Research map / Adversarial robustness and security / Black-box and transfer attacks
Transferable Adversarial Attacks for Object Detection Using Object-Aware Significant Feature Distortion
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes OSFD, a loss plus RRB augmentation (random axis rotation, adaptive random resizing, Gaussian blur) that distorts object-aware significant backbone features to craft transferable untargeted black-box attacks on object detectors.
Problem
Transferable black-box adversarial attacks against object detectors perform poorly when intermediate-feature attacks designed for classifiers are applied directly, because detector backbone features differ fundamentally from classifier features.
Approach
Exploits spatial consistency and limited equivariance of detector backbone features: an MSE-style loss suppresses significant (object) features while amplifying benign features by k, so vicinal features around object boundaries are also distorted; a detector-aware augmentation RRB (rotation, adaptive resizing, blur) is combined with MIM/DIM.
Key results
- On FasterRCNN source, OSFD-RRB reduces black-box mAP to a mean of 0.118 across targets versus 0.215 for TOG and 0.109-0.150 for other baselines (Table 1 mean column).
- OSFD-RRB achieves mean black-box mAP of 0.042 when attacking VFNet, versus 0.215 for TOG, indicating strong transfer across ResNet, Swin, CSPDarknet and DETR-style detectors.
- Ablation on FasterRCNN: removing RRB raises mean black-box mAP from 0.039 to 0.195, showing the augmentation is essential; rotation contributes more than resizing.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use OSFD-RRB instead of NRDM | YOLOv3-source attack · COCO mAP (black-box mean) | mAP: 0.272 -> 0.118 | Helped |
| use OSFD-RRB instead of FDA | VFNet-source attack · COCO mAP (black-box mean) | mAP: 0.079 -> 0.042 | Helped |
| use OSFD-RRB instead of FDA | Faster R-CNN-source attack · COCO mAP (black-box mean) | mAP: 0.083 -> 0.039 | Helped |
| use OSFD-RRB instead of NRDM | Mask R-CNN-source attack · COCO mAP (black-box mean) | mAP: 0.123 -> 0.054 | Helped |
| add RRB data augmentation (ablation) | OSFD on Faster R-CNN · COCO mAP (black-box mean) | mAP: 0.195 -> 0.039 | Helped |
| add adaptive random resizing (ablation) | OSFD-RRB on Faster R-CNN · COCO mAP (black-box mean) | mAP: 0.048 -> 0.039 | Helped |
| add random axis rotation (ablation) | OSFD-RRB on Faster R-CNN · COCO mAP (black-box mean) | mAP: 0.062 -> 0.039 | Helped |
| add Gaussian blur (ablation) | OSFD-RRB on Faster R-CNN · COCO mAP (black-box mean) | mAP: 0.046 -> 0.039 | Helped |
Surprising findings
- Loss-only variant without vicinal amplification (w/o RRB) transfers worse than several comparative baselines, showing that perturbing surrounding regions is necessary.
Limitations
- Gains are reported on a limited set of detectors trained on COCO with VOC2012 images for attack, and transfer is mainly evaluated with mAP on a subset of images.
- Attacks are evaluated only for untargeted settings and with a fixed l-infinity budget of 5/255.
- Some black-box targets (e.g. MaskRCNN, DETR) remain partially robust, with mean mAP values noted as non-negligible in some settings.
Experimental setup
Datasets: VOC2012 COCO
Benchmarks: COCO
Metrics: mAP
Baselines: NRDM FDA NAA RPA TOG OSFD-DIM
Builds on: MIM DIM FDA NRDM TOG
Closest papers by meaning
- Context-Aware Transfer Attacks for Object Detection (AAAI 2022 · similarity 0.92)
- Harmonizing Transferability and Discriminability for Adapting Object Detectors (CVPR 2020 · similarity 0.89)
- Enhancing Cross-Task Black-Box Transferability of Adversarial Examples With Dispersion Reduction (CVPR 2020 · similarity 0.89)
- Feature Space Perturbations Yield More Transferable Adversarial Examples (CVPR 2019 · similarity 0.88)
- Rethinking Model Ensemble in Transfer-based Adversarial Attacks (ICLR 2024 · similarity 0.86)
- Harnessing the Computation Redundancy in ViTs to Boost Adversarial Transferability (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.