ARMOR: Manifold-Oriented Training for Adversarially Robust Aerial Object Detection under Data Scarcity

ARMOR: Manifold-Oriented Training for Adversarially Robust Aerial Object Detection under Data Scarcity Haoran Wang1,* , Matthew Lau1,* , Alec Helbling1 , Matthew Hull1 , ShengYun Peng1 , Mansi Phute1 , Martin Andreoni2 , Willian T. Lunardi3 , Duen Horng Chau1 , Wenke Lee1

arXiv:2608.29510v1 [cs.CV] 30 Aug 2026

1

2 Georgia Institute of Technology, Atlanta, GA, USA Khalifa University, Abu Dhabi, UAE 3 Technology Innovation Institute, Abu Dhabi, UAE {haoran.wang, mlau40, alechelbling, matthewhull, speng65, mphute6, polo}@gatech.edu, wenke@cc.gatech.edu martin.andreoni@ku.ac.ae, williantessarolunardi@gmail.com

Abstract—Aerial object detection is increasingly deployed in real-world applications, but models remain vulnerable to physical, universal adversarial patches that cause them to miss objects. Furthermore, defenders face the practical constraint of training data scarcity: aerial imagery is costly to collect and label, so a deployment site typically yields hundreds of images rather than the tens of thousands that adversarial robustness benchmarks assume. To tackle model vulnerability and training data scarcity, we propose Adversarial Robustness with ManifoldOriented Training (ARMOR), a novel defense that realizes the core insights of on-manifold adversarial training (OMAT) in lowdata regimes. ARMOR builds on the insight of OMAT to model the data manifold — the compact structure capturing the data’s relevant features — to learn and robustify these features during training. While OMAT relies on the data-intensive operations of training large generative models and adversarial training to achieve this, ARMOR adopts a data-efficient approach that reuses labels the detection task already supplies: ARMOR (i) masks image backgrounds to retain object-relevant features, and (ii) injects randomized patches on objects to improve feature robustness. Our low-data experiments with physically-realizable adversarial patches evaluate both query-free transfer attacks and defense-aware attacks. ARMOR maintains strong clean performance of over 0.90 model confidence, while improving adversarial robustness by up to 0.32 in model confidence over state-of-theart defenses. Physical experiments with printed patches confirm that these gains survive deployment. Overall, ARMOR translates insights from manifold-based training to defend object detectors amidst training data scarcity. Index Terms—adversarial robustness, object detection, aerial imagery, data scarcity, physically-realizable attacks, data manifold, label efficiency

I. I NTRODUCTION Object detection models are progressively deployed in realworld applications of aerial imagery, such as traffic monitoring [1], environmental protection [2] and disaster relief [3]. Drones and fixed aerial cameras stream imagery continuously, and the detector sits at the ingest layer of the pipeline: every downstream count, track and alert is derived from what it does or does not detect. Despite their growing adoption, these models remain vulnerable: failures in perception systems * Equal contribution.

Fig. 1. Main idea of ARMOR. We model the two data-intensive operations of on-manifold adversarial training — on-manifold projection and adversarial training — with background removal and random patches respectively. These modifications force the model to learn relevant and robust features, defending physically-realizable adversarial patch attacks.

have contributed to accidents [4]. More disconcertingly, these vulnerabilities can be straightforwardly exploited in aerial imagery with physical, universal adversarial attack patches that fool object detectors [1]. A single printed patch is therefore a cheap and persistent way to corrupt the pipeline at its source — a veracity failure that no amount of downstream data volume can recover. Besides the ease of attacks, the attacker can also generate model-agnostic “grey-box” attacks [5], [6], which require far less knowledge than a defense-aware “white-box” threat model. Despite these vulnerabilities, the viability of defenses in aerial imagery has been understudied [7]. As such, improving the adversarial robustness of aerial object detectors is vital. Moreover, robustness alone is not enough. In many aerial imagery applications, defenders face a second, underexplored challenge: training or fine-tuning data is often scarce due to high costs and limited availability [8], [9]. The scarcity is one of labels, not pixels: raw aerial footage is abundant, but each deployment site has its own camera geometry, altitude and lighting, so the labeled set matching the site must be annotated by hand and stays small. Many existing defenses have yet to account for this, because benchmarks offer abundant data. To illustrate, CIFAR-10, a popular benchmark for studying adversarial robustness [10], [11], offers 60,000 images for

classification at 32×32 dimensionality [12]. In contrast, aerial object detection datasets often contain only hundreds to tens of thousands of images [1], despite much higher dimensionality of 320 × 320 to 640 × 640 [13], [14]. It is not clear if defenses can generalize to data-scarce settings. Thus, we address the practical question: How can we improve the adversarial robustness, while maintaining good clean performance, of aerial object detection when training data is scarce? One promising approach to improve adversarial robustness is on-manifold adversarial training (OMAT) [15], [16]. OMAT aims to sidestep the typical trade-off between adversarial robustness and generalization (i.e., clean performance) — known as robust overfitting [11] — by leveraging the manifold hypothesis. The manifold hypothesis is a common assumption in deep learning, positing that real-world, high-dimensional data like images lie on a low dimensional structure or “manifold” [17]. Intuitively, this manifold captures the relevant features in realistic data. However, OMAT is impractical in low-data regimes due to its reliance on training large generative models to approximate the manifold [18] and solving expensive adversarial optimization problems for robustness [19]–[21]. To overcome this limitation, we propose ARMOR (Adversarial Robustness with Manifold-Oriented Training, Figure 1), a defense that retains OMAT’s benefits in realworld, data-scarce applications. Instead of OMAT’s dataintensive operations of generative modeling and adversarial training, ARMOR is based on OMAT’s insight on guiding models to learn relevant and robust features. Crucially, ARMOR sources both operations from annotation the detection task already pays for — bounding box labels — so the defense adds no labeling cost over standard fine-tuning. To learn relevant features, instead of using generative models, ARMOR masks image backgrounds defined by bounding box labels to a uniform black during training. Irrelevant background features are removed, focusing the model on object-relevant features. To learn robust features, instead of adversarial training, ARMOR inserts randomized patches on objects, approximated by the center of each bounding box, during training. Randomization simulates variability due to noise, improving feature robustness without the instability of min-max adversarial optimization. These two steps challenge the conventional wisdom that distribution shift between train and test data degrades performance: ARMOR deliberately introduces one, since test images contain backgrounds and have no patches on objects (Figure 1). Nonetheless, ARMOR consistently increases robustness to adversarial attacks while retaining strong accuracy on clean data, and we read this mitigation of robust overfitting as evidence that ARMOR is a data-efficient adaptation of OMAT’s insights. Our contributions are as follows: We propose ARMOR, a novel defense for aerial object detectors against physically-realizable adversarial patches that accounts for training data scarcity. • To mitigate training data scarcity, ARMOR adapts the two data-intensive operations of on-manifold adversarial train•

