簡易檢索 / 詳目顯示

回結果列表
研究生： 陳二中
Chen, Erh-Chung
論文名稱： 提升電腦視覺中的對抗穩健性與效率
Improving Adversarial Resilience and Efficiency in Computer Vision Models
指導教授： 李哲榮
Lee, Che-Rung
口試委員: 陳品諭
Chen, Pin-Yu
陳尚澤
Chen, Shang-Tse
游家牧
Yu, Chia-Mu
呂俊賢
Lu, Chun-Shien
吳尚鴻
Wu, Shan-Hung
學位類別： 博士
Doctor
系所名稱： 電機資訊學院 - 資訊工程學系
Computer Science
論文出版年： 2025
畢業學年度： 113
語文別： 英文
論文頁數： 114
中文關鍵詞： 深度學習
外文關鍵詞： trustworthy
相關次數： 點閱：3  下載：0 
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報

    • 深度神經網的安全性(security)和穩健性(robustness)正成為迫切重要的關注點。先前的研究表明，對抗性攻擊可以透過對原始資料引入難以察覺的擾動來有效地創建惡意資料，從而導致模型對影像分類器和物件偵測器產生錯誤的預測。本論文提供了增強 DNN 可靠性的理論見解和實際解決方案。對於影像分類(image classification)，我們發現現實世界資料集中的模糊資料(ambiguous data)通常使用單熱標籤(one-hot label)表示，這會是導致漏洞的其中一個原因。為了減輕對非預期資料分佈的過度擬合並提高目標模型的泛化性(generalizability)，我們建議在標記真實資料時應考慮類別間分佈的關係。此外，我們提出了一種新穎的最佳化方法，透過降低計算成本來提高對抗訓練的效率而不影響穩健性。對於物件偵測的研究，我們審視了一種特定對抗性攻擊變體，其被稱為延遲攻擊。這些攻擊透過在影像中產生巨量的幽靈物件來增加推理時間。我們研究如何有效產生這些對抗性範例並評估它們對邊緣設備(edge devices)的影響。我們的研究結果表明，延遲攻擊利用的主要漏洞在於丟棄重複物件的機制。然而，我們的分析表明，時間增量的主要貢獻者是次要頁面錯誤(minor page fault)。據我們所知，這是第一個從運算架構角度解決延遲問題的研究。這項發現為在邊緣設備上設計即時應用程式提供了寶貴的指導，旨在提高效率和增強彈性。實驗結果表明，所提出的演算法不僅降低了訓練可靠模型的成本，而且還顯示透過RobustBench等公開標準驗證可以進一步提高穩健性。

    The security and robustness of deep neural networks (DNNs) are becoming increasingly critical concerns. Prior research has demonstrated that adversarial attacks can effectively generate malicious examples by introducing imperceptible perturbations to original data, causing models to produce incorrect predictions in tasks such as image classification and object detection. This thesis provides both theoretical insights and practical solutions to enhance the reliability of DNNs. For image classification, we identify that ambiguous data in real-world datasets, often represented using one-hot labels, contributes to vulnerabilities. To mitigate overfitting to unexpected distributions and improve the generalizability of target models, we propose considering inter-class distribution when labeling ground truth. Additionally, we present a novel optimization approach that enhances the efficiency of adversarial training by reducing computational costs without compromising robustness. In the context of object detection, we examine a specific adversarial attack variant known as latency attacks. These attacks increase inference time by generating numerous phantom objects in images. We investigate methods for effectively generating such adversarial examples and evaluate their impact on edge devices. Our findings reveal that the primary vulnerability exploited by latency attacks lies in the mechanism for discarding duplicated objects. However, our analysis indicates that the main contributors to time increments are minor page faults. To our knowledge, this is the first study addressing latency issues from a computing architecture perspective. This findings offer valuable guidelines for developing real-time applications on resource-constrained devices, aiming for both efficiency and enhanced resilience. Experimental results demonstrate that the proposed algorithms not only reduce the costs of training reliable models but also show that robustness can be further improved using public benchmarks like RobustBench.

