Research map / Adversarial robustness and security / Attacks on text and graphs
KDAT: Inherent Adversarial Robustness via Knowledge Distillation with Adversarial Tuning for Object Detection Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes KDAT, a fine-tuning defense that uses self-distillation with adversarial tuning (teacher sees benign images, student sees adversarial patches) to make OD models robust to patch attacks without hurting benign accuracy or inference time.
Problem
Adversarial patches degrade object detection accuracy, and existing OD defenses trade off benign performance for robustness or add significant inference overhead.
Approach
Replicates the pretrained OD model as a frozen teacher (benign inputs) and a trainable student (adversarial and benign inputs), and trains the student with four loss components (OD, feature map, classification over probability vectors over areas, and architecture-specific family adjustable loss) so adversarial predictions match benign teacher predictions, with a self-guiding switch between teacher
Key results
- On COCO, KDAT improves DETR mean mAP to 0.497 vs 0.431 for the undefended model under M-PGD... and benign mAP for DETR rises to 0.613 vs 0.534 for the undefended model under DPatch setting.
- On Superstore (physical printed DPatch), KDAT reaches 0.788 adversarial mAP vs 0.568 undefended, with no inference-time overhead.
- Adaptive attacks need 8% more optimization iterations for Faster R-CNN (324.83 to 350.52) and 10% for DETR (383.5 to 425.5).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply KDAT instead of AD-YOLO | DETR · COCO DPatch mean | mAP: 0.544 -> 0.557 | Helped |
| Apply KDAT instead of AD-YOLO | DETR · COCO Google mean | mAP: 0.493 -> 0.507 | Helped |
| Apply KDAT instead of PAD | DETR · COCO M-PGD mean | mAP: 0.429 -> 0.497 | Helped |
| Apply KDAT instead of SAC | Faster R-CNN · COCO DPatch mean | mAP: 0.399 -> 0.425 | Helped |
| Apply KDAT instead of ObjectSeeker | Faster R-CNN · COCO Google mean | mAP: 0.414 -> 0.409 | Hurt |
| Apply KDAT instead of SAC | Faster R-CNN · COCO M-PGD mean | mAP: 0.425 -> 0.432 | Helped |
| Apply KDAT instead of ObjectSeeker | Faster R-CNN · Superstore adversarial DPatch | mAP: 0.681 -> 0.788 | Helped |
| Add OD loss (ablation) | KDAT on DETR · COCO ablation mean, benign | mAP: 0.571 -> 0.584 | Helped |
| Add OD loss (ablation) | KDAT on DETR · COCO ablation mean, adversarial | mAP: 0.452 -> 0.457 | Helped |
| Add feature map loss (ablation) | KDAT on DETR · COCO ablation mean, benign | mAP: 0.573 -> 0.584 | Helped |
| Add feature map loss (ablation) | KDAT on DETR · COCO ablation mean, adversarial | mAP: 0.457 -> 0.457 | No clear effect |
| Add classification loss (ablation) | KDAT on DETR · COCO ablation mean, benign | mAP: 0.570 -> 0.584 | Helped |
Surprising findings
- KDAT improves benign performance as well as adversarial robustness, rather than trading one for the other.
- The variant without ground-truth labels (KDAT w/o LOD) still improves both benign and adversarial mAP.
Limitations
- Feature-attention (FA) loss must be redesigned for each new OD architecture family.
- Superstore benign images are replaced by masked attacked images, which lowers benign performance there.
- Requires one-time offline fine-tuning on paired benign and adversarial data.
Experimental setup
Datasets: COCO INRIA Superstore
Benchmarks: COCO INRIA Superstore
Metrics: mAP@0.5 inference time (ms) FPS number of optimization iterations under adaptive attack
Baselines: AT LGS Grad Defense AD-YOLO SAC ObjectSeeker PAD
Builds on: Knowledge distillation (Hinton et al. 2015) Adversarial training (Goodfellow et al. 2014) PGD adversarial training (Madry et al. 2017) Adversarial tuning (Jeddi et al. 2020)
Closest papers by meaning
- Out of Thin Air: Exploring Data-Free Adversarial Robustness Distillation (AAAI 2024 · similarity 0.86)
- VkD: Improving Knowledge Distillation using Orthogonal Projections (CVPR 2024 · similarity 0.86)
- DCSF-KD: Dynamic Channel-wise Spatial Feature Knowledge Distillation for Object Detection (AAAI 2025 · similarity 0.86)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.86)
- CrossKD: Cross-Head Knowledge Distillation for Object Detection (CVPR 2024 · similarity 0.85)
- DFD: Distilling the Feature Disparity Differently for Detectors (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.