ing. Instead of (i) generative modeling and (ii) adversarial training, ARMOR uses bounding box labels to (i) mask image backgrounds and (ii) insert random patches on objects during training. These operations guide the model to learn relevant and robust features in a data-efficient manner. • Despite training data scarcity, our experiments demonstrate that ARMOR is an effective defense, maintaining strong clean performance of over 0.90 model confidence while improving adversarial robustness by up to 0.32 in model confidence over state-of-the-art defenses. A manifold analysis of the learned representations explains why, and physical experiments with printed patches confirm the gains hold in deployment. II. R ELATED W ORKS Object Detection. The goal of object detection is to localize objects of interest in an image by enclosing the object with a bounding box. We focus on the You Only Look Once (YOLO) v3 object detector [13] because of its success in aerial imagery [22], and additionally evaluate the recent YOLOv11 [14]. Aerial images are obtained from a bird’s-eye view camera, usually mounted on a drone or satellite, enabling observation of large areas for traffic and environmental monitoring [1], [2] and self-driving [23]. However, aerial object detection is less researched than ground-based detection — common detectors like YOLO are pre-trained on ground-based datasets [13], [24], and objects may be low resolution due to small size or weather [22], challenging both clean transfer and adversarial robustness [25]. Adversarial Patch Attacks. Adversarial attacks make perturbations on images to change the model’s prediction. We consider untargeted attacks [15], [26], which change images to maximize the loss on the altered images. Formally, let f : X → Rm be the model, Y be the label space, (x, y) ∈ X × Y be the ground-truth datum-label pair and L : Rm × Y → R≥0 be the loss function. The adversarial perturbation δ solves maxδ L(f (x + δ), y) subject to δ ∈ ∆, where ∆ is the constraint set on δ. Adversarial patches [27] restrict ∆ to localized regions, providing a realistic threat model: attackers print physical patches to place in the environment. We study this in aerial imagery because (i) the attack is practical — attackers can apply patches on their own car at a safe distance, and (ii) aerial patches are less susceptible to occlusions or camera angle changes, enabling straightforward transfer from digital to physical attacks. Physically-realizable patch generation against object detectors [28] is generally harder than against classifiers [26]. Expectation over Transformation (EoT) [29] is commonly applied for robustness against physical transformations [1], [26]. [1] attacks YOLOv3 by minimizing model confidence with total variation (TV) and non-printability score (NPS) regularization. A. Adversarial Defenses Pre-processing. Some defenses localize and mask adversarial patches. SAC [30] trains a model to detect patches, but

new patches can be developed against them [31], and more fundamentally deep learning detectors can be easily evaded [32]. Information-theoretic approaches avoid neural network vulnerabilities: Jedi [33] uses entropy but requires threshold estimation, while PAD [31] outperforms SAC, Jedi and ObjectSeeker using mutual information and compression quality, optionally refined with SAM [34], but relies on the segmentation model to segment patches it may not be trained on. Traditional image-processing defenses such as JPEG compression [35], [36] and image quilting [36] suffer from robust overfitting and have been broken by defense-aware attacks [10]; physical patches are also designed to be smooth enough to survive compression. Overall, these techniques are useful but do not directly address model vulnerability. Model Robustness. Data augmentations encode invariances that improve robustness, but adversarial performance remains 20% lower than clean [37], making them insufficient on their own. RobustDet [38] modifies adversarial training for object detection but requires training from scratch with extensive data, and [39] suffers a 36% decrease in clean mAP. [40] focuses on low-data fine-tuning but requires a robust pre-trained model, which may be unavailable in practice, especially for object detection. Distinguishing Off- and On-Manifold Attacks. There is a theory that dichotomizes adversarial examples into those on and off the data manifold — the collection of relevant features in realistic data. Off-manifold vulnerability arises from perturbations targeting irrelevant features like background [41], [42]. Direct adversarial training in pixel space [43] is popular [10], [20], but only alleviates off-manifold vulnerability [16]: it defends only “unrealistic” background perturbations and suffers from robust overfitting [11], with clean accuracy dropping by up to 20%. In contrast, onmanifold vulnerability arises from failure to correctly use relevant features [15], [44]. We study physically-realizable patches on objects, resembling on-manifold attacks (Section III-A). On-manifold adversarial training (OMAT) promotes robustness and generalization on toy problems [15], [44] by projecting data onto the manifold then adversarial training. However, both steps are difficult in low-data regimes. Manifold projection is typically approximated via generative models [15], [16], but training requires ∼10,000 images even with transfer learning [18], and off-the-shelf models lack guarantees for specific applications. Adversarial training is also unstable [19], [20], exacerbated by low data [21]. This gap is exactly what ARMOR targets. Certified Robustness and Model Modification. Certifiably robust defenses are rare in object detection: ObjectSeeker [45] breaks with multiple or large patches [31], and randomized smoothing [46] aggregates predictions from noisy images but is impractical due to thousands of inferences per frame, and only targets ℓp perturbations. Separately, some defenses modify the detector itself [47], [48], for instance by clipping the feature norms of intermediate layers [47]. These modifications are model-specific fixes and, as [31] suggests, do not provide

(a) ON patch on car roof. (b) Aerial (c) ON-T (d) ON-DA view. patch [1]. patch. Fig. 2. Adversarial “ON patches” [1] are easy for an attacker to deploy physically (a, b). Transfer (ON-T) and defense-aware (ON-DA) patches (c, d) are optimized for smoothness and printability.

insights on defending object detectors in general. III. P ROBLEM S ET-U P Our case study focuses on aerial imagery for car detection. We study this setting due to its prevalence in applications such as traffic monitoring and self-driving [1], [23], its common feature of limited training data (Section I) and realistic threat model (Section III-A). Our main experiments use a stationary aerial camera that looks out onto the street for traffic monitoring. We proceed to outline the attacker’s and defender’s goals. A. Threat Model: Realistic Evasion Attacks Attacker’s Goal. We follow the set-up from [1] on physicallyrealizable evasion attacks on aerial object detectors. The attacker aims to cause their own car to evade detection of the object detector. The attacker does so by placing an adversarial patch on the roof of the car, known as “ON patches” (Figure 2). The patch should also be robust to varying environmental conditions. For the sake of evaluating attack efficacy, we do not consider partially hidden patches or cars. Attacker’s Knowledge. We consider two levels of attack knowledge. The first is the “transfer” attack (ON-T), traditionally known as grey-box. Here, the attacker has access to a pre-trained model, which is often open-sourced, and can collect their own training data which, for simplicity, we assume to be the same as the defender’s. The attacker does not have knowledge about the defense strategies, and hopes to generate an adversarial patch that is model- and defenseagnostic [5], [6]. Since this setting is the most practical for the attacker, we use transfer attacks to evaluate the practical feasibility of defenses. The second is the “defense-aware” attack (ON-DA), traditionally known as white-box, where the attacker has access to the defense, such as the fine-tuned model parameters and defense approach. This attack stresstests defenses, optimizing against the defense directly. Since this setting is the most challenging for the defender, we use defense-aware attacks to evaluate the robustness of defenses. Attacker’s Capabilities. Following [1], the attacker optimizes patches digitally on training data, then prints and affixes the patch to the car roof. The attacker cannot perturb the entire scene, but is restricted to modifying the patches. We avoid the traditional terminology of “grey-box” and “white-box” because this physically-realizable attack is weaker than the traditional setting, where two key assumptions no longer hold: the attacker cannot manipulate the whole image, only a small