    Contents Abstract (Chinese) I Abstract II Contents IV List of Figures VIII List of Tables X List of Algorithms XII 1 Introduction 1 2 Related Work 6 2.1 Adversarial Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.2 Latency Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.3 Adversarial Training . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.3.1 Distribution of Adversarial and Natural Examples . . . . . . 10 2.3.2 Additional Data and Generative Data . . . . . . . . . . . . . 11 2.3.3 Fast Adversarial Training . . . . . . . . . . . . . . . . . . . 12 3 Robust Image Classifiers to Defend Against Adversarial Attacks 13 3.1 Method - Enhanced FGSM Training . . . . . . . . . . . . . . . . . 13 3.1.1 Preliminary . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.1.2 Adversarial Image Generator . . . . . . . . . . . . . . . . . . 15 3.1.3 Inter-Class Distance . . . . . . . . . . . . . . . . . . . . . . 16 3.1.4 Training Model . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.1.5 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 3.2 Method - Low Temperature Distillation for Gradient Masking-free Adversarial Training . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.2.1 Classification Problem in Real-world Scenario . . . . . . . . 21 3.2.2 Oracle Distribution Estimation . . . . . . . . . . . . . . . . 23 3.2.3 Training Framework . . . . . . . . . . . . . . . . . . . . . . 24 3.2.4 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 3.3 Method - Data Filtering for Efficient Adversarial Training . . . . . 31 3.3.1 Problem Definition . . . . . . . . . . . . . . . . . . . . . . . 32 3.3.2 An Upper Bound of Adversarial Risk . . . . . . . . . . . . . 33 3.3.3 Properties of Adversarial Examples . . . . . . . . . . . . . . 34 3.3.4 Existence of Inefficient Examples . . . . . . . . . . . . . . . 36 3.3.5 Optimization Strategies . . . . . . . . . . . . . . . . . . . . 38 3.3.6 Heuristic Decision Making Approach . . . . . . . . . . . . . 38 3.3.7 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.3.8 Inefficient Examples Investigation . . . . . . . . . . . . . . . 45 3.3.9 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.4 Method - Data-Driven Lipschitz Continuity: A Cost-Effective Ap- proach to Improve Adversarial Robustness . . . . . . . . . . . . . . 47 3.4.1 Lipschitz Continuity . . . . . . . . . . . . . . . . . . . . . . 48 3.4.2 Forged Function . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.4.3 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 3.4.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 4 Adversarial Attacks and Defenses in Object Detection 58 4.1 Method - Overload: Latency Attacks on Object Detection for Edge Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 4.1.1 Non-maximum Suppression . . . . . . . . . . . . . . . . . . 58 4.1.2 Exploring Objectives for Adversarial Example Generation . 61 4.1.3 Proposed Method for Latency Attacks on Object Detection . 62 4.1.4 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 4.1.5 IoU-invariant Verification . . . . . . . . . . . . . . . . . . . 67 4.1.6 Comparison to Known Attacks . . . . . . . . . . . . . . . . 68 4.1.7 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 4.2 Method - Evaluating Robustness of Object Detection against Black- box Adversarial Attacks . . . . . . . . . . . . . . . . . . . . . . . . 71 4.2.1 Threat Model and Motivations . . . . . . . . . . . . . . . . 71 4.2.2 Attack Flow Overview . . . . . . . . . . . . . . . . . . . . . 72 4.2.3 Data Collection from Open World . . . . . . . . . . . . . . . 73 4.2.4 Position-centric Candidate Selection . . . . . . . . . . . . . . 74 4.2.5 Color Manipulation . . . . . . . . . . . . . . . . . . . . . . . 76 4.2.6 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 4.3 Method - Latency Attack Resilience in Object Detectors: Insights from Computing Architecture . . . . . . . . . . . . . . . . . . . . . 81 4.3.1 Mechanisms for Page Faults . . . . . . . . . . . . . . . . . . 81 4.3.2 Performance Analysis . . . . . . . . . . . . . . . . . . . . . . 82 4.3.3 Minor Page Fault-aware Implementations . . . . . . . . . . . 84 4.3.4 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 4.3.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 5 Conclusion 94 Bibliography 95

    [1] Sravanti Addepalli, Samyak Jain, Gaurang Sriramanan, Shivangi Khare, and Venkatesh Babu Radhakrishnan. Towards achieving adversarial robustness beyond perceptual limits. In ICML 2021 Workshop on Adversarial Machine Learning, 2021.
    [2] Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? Advances in Neural Information Processing Systems, 32, 2019.
    [3] Ahmed Aldahdooh, Wassim Hamidouche, Sid Ahmed Fezza, and Olivier D´eforges. Adversarial example detection for dnn models: a review and experimental comparison. Artificial Intelligence Review, pages 1–60, 2022.
