{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T07:11:00Z","timestamp":1790320260039,"version":"4.1.0"},"reference-count":89,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T00:00:00Z","timestamp":1763424000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>The object detection systems aim to classify and localize objects in an image or video. Over the past decade, we have seen how adversarial attacks can impact the performance of object detection systems and make them unusable in many situations. This survey summarizes different types of digital adversarial attacks bounded by Lp norms and the corresponding defense techniques for object detection systems. It categorizes the defenses into six groups, namely, preprocessing, adversarial training, detection of adversarial noise, architectural changes, ensemble defense, and certified defenses, and highlights the effectiveness of each technique. We end the paper with a discussion of the weaknesses of different defenses and possible approaches to make them stronger. Patch- or physical-based attacks are excluded from this survey, as they follow a different threat model.<\/jats:p>","DOI":"10.3390\/info16111003","type":"journal-article","created":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T16:49:51Z","timestamp":1763484591000},"page":"1003","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Defenses Against Adversarial Attacks on Object Detection: Methods and Future Directions"],"prefix":"10.3390","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-8222-6819","authenticated-orcid":false,"given":"Anant","family":"Thunuguntla","sequence":"first","affiliation":[{"name":"School of Electrical Engineering and Computer Science, Oregon State University, Corvallis, OR 97331, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Prasad","family":"Tadepalli","sequence":"additional","affiliation":[{"name":"School of Electrical Engineering and Computer Science, Oregon State University, Corvallis, OR 97331, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Giuseppe","family":"Raffa","sequence":"additional","affiliation":[{"name":"Intel Corporation, Hillsboro, OR 97124, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,18]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Girshick, R.B., Donahue, J., Darrell, T., and Malik, J. (2014, January 23\u201328). Rich Feature Hierarchies for Accurate Object Detection and Semantic Segmentation. Proceedings of the 2014 IEEE Conference on Computer Vision and Pattern Recognition, Columbus, OH, USA.","DOI":"10.1109\/CVPR.2014.81"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Girshick, R.B. (2015, January 7\u201313). Fast R-CNN. Proceedings of the 2015 IEEE International Conference on Computer Vision (ICCV), Santiago, Chile.","DOI":"10.1109\/ICCV.2015.169"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Redmon, J., Divvala, S.K., Girshick, R.B., and Farhadi, A. (2016, January 27\u201330). You Only Look Once: Unified, Real-Time Object Detection. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref_4","unstructured":"Simonyan, K., and Zisserman, A. (2014). Very Deep Convolutional Networks for Large-Scale Image Recognition. arXiv."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep Residual Learning for Image Recognition. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1137","DOI":"10.1109\/TPAMI.2016.2577031","article-title":"Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks","volume":"39","author":"Ren","year":"2015","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Liu, W., Jia, Y., Sermanet, P., Reed, S.E., Anguelov, D., Erhan, D., Vanhoucke, V., and Rabinovich, A. (2015, January 7\u201312). Going deeper with convolutions. Proceedings of the2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Boston, MA, USA.","DOI":"10.1109\/CVPR.2015.7298594"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Liu, W., Anguelov, D., Erhan, D., Szegedy, C., Reed, S.E., Fu, C., and Berg, A.C. (2016, January 11\u201314). SSD: Single shot multibox detector. Proceedings of the European Conference on Computer Vision (ECCV), Amsterdam, The Netherlands.","DOI":"10.1007\/978-3-319-46448-0_2"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Carion, N., Massa, F., Synnaeve, G., Usunier, N., Kirillov, A., and Zagoruyko, S. (2020). End-to-End Object Detection with Transformers. arXiv.","DOI":"10.1007\/978-3-030-58452-8_13"},{"key":"ref_10","unstructured":"Vaswani, A., Shazeer, N.M., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., and Polosukhin, I. (2017, January 4\u20139). Attention is All you Need. Proceedings of the 31st International Conference on Neural Information Processing Systems, Long Beach, CA, USA."