoU and area terms), and adds spatial attention that reweights grid cells to target low-density regions.
Key results
- On Nvidia Jetson NX, adversarial YOLOv5s images average about 13.0x longer elapsed time than original images at the median (217.8 ms vs 16.4 ms).
- Over 90% of adversarial images for YOLOv5s and over 60% for YOLOv5n generate more than 20,000 objects fed into NMS.
- Overload crafts 16 images in a batch in about 3 minutes with 7.5 GB peak memory, versus about 145 minutes for 10 images with Daedalus.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply Overload to YOLOv5s images | YOLOv5s · MS COCO 2017 val, 50th percentile, NVIDIA Jetson NX | inference time (ms): 16.4 -> 217.8 | Helped |
| apply Overload to YOLOv5n images | YOLOv5n · MS COCO 2017 val, 50th percentile, NVIDIA Jetson NX | inference time (ms): 11.5 -> 128.9 | Helped |
| increase adversarial-image ratio from 0.00 to 1.00 | YOLOv5s pipeline on NVIDIA Jetson NX · Pipeline | time per image (ms): 23 -> 230 | Helped |
| increase adversarial-image ratio from 0.00 to 1.00 | YOLOv5n pipeline on NVIDIA Jetson NX · Pipeline | time per image (ms): 20 -> 135 | Helped |
| apply Overload to YOLOv5s | YOLOv5s on NVIDIA A100 · Pipeline | time (ms): 16 -> 54 | Helped |
| apply Overload to YOLOv5s | YOLOv5s on NVIDIA A10 · Pipeline | time (ms): 14 -> 52 | Helped |
| apply Overload to YOLOv5s | YOLOv5s on NVIDIA 1080 Ti · Pipeline | time (ms): 11 -> 62 | Helped |
| apply Overload to YOLOv5s | YOLOv5s on NVIDIA Jetson · Pipeline | time (ms): 23 -> 230 | Helped |
| add object-area minimization loss (ablation) | Overload · Adversarial example generation, batch size 16, NVIDIA V100 | time (s): 180 -> 240 | Hurt |
| add object-area minimization loss (ablation) | Overload · Adversarial example generation, batch size 16, NVIDIA V100 | memory (GB): 7.5 -> 7.9 | Hurt |
| add pairwise-IoU minimization loss (ablation) | Overload · Adversarial example generation, batch size 16, NVIDIA V100 | memory | Hurt |
Surprising findings
- Maximizing pairwise-IoU and object-area terms, as in prior work, did not improve attack performance and increased memory use; the IoU term ran out of memory.
- Keeping more surviving boxes (IoU threshold 1.0) gave similar latency to the default threshold, so latency depends mainly on objects fed into NMS rather than output boxes.
Limitations
- Evaluation is only under white-box settings, which the authors acknowledge may be impractical.
- Not applicable to NMS-free detectors such as DETR and CenterNet.
- Black-box and physical attacks are left unexplored.
Experimental setup
Datasets: MS COCO 2017
Benchmarks: MS COCO 2017
Metrics: elapsed time (ms) number of objects fed into NMS number of output boxes FPS recall mAP@50 peak memory (GB)
Baselines: Phantom Sponge Daedalus PGD
Builds on: Phantom Sponge Daedalus PGD
Closest papers by meaning
- Can't Slow Me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices (CVPR 2025 · similarity 0.89)
- Latency NMS Attacks: Is It Real Life or Is It Just Fantasy? (NeurIPS 2025 · similarity 0.89)
- NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors (AAAI 2025 · similarity 0.84)
- SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · similarity 0.84)
- Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection (NeurIPS 2024 · similarity 0.83)
- SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers (CVPR 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.