    [4] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. arXiv preprint arXiv:1912.00049, 2019.
    [5] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pages 274–283. PMLR, 2018.
    [6] Yatong Bai, Mo Zhou, Vishal M Patel, and Somayeh Sojoudi. Mixednuts: Training-free accuracy-robustness balance via nonlinearly mixed classifiers. arXiv preprint arXiv:2402.02263, 2024.
    [7] Jeremy Bernstein, Jiawei Zhao, Kamyar Azizzadenesheli, and Anima Anandkumar. signsgd with majority vote is communication efficient and fault tolerant. arXiv preprint arXiv:1810.05291, 2018.
    [8] Lucas Beyer, Olivier J H´enaff, Alexander Kolesnikov, Xiaohua Zhai, and A¨aron van den Oord. Are we done with imagenet? arXiv preprint arXiv:2006.07159, 2020.
    [9] Alexey Bochkovskiy, Chien-Yao Wang, and Hong-Yuan Mark Liao. Yolov4: Optimal speed and accuracy of object detection. arXiv preprint arXiv:2004.10934, 2020.
    [10] Tom B Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul Christiano, and Ian Goodfellow. Unrestricted adversarial examples. arXiv preprint arXiv:1809.08352, 2018.
    [11] Qi-Zhi Cai, Min Du, Chang Liu, and Dawn Song. Curriculum adversarial training. arXiv preprint arXiv:1805.04807, 2018.
    [12] Zikui Cai, Xinxin Xie, Shasha Li, Mingjun Yin, Chengyu Song, Srikanth V Krishnamurthy, Amit K Roy-Chowdhury, and M Salman Asif. Contextaware transfer attacks for object detection. In AAAI, 2022.
    [13] Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part I 16, pages 213–229. Springer, 2020.
    [14] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019.
    [15] Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE Security and Privacy Workshops (SPW), pages 1–7. IEEE, 2018.
    [16] Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems, 32, 2019.
    [17] Erh-Chung Chen, Pin-Yu Chen, I Chung, Che-Rung Lee, et al. Latency attack resilience in object detectors: Insights from computing architecture. In Proceedings of the Asian Conference on Computer Vision, pages 3206–3222, 2024.
    [18] Erh-Chung Chen, Pin-Yu Chen, I Chung, Che-Rung Lee, et al. Overload: Latency attacks on object detection for edge devices. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24716–24725, 2024.
    [19] Erh-Chung Chen, Pin-Yu Chen, I Chung, Che-Rung Lee, et al. Steal now and attack later: Evaluating robustness of object detection against black-box adversarial attacks. arXiv preprint arXiv:2404.15881, 2024.
    [20] Erh-Chung Chen and Che-Rung Lee. Towards fast and robust adversarial training for image classification. In Proceedings of the Asian Conference on Computer Vision, 2020.
    [21] Erh-Chung Chen and Che-Rung Lee. Ltd: Low temperature distillation for robust adversarial training. arXiv preprint arXiv:2111.02331, 2021.
    [22] Erh-Chung Chen and Che-Rung Lee. Data filtering for efficient adversarial training. Pattern Recognition, 151:110394, 2024.
    [23] Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. Ead: elastic-net attacks to deep neural networks via adversarial examples. In Proceedings of the AAAI conference on artificial intelligence, volume 32, 2018.
    [24] Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pages 15–26, 2017.
    [25] Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations, 2021.
    [26] Minhao Cheng, Thong Le, Pin-Yu Chen, Jinfeng Yi, Huan Zhang, and ChoJui Hsieh. Query-efficient hard-label black-box attack: An optimizationbased approach. arXiv preprint arXiv:1807.04457, 2018.
    [27] Zhen Cheng, Fei Zhu, Xu-Yao Zhang, and Cheng-Lin Liu. Adversarial training with distribution normalization and margin balance. Pattern Recognition, 136:109182, 2023.
    [28] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021.
    [29] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pages 2206–2216. PMLR, 2020.
    [30] Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 15721–15730, 2021.
    [31] Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled kullback-leibler divergence loss. arXiv preprint arXiv:2305.13948, 2023.
    [32] Edoardo Debenedetti, Vikash Sehwag, and Prateek Mittal. A light recipe to train robust vision transformers. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 225–253. IEEE, 2023.