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Tan, M., Pang, R., and Le, Q.V. (2019, January 13\u201319). EfficientDet: Scalable and Efficient Object Detection. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.01079"},{"key":"ref_12","unstructured":"Tan, M., and Le, Q.V. (2019). EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Cheng, T., Song, L., Ge, Y., Liu, W., Wang, X., and Shan, Y. (2024, January 16\u201322). YOLO-World: Real-Time Open-Vocabulary Object Detection. Proceedings of the 2024 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR52733.2024.01599"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Liu, S., Zeng, Z., Ren, T., Li, F., Zhang, H., Yang, J., Li, C., Yang, J., Su, H., and Zhu, J. (2023, January 2\u20133). Grounding DINO: Marrying DINO with Grounded Pre-Training for Open-Set Object Detection. Proceedings of the European Conference on Computer Vision, Paris, France.","DOI":"10.1007\/978-3-031-72970-6_3"},{"key":"ref_15","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and Harnessing Adversarial Examples. arXiv."},{"key":"ref_16","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., and Fergus, R. (2013). Intriguing properties of neural networks. arXiv."},{"key":"ref_17","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv."},{"key":"ref_18","unstructured":"Kurakin, A., Goodfellow, I.J., and Bengio, S. (2016). Adversarial examples in the physical world. arXiv."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D.A. (2017, January 22\u201326). Towards Evaluating the Robustness of Neural Networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal Adversarial Perturbations. Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S., Fawzi, A., and Frossard, P. (2016, January 27\u201330). DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Lin, T.-Y., Goyal, P., Girshick, R., He, K., and Dollar, P. (2017, January 22\u201329). Focal loss for dense object detection. Proceedings of the International Conference on Computer Vision, Venice, Italy.","DOI":"10.1109\/ICCV.2017.324"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., and Yuille, A.L. (2017, January 22\u201329). Adversarial Examples for Semantic Segmentation and Object Detection. Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV), Venice, Italy.","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Wei, X., Liang, S., Cao, X., and Zhu, J. (2018, January 13\u201319). Transferable Adversarial Attacks for Image and Video Object Detection. Proceedings of the International Joint Conference on Artificial Intelligence, Stockholm, Sweden.","DOI":"10.24963\/ijcai.2019\/134"},{"key":"ref_25","unstructured":"Goodfellow, I.J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A.C., and Bengio, Y. (2023, January 6\u20138). Generative Adversarial Networks. Proceedings of the 2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT), Delhi, India."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Lin, T., Maire, M., Belongie, S.J., Hays, J., Perona, P., Ramanan, D., Doll\u00e1r, P., and Zitnick, C.L. (2014, January 6\u201312). Microsoft COCO: Common Objects in Context. Proceedings of the European Conference on Computer Vision, Zurich, Switzerland.","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"25174","DOI":"10.1109\/ACCESS.2023.3256723","article-title":"Quantifying the Effects of Ground Truth Annotation Quality on Object Detection and Instance Segmentation Performance","volume":"11","author":"Agnew","year":"2023","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Chen, P.-C., Kung, B.-H., and Chen, J.