arXiv:2607.06592cs.CVcs.AI2026-07

通过约束模型结构的利普希茨常数,提升目标检测在对抗攻击下的鲁棒性。

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

  • 用利普希茨约束设计检测器架构,无需依赖对抗训练
  • 在Pascal VOC上对未知攻击提升mAP@50达15点
  • 适用于安全关键场景,兼容多种数据集与攻击类型

目标检测广泛应用于安全敏感系统,但易受对抗攻击等最坏情况扰动影响。相较于分类任务,目标检测的鲁棒性研究较少,现有方法多依赖对抗训练,其效果难以跨攻击类型、扰动幅度或模型架构迁移。本文提出基于利普希茨约束的检测架构,作为“设计即鲁棒”的替代方案。以利普希茨约束版单阶段检测器LipSSD为例,在多个白盒攻击和数据集上验证其鲁棒性。分析发现,利普希茨约束可由单一超参数调控准确率-鲁棒性权衡。在相同训练设置下,对抗训练后的LipSSD在未见攻击中比传统对抗训练的SSD提升最大15点mAP@50。在更贴近实际的安全关键数据集LARD和KITTI上,该方法在保持良好干净性能的同时显著增强鲁棒性。结果表明,架构级利普希茨控制是提升目标检测鲁棒性的实用且攻击无关路径。

原文摘要 · Abstract (English)

Object detectors have many applications in safety-critical systems, but they are known to be sensitive to worst-case perturbations such as adversarial attacks, which limits their applicability in real-world scenarios. Compared with classification, adversarial robustness for object detection has received less attention, and existing methods are often tied to adversarial training, whose performance may not transfer across attacks, perturbation budgets, or architectures. In this work, we introduce Lipschitz-constrained variants of object detection architectures as robust-by-design alternatives to standard detectors. We validate this approach with LipSSD, a Lipschitz-constrained Single Shot MultiBox Detector (SSD), and provide a comprehensive study of its adversarial robustness using multiple white-box adversarial attacks and datasets. We first analyze the accuracyrobustness trade-off induced by Lipschitz constraints and show that it can be controlled through a single training hyperparameter. We then demonstrate that Lipschitzconstrained detectors are complementary to adversarial training: under the same training setup on the Pascal VOC dataset, adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical adversarially trained SSD. Finally, we use more specific safety-critical datasets such as LARD and KITTI, and show that Lipschitz-constrained detectors can improve robustness while largely preserving clean performance. These results suggest that architectural Lipschitz control is a practical and attack-agnostic direction for improving the robustness of object detectors.

目标检测对抗鲁棒性利普希茨约束

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。