    [33] Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adversarial attacks transfer? explaining transferability of evasion and poisoning
    attacks. In 28th USENIX security symposium (USENIX security 19), pages 321–338, 2019.
    [34] Jian Ding, Nan Xue, Gui-Song Xia, Xiang Bai, Wen Yang, Michael Ying Yang, Serge Belongie, Jiebo Luo, Mihai Datcu, Marcello Pelillo, et al. Object detection in aerial images: A large-scale benchmark and challenges. IEEE transactions on pattern analysis and machine intelligence, 44(11):7778–7796, 2021.
    [35] Logan Engstrom, Andrew Ilyas, Hadi Salman, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library), 2019.
    [36] Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The pascal visual object classes (voc) challenge. International journal of computer vision, 88:303–338, 2010.
    [37] Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1625–1634, 2018.
    [38] Farzan Farnia, Jesse M Zhang, and David Tse. Generalizable adversarial training via spectral normalization. arXiv preprint arXiv:1811.07457, 2018.
    [39] Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In International Conference on Learning Representations, 2020.
    [40] Ross Girshick. Fast r-cnn. In International Conference on Computer Vision (ICCV), 2015.
    [41] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
    [42] Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34, 2021.
    [43] Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280, 2017.
    [44] Jindong Gu and Volker Tresp. Improving the robustness of capsule networks to image affine transformations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7285–7293, 2020.
    [45] Jindong Gu, Volker Tresp, and Han Hu. Capsule network is not more robust than convolutional network. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 14309–14317, 2021.
    [46] Sidharth Gupta, Parijat Dube, and Ashish Verma. Improving the affordability of robustness training for dnns. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, pages 780–781, 2020.
    [47] Kaiming He, Georgia Gkioxari, Piotr Doll´ar, and Ross Girshick. Mask r-cnn. In Proceedings of the IEEE international conference on computer vision, pages 2961–2969, 2017.
    [48] Yang He and Lingao Xiao. Structured pruning for deep convolutional neural networks: A survey. IEEE transactions on pattern analysis and machine intelligence, 2023.
    [49] Ziwen He, Wei Wang, Jing Dong, and Tieniu Tan. Temporal sparse adversarial attack on sequence-based gait recognition. Pattern Recognition, 133:109028, 2023.
    [50] Geoffrey Hinton, Oriol Vinyals, and Jeffrey Dean. Distilling the knowledge in a neural network. In NIPS Deep Learning and Representation Learning Workshop, 2015.
    [51] Sanghyun Hong, Yi˘gitcan Kaya, Ionut¸-Vlad Modoranu, and Tudor Dumitra¸s. A panda? no, it’s a sloth: Slowdown attacks on adaptive multi-exit neural network inference. arXiv preprint arXiv:2010.02432, 2020.
    [52] EunJin Jeong, Jangryul Kim, and Soonhoi Ha. Tensorrt-based framework and optimization methodology for deep learning inference on jetson boards. ACM Transactions on Embedded Computing Systems (TECS), 2022.
    [53] Yunhan Jia Jia, Yantao Lu, Junjie Shen, Qi Alfred Chen, Hao Chen, Zhenyu Zhong, and Tao Wei Wei. Fooling detection alone is not enough: Adversarial attack against multiple object tracking. In International Conference on
    Learning Representations (ICLR’20), 2020.
    [54] Glenn Jocher. YOLOv5 by Ultralytics, May 2020.
    [55] Glenn Jocher, Ayush Chaurasia, and Jing Qiu. YOLO by Ultralytics, January 2023.
    [56] Salman Khan, Muzammal Naseer, Munawar Hayat, Syed Waqas Zamir, Fahad Shahbaz Khan, and Mubarak Shah. Transformers in vision: A survey. ACM computing surveys (CSUR), 54(10s):1–41, 2022.
    [57] Dae Ha Kim, Seunghyun Lee, Jungho Jeon, and Byung Cheol Song. Realtime purchase behavior recognition system based on deep learning-based object detection and tracking for an unmanned product cabinet. Expert Systems with Applications, 143:113063, 2020.
    [58] Chi-Hsi Kung and Che-Rung Lee. Add: A fine-grained dynamic inference architecture for semantic image segmentation. In 2021 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 4792–4799. IEEE, 2021.
    [59] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machinelearning at scale. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017.
    [60] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99–112. Chapman and Hall/CRC, 2018.