ARMOR: Adversarial Robustness with Manifold-Oriented Training Random Patches in training data improve Robustness

Label

Label

Label

Label Label

Label

Train

DomainModel Initialization Regular Training/ Adapted Fine-Tuning to adapt model to domain

Train

Train

BackgroundFinal Masked Mitigate Model

Key Novelty:

Adapt On-Manifold Adversarial Training to learn Relevant and Robust Features

Trivial Solutions

Fig. 3. ARMOR’s Method Diagram. ARMOR injects random patches onto objects during training to promote robustness. The first phase of ARMOR’s training is standard fine-tuning, which is used as a warm start for the second phase. This second phase implements our key novelty of training with backgroundmasked images and random patches. The last phase of hybrid training mitigates any trivial solutions that the prior phase learns, such as localizing non-black regions as objects.

localized patch constrained to be on the object, and cannot “cheat” by using test-time data to generate patches. Attacker’s Strategy. Following [1], we allow only one patch (universal attack) trained with physical deployment considerations. First, we ensure printability with a non-printability score (NPS) loss. Second, we increase smoothness with a total variation (TV) loss to ensure that adversarial effects are not blurred out due to low resolution. Third, to increase robustness to environmental variations, we generate attacks with EoT on the geometry (size and angle) and color (brightness, contrast and noise), since the patch can be in bright and dark spots (Figure 2b). To avoid obfuscated gradients, the attacker is also allowed to use BPDA by removing the output sigmoid activation [10]. Although adversarial robustness requires much more data than clean generalization, these constraints let us make more practical empirical observations: realistic threat models constrained to physically-realizable ON patches resemble onmanifold adversarial threats, not arbitrary threats such as pixellevel perturbations. B. Defender Model Like [1], we assume that the defender has access to a model pre-trained on the task (car detection) and can collect some limited number of labeled training examples from the deployment site for fine-tuning, also known as transductive transfer learning. To emphasize, datasets in this work have fewer than 1,000 training samples, while the popular benchmark CIFAR10 [12] has 60,000 training samples. The defender’s budget is therefore an annotation budget, and any defense that demands additional labeled data — or a separately trained generative model — is out of reach at the deployment site. IV. P ROPOSED M ETHOD : ARMOR The key idea of Adversarial Robustness with ManifoldOriented Training (ARMOR) is shown in Figure 1, while a summary of the specific methodology is provided in Figure 3. ARMOR creates and uses novel adaptations of the two fundamental steps of OMAT for low-data applications. First,

for learning the projection onto the manifold, we remove the background of images with ground truth bounding box labels instead of training a generative model. Second, to improve feature robustness, we place patches with randomly generated pixels on objects at every fine-tuning epoch rather than adversarially generate those pixels. During testing, we feed raw (i.e., unmasked) images into the fine-tuned object detector. Both steps reuse labels the detection task already provides, so ARMOR’s data cost is that of ordinary fine-tuning. A. Manifold Projection by Background Removal The first step of OMAT is to project data onto the data manifold. To model this step, we propose removing image backgrounds by masking pixels outside of bounding boxes to be black. Background removal in image space during training is part of our novel contribution, and we justify it along the two axes of projection and manifold. Projection. Data augmentation applies multiple transformations to introduce a set of invariances the modeler wishes to capture, and increases dataset size as a side-effect (Section II-A). Background removal, in contrast, applies a single transformation and does not produce more data. In fact, applying it a second time to the background-masked dataset returns the same dataset, which is reminiscent of the idempotency property of mathematical projections [49]. To be precise, background removal is an idempotent pixel-masking (offobject pixels set to a constant), not a linear projection; this idempotency is what makes it a practical approximation of an on-manifold projection. Manifold. After projection by OMAT, most information is lost and what remains are the relevant features captured by realistic data, with the split determined by the task. In our case, the task is localizing objects of interest, so pixels pertaining to the object should be retained while everything else is information we can afford to lose. This is also supported by how perturbations on the manifold only change objectrelevant pixels in the classification literature [15]. We may not have ground-truth masks of which pixels are important,

but the object detection task supplies bounding box labels on the object’s location. We therefore use these labels to identify pixels in each bounding box as meaningful information while masking out other pixels to black — in general, these pixels can be masked to anything, as long as they do not contain irrelevant background information. Though the background may contain some context, this information can be spurious and many irrelevant features can be present instead [41], [48]. Rather than specifying an exhaustive list of irrelevant features like rotation or color, as in data augmentation, removing the background eliminates many of them at once. Mitigating Potential Issues. However, there are two potential issues. First, trivial solutions can arise during training: the model can learn to localize objects in unmasked regions of the image, which is bad for generalization when we test with raw images because there will be many false positives in the background. To avoid this, we break our training into three phases (Figure 3). The first phase is conventional finetuning to adapt the model to the domain. The second is the originally proposed background-masked fine-tuning to learn relevant semantics and avoid spurious background signals. The third mitigates trivial solutions: it implements the second phase but adds the original raw images into the background-masked training dataset for regularization, supervising that background regions should not be identified as objects purely because they are unmasked. Training on this hybrid dataset thus aims to unlearn trivial solutions and suppress false positives, while preserving good existing solutions. Second, background removal does not necessarily remove adversarial vulnerability. Consider MNIST: images of digits on black background have no background, but can still produce models that are not robust. The upshot is that most model vulnerability here is from background manipulations [15], which pertains more to off-manifold digital attacks than physically-realizable attacks like our threat model. To further increase robustness to the remaining on-manifold vulnerability, adversarial training on the manifold — step 2 of OMAT — has been shown to help [15]. Next, we show how ARMOR does this without the instability of adversarial training. B. On-Manifold Fine-Tuning Data Augmentation. To mitigate the low-data issue, we enrich the dataset with more training examples representing the invariances we wish to capture. Many data augmentations (e.g., random noise, blur and object overlay) can surely be useful, but we aim to show that removing the background is already largely effective in removing irrelevant features, so we keep our augmentations modest. We make 10 copies of the original image and randomly apply weather augmentations from [1] (increasing/decreasing light intensity, snow, rain, fog, autumn and no change) to the unmasked regions of images. For parity, all evaluated defenses augment data with weather augmentations too unless specified. Fine-Tuning with Random ON Patches. The second step of OMAT is adversarial training on the projected data, which adds