-C. (2021, January 20\u201325). Class-Aware Robust Adversarial Training for Object Detection. Proceedings of the 2021 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA.","DOI":"10.1109\/CVPR46437.2021.01028"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1007\/s11263-009-0275-4","article-title":"The Pascal visual object classes (VOC) challenge","volume":"88","author":"Everingham","year":"2010","journal-title":"Int. J. Comput. Vis."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Geiger, A., Lenz, P., and Urtasun, R. (2012, January 16\u201321). Are we ready for autonomous driving? The KITTI vision benchmark suite. Proceedings of the 2012 IEEE Conference on Computer Vision and Pattern Recognition, Providence, RI, USA.","DOI":"10.1109\/CVPR.2012.6248074"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Yu, F., Chen, H., Wang, X., Xian, W., Chen, Y., Liu, F., Madhavan, V., and Darrell, T. (2020, January 14\u201319). BDD100K: A Diverse Driving Dataset for Heterogeneous Multitask Learning. Proceedings of the 2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00271"},{"key":"ref_32","unstructured":"Dai, J., Li, Y., He, K., and Sun, J. (2016, January 5\u201310). R-FCN: Object Detection via Region-based Fully Convolutional Networks. Proceedings of the Neural Information Processing Systems (2016), Barcelona, Spain."},{"key":"ref_33","unstructured":"Li, Y., Tian, D., Chang, M., Bian, X., and Lyu, S. (2018, January 3\u20136). Robust Adversarial Perturbation on Deep Proposal-based Models. Proceedings of the British Machine Vision Conference, Newcastle, UK."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"102634","DOI":"10.1016\/j.jnca.2020.102634","article-title":"An adversarial attack on DNN-based black-box object detectors","volume":"161","author":"Wang","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_35","unstructured":"Venter, G., and Sobieszczanski-Sobieski, J. (2019). Particle Swarm Optimization. Advances in Metaheuristic Algorithms for Optimal Design of Structures, Springer."},{"key":"ref_36","unstructured":"Wang, D., Li, C., Wen, S., Nepal, S., and Xiang, Y. (2019). Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples. arXiv."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Shapira, A., Zolfi, A., Demetrio, L., Biggio, B., and Shabtai, A. (2023, January 3\u20137). Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors. Proceedings of the 2023 IEEE\/CVF Winter Conference on Applications of Computer Vision (WACV), Waikoloa, HI, USA.","DOI":"10.1109\/WACV56688.2023.00455"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Chen, E., Chen, P., Chung, I., and Lee, C. (2024, January 16\u201322). Overload: Latency Attacks on Object Detection for Edge Devices. Proceedings of the 2024 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR52733.2024.02334"},{"key":"ref_39","unstructured":"Ultralytics (2025, August 01). Yolov5. Available online: https:\/\/github.com\/ultralytics\/yolov5."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Chow, K., Liu, L., Loper, M.L., Bae, J., Gursoy, M.E., Truex, S., Wei, W., and Wu, Y. (2020, January 28\u201331). Adversarial Objectness Gradient Attacks in Real-time Object Detection Systems. Proceedings of the 2020 Second IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), Atlanta, GA, USA.","DOI":"10.1109\/TPS-ISA50397.2020.00042"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"15706","DOI":"10.1109\/TNNLS.2025.3561225","article-title":"A Survey and Evaluation of Adversarial Attacks in Object Detection","volume":"36","author":"Nguyen","year":"2024","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Zhou, L., Liu, Q., and Zhou, S. (2024, January 19\u201321). Preprocessing-based Adversarial Defense for Object Detection via Feature Filtration. Proceedings of the 7th International Conference on Algorithms, Computing and Systems (ICACS \u201923). Association for Computing Machinery, New York, NY, USA.","DOI":"10.1145\/3631908.3631920"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Zhang, H., and Wang, J. (November, January 27). Towards Adversarially Robust Object Detection. Proceedings of the 2019 IEEE\/CVF International Conference on Computer Vision (ICCV), Seoul, Republic of Korea.","DOI":"10.1109\/ICCV.2019.00051"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Choi, J.I., and