    [61] Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Kamali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, et al. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. International Journal of Computer Vision, 128(7):1956–1981, 2020.
    [62] Hyungyu Lee, Ho Bae, and Sungroh Yoon. Gradient masking of label smoothing in adversarial robustness. IEEE Access, 9:6453–6464, 2020.
    [63] Saehyung Lee, Hyungyu Lee, and Sungroh Yoon. Adversarial vertex mixup: Toward better adversarially robust generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 272–281, 2020.
    [64] Chao Li, Wen Yao, Handing Wang, and Tingsong Jiang. Adaptive momentum variance for attention-guided sparse adversarial attacks. Pattern Recognition, 133:108979, 2023.
    [65] Chengxi Li, Stanley H Chan, and Yi-Ting Chen. Driver-centric risk object identification. arXiv preprint arXiv:2106.13201, 2021.
    [66] Chuyi Li, Lulu Li, Hongliang Jiang, Kaiheng Weng, Yifei Geng, Liang Li, Zaidan Ke, Qingyuan Li, Meng Cheng, Weiqiang Nie, et al. Yolov6: a single-stage object detection framework for industrial applications. arXiv preprint arXiv:2209.02976, 2022.
    [67] Debang Li, Junge Zhang, and Kaiqi Huang. Universal adversarial perturbations against object detection. Pattern Recognition, 110:107584, 2021.
    [68] Hao Li, Zheng Xu, Gavin Taylor, Christoph Studer, and Tom Goldstein. Visualizing the loss landscape of neural nets. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018.
    [69] Haoyang Li, Heng Li, Hansong Zhang, and Wei Yuan. Black-box attack against handwritten signature verification with region-restricted adversarial perturbations. Pattern Recognition, 111:107689, 2021.
    [70] Shasha Li, Shitong Zhu, Sudipta Paul, Amit Roy-Chowdhury, Chengyu Song, Srikanth Krishnamurthy, Ananthram Swami, and Kevin S Chan. Connecting the dots: Detecting adversarial perturbations using context inconsistency. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXIII 16, pages 396–413. Springer, 2020.
    [71] Siyuan Liang, Hao Wu, Li Zhen, Qiaozhi Hua, Sahil Garg, Georges Kaddoum, Mohammad Mehedi Hassan, and Keping Yu. Edge yolo: Real-time intelligent object detection system based on edge-cloud cooperation in autonomous vehicles. IEEE Transactions on Intelligent Transportation Sys- tems, 2022.
    [72] Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pages 740–755. Springer, 2014.
    [73] Chang Liu, Yinpeng Dong, Wenzhao Xiang, Xiao Yang, Hang Su, Jun Zhu, Yuefeng Chen, Yuan He, Hui Xue, and Shibao Zheng. A comprehensive study on robustness of image classification models: Benchmarking and rethinking. arXiv preprint arXiv:2302.14301, 2023.
    [74] Chongwei Liu, Haojie Li, Shuchang Wang, Ming Zhu, Dong Wang, Xin Fan, and Zhihui Wang. A dataset and benchmark of underwater object detection for robot picking. In 2021 IEEE International Conference on Multimedia & Expo Workshops (ICMEW), pages 1–6. IEEE, 2021.
    [75] Li Liu, Wanli Ouyang, Xiaogang Wang, Paul Fieguth, Jie Chen, Xinwang Liu, and Matti Pietik¨ainen. Deep learning for generic object detection: A survey. International journal of computer vision, 128(2):261–318, 2020.
    [76] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021.
    [77] H Luo and S Hanagud. Dynamic learning rate neural network training and composite structural damage detection. AIAA journal, 35(9):1522–1527,1997.
    [78] Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 110:107332, 2021.
    [79] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
    [80] TorchVision maintainers and contributors. Torchvision: Pytorch’s computer vision library. https://github.com/pytorch/vision, 2016.
    [81] Yuhao Mao, Mark Niklas Mueller, Marc Fischer, and Martin Vechev. Understanding certified training with interval bound propagation. In The Twelfth International Conference on Learning Representations, 2024.
    [82] Takeru Miyato, Andrew M. Dai, and Ian Goodfellow. Adversarial training methods for semi-supervised text classification. In International Conference on Learning Representations, 2017.
    [83] Yichuan Mo, Dongxian Wu, Yifei Wang, Yiwen Guo, and Yisen Wang. When adversarial training meets vision transformers: Recipes from training to architecture. Advances in Neural Information Processing Systems, 35:18599–18611, 2022.
