Search papers, labs, and topics across Lattice.
This paper introduces InsCAT, an instance-level contrastive adversarial training framework designed to mitigate the issue of detectors relying on adversarial textures as shortcuts for object detection. By aligning adversarial person features with clean features and separating them from texture-only negatives, InsCAT significantly reduces false positives and enhances cross-attack generalization. The method outperforms existing baselines, achieving an average attack AP of 82.3% and a texture false positive rate (FPR) reduction from 46.9% to 7.3%, demonstrating its effectiveness across various detector architectures.
Adversarial training can backfire, but InsCAT ensures that detectors focus on true object features rather than misleading textures, achieving a remarkable FPR of just 1.8% in physical tests.
AI-enabled visual perception systems are increasingly deployed in intelligent transportation infrastructure and autonomous vehicle related applications. However, physically realizable adversarial appearances pose a significant reliability challenge for these safety-critical systems. Adversarial training is effective, but repeated co-occurrence between adversarial texture and positive person instances can cause detectors to treat the texture itself as evidence of object presence, forming a patch texture shortcut. The detector may then treat texture as evidence for the target, causing false detections on texture-only inputs and weakening cross attack generalisation. We propose InsCAT, an instance-level contrastive adversarial training framework that prevents detectors from using adversarial texture as an independent decision cue. SICA aligns adversarial person features with matched clean features and separates them from texture-only negatives, while ROPO and Guard maintain online attack pressure and coordinate training. We evaluate eight independently generated attack textures on rendered nuScenes, INRIAPerson, printed garments, and three detector families. InsCAT achieves an average attack AP of 82.3% on rendered nuScenes, exceeding the strongest baseline by 11.1 points.Relative to AT-Mix, texture FPR decreases from 46.9% to 7.3%. Physical tests yield an F1 score of 96.6% and an FPR of 1.8%. Consistent gains across separately trained detectors demonstrate applicability across architectures with direct inference. The findings show that robust physical detection depends on preserving target related evidence while preventing adversarial texture from becoming an independent decision cu