Tian, Q. (2022, January 4\u20139). Adversarial Attack and Defense of YOLO Detectors in Autonomous Driving Scenarios. Proceedings of the 2022 IEEE Intelligent Vehicles Symposium (IV), Aachen, Germany.","DOI":"10.1109\/IV51971.2022.9827222"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"179065","DOI":"10.1109\/ACCESS.2024.3507745","article-title":"Toward Enhanced Adversarial Robustness Generalization in Object Detection: Feature Disentangled Domain Adaptation for Adversarial Training","volume":"12","author":"Jung","year":"2024","journal-title":"IEEE Access"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Wang, T., Wang, Z., Wang, C., Shu, Y., Deng, R., Cheng, P., and Chen, J. (2025, January 11\u201315). Can\u2019t Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devices. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA.","DOI":"10.1109\/CVPR52734.2025.01791"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Chen, X., Xie, C., Tan, M., Zhang, L., Hsieh, C., and Gong, B. (2021, January 20\u201325). Robust and Accurate Object Detection via Adversarial Learning. Proceedings of the 2021 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA.","DOI":"10.1109\/CVPR46437.2021.01635"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Avidan, S., Brostow, G., Ciss\u00e9, M., Farinella, G.M., and Hassner, T. (2022). Adversarially-Aware Robust Object Detector. Computer Vision\u2014ECCV 2022. Lecture Notes in Computer Science, Springer.","DOI":"10.1007\/978-3-031-19833-5"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"104252","DOI":"10.1016\/j.cviu.2024.104252","article-title":"Adversarial intensity awareness for robust object detection","volume":"251","author":"Cheng","year":"2024","journal-title":"Comput. Vis. Image Underst."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"1929","DOI":"10.1007\/s00371-021-02256-6","article-title":"Adversarial defenses for object detectors based on Gabor convolutional layers","volume":"38","author":"Amirkhani","year":"2022","journal-title":"Vis. Comput."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Zeng, W., Gao, S., Zhou, W., Dong, Y., and Wang, R. (2023). Improving the Adversarial Robustness of Object Detection with Contrastive Learning. Chinese Conference on Pattern Recognition and Computer Vision, Springer.","DOI":"10.1007\/978-981-99-8546-3_3"},{"key":"ref_52","unstructured":"Muhammad, A., Zhuang, W., Lyu, L., and Bae, S.-H. (2023). FROD: Robust Object Detection for Free. arXiv."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"2387","DOI":"10.1109\/TIFS.2025.3542964","article-title":"On the Importance of Backbone to the Adversarial Robustness of Object Detectors","volume":"20","author":"Li","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_54","doi-asserted-by":"crossref","first-page":"169","DOI":"10.1186\/s13677-023-00534-3","article-title":"RPU-PVB: Robust object detection based on a unified metric perspective with bilinear interpolation","volume":"12","author":"Yang","year":"2023","journal-title":"J. Cloud Comput."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Alamri, F., Kalkan, S., and Pugeault, N. (2020, January 10\u201315). Transformer-Encoder Detector Module: Using Context to Improve Robustness to Adversarial Attacks on Object Detection. Proceedings of the 2020 25th International Conference on Pattern Recognition (ICPR), Milan, Italy.","DOI":"10.1109\/ICPR48806.2021.9413344"},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, H., and Pan, S. (2021, January 19\u201322). Using Feature Alignment Can Improve Clean Average Precision and Adversarial Robustness in Object Detection. Proceedings of the 2021 IEEE International Conference on Image Processing (ICIP), Anchorage, AK, USA.","DOI":"10.1109\/ICIP42928.2021.9506689"},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Xu, W., Chu, P., Xie, R., Xiao, X., and Huang, H. (2022, January 16\u201319). Robust and Accurate Object Detection Via Self-Knowledge Distillation. Proceedings of the 2022 IEEE International Conference on Image Processing (ICIP), Bordeaux, France.","DOI":"10.1109\/ICIP46576.2022.9898031"},{"key":"ref_58","doi-asserted-by":"crossref","unstructured":"Chow, K.