    [84] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016.
    [85] Rafael M¨uller, Simon Kornblith, and Geoffrey E Hinton. When does label smoothing help? Advances in neural information processing systems, 32, 2019.
    [86] David Opitz and Richard Maclin. Popular ensemble methods: An empirical study. Journal of artificial intelligence research, 11:169–198, 1999.
    [87] Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2021.
    [88] Tianyu Pang, Xiao Yang, Yinpeng Dong, Kun Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. Advances in Neural Information Processing Systems, 33:7779–7792, 2020.
    [89] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pages 582–597. IEEE, 2016.
    [90] ShengYun Peng, Weilin Xu, Cory Cornelius, Matthew Hull, Kevin Li, Rahul Duggal, Mansi Phute, Jason Martin, and Duen Horng Chau. Robust principles: Architectural design principles for adversarially robust cnns. arXiv preprint arXiv:2308.16258, 2023.
    [91] Delong Qi, Weijun Tan, Qi Yao, and Jingfeng Liu. Yolo5face: Why reinventing a face detector. In European Conference on Computer Vision, pages 228–244. Springer, 2022.
    [92] Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. Boosting the transferability of adversarial attacks with reverse adversarial perturbation. Advances in neural information processing systems, 35:29845–29858, 2022.
    [93] Niranjan Ravi and Mohamed El-Sharkawy. Real-time embedded implementation of improved object detector for resource-constrained devices. Journal of Low Power Electronics and Applications, 12(2):21, 2022.
    [94] Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946, 2021.
    [95] Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International Conference on Machine Learning, pages 5389–5400. PMLR, 2019.
    [96] Joseph Redmon and Ali Farhadi. Yolov3: An incremental improvement. arXiv preprint arXiv:1804.02767, 2018.
    [97] Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in neural information processing systems, 28, 2015.
    [98] Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pages 8093–8104. PMLR, 2020.
    [99] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems, 33:3533–3545, 2020.
    [100] Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, pages 3358–3369, 2019.
    [101] Avishag Shapira, Alon Zolfi, Luca Demetrio, Battista Biggio, and Asaf Shabtai. Phantom sponges: Exploiting non-maximum suppression to attack deep object detectors. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 4571–4580, 2023.
    [102] Yash Sharma and Pin-Yu Chen. Attacking the madry defense model with l1-based adversarial examples. arXiv preprint arXiv:1710.10733, 2017.
    [103] Hwanjun Song, Minseok Kim, Dongmin Park, Yooju Shin, and Jae-Gil Lee. Learning from noisy labels with deep neural networks: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022.
    [104] David Stutz, Matthias Hein, and Bernt Schiele. Confidence-calibrated adversarial training: Generalizing to unseen attacks. In International Conference on Machine Learning, pages 9155–9166. PMLR, 2020.
    [105] Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828–841, 2019.
    [106] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
    [107] Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness to natural distribution shifts in image classification. Advances in Neural Information Processing Systems, 33:18583–18599, 2020.
    [108] Zhi Tian, Chunhua Shen, Hao Chen, and Tong He. Fcos: Fully convolutional one-stage object detection. In Proceedings of the IEEE/CVF international conference on computer vision, pages 9627–9636, 2019.
    [109] Chandrahas Tirumalasetty, Chih Chieh Chou, Narasimha Reddy, Paul Gratz, and Ayman Abouelwafa. Reducing minor page fault overheads through enhanced page walker. ACM Transactions on Architecture and Code Optimization (TACO), 19(4):1–26, 2022.
    [110] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. From imagenet to image classification: Contextualizing progress on benchmarks. In International Conference on Machine Learning, pages 9625–9635. PMLR, 2020.
    [111] Jonathan Uesato, Brendan O’donoghue, Pushmeet Kohli, and Aaron Oord. Adversarial risk and the dangers of evaluating against weak attacks. In International Conference on Machine Learning, pages 5025–5034. PMLR, 2018.
    [112] Pascal Vincent, Hugo Larochelle, Isabelle Lajoie, Yoshua Bengio, and Pierre Antoine Manzagol. Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion. J. Mach. Learn. Res., 11:3371–3408, December 2010.
    [113] Oriol Vinyals, Alexander Toshev, Samy Bengio, and Dumitru Erhan. Showand tell: A neural image caption generator. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3156–3164, 2015.
