Research map / Adversarial robustness and security / Attacks on text and graphs
Can't Slow Me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Underload, a background-attentive, hardware-adaptive adversarial training defense that protects YOLO object detectors against NMS-targeting latency attacks while restoring real-time FPS on edge GPUs.
Problem
Latency attacks create huge numbers of phantom candidate boxes that congest NMS post-processing in object detectors, breaking real-time performance on edge and other GPUs; existing defenses are not tailored to these attacks.
Approach
Use the objectness loss as a proxy for latency-attack perturbations, apply adversarial training with a mask that attends to background regions (shrinking the mask until the predicted box count fits the GPU's hardware capacity derived from system profiling).
Key results
- Underload restores YOLOv5s robust accuracy under Phantom Sponge on VOC from 7.5% to 61.3% mAP50 with only a 4.4% clean accuracy drop.
- On Jetson Orin NX, the defense restores processing latency from about 13 FPS to 43 FPS (13, 17, 23 ms for different YOLO generations).
- Underload outperforms MTD and OOD on clean and robust accuracy across YOLOv3, YOLOv5s, and YOLOv8s on VOC, COCO, and BDD.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply background-attentive adversarial training instead of the strongest listed defense | YOLOv5s · PASCAL-VOC, Phantom Sponge | mAP50 (%): 54.7 -> 61.3 | Helped |
| Apply background-attentive adversarial training instead of the strongest listed defense | YOLOv5s · PASCAL-VOC, Overload | mAP50 (%): 49.4 -> 53.3 | Helped |
| Apply background-attentive adversarial training instead of the strongest listed defense | YOLOv5s · PASCAL-VOC, clean | mAP50 (%): 57.7 -> 68.9 | Helped |
| Apply background-attentive adversarial training instead of the strongest listed defense | YOLOv5s · MS-COCO, Phantom Sponge | mAP50 (%): 36.8 -> 36.9 | Helped |
| Apply background-attentive adversarial training instead of the strongest listed defense | YOLOv5s · BDD, Overload | mAP50 (%): 25.8 -> 26.5 | Helped |
| Apply Underload to the undefended detector | YOLOv5s on Jetson Orin NX · Latency attacks | FPS: 13 FPS -> 43 FPS | Helped |
| Increase the mask size (unprotected area) (ablation) | Underload · PASCAL-VOC | clean accuracy | Helped |
| Increase the mask/object ratio toward around 0.9 (ablation) | Underload · PASCAL-VOC | robust accuracy: around 0.9 | Helped |
Surprising findings
- Robust accuracy peaks at a mask-to-object ratio near 0.9 rather than monotonically decreasing as the protected area shrinks.
Limitations
- Evaluated only against three latency attacks (Daedalus, Phantom Sponge, Overload) and three YOLO models.
- Requires profiling hardware (IoU speed, PCIe bandwidth, backbone time) to set the box-count capacity.
Experimental setup
Datasets: PASCAL-VOC MS-COCO BDD100K
Benchmarks: PASCAL-VOC MS-COCO BDD100K
Metrics: mAP50 FPS / execution time (ms)
Baselines: MTD OOD Standard (no defense)
Builds on: PGD adversarial training Overload Phantom Sponge Daedalus
Closest papers by meaning
- Overload: Latency Attacks on Object Detection for Edge Devices (CVPR 2024 · similarity 0.89)
- SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · similarity 0.87)
- SlowFormer: Adversarial Attack on Compute and Energy Consumption of Efficient Vision Transformers (CVPR 2024 · similarity 0.84)
- Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion (AAAI 2024 · similarity 0.84)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.83)
- NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors (AAAI 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.