LipSSD Makes Object Detectors Robust to Adversarial Attacks with 15% mAP Boost
New Lipschitz-constrained SSD improves robustness by up to 15 mAP points on unseen attacks.
Object detectors are critical for autonomous driving and surveillance but remain vulnerable to adversarial perturbations—small, malicious input changes that fool AI. Most defense methods rely on adversarial training, which often fails against novel attacks or different budgets. To address this, researchers from IRIT, SNCF, and UT3 introduce LipSSD—a Lipschitz-constrained version of the popular Single Shot MultiBox Detector (SSD). The Lipschitz constraint limits how much the model's output can change given small input changes, making it inherently robust by design. The authors show that the trade-off between accuracy and robustness can be controlled with a single hyperparameter, simplifying deployment. Unlike prior work, LipSSD does not depend on specific attack types, making it attack-agnostic.
We validated LipSSD on three datasets: Pascal VOC, LARD (for road damage), and KITTI (autonomous driving). Under identical adversarial training setups, LipSSD improved mean Average Precision at 0.5 IoU (mAP@50) by up to 15 points on unseen white-box attacks compared to standard SSD. Even without adversarial training, LipSSD preserved clean performance better than conventional detectors. These results suggest that architectural Lipschitz control is a practical, generalizable direction for hardening object detectors. For professionals deploying computer vision in safety-critical systems, LipSSD offers a drop-in replacement that reduces vulnerability to adversarial threats without sacrificing accuracy.
- LipSSD uses Lipschitz constraints to limit output sensitivity, achieving attack-agnostic robustness without relying on adversarial training alone.
- On Pascal VOC, adversarially trained LipSSD improves mAP@50 by up to 15 points over standard SSD on unseen white-box attacks.
- Single hyperparameter controls accuracy-robustness trade-off; performs well on safety-critical datasets LARD and KITTI while preserving clean performance.
Why It Matters
Makes object detection safer for autonomous vehicles and surveillance without sacrificing accuracy or requiring retraining for new attacks.