-H. (2021, January 14\u201318). Robust Object Detection Fusion Against Deception. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Singapore.","DOI":"10.1145\/3447548.3467121"},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"Chow, K.H., and Liu, L. (December, January 28). Boosting Object Detection Ensembles with Error Diversity. Proceedings of the 2022 IEEE International Conference on Data Mining (ICDM), Orlando, FL, USA.","DOI":"10.1109\/ICDM54844.2022.00105"},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Peng, Z., Chen, X., Huang, W., Kong, X., Li, J., and Xue, S. (2024, January 10\u201312). Shielding Object Detection: Enhancing Adversarial Defense through Ensemble Methods. Proceedings of the 2024 5th Information Communication Technologies Conference (ICTC), Nanjing, China.","DOI":"10.1109\/ICTC61510.2024.10601992"},{"key":"ref_61","doi-asserted-by":"crossref","unstructured":"Wu, Y., Chow, K., Wei, W., and Liu, L. (2023, January 1\u20134). Exploring Model Learning Heterogeneity for Boosting Ensemble Robustness. Proceedings of the 2023 IEEE International Conference on Data Mining (ICDM), Shanghai, China.","DOI":"10.1109\/ICDM58522.2023.00074"},{"key":"ref_62","unstructured":"Cohen, J.M., Rosenfeld, E., and Kolter, J.Z. (2019). Certified Adversarial Robustness via Randomized Smoothing. arXiv."},{"key":"ref_63","unstructured":"Elboher, Y.Y., Raviv, A., Weiss, Y.L., Cohen, O., Assa, R., Katz, G., and Kugler, H. (2024). Formal Verification of Deep Neural Networks for Object Detection. arXiv."},{"key":"ref_64","unstructured":"Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. (2019, January 8\u201314). Adversarial Examples Are Not Bugs, They Are Features. Proceedings of the Neural Information Processing Systems 2019, Vancouver, BC, Canada."},{"key":"ref_65","unstructured":"Arjovsky, M., Chintala, S., and Bottou, L. (2017). Wasserstein GAN. arXiv."},{"key":"ref_66","unstructured":"Gulrajani, I., Ahmed, F., Arjovsky, M., Dumoulin, V., and Courville, A.C. (2017, January 4\u20139). Improved training of wasserstein gans. Proceedings of the 31st International Conference on Neural Information Processing Systems, Long Beach, CA, USA."},{"key":"ref_67","unstructured":"Miyato, T., Kataoka, T., Koyama, M., and Yoshida, Y. (2018). Spectral Normalization for Generative Adversarial Networks. arXiv."},{"key":"ref_68","unstructured":"Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., and Madry, A. (2018). There Is No Free Lunch In Adversarial Robustness (But There Are Unexpected Benefits). arXiv."},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","article-title":"ImageNet Large Scale Visual Recognition Challenge","volume":"115","author":"Russakovsky","year":"2014","journal-title":"Int. J. Comput. Vis."},{"key":"ref_70","unstructured":"Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J.P., Studer, C., Davis, L.S., Taylor, G., and Goldstein, T. (2019, January 8\u201314). Adversarial Training for Free!. Proceedings of the 33rd International Conference on Neural Information Processing Systems, Vancouver, BC, Canada."},{"key":"ref_71","doi-asserted-by":"crossref","unstructured":"Redmon, J., and Farhadi, A. (2016, January 21\u201326). YOLO9000: Better, Faster, Stronger. Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.690"},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Xiao, C., Deng, R., Li, B., Yu, F., Liu, M., and Song, D.X. (2018). Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation. arXiv.","DOI":"10.1007\/978-3-030-01249-6_14"},{"key":"ref_73","doi-asserted-by":"crossref","unstructured":"Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A.L., and Le, Q.V. (2020, January 13\u201319). Adversarial examples improve image recognition. Proceedings of the Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00090"},{"key":"ref_74","unstructured":"Ioffe, S., and Szegedy, C. (2015). Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. arXiv."},{"key":"ref_75","unstructured":"Kingma, D.P., and Welling, M. (2014, January 14\u201316). Auto-encoding variational bayes. Proceedings of the International Conference on Learning Representations (ICLR), Banff, AB, Canada."