noise optimized against the training objective to improve robustness. However, optimizing noise in this min-max objective is unstable (Section II-A), so we instead add uniform random noise. Our approach is similar to randomized smoothing but used during training and not test-time — we use random instead of optimized, adversarial noise to improve adversarial robustness. Applied straightforwardly, this on-manifold noise would be added to unmasked regions of images. However, given the threat model of adversarial patches that go onto objects rather than noise added to the entire image, we opt for patch insertion rather than noise addition, constraining these perturbations to be ON patches placed in the middle of the bounding box. This way, we introduce an invariance where the model is not fooled by the presence of a patch on the car, which is not naturally in the dataset, but is only fooled by an adversarial pattern that is printed on the patch. Hence, instead of adversarial training on the manifold, we perform our threephase training which models training on the manifold (Section IV-A) and add random noise in the form of random patches to all training samples. V. E XPERIMENTS To evaluate ARMOR as a defense, we ask four research questions: is ARMOR an effective solution for good clean and adversarial performance [RQ1, Section V-B]; why does it work [RQ2, Section V-C]; is it generalizable [RQ3, Section V-D]; and is it practically useful [RQ4, Section V-E]? To benchmark ARMOR, we use the set-up (e.g., attacks, models and dataset) primarily from [1]. A. Evaluation and Metrics Our main metric measures how successful the patch is in enabling the car to evade the object detector. Hence, we measure the average model confidence (Conf, also known as objectness score) across all ground-truth objects, and also report the standard deviation. Successful attacks decrease model confidence, while successful defenses mitigate that decrease. To evaluate the trade-off between true positives, false positives and false negatives, we also use average precision (AP), where higher AP corresponds to better separability between cars and everything else. We report AP for our main results and ablations, where the false-positive trade-off is informative, and Conf elsewhere, since Conf directly measures attack success. B. Defending Digital Attacks Set-Up. There are 843 images from an aerial video feed of a sidestreet [1]. The first 780 images are used for training (fine-tuning) and the remaining 63 are reserved for testing. Our “baseline 0” undefended model is a pre-trained YOLOv3 object detector [13] further pre-trained on COWC, an aerial imagery dataset of cars [50]. This model does not use the sidestreet training data, and is used as an initialization to other fine-tuned models. During testing, we evaluate defenses on clean test images and with 3 types of patches: a random ON patch, controlling for each defense’s vulnerability to the mere presence of a patch without adversarial patterns; the

(a) Undefended.

(b) Fine-tuned.

(c) RS [46].

(d) PAD-S [31].

(e) SHIELD [35].

(f) ARMOR (Ours).

Fig. 4. Main Results. Sample visualizations of car detection by various defenses amidst defense-aware ON (ON-DA) attacks. Other defenses have predictions below the standard threshold of 0.50, resulting in no detections. Meanwhile, ARMOR mitigates the ON-DA attack and detects cars with high average confidence of 0.62. TABLE I M AIN R ESULTS . C ONF AND AP FOR EACH DEFENSE AGAINST NO PATCHES ( CLEAN ), RANDOM AND ON ATTACK PATCHES , COMPARING FINE - TUNING (FT), RANDOMIZED SMOOTHING (RS) [46], PAD [31] WITHOUT AND WITH SAM (-S SUFFIX ), SHIELD [35] AND ARMOR ( OURS ); BEST ON-T AND ON-DA RESULTS IN BOLD . ARMOR maintains good Conf on all settings, achieving the best Conf against ON-T and ON-DA attacks by a large margin.

Patch\Defense

Undefended Conf ↑

Clean

AP ↑

FT Conf ↑

RS AP ↑

Conf ↑

PAD AP ↑

Conf ↑

PAD-S AP ↑

Conf ↑

SHIELD AP ↑

Conf ↑

AP ↑

ARMOR (ours) Conf ↑

AP ↑

0.83±0.16 0.89

0.96±0.04 1.00

0.91±0.10 1.00

0.94±0.04 1.00

0.96±0.04 1.00

0.96±0.05 1.00

0.92±0.07 1.00

Random ON 0.62±0.26 0.73 ON-T Attack 0.14±0.19 0.19 ON-DA Attack 0.14±0.19 0.19

0.87±0.11 1.00 0.36±0.27 0.99 0.14±0.14 0.95

0.46±0.31 0.72 0.31±0.32 0.54 0.30±0.29 0.57

0.87±0.12 1.00 0.48±0.38 1.00 0.14±0.26 1.00

0.78±0.31 1.00 0.48±0.37 1.00 0.17±0.28 1.00

0.90±0.09 1.00 0.42±0.33 0.94 0.14±0.14 0.95

0.87±0.12 1.00 0.73±0.16 1.00 0.62±0.20 0.97

transfer ON (ON-T) attack patch, generated for the undefended model; and the defense-aware ON (ON-DA) attack patch, which stress-tests each defense against the strongest attack in our threat model (Section III-A). Sampling one diverse method per defense category (Section II-A), we compare ARMOR with (i) the undefended model, (ii) fine-tuning with weather augmentation, (iii) randomized smoothing [46], (iv) PAD [31] with and without SAM, and (v) SHIELD [35], omitting modelmodification defenses due to their generalizability issues. Defenses (iii)–(v) use the fine-tuned model as their base model, and we use the ON-DA patch from that fine-tuned model for their defense-aware evaluations. We also experimented with patch localization methods Jedi and SAC, which had similar results to PAD, and with adversarial training via fine-tuning [39], [40], which was highly unstable and produced bad results on all settings; we exclude both for brevity. We do not compare directly with OMAT because we focus on methods suitable for training data scarcity. Main Results. For RQ1, Table I shows model confidence and AP across settings and defenses, and Figure 4 shows sample visualizations. The undefended model performs decently in clean settings (0.83 Conf, 0.89 AP), but is not robust to random or adversarial noise.1 Its reduced AP suggests car confidence drops below other objects, increasing false positives — expected due to lack of fine-tuning. After fine-tuning, AP improves to >0.90 across most defenses, validating that fine-tuning removes those false positives, and the clean setting yields good performance across all defenses (>0.90 Conf and AP). Random ON patches reduce model confidence for each 1 ON-T and ON-DA attacks are the same for the undefended model, based on how ON-T is defined.

defense, from 0.91–0.96 Conf to roughly 0.78–0.90 Conf, except for the undefended model and randomized smoothing. Apart from ARMOR, the drop from clean to ON-T patches is even greater: 0.46–0.60, down to 0.31–0.48 Conf. This is almost as large as the undefended model’s 0.69 Conf drop from clean to ON-DA, showing that the ON attack is transferable from the undefended model to other defenses — these defenses do not remove the vulnerability they inherit from it. Except for ARMOR, performance falls further under ON-DA patches to similar levels as the undefended model at 0.14–0.30 Conf. These defenses do not effectively address our physicallyrealizable threat model. Baselines and Pre-processing Defenses. Fine-tuning improves model confidence on both clean and random settings, corroborating our intuition that generalization and averagecase robustness are correlated — which supports ARMOR’s choice to swap adversarial noise for random noise. Randomized smoothing achieves poor model confidence of 0.46 and is the only defense with poor AP (0.72) for random ON patches, suggesting a lack of robustness even against averagecase noise; it focuses on the ℓp threat model, which seems to break down for ON patches. SHIELD performs well against random patches — their high frequency can be alleviated with JPEG compression — but cannot defend physically-realizable ON attack patches designed to be less pixelated, and thus lower frequency, obtaining a similarly low confidence to the fine-tuned model without SHIELD. Although PAD/PAD-S is the SOTA for patch localization, it too has limited efficacy: Figure 4d shows PAD-S localizing only one of the two patches. We posit that unrelated areas such as construction sites, and the smoothness of the attack patch, make patches look more

TABLE II A BLATION . C ONF AND AP FOR CLEAN , ON-T AND ON-DA SETTINGS . ROW 1 IS FINE - TUNED ON THE ORIGINAL , NON - AUGMENTED DATASET; LATER ROWS ADD WEATHER AUGMENTATION (W T ), RANDOM PATCHES (RP), OR A FINE - TUNING PHASE WITH BACKGROUND - MASKED (BM) OR HYBRID (H B ) IMAGES . Random patches improve Conf under both ON-T and ON-DA, AND models trained without background TRADE SLIGHT CLEAN PERFORMANCE FOR much better ON-DA Conf. H YBRID FINE - TUNING AFTER BM FINE - TUNING MITIGATES FALSE POSITIVES , SHOWN BY POOR AP OF BM FINE - TUNING ALONE ( UNDERLINED ). Ablated Settings Wt RP BM Hb ✓ ✓ ✓ ✓ ✓

✓ ✓ ✓ ✓

✓ ✓

✓ ✓

Clean

Conf ↑ ON-T

ON-DA

Clean

AP ↑ ON-T ON-DA

0.89±0.10 0.96±0.04 0.96±0.05 0.81±0.22 0.94±0.05 0.92±0.07

0.18±0.23 0.36±0.27 0.52±0.34 0.76±0.17 0.78±0.16 0.73±0.16

0.11±0.19 0.14±0.14 0.25±0.21 0.59±0.26 0.49±0.23 0.62±0.20

0.98 1.00 1.00 0.64 1.00 1.00

0.39 0.99 0.92 0.47 0.99 1.00

0.27 0.95 0.92 0.30 0.86 0.97

“normal” and resist detection. Even for the car with the masked patch, the detector still cannot detect it. PAD is not enough as a defense. ARMOR (Ours). ARMOR maintains good performance of over 0.90 Conf and AP in clean settings. Although its 0.92 Conf is not as high as the fine-tuned baseline, it is far above the usual detection threshold of 0.50, so ARMOR remains as useful as other methods in practical settings. Moreover, ARMOR has the smallest drop from clean to random ON patch, at 0.05 Conf, and the best confidence against ONT by a large margin with 0.73 Conf. The ON-DA patch still decreases ARMOR’s performance, as expected when an adversary has more knowledge. Nevertheless, against ON-DA attacks ARMOR is much better than other defenses with 0.62 Conf compared to 0.14–0.30 Conf (Figure 4f), an improvement of 0.32. Notably, ARMOR is more robust against the stronger ON-DA attack than other defenses are against the weaker ONT attack (0.62 vs. 0.31–0.48 Conf). ARMOR is an effective defense, maintaining good clean performance and much higher adversarial robustness than other defenses. C. Understanding ARMOR 1) Ablations: To understand how ARMOR works [RQ2], we iteratively add ARMOR components to a vanilla fine-tuned model and evaluate each model. We are most interested in the effectiveness of background removal and random ON patches during training, as per our on-manifold adversarial training adaptation. Results are in Table II. Standard Fine-Tuning and Augmentations. To contextualize background removal and random patches, we first understand what standard fine-tuning and weather augmentation can and cannot do. Comparing the undefended model (Table I) with the vanilla fine-tuned model (row 1, Table II), fine-tuning improves generalization, raising clean Conf from 0.83 to 0.89 with a slight ON-T improvement from 0.14 to 0.18. Adding weather augmentation (row 2) continues the pattern — clean Conf improves from 0.89 to 0.96 and ON-T from 0.18 to 0.36 — as expected, since augmentation enriches the

dataset and encourages generalization. However, fine-tuning and augmentation do not improve adversarial robustness: ONDA performance remains poor at 0.11–0.14 Conf, similar to the undefended model. Random Patch Augmentation. Like regular augmentation, random ON patches during training (row 3) improve Conf in clean and ON-T settings. Moreover, they significantly improve ON-DA Conf from 0.14 to 0.25, where weather augmentation alone only moved it from 0.11 to 0.14. Like on-manifold adversarial perturbations in OMAT, random ON patches improve both model generalization and (on-manifold) adversarial robustness — and they do so while producing good clean performance, despite the distribution shift that clean test images have no patches on them. Hence, random ON patches are a practically effective adaptation of on-manifold adversarial perturbation. Background Removal. Adding background-masked finetuning (BM FT: row 4) drastically improves ON-DA Conf from 0.25 to 0.59, showing that background removal improves (on-manifold) adversarial robustness and supporting our belief that it is a suitable and practical adaptation of on-manifold projection in OMAT. Replacing BM FT with hybrid fine-tuning (row 5) is not as effective — ON-DA Conf decreases from 0.59 to 0.49 — suggesting that adding raw images to BM FT is not as complete a model of on-manifold projection as pure BM FT. However, AP after BM FT drops in all settings; investigating the predictions, we observe a lot of false positives, as predicted in Section IV-A. Nevertheless, hybrid fine-tuning after BM FT (row 6) mitigates false positives (high AP returns) while preserving adversarial robustness, with ON-DA Conf rising slightly from 0.59 to 0.62. Overall, ARMOR’s three-phase training with raw, background-masked and hybrid images improves adversarial robustness while mitigating false positives. 2) Manifold Analysis: OMAT assumes robustness arises from learning representations constrained to the data manifold (Section II-A). We verify this geometrically [RQ2] by comparing feature representations of the undefended model and ARMOR — the two models that isolate ARMOR’s training effect — on three metrics. We extract features from YOLOv3’s penultimate layer (layer 81) for clean and patched test images, reduced to 30 dimensions via PCA. For tangent space alignment, we use model-specific attack patches (ON-T for the undefended model, ON-DA for ARMOR) so that each model is probed by its own strongest perturbation. Intrinsic Dimensionality. A model focusing on task-relevant features rather than background noise should have fewer degrees of freedom in its representation. Using the Maximum Likelihood Estimator [51], ARMOR has lower intrinsic dimensionality (1.64±0.54) than the undefended model (1.74±0.57). This 5.7% reduction suggests background removal constrains the representation to car-relevant features. Local Linearity. OMAT assumes the manifold is locally linear, allowing small perturbations to stay on it. We measure this via reconstruction error: the variance unexplained

TABLE III G ENERALIZABILITY. C ONF (↑) ACROSS THREE SHIFTS : RANDOM WEATHER CORRUPTIONS AT TEST TIME , DRONE IMAGERY OF A CARPARK (541 IMAGES ), AND A MUCH SMALLER DETECTOR (YOLOV 11 N ) ATTACKED WITH A PATCH TRAINED ON YOLOV 3. ARMOR obtains the best Conf against ON-T and ON-DA attacks in every setting.

Setting

Patch

Undefended

FT

ARMOR (ours)

Weather

Clean Random ON ON-T ON-DA

0.63±0.39 0.47±0.34 0.23±0.25 0.23±0.25

0.82±0.28 0.65±0.33 0.35±0.32 0.34±0.32

0.85±0.22 0.73±0.29 0.61±0.27 0.54±0.27

Drone

Clean Random ON ON-T ON-DA

0.78±0.31 0.66±0.31 0.04±0.10 0.04±0.10

0.94±0.16 0.93±0.13 0.55±0.28 0.43±0.26

0.90±0.13 0.89±0.10 0.73±0.18 0.71±0.19

YOLOv11n

Clean ON-T

0.12±0.26 0.13±0.16

0.66±0.11 0.55±0.15

0.68±0.21 0.68±0.13

by local PCA around each point. ARMOR achieves lower error (0.37±0.06) than the undefended model (0.41±0.14), indicating a more structured, locally linear manifold, and 57% lower variance (0.06 vs. 0.14), showing a more consistent manifold structure across samples. Tangent Space Alignment. Finally, we measure the cosine similarity between perturbation directions and the local tangent space. Both models show high mean alignment (>0.90), confirming that adversarial patches exploit on-manifold directions. The difference lies in consistency: the undefended model is tightly aligned (0.96±0.04), so attacks reliably find and exploit the same manifold directions, whereas ARMOR shows 6× higher variance (0.90±0.24) — defense-aware attacks against ARMOR cannot find consistent directions, and perturbations scatter rather than converging on a single exploitable one. Collectively, these metrics support our hypothesis that ARMOR’s effectiveness stems from learning a more constrained, onmanifold representation, explaining why background removal and random patches improve robustness. D. Generalizability of ARMOR We test ARMOR under three shifts [RQ3], reported together in Table III. Weather Corruptions in Test Data. During deployment, test data may experience natural distribution shift due to image corruptions, such as weather (Section II), so we randomly sample weather corruptions per test image as we did for training (Section IV-B). Model confidence decreases across all models relative to our main results (Table I); in particular, clean Conf under weather corruption degrades to each model’s original performance on random ON patches without corruption. This correlation between robustness to global corruptions like weather and localized ones like random ON patches corroborates our insight that random ON patches during training improve feature robustness (Section IV-B) [RQ2]. The attacks still land under corruption, reducing the undefended and fine-tuned model from 0.47 to 0.23 and 0.65 to 0.34–0.35

respectively, but ARMOR resists this drop the most at 0.61 Conf against ON-T and 0.54 against ON-DA. Different Setting: Drone Imagery. We next evaluate another form of aerial imagery: a moving drone surveying a densely populated carpark, where camera movement makes the background change constantly and introduces jitter. Similarly, this dataset has only 541 images. Again, the random ON patch decreases confidence for the undefended model with limited impact on the fine-tuned model and ARMOR. The ON-T attack lowers the undefended and fine-tuned model to 0.04 and 0.55 Conf, and ON-DA further decreases the fine-tuned model to 0.43. Meanwhile ARMOR stays well above the standard 0.50 detection threshold even under attack, at 0.90 Conf clean, 0.73 for ON-T and 0.71 for ON-DA. Once again, ARMOR is robust while mitigating robust overfitting. Different Model. During deployment, defenders may prefer other detectors, and a common consideration is size: smaller models perform worse but are more energy-friendly, which is desirable in low-resource settings like drones. Hence we evaluate YOLOv11 nano [14] (YOLOv11n), which takes 5 MB of storage with 3M parameters, against 241 MB and over 60M for YOLOv3. As with YOLOv3, we pre-train on COWC, derive the undefended, fine-tuned and ARMOR models, and evaluate on the ON-T patch trained on YOLOv3 — the realistic case where the attacker does not know the deployed model. Clean performance drops for all YOLOv11n models: the smaller pre-trained model lacks expressivity and overfits to the pre-training data, though it remains useful for downstream fine-tuning, and both fine-tuned models stay above the usual 0.50 threshold. Under the ON-T attack, the fine-tuned model drops about one standard deviation from 0.66 to 0.55 Conf, while ARMOR maintains high model confidence of 0.68, demonstrating its generalizability to small models. 1) Stress-Test with Other Attacks: We stress-test ARMOR against different defense-aware attacks by modifying the original attack [RQ3]. From the original ON-DA attack [1] generated with BPDA [10] (0.62 Conf), we change (i) the Adam optimizer to SGD (0.66), (ii) hybrid images to raw images (0.57), (iii) minimizing logits to minimizing the probability after sigmoid [25] (0.57), (iv) minimizing the maximum detection confidence to minimizing the mean score [52] (0.52), and (v) patch initialization from the ON-T patch to random initialization (0.48). The largest gain for the attacker comes from removing the ON-T warm start, which connotes that the warm start is not helpful and emphasizes that adversarial features for the undefended model cannot be easily transferred to ARMOR — contrary to the transferability of ON-T patches for other defenses, both directly and as a warm start (Table I). Even this best defense-aware attack leaves ARMOR at 0.48 Conf, still better than every other defense under the original ON-DA attack (0.14–0.30 Conf). Overall, ARMOR attains 0.48–0.66 Conf under these attacks, more robust than other defenses under ON-DA attacks and on par with them under the weaker ON-T attacks (0.14–0.48 Conf). We also modify the threat model from patches on the car

(a) Undefended.

(b) Fine-tuned.

(c) ARMOR (Ours).

Fig. 5. Realistic Physical ON-T Attack. The undefended and fine-tuned model do not detect the car. In contrast, ARMOR detects cars with high average confidence of 0.75. TABLE IV R EALISTIC P HYSICAL ON-T ATTACKS . C ONF (↑) FOR PRINTED PATCHES AFFIXED TO CAR ROOFS , IN THE ORIGINAL SIDESTREET SET- UP AND UNDER MOTION BLUR . ARMOR obtains the best Conf while under realistic physical attack in both settings.

Setting

Patch

Undefended

FT

ARMOR (ours)

Sidestreet

Clean Physical ON-T

0.83±0.16 0.01±0.09

0.96±0.04 0.38±0.37

0.92±0.07 0.75±0.23

Motion blur

Clean Physical ON-T

0.92±0.09 0.11±0.29

0.95±0.05 0.23±0.36

0.65±0.27 0.59±0.35

to patches around the car, known as “OFF” patches [1]. OFF patches can only be realistically implemented for stationary cars, limiting their deployability, and generating defense-aware OFF patches is over 600 times more expensive than ON-DA patches due to their larger size and number, so we use the existing transfer OFF patch from [1]. The OFF-T attack does not have much adversarial effect on ARMOR either, at 0.78 Conf compared to 0.73 Conf for ON-T, while other defenses obtain 0.21–0.66 Conf. Hence, ARMOR is not overfitted to the ON attack threat model, but also has potential to extend to other physically-realistic threat models. E. Evaluation on Realistic Physical Attacks For RQ4, we evaluate settings closer to realistic deployment, constraining the attacker to the more realistic ON-T threat model. Results are in Table IV. Original Set-Up, but with Physical Attack. We mimic a realistic attack-defense scenario in the original sidestreet setting, as in [1]: the attacker has access to training data and the pre-trained COWC model, then prints the patch and physically sticks it on the roof of the car. Note the difference between the physical attack (Figures 2b and 5) and the digital one (Figure 4a): the digital patch disregards the environment, being high resolution and acting as a source of light, whereas the physical patch is lower resolution and reflects environmental light. Nonetheless, the physical ON-T patch is nearly as effective as the digital patch. The undefended and fine-tuned models have low confidence (0.01 and 0.38), while ARMOR remains effective under realistic physical attacks, maintaining high confidence of 0.75. Motion Blur. During deployment, cars may have motion blur from fast movement, which may degrade attack efficacy by blurring the patch; we ask whether ARMOR offers more

robustness than the baselines, or whether the attack simply stops working. Motion blur is hard to generate with real cars due to safety concerns of driving fast in a small environment, so we use three palm-sized physical replicas driven by their pull-back motors. Reusing the models fine-tuned on the original sidestreet dataset also simulates a scenario where the data collected for fine-tuning is insufficient. In the clean setting the baselines have good zero-shot transfer, and although ARMOR’s 0.65 Conf is not as high, it remains above the standard 0.50 threshold. The undefended and fine-tuned models are vulnerable to ON-T patches even with motion blur, at 0.11 and 0.23 Conf, while ARMOR resists the attack with 0.59 Conf. Limitations and Extensions. Under motion blur, ARMOR resists attacks but trails the baselines in the clean setting. We suspect this is due to motion blur creating a distribution shift localized to object semantics: ARMOR forces the model to learn object-relevant features, which look different when training cars have no motion blur but test cars do. ARMOR also assumes bounding box labels at fine-tuning time — standard for detection, but it rules out fully unlabeled adaptation. In future work, we hope to extend ARMOR to increase the robustness of learnt object-relevant features. VI. C ONCLUSION We address improving adversarial robustness of aerial object detectors under limited training data and propose ARMOR (Adversarial Robustness with Manifold-Oriented Training). ARMOR modifies two data-intensive steps of on-manifold adversarial training. First, it masks backgrounds using bounding boxes to approximate manifold projection. Second, it inserts random patches on objects instead of optimizing adversarial noise. Both steps draw only on labels the detection task already supplies, so the defense costs no extra annotation — the binding constraint at a deployment site. These changes encourage learning relevant, robust features while reducing data demands. We evaluate ARMOR against realistic, physically-realizable patches and show it reduces robust overfitting and defends well, including against defense-aware attacks, and a manifold analysis of the learned features explains why. Physical experiments confirm ARMOR is effective and practical. We view ARMOR as a step toward making adversarial robustness practical. R EFERENCES [1] A. Du, B. Chen, T.-J. Chin, Y. W. Law, M. Sasdelli, R. Rajasegaran, and D. Campbell, “Physical adversarial attacks on an aerial imagery object detector,” in IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 2022. [2] D. Cazzato, C. Cimarelli, J. L. Sanchez-Lopez, H. Voos, and M. Leo, “A survey of computer vision methods for 2d object detection from unmanned aerial vehicles,” Journal of Imaging, 2020. [3] A. Abu-Khadrah, A. Al-Qerem, M. R. Hassan, A. M. Ali, and M. Jarrah, “Drone-assisted adaptive object detection and privacy-preserving surveillance in smart cities using whale-optimized deep reinforcement learning techniques,” Scientific Reports, 2025. [4] H. C. Joshi and S. Kumar, “Artificial intelligence failures in autonomous vehicles: Causes, implications, and prevention,” Computer, 2024.

[5] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Representations, 2015. [6] A. Demontis, M. Melis, M. Pintor, M. Jagielski, B. Biggio, A. Oprea, C. Nita-Rotaru, and F. Roli, “Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks,” in USENIX Security Symposium, 2019. [7] A. Amirkhani, M. P. Karimi, and A. Banitalebi-Dehkordi, “A survey on adversarial attacks and defenses for object detection and their applications in autonomous vehicles,” The Visual Computer, 2022. [8] V. Mnih and G. Hinton, “Learning to label aerial images from noisy data,” in International Conference on Machine Learning (ICML). Omnipress, 2012. [9] N. Jean, M. Burke, M. Xie, W. M. A. Davis, D. B. Lobell, and S. Ermon, “Combining satellite imagery and machine learning to predict poverty,” Science, 2016. [10] A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,” in International conference on machine learning, 2018. [11] L. Rice, E. Wong, and Z. Kolter, “Overfitting in adversarially robust deep learning,” in International Conference on Machine Learning, 2020. [12] A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” Tech. Rep., 2009. [13] J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,” arXiv preprint, 2018. [14] G. Jocher and J. Qiu, “Ultralytics YOLO11,” 2024. [15] D. Stutz, M. Hein, and B. Schiele, “Disentangling adversarial robustness and generalization,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019. [16] W.-A. Lin, C. P. Lau, A. Levine, R. Chellappa, and S. Feizi, “Dual manifold adversarial robustness: Defense against lp and non-lp adversarial attacks,” Advances in Neural Information Processing Systems, 2020. [17] P. P. Brahma, D. Wu, and Y. She, “Why deep learning works: A manifold disentanglement perspective,” IEEE Transactions on Neural Networks and Learning Systems, 2016. [18] T. Karras, M. Aittala, J. Hellsten, S. Laine, J. Lehtinen, and T. Aila, “Training generative adversarial networks with limited data,” Advances in Neural Information Processing Systems, 2020. [19] I. Goodfellow, “Nips 2016 tutorial: Generative adversarial networks,” arXiv preprint, 2017. [20] Y. Xing, Q. Song, and G. Cheng, “On the algorithmic stability of adversarial training,” in Advances in Neural Information Processing Systems, 2021. [21] M. Goldblum, L. Fowl, and T. Goldstein, “Adversarially robust few-shot learning: A meta-learning approach,” Advances in Neural Information Processing Systems, 2020. [22] H. He, J. Ding, B. Xu, and G.-S. Xia, “On the robustness of object detection models on aerial images,” IEEE Transactions on Geoscience and Remote Sensing, 2025. [23] V. Murali, R. Guy, K. Sertac, and D. Rus, “Learning autonomous driving from aerial imagery,” in 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), 2024. [24] J. Redmon, S. Divvala, R. Girshick, and A. Farhadi, “You only look once: Unified, real-time object detection,” in IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016. [25] G. Tang, T. Jiang, W. Zhou, C. Li, W. Yao, and Y. Zhao, “Adversarial patch attacks against aerial imagery object detectors,” Neurocomputing, 2023. [26] S.-T. Chen, C. Cornelius, J. Martin, and D. H. Chau, “Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector,” in Machine Learning and Knowledge Discovery in Databases. Springer, 2019. [27] T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” arXiv preprint, 2017. [28] D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, F. Tramer, A. Prakash, and T. Kohno, “Physical adversarial examples for object detectors,” in 12th USENIX workshop on offensive technologies (WOOT 18), 2018. [29] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing robust adversarial examples,” in International Conference on Machine Learning, 2018. [30] J. Liu, A. Levine, C. P. Lau, R. Chellappa, and S. Feizi, “Segment and complete: Defending object detectors against adversarial patch attacks

with robust patch detection,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [31] L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou, “Pad: Patch-agnostic defense against adversarial patch attacks,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024. [32] N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in Proceedings of the 10th ACM workshop on artificial intelligence and security, 2017. [33] B. Tarchoun, A. Ben Khalifa, M. A. Mahjoub, N. Abu-Ghazaleh, and I. Alouani, “Jedi: Entropy-based localization and removal of adversarial patches,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. [34] A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y. Lo et al., “Segment anything,” in IEEE/CVF International Conference on Computer Vision, 2023. [35] N. Das, M. Shanbhogue, S.-T. Chen, F. Hohman, S. Li, L. Chen, M. E. Kounavis, and D. H. Chau, “Shield: Fast, practical defense and vaccination for deep learning using jpeg compression,” in ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2018. [36] C. Guo, M. Rana, M. Cisse, and L. van der Maaten, “Countering adversarial images using input transformations,” in International Conference on Learning Representations, 2018. [37] S.-A. Rebuffi, S. Gowal, D. A. Calian, F. Stimberg, O. Wiles, and T. A. Mann, “Data augmentation can improve robustness,” in Advances in Neural Information Processing Systems, 2021. [38] Z. Dong, P. Wei, and L. Lin, “Adversarially-aware robust object detector,” in European Conference on Computer Vision, 2022. [39] H. Zhang and J. Wang, “Towards adversarially robust object detection,” in IEEE/CVF International Conference on Computer Vision (ICCV), 2019. [40] A. Shafahi, P. Saadatpanah, C. Zhu, A. Ghiasi, C. Studer, D. Jacobs, and T. Goldstein, “Adversarially robust transfer learning,” in International Conference on Learning Representations, 2020. [41] E. Fetaya, J.-H. Jacobsen, W. Grathwohl, and R. Zemel, “Understanding the limitations of conditional generative models,” in International Conference on Learning Representations, 2020. [42] M. Lau, H. Wang, A. Helbling, M. Hull, S. Peng, W. T. Lunardi, M. Andreoni, and W. Lee, “Non-robust features are not always useful in one-class classification,” arXiv preprint arXiv:2407.06372, 2024. [43] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations, 2018. [44] I. Buzhinsky, A. Nerinovsky, and S. Tripakis, “Metrics and methods for robustness evaluation of neural networks with generative models,” Machine Learning, 2021. [45] C. Xiang, A. Valtchanov, S. Mahloujifar, and P. Mittal, “Objectseeker: Certifiably robust object detection against patch hiding attacks via patchagnostic masking,” in 2023 IEEE Symposium on Security and Privacy (SP), 2023. [46] P.-y. Chiang, M. Curry, A. Abdelkader, A. Kumar, J. Dickerson, and T. Goldstein, “Detection as regression: Certified object detection with median smoothing,” in Advances in Neural Information Processing Systems, 2020. [47] C. Yu, J. Chen, Y. Xue, Y. Liu, W. Wan, J. Bao, and H. Ma, “Defending against universal adversarial patches by clipping feature norms,” in IEEE/CVF International Conference on Computer Vision, 2021. [48] A. Saha, A. Subramanya, K. Patil, and H. Pirsiavash, “Role of spatial context in adversarial robustness for object detection,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, 2020. [49] V. N. Kolokoltsov and V. P. Maslov, Idempotent analysis and its applications. Springer Science & Business Media, 2013, vol. 401. [50] T. N. Mundhenk, G. Konjevod, W. A. Sakla, and K. Boakye, “A large contextual dataset for classification, detection and counting of cars with deep learning,” in European Conference on Computer Vision, 2016. [51] E. Levina and P. Bickel, “Maximum likelihood estimation of intrinsic dimension,” Advances in neural information processing systems, vol. 17, 2004. [52] J. Lian, S. Mei, S. Zhang, and M. Ma, “Benchmarking adversarial patch against aerial detection,” IEEE Transactions on Geoscience and Remote Sensing, 2022.

Related documents

• ARMOR: Manifold-Oriented Training for Adversarially Robust Aerial Object Detection under Data Scarcity#973375
• DroneWAM: Efficient World Action Model for Drone Visual Navigation#1117860
• DCA-YOLO: A Dynamic Cross-Attention Network for Small Vehicle Detection in UAV Aerial Imagery#398952
• The impact of augmented reality on biodiversity learning : an experimental study#670151
• LLMs for Zero-Shot Threat Detection via Structured Risk Indicators#625093