{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T22:58:53Z","timestamp":1781650733611,"version":"3.54.5"},"reference-count":34,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,4,23]],"date-time":"2026-04-23T00:00:00Z","timestamp":1776902400000},"content-version":"vor","delay-in-days":22,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/100006498","name":"Clemson University","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100006498","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Appl Intell"],"published-print":{"date-parts":[[2026,4]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    Robust object detection is critical for autonomous driving and mobile robotics, where accurate recognition of vehicles, pedestrians, and obstacles is essential for ensuring safety. Despite the advancements in detection transformers (DETRs), their robustness against adversarial perturbations remains underexplored. This paper presents a comprehensive evaluation of the DETR model and its variants under both white-box and black-box adversarial attack settings, using the MS-COCO and KITTI datasets to cover general-purpose and autonomous driving scenarios. We adapt a suite of popular white-box attacks in image classifications including FGSM, PGD, C&amp;W and AutoPGD to object detection and assess DETR\u2019s vulnerability under these threats. In addition, we introduce a Modified C&amp;W attack tailored to the DETR architecture that exploits intermediate decoder losses to induce misclassification with minimal perturbations. Our results demonstrate that DETR models are significantly susceptible to the entire range of attacks, and that intra-network transferability between DETR variants is high, whereas cross-network transfer to Faster\u00a0R-CNN is more limited. We further validate the resilience of Modified C&amp;W against several input purification techniques and visualize self-attention maps to illustrate how adversarial attacks affect the models\u2019 internal representations. These findings reveal critical vulnerabilities in detection transformers under standard and adaptive attacks, underscoring the need for further research to improve the robustness of transformer-based object detectors in safety-critical applications. Codes are available at\n                    <jats:ext-link xmlns:xlink=\"http:\/\/www.w3.org\/1999\/xlink\" xlink:href=\"https:\/\/github.com\/amirhnazerii\/Transformer_ObjDet_Robustness\/\" ext-link-type=\"uri\">https:\/\/github.com\/amirhnazerii\/Transformer_ObjDet_Robustness\/<\/jats:ext-link>\n                  <\/jats:p>","DOI":"10.1007\/s10489-026-07220-2","type":"journal-article","created":{"date-parts":[[2026,4,23]],"date-time":"2026-04-23T13:19:53Z","timestamp":1776950393000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Evaluating the adversarial robustness of detection transformers"],"prefix":"10.1007","volume":"56","author":[{"given":"Amirhossein","family":"Nazeri","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chunheng","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4266-1336","authenticated-orcid":false,"given":"Pierluigi","family":"Pisu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,4,23]]},"reference":[{"issue":"8","key":"7220_CR1","doi-asserted-by":"publisher","first-page":"9961","DOI":"10.1109\/TITS.2021.3096854","volume":"23","author":"D Feng","year":"2021","unstructured":"Feng D, Harakeh A, Waslander SL, Dietmayer K (2021) A review and comparative study on probabilistic object detection in autonomous driving. IEEE Trans Intell Transp Syst 23(8):9961\u20139980","journal-title":"IEEE Trans Intell Transp Syst"},{"issue":"7","key":"7220_CR2","doi-asserted-by":"publisher","first-page":"4316","DOI":"10.1109\/TITS.2020.3032227","volume":"22","author":"K Muhammad","year":"2020","unstructured":"Muhammad K, Ullah A, Lloret J, Del Ser J, De Albuquerque VHC (2020) Deep learning for safe autonomous driving: Current challenges and future directions. IEEE Trans Intell Transp Syst 22(7):4316\u20134336","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"7220_CR3","unstructured":"Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser \u0141, Polosukhin I (2017) Attention is all you need. Adv Neural Inf Process Syst 30"},{"key":"7220_CR4","unstructured":"Dosovitskiy A, Beyer L, Kolesnikov A, Weissenborn D, Zhai X, Unterthiner T, Dehghani M, Minderer M, Heigold G, Gelly S, Uszkoreit J, Houlsby N (2021) An image is worth 16x16 words: Transformers for image recognition at scale. In: Int Conf Learn Represent. https:\/\/openreview.net\/forum?id=YicbFdNTTy"},{"key":"7220_CR5","doi-asserted-by":"crossref","unstructured":"Carion N, Massa F, Synnaeve G, Usunier N, Kirillov A, Zagoruyko S (2020) End-to-end object detection with transformers. In: European conference on computer vision, pp 213\u2013229. Springer","DOI":"10.1007\/978-3-030-58452-8_13"},{"key":"7220_CR6","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2014) Intriguing properties of neural networks. In: International conference on learning representations. arXiv:1312.6199"},{"key":"7220_CR7","doi-asserted-by":"crossref","unstructured":"Zhang Z, Wu T (2020) Learning ordered top-k adversarial attacks via adversarial distillation. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition workshops, pp 776\u2013777","DOI":"10.1109\/CVPRW50498.2020.00396"},{"key":"7220_CR8","unstructured":"Goodfellow I, Shlens J, Szegedy C (2015) Explaining and harnessing adversarial examples. In: International conference on learning representations. arXiv:1412.6572"},{"key":"7220_CR9","doi-asserted-by":"crossref","unstructured":"Chen S-T, Cornelius C, Martin J, Chau DH (2018) Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In: Joint european conference on machine learning and knowledge discovery in databases, pp 52\u201368. Springer","DOI":"10.1007\/978-3-030-10925-7_4"},{"issue":"9","key":"7220_CR10","doi-asserted-by":"publisher","first-page":"6463","DOI":"10.1002\/int.22851","volume":"37","author":"T Du","year":"2022","unstructured":"Du T, Ji S, Wang B, He S, Li J, Li B, Wei T, Jia Y, Beyah R, Wang T (2022) Detects ec: Evaluating the robustness of object detection models to adversarial attacks. Int J Intell Syst 37(9):6463\u20136492","journal-title":"Int J Intell Syst"},{"key":"7220_CR11","first-page":"54111","volume":"36","author":"Y Zhao","year":"2023","unstructured":"Zhao Y, Pang T, Du C, Yang X, Li C, Cheung N-MM, Lin M (2023) On evaluating adversarial robustness of large vision-language models. Adv Neural Inf Process Syst 36:54111\u201354138","journal-title":"Adv Neural Inf Process Syst"},{"key":"7220_CR12","doi-asserted-by":"crossref","unstructured":"Wang Y, Zhang X, Yang T, Sun J (2022) Anchor detr: Query design for transformer-based detector. In: Proceedings of the AAAI conference on artificial intelligence 36:2567\u20132575","DOI":"10.1609\/aaai.v36i3.20158"},{"key":"7220_CR13","unstructured":"Yao Z, Ai J, Li B, Zhang C (2021) Efficient detr: improving end-to-end object detector with dense prior. arXiv preprint arXiv:2104.01318"},{"key":"7220_CR14","doi-asserted-by":"crossref","unstructured":"Zhang J, Huang Y, Wu W, Lyu MR (2023) Transferable adversarial attacks on vision transformers with token gradient regularization. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 16415\u201316424","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"7220_CR15","doi-asserted-by":"crossref","unstructured":"Wei Z, Chen J, Goldblum M, Wu Z, Goldstein T, Jiang Y-G (2022) Towards transferable adversarial attacks on vision transformers. In: Proceedings of the AAAI conference on artificial intelligence 36:2668\u20132676","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"7220_CR16","doi-asserted-by":"crossref","unstructured":"Wang Y, Wang J, Yin Z, Gong R, Wang J, Liu A, Liu X (2022) Generating transferable adversarial examples against vision transformers. In: Proceedings of the 30th ACM international conference on multimedia, pp 5181\u20135190","DOI":"10.1145\/3503161.3547989"},{"issue":"4","key":"7220_CR17","doi-asserted-by":"publisher","first-page":"2245","DOI":"10.1109\/COMST.2023.3319492","volume":"25","author":"Y Wang","year":"2023","unstructured":"Wang Y, Sun T, Li S, Yuan X, Ni W, Hossain E, Poor HV (2023) Adversarial attacks and defenses in machine learning-empowered communication systems and networks: A contemporary survey. IEEE Commun Surv Tutor 25(4):2245\u20132298","journal-title":"IEEE Commun Surv Tutor"},{"key":"7220_CR18","doi-asserted-by":"publisher","first-page":"14410","DOI":"10.1109\/ACCESS.2018.2807385","volume":"6","author":"N Akhtar","year":"2018","unstructured":"Akhtar N, Mian A (2018) Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access 6:14410\u201314430","journal-title":"Ieee Access"},{"key":"7220_CR19","doi-asserted-by":"crossref","unstructured":"Mahmood K, Mahmood R, Van Dijk M (2021) On the robustness of vision transformers to adversarial examples. In: Proceedings of the IEEE\/CVF international conference on computer vision, pp 7838\u20137847","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"7220_CR20","doi-asserted-by":"crossref","unstructured":"Kolesnikov A, Beyer L, Zhai X, Puigcerver J, Yung J, Gelly S, Houlsby N (2020) Big transfer (bit): General visual representation learning. In: Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23\u201328, 2020, Proceedings, Part