},{"key":"ref_76","doi-asserted-by":"crossref","unstructured":"Chen, Y., Dai, X., Liu, M., Chen, D., Yuan, L., and Liu, Z. (2020, January 13\u201319). Dynamic convolution: Attention over convolution kernels. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.01104"},{"key":"ref_77","doi-asserted-by":"crossref","unstructured":"P\u2019erez, J.C., Alfarra, M., Jeanneret, G., Bibi, A., Thabet, A.K., Ghanem, B., and Arbel\u2019aez, P. (2019). Gabor Layers Enhance Network Robustness. European Conference on Computer Vision, Springer.","DOI":"10.1007\/978-3-030-58545-7_26"},{"key":"ref_78","doi-asserted-by":"crossref","unstructured":"Yang, H., Chen, Y., Dou, H., Luo, Y., Tan, C.J., and Zhang, Y. (2023, January 14\u201317). Robust Object Detection Based on a Comparative Learning Perspective. Proceedings of the 2023 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech), Abu Dhabi, United Arab Emirates.","DOI":"10.1109\/DASC\/PiCom\/CBDCom\/Cy59711.2023.10361443"},{"key":"ref_79","unstructured":"Wong, E., Rice, L., and Kolter, J.Z. (2020). Fast is better than free: Revisiting adversarial training. arXiv."},{"key":"ref_80","unstructured":"Hinton, G.E., Vinyals, O., and Dean, J. (2015). Distilling the Knowledge in a Neural Network. arXiv."},{"key":"ref_81","doi-asserted-by":"crossref","unstructured":"Thys, S., Ranst, W.V., and Goedem\u00e9, T. (2019, January 16\u201317). Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection. Proceedings of the 2019 IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), Long Beach, CA, USA.","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref_82","unstructured":"Liu, X., Yang, H., Liu, Z., Song, L., Chen, Y., and Li, H.H. (2018). DPATCH: An Adversarial Patch Attack on Object Detectors. arXiv."},{"key":"ref_83","doi-asserted-by":"crossref","unstructured":"Xu, K., Zhang, G., Liu, S., Fan, Q., Sun, M., Chen, H., Chen, P., Wang, Y., and Lin, X. (2020). Adversarial T-Shirt! Evading Person Detectors in a Physical World. Computer Vision\u2014ECCV 2020, Proceedings of the 16th European Conference, Glasgow, UK, 23\u201328 August 2020, Springer. Proceedings, Part V.","DOI":"10.1007\/978-3-030-58558-7_39"},{"key":"ref_84","first-page":"158","article-title":"Multitask learning strengthens adversarial robustness","volume":"Volume 12347","author":"Mao","year":"2020","journal-title":"Computer Vision\u2014ECCV 2020, Proceedings of the 16th European Conference, Glasgow, UK, 23\u201328 August 2020"},{"key":"ref_85","doi-asserted-by":"crossref","unstructured":"Yeo, T., Kar, O.F., and Zamir, A. (2021, January 10\u201317). Robustness via cross-domain ensembles. Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada.","DOI":"10.1109\/ICCV48922.2021.01197"},{"key":"ref_86","unstructured":"Mopuri, K.R., Garg, U., and Babu, R.V. (2017). Fast feature fool: A data independent approach to universal adversarial perturbations. arXiv."},{"key":"ref_87","first-page":"1275","article-title":"Detection as Regression: Certified Object Detection by Median Smoothing","volume":"33","author":"Chiang","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_88","doi-asserted-by":"crossref","first-page":"336","DOI":"10.1007\/s11263-019-01228-7","article-title":"Grad-cam: Visual explanations from deep networks via gradient-based localization","volume":"128","author":"Selvaraju","year":"2020","journal-title":"Int. J. Comput. Vis."},{"key":"ref_89","doi-asserted-by":"crossref","unstructured":"Altstidl, T.R., Dobre, D., Kosmala, A., Eskofier, B.M., Gidel, G., and Schwinn, L. (2024, January 10\u201315). On the Scalability of Certified Adversarial Robustness with Generated Data. Proceedings of the 38th International Conference on Neural Information Processing Systems, Vancouver, BC, Canada.","DOI":"10.52202\/079017-3247"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/1003\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,25]],"date-time":"2025-11-25T09:14:02Z","timestamp":1764062042000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/1003"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,18]]},"references-count":89,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["info16111003"],"URL":"https:\/\/doi.org\/10.3390\/info16111003","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,18]]}}}