    [114] Chien-Yao Wang, Alexey Bochkovskiy, and Hong-Yuan Mark Liao. Yolov7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7464–7475, 2023.
    [115] Derui Wang, Chaoran Li, Sheng Wen, Qing-Long Han, Surya Nepal, Xiangyu Zhang, and Yang Xiang. Daedalus: Breaking nonmaximum suppression in object detection via adversarial examples. IEEE Transactions on Cybernetics, 2021.
    [116] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In International Conference on Machine Learning, pages 36246–36263. PMLR, 2023.
    [117] Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
    [118] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33, 2020.
    [119] Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein. Making an invisibility cloak: Real world adversarial attacks on object detectors. In European Conference on Computer Vision, pages 1–17. Springer, 2020.
    [120] Canqun Xiang, Lu Zhang, Yi Tang, Wenbin Zou, and Chen Xu. Mscapsnet: A novel multi-scale capsule network. IEEE Signal Processing Letters, 25(12):1850–1854, 2018.
    [121] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le. Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 819–828, 2020.
    [122] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 501–509, 2019.
    [123] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. The Internet Society, 2018.
    [124] Chengyuan Yao, Pavol Bielik, Petar Tsankov, and Martin Vechev. Automated discovery of adaptive attacks on adversarial defenses. Advances in Neural Information Processing Systems, 34, 2021.
    [125] Mingjun Yin, Shasha Li, Zikui Cai, Chengyu Song, M Salman Asif, Amit K Roy-Chowdhury, and Srikanth V Krishnamurthy. Exploiting multi-object relationships for detecting adversarial attacks in complex scenes. In proceedings of the IEEE/CVF international conference on computer vision, pages 7858–7867, 2021.
    [126] Mingjun Yin, Shasha Li, Chengyu Song, M Salman Asif, Amit K RoyChowdhury, and Srikanth V Krishnamurthy. Adc: Adversarial attacks against object detection that evade context consistency checks. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3278–3287, 2022.
    [127] Yuichi Yoshida and Takeru Miyato. Spectral norm regularization for improving the generalizability of deep learning. arXiv preprint arXiv:1705.10941, 2017.
    [128] Xi Yu, Niklas Smedemark-Margulies, Shuchin Aeron, Toshiaki Koike-Akino, Pierre Moulin, Matthew Brand, Kieran Parsons, and Ye Wang. Improving adversarial robustness by learning shared information. Pattern Recognition, 134:109054, 2023.
    [129] Ziping Yu, Hongbo Huang, Weijun Chen, Yongxin Su, Yahui Liu, and Xiuying Wang. Yolo-facev2: A scale and occlusion aware face detector. arXiv preprint arXiv:2208.02019, 2022.
    [130] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pages 7472–7482. PMLR, 2019.
    [131] Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankanhalli. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pages 11278–11287. PMLR, 2020.
    [132] Lei Zhang, Shuai Wang, and Bing Liu. Deep learning for sentiment analysis: A survey. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 8(4):e1253, 2018.
    [133] Xu-Yao Zhang, Cheng-Lin Liu, and Ching Y Suen. Towards robust pattern recognition: A review. Proceedings of the IEEE, 108(6):894–922, 2020.\[134] Xin Zheng, Yanbo Fan, Baoyuan Wu, Yong Zhang, Jue Wang, and Shirui
    Pan. Robust physical-world attacks on face recognition. Pattern Recognition, 133:109009, 2023.
    [135] Zhaohui Zheng, Ping Wang, Wei Liu, Jinze Li, Rongguang Ye, and Dongwei Ren. Distance-iou loss: Faster and better learning for bounding box regression. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 12993–13000, 2020.
    [136] Xingyi Zhou, Dequan Wang, and Philipp Kr¨ahenb¨uhl. Objects as points. arXiv preprint arXiv:1904.07850, 2019.
    [137] Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. arXiv preprint arXiv:2106.04928, 2021.
    [138] Bojia Zi, Shihao Zhao, Xingjun Ma, and Yu-Gang Jiang. Revisiting adversarial robustness distillation: Robust soft labels make student better. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16443–16452, 2021.
    [139] Monty-Maximilian Z¨uhlke and Daniel Kudenko. Adversarial robustness of neural networks from the perspective of lipschitz calculus: A survey. ACM Computing Surveys, 2024.

    QR CODE