V 16, pp 491\u2013507. Springer","DOI":"10.1007\/978-3-030-58558-7_29"},{"key":"7220_CR21","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2018) Towards deep learning models resistant to adversarial attacks. In: International conference on learning representations. https:\/\/openreview.net\/forum?id=rJzIBfZAb"},{"key":"7220_CR22","unstructured":"Athalye A, Carlini N, Wagner D (2018) Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: International conference on machine learning, pp 274\u2013283. PMLR"},{"key":"7220_CR23","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 Ieee Symposium on Security and Privacy (sp), pp 39\u201357. Ieee","DOI":"10.1109\/SP.2017.49"},{"key":"7220_CR24","unstructured":"Shao R, Shi Z, Yi J, Chen P-Y, Hsieh C-J (2022) On the adversarial robustness of vision transformers. Trans Mach Learn Res"},{"key":"7220_CR25","doi-asserted-by":"crossref","unstructured":"Wei Z, Chen J, Goldblum M, Wu Z, Goldstein T, Jiang Y-G (2022) Towards transferable adversarial attacks on vision transformers. In: Proceedings of the AAAI conference on artificial intelligence 36:2668\u20132676","DOI":"10.1609\/aaai.v36i3.20169"},{"key":"7220_CR26","doi-asserted-by":"crossref","unstructured":"Zhang J, Huang Y, Wu W, Lyu MR (2023) Transferable adversarial attacks on vision transformers with token gradient regularization. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 16415\u201316424","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"7220_CR27","doi-asserted-by":"crossref","unstructured":"Lovisotto G, Finnie N, Munoz M, Mummadi CK, Metzen JH (2022) Give me your attention: Dot-product attention considered harmful for adversarial patch robustness. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 15234\u201315243","DOI":"10.1109\/CVPR52688.2022.01480"},{"key":"7220_CR28","doi-asserted-by":"crossref","unstructured":"Zhang Y, Gong Z, Zhang Y, Li Y, Bin K, Qi J, Xue W, Zhong P (2022) Transferable physical attack against object detection with separable attention. arXiv preprint arXiv:2205.09592","DOI":"10.1016\/j.patcog.2023.109435"},{"key":"7220_CR29","doi-asserted-by":"crossref","unstructured":"Leng Z, Cheng Z, Wei P, Chen J (2023) Object-aware transfer-based black-box adversarial attack on object detector. In: Chinese Conference on Pattern Recognition and Computer Vision (PRCV), pp 278\u2013289. Springer","DOI":"10.1007\/978-981-99-8555-5_22"},{"key":"7220_CR30","unstructured":"Croce F, Hein M (2020) Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International conference on machine learning, pp 2206\u20132216. PMLR"},{"key":"7220_CR31","unstructured":"Ren S, He K, Girshick R, Sun J (2015) Faster r-cnn: Towards real-time object detection with region proposal networks. Adv Neural Inf Process Syst 28"},{"key":"7220_CR32","doi-asserted-by":"crossref","unstructured":"Lin T-Y, Maire M, Belongie S, Hays J, Perona P, Ramanan D, Doll\u00e1r P, Zitnick CL (2014) Microsoft coco: Common objects in context. In: Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6\u201312, 2014, Proceedings, Part V 13, pp 740\u2013755. Springer","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"7220_CR33","doi-asserted-by":"crossref","unstructured":"Geiger A, Lenz P, Urtasun R (2012) Are we ready for autonomous driving? the kitti vision benchmark suite. In: 2012 IEEE conference on computer vision and pattern recognition, pp 3354\u20133361. IEEE","DOI":"10.1109\/CVPR.2012.6248074"},{"key":"7220_CR34","unstructured":"Wang Y, Ma X, Bailey J, Yi J, Zhou B, Gu Q (2019) On the convergence and robustness of adversarial training. In: International conference on machine learning, pp 6586\u20136595. PMLR"}],"container-title":["Applied Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10489-026-07220-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10489-026-07220-2","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10489-026-07220-2.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T22:37:45Z","timestamp":1781649465000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10489-026-07220-2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4]]},"references-count":34,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2026,4]]}},"alternative-id":["7220"],"URL":"https:\/\/doi.org\/10.1007\/s10489-026-07220-2","relation":{},"ISSN":["0924-669X","1573-7497"],"issn-type":[{"value":"0924-669X","type":"print"},{"value":"1573-7497","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4]]},"assertion":[{"value":"13 February 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 March 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"23 April 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"223"}}