Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces ARMOR, a novel defense mechanism for aerial object detection that addresses the dual challenges of adversarial vulnerability and data scarcity. By leveraging manifold-oriented training techniques, ARMOR enhances feature robustness through background masking and randomized patch injection, allowing it to operate effectively with limited training data. Experimental results demonstrate that ARMOR achieves over 0.90 model confidence on clean data while improving adversarial robustness by up to 0.32 in model confidence compared to existing state-of-the-art defenses, with physical experiments validating its effectiveness in real-world scenarios.
ARMOR boosts aerial object detection robustness by up to 32% against adversarial attacks, even in low-data environments.
Aerial object detection is increasingly deployed in real-world applications, but models remain vulnerable to physical, universal adversarial patches that cause them to miss objects. Furthermore, defenders face the practical constraint of training data scarcity: aerial imagery is costly to collect and label, so a deployment site typically yields hundreds of images rather than the tens of thousands that adversarial robustness benchmarks assume. To tackle model vulnerability and training data scarcity, we propose Adversarial Robustness with Manifold-Oriented Training (ARMOR), a novel defense that realizes the core insights of on-manifold adversarial training (OMAT) in low-data regimes. ARMOR builds on the insight of OMAT to model the data manifold - the compact structure capturing the data's relevant features - to learn and robustify these features during training. While OMAT relies on the data-intensive operations of training large generative models and adversarial training to achieve this, ARMOR adopts a data-efficient approach that reuses labels the detection task already supplies: ARMOR (i) masks image backgrounds to retain object-relevant features, and (ii) injects randomized patches on objects to improve feature robustness. Our low-data experiments with physically-realizable adversarial patches evaluate both query-free transfer attacks and defense-aware attacks. ARMOR maintains strong clean performance of over 0.90 model confidence, while improving adversarial robustness by up to 0.32 in model confidence over state-of-the-art defenses. Physical experiments with printed patches confirm that these gains survive deployment. Overall, ARMOR translates insights from manifold-based training to defend object detectors